Capstone Ltd.: Scam Warning, Reviews and Recovery Guide

Issued by: Ontario Securities Commission (OSC) / CSA · Date: 2026-03-30 · Region: Ontario

Reviewed by: William Galipeau · Last updated: 2026-09-13

Also known as: cstona-canada.io, client.capstone-ltd.io, capstone-ltd.io, Capstone Ltd

Overview: Is Capstone Ltd. Legit?

Look at the address bar before you look at anything else. The Ontario Securities Commission (OSC) named Capstone Ltd. in an investor warning on March 30, 2026, and the two web addresses it attached to that name were cstona-canada.io and client.capstone-ltd.io. The primary one does not contain the word Capstone anywhere in it. The OSC found that Capstone Ltd., at both of those addresses, is not registered in Ontario to engage in the business of trading in securities.

That first domain repays a closer look, because it is the most concrete thing on the public record about this operation. The string cstona is not the company name, an abbreviation of it, or a recognisable contraction. What has been appended to it is the word canada, and that is the part doing the persuading. A domain ending in canada.io reads as domestic to someone glancing at it quickly, which is precisely the assurance an Ontario investor is looking for and precisely the assurance a domain name cannot give. Anyone in the world can register a name containing the word canada. It reflects no incorporation here, no office here, and above all no registration with the OSC.

There is a second thing worth saying plainly, because it is the likeliest source of false comfort. Capstone is a common and respectable name in real finance, used by a number of established and properly registered firms in Canada and elsewhere that have no connection whatsoever to the entity the OSC flagged. Those businesses are not the subject of this warning and nothing here is about them. The practical effect, though, is that searching the name Capstone returns a reassuring wall of legitimate results, and an investor doing a quick check can come away satisfied without ever having looked at the specific entity in front of them. The name is generic enough to borrow credibility it has not earned.

Registration is the test that actually settles the question. Selling securities to Ontario residents, or advising them on securities, requires registration with the OSC. Registration carries proficiency requirements for the people dealing with clients, capital requirements for the firm, rules on how client assets are held, and a complaints process backed by a regulator. Where it is absent, none of that applies. Capstone Ltd. is not registered, and no dashboard, account manager or client portal changes that. Report to RecoverFunds.ca if you have dealt with Capstone Ltd.

How Capstone Ltd. Operates

The OSC warning is short, and that brevity is worth respecting rather than filling in. Who runs Capstone Ltd., where the money goes and what any individual client was told are not on the public record. What is on the record is the pair of addresses the regulator named, and they are unusually informative.

A domain that does not say Capstone: The main address is cstona-canada.io. The brand presented to clients is Capstone Ltd. Those two strings share some letters and nothing else. Detaching the operating domain from the brand name has a predictable effect on anyone who later tries to work out what happened to them. The name they would search is not the name in their browser history. Search engines index the domain, review sites and complaint threads accumulate under whichever label each person happened to use, and the accounts of two victims of the same operation can look like accounts of two different ones. It also means the presented brand is cheap to discard. A name attracting complaints can be dropped and replaced while the domain, the database and the payment arrangements carry on without interruption.

The word canada as a credential: Appending canada to a domain is the least expensive trust signal available, and it is aimed squarely at the concern a cautious Canadian investor actually has. It costs the price of a domain registration and requires no presence in the country, no corporate filing and no regulatory approval. It is worth being blunt about the direction of causation here. Genuine Canadian registration produces an entry in a public register that anyone can search. It does not produce a domain name. When the only Canadian thing about a platform is a word inside its web address, that is the whole of the claim.

The client portal on the other domain: The second address, client.capstone-ltd.io, carries the brand name the first one lacks, and it is where the client experience lives. This split between a site clients are sent to and the domain that fronts the operation is worth understanding, because the portal is what makes the arrangement feel substantial. It shows a balance, a history and a set of positions, and it accepts a withdrawal request. None of that is verifiable by the person looking at it. A portal is a page displaying figures held in the operator's own database, and the figures reflect what the operator entered rather than assets held for anyone. It is also the first thing to disappear. Access is commonly withdrawn once a client complains in earnest, taking with it the only record they held of what was promised.

Two top level domains, no regulatory meaning: Both addresses use .io, a domain popular with technology companies and therefore carrying a faint impression of a modern platform business. It should not carry any weight in this assessment. A top level domain is a purchasing decision. It says nothing about incorporation, solvency, custody arrangements or registration, and no Canadian regulator attaches any significance to it.

What the OSC can and cannot do here: The commission can warn the public, and on March 30, 2026 it did. It can pursue enforcement against parties within its reach, and it can pass information to other regulators through the CSA, which republished this listing nationally. What it cannot do is order the return of money from an entity that never entered the regulatory perimeter in the first place. That limit is the reason the warning exists at all, and the reason checking registration before depositing matters more than any due diligence performed afterwards.

How the check actually works: The National Registration Search at aretheyregistered.ca, maintained by the Canadian Securities Administrators, is free and takes well under a minute. A registered firm returns its registration categories, the provinces in which it may deal and the individuals permitted to act for it. Capstone Ltd. returns nothing. A registration number printed on a website, a certificate arriving as a PDF attachment or a regulator's logo in a footer means nothing at all, because each is trivially fabricated and each is regularly copied from firms that hold genuine registration. The register is the only source that settles it.

Red Flags in Capstone Ltd. Reviews

  • Ontario Securities Commission investor warning issued March 30, 2026, not registered to trade in securities in Ontario
  • Primary web address cstona-canada.io does not contain the company name Capstone anywhere
  • The word canada is built into the domain despite no Canadian registration of any kind
  • Client portal sits on a second and unrelated domain at client.capstone-ltd.io
  • Brand name is deliberately generic and shared with established registered firms that are unconnected
  • No entry returned by the CSA National Registration Search at aretheyregistered.ca
  • No CIRO membership and no coverage under any Canadian investor protection fund
  • Warning republished in the CSA national investor alert database beyond Ontario
  • No named directors, operators or corporate registration details on the public record
  • Account balances exist only inside a portal the operator controls and can revoke

What the Regulator Said

Capstone Ltd. found at https://cstona-canada.io/ and https://client.capstone-ltd.io/ is not registered in Ontario to engage in the business of trading in securities.

Official regulator source

What to Do if You Were Targeted by Capstone Ltd.

If funds have gone to Capstone Ltd., take these in order. The first two carry deadlines that run whether or not the platform is still replying to you.

  1. Begin a free case review with RecoverFunds.ca at recoverfunds.ca/report-crypto-fraud-canada. It costs nothing to start and there is no upfront fee at any point. What you get is a direct assessment rather than reassurance: what can realistically be pursued given how the money actually left your hands, which is the fact that governs everything that follows. A card deposit made recently may still sit inside a live chargeback window that closes on a fixed schedule regardless of what any account manager promises. A wire or accepted e transfer is harder, and attention shifts to your bank's fraud team and the receiving account. Crypto sent to a wallet address cannot be reversed, so the priority becomes flagging the destination quickly while exchanges are still in a position to act. Bring both addresses with you, because your records may show cstona-canada.io while you remember signing in at client.capstone-ltd.io.
  1. Report to the Ontario Securities Commission at 1-877-785-1555, or through the contact route at osc.ca. This is the regulator that published the warning and the one holding the file on this entity. A report from someone who actually deposited is more useful than the warning itself, because it establishes that the operation was soliciting and taking money rather than merely existing. Tell the OSC which domain you transacted on and how you were first approached. If you live outside Ontario, file with the securities regulator for your own province as well, since the CSA republished this listing nationally.
  1. Contact your bank, card issuer or crypto exchange today. Ask for the fraud department by name rather than general customer service, and state that you are reporting a firm named in a securities regulator warning. Be ready for the merchant descriptor on your statement to match neither name you know, since the operating domain and the brand differ here. Ask for the transactions to be flagged and for any recurring authorisation to be cancelled. If you granted anyone remote access to your device, treat every account reachable from it as exposed and change those passwords from a different machine.
  1. Save the portal while it still exists. Sign in to client.capstone-ltd.io and take full page screenshots of the balance, the open positions and the full transaction history, including any pending withdrawal. Access is routinely cut once a client escalates, and that dashboard is often the only surviving record of what was represented. Export chat and messaging logs in full rather than in fragments, keep emails with headers intact, and keep bank or exchange confirmations showing amounts, dates and destination details.
  1. Never pay an upfront fee to anyone offering to recover your money. That is a second scam, aimed specifically at people who have already lost money once, and it often arrives within weeks of the first loss. A genuine assessment of your case costs nothing to begin.
  2. Report to the Canadian Anti-Fraud Centre and to the securities regulator for your province, the full process, with contact details for every province, is here

Capstone Ltd.: Frequently Asked Questions

Is Capstone Ltd. a scam?

The Ontario Securities Commission published an investor warning on March 30, 2026 stating that Capstone Ltd., found at cstona-canada.io and client.capstone-ltd.io, is not registered in Ontario to engage in the business of trading in securities. Regulators issue that warning when an unregistered operation is soliciting residents, which is not lawful and leaves you outside every protection registration is meant to supply.

Who can help me get my money back from Capstone Ltd. in Canada?

RecoverFunds.ca provides a free case review with no upfront fee. You get an honest read on what is realistically recoverable given how you paid, assistance filing with the right provincial regulator, and a clear first action. Nobody can promise recovery and anyone who does should be treated with suspicion. Card payments sometimes retain chargeback options, while crypto transfers are irreversible and the work turns to flagging the receiving wallet quickly.

Is this the same as other investment firms called Capstone?

No. Several established and properly registered financial firms use the Capstone name in Canada and elsewhere, and none of them has any connection to the entity the OSC flagged. This warning concerns only the operation the OSC identified at cstona-canada.io and client.capstone-ltd.io. The overlap matters because searching the name alone surfaces legitimate firms and can leave an investor falsely reassured about a completely different entity.

Why is the Capstone Ltd. website called cstona-canada.io?

The OSC named that domain as the operation's address even though it does not contain the brand name. Separating the two splits the paper trail, since the name you would search is not the one in your browser history or on your statement. It also makes the presented brand disposable: a name drawing complaints can be replaced while the domain, client database and payment arrangements continue unchanged.

Does having canada in the web address mean the firm is Canadian or approved here?

No, and this is the detail most likely to have reassured you. Anyone anywhere can register a domain containing the word canada for the ordinary price of a domain. It requires no incorporation in Canada, no office here, and no approval from any regulator. Genuine Canadian registration produces a searchable entry in a public register, which is the only thing that settles the question.

Does the .io domain mean Capstone Ltd. is a legitimate technology platform?

No. A top level domain is simply a purchasing choice. The .io ending is popular with technology companies and can create an impression of a modern platform business, but it carries no information about incorporation, solvency, how client assets are held, or registration status. No Canadian securities regulator attaches any weight to which top level domain a firm uses.

Capstone Ltd. is demanding a fee or tax before it will release my withdrawal. Should I pay it?

No. No legitimate firm requires you to send new money in order to receive money that is already yours, and no Canadian tax is collected by a trading platform as a condition of releasing a withdrawal. A fee attached to a blocked withdrawal is how the operation takes a further payment from someone who has started to suspect the truth, and paying it almost always produces another requirement instead of a release.

Can the OSC get my money back from Capstone Ltd.?

The OSC can warn the public, pursue enforcement against parties within its reach, and share information with other regulators through the CSA. What it cannot generally do is order the return of funds from an entity that never entered the regulatory system at all. That is exactly why the registration check at aretheyregistered.ca matters before a deposit far more than any investigation afterwards.

Why is my Capstone Ltd. login not working?

A Capstone Ltd. login that stops working is worth treating as information rather than a glitch. Accounts on flagged platforms are frequently locked once the operator decides a client is no longer going to deposit, and domains disappear entirely when an operation moves on. Screenshot whatever you can still reach. Balances, transaction history, chat logs, all of it, before it becomes unreachable.

Are Capstone Ltd. reviews real?

Ratings-site reviews are among the easiest things to manufacture, and a platform under a regulatory warning has every reason to manufacture them. For Capstone Ltd., weigh the OSC warning on March 30, 2026 above any star rating. Also be wary of reviews that appear immediately after a warning is published. A sudden burst of five-star reviews is a response to the warning, not evidence against it.

Is cstona-canada.io a safe website?

No. cstona-canada.io is named in connection with the OSC warning about Capstone Ltd. on March 30, 2026. Beyond the money, avoid installing anything it asks you to install and never grant remote access through tools like AnyDesk or TeamViewer to someone contacting you from it.

How do I report Capstone Ltd. in Canada?

Report to the Canadian Anti-Fraud Centre, to your provincial securities regulator, and to your local police. Your bank or exchange comes first though, the same day, ahead of all of them. Report to the regulator for the province you live in rather than wherever Capstone Ltd. claimed to be based, because that is almost always fictional. Step by step, with every provincial contact, is here.

Related Fraud Alerts

How to report investment fraud in Canada, the full process · How we verify these warnings