2020 spotlight: PlusToken, a $ 2 billion Ponzi scheme, may become a cloud over bitcoin prices

Author: Chainalysis

Translator: Lu Jiangfei

Source: ChainNews ChainNews

 

• Dry Goods | Revalidation Proof vs. Error Proof
• Talk to Microsoft China's chief innovation technology consultant: Can the development of blockchain applications be simplified?
• Japanese retail giant Rakuten announces allowing users to use points for bitcoin, etc., boosting cryptocurrency adoption

The demise of a cryptocurrency Ponzi scheme that totaled $ 2 billion in 2019 could have a lasting effect on the price of Bitcoin in 2020.

This scam is PlusToken, which may be the biggest Ponzi scheme ever.

PlusToken was born in 2018. At that time, a digital currency wallet tool called "PlusToken" with a monthly income of 10% was born. Investors can store assets such as Bitcoin and Ethereum in PlusToken, and they can also obtain more updates by developing offline forms. high Benefit.

Eye-sighted people know at a glance that this is a typical MLM and Ponzi scheme, but PlusToken still packs a sound business model for it: the revenue comes from "moving bricks to arbitrage and quantify." How can brick arbitrage have an annualized return of more than 100%.

This tried-and-tested MLM model, coupled with "high-tech" and "high yield", has attracted a large number of investors, and the fund absorbed by the platform has also increased. According to the analysis of blockchain data analysis company Chainalysis, the funds involved in the case are about 2 billion US dollars, and there are media reports that the entire scam may be close to 3 billion US dollars.

In June 2019, some users found that PlusToken could not be withdrawn. Previously, PlusToken might have been open to withdraw in order to absorb more funds. Of course, the funds of users who joined in the later period were used to fill the revenue of previously joined users.

Later, six Chinese nationals were arrested by the Vanuatu Police Force for "perpetrating an illegal Internet scam" and repatriated. Later, it was discovered that the persons involved in the case coincided with the PlusToken team that spread online.

When everyone didn't have time to applaud, they realized that the funds of the PlusToken scam may be difficult to recover. Because cryptocurrencies have a feature of being "anti-confiscation", as long as they do not hand over the cryptocurrency's private key, those assets will always be in their hands or in someone's hands.

Therefore, some people have suggested that regulators cooperate with blockchain data analysis companies as soon as possible to analyze the final whereabouts of these funds. After all, criminals will definitely wash the huge sums through complex means. Perhaps the on-chain transactions of these stolen funds cannot be prevented, but as long as it involves the exchange of fiat currencies, the regulators have the ability to trace and process them.

In fact, the PlusToken team is indeed laundering money. Although six people of the PlusToken team were arrested, the addresses of these stolen funds have been transferring, trying to realize the stolen funds into other cryptocurrencies through complex and difficult to track mixed coins and more advanced strategies, or sold to OTC brokers on the exchange. Business. This also shows that the people involved have not been arrested and at least one or more suspects are still at large.

Blockchain data analysis company Chainalysis tracked the asset trend of PlusToken and analyzed the transaction data at the same time, and found that the decline in the price of bitcoin was related to the hidden money laundering of PlusToken. At least $ 150 million in stolen money is currently unrealized.

Combining the analysis results, Chainalysis wrote a report detailing the money laundering method of PlusToken they analyzed, and the impact on cryptocurrency prices. The following is the full report.

Fraud is very common in the cryptocurrency world, and according to our internal research, crypto fraudsters have scammed billions of dollars in funds from millions of victims in 2019. However, the potential impact of crypto fraud is not limited to the loss of funds. For the development of the entire industry, it may also scare away other potential participants.

What is PlusToken?

PlusToken is headquartered in China and is a cryptocurrency wallet. If users use Bitcoin or Ethereum to purchase the PLUS cryptocurrency associated with their wallet, they will provide a high return rate. The fraudsters claimed that they were able to provide high returns because of "exchange profits, mining income and referral income". PlusToken will also be listed on several domestic exchanges and reach a maximum price of US $ 350, thus attracting millions of “investments”.

Domestic media have previously reported that the PlusToken scam has absorbed more than $ 3 billion in cryptocurrencies. Chainalysis tracks 180,000 BTC, 6,400,000 ETH, 111,000 USDT, and 53 OMG (OmiseGo) flowing from the victim to the PlusToken wallet, with a total value of approximately $ 2 billion. These data are enough to make PlusToken one of the largest Ponzi schemes ever.

Despite the arrest of six people involved in PlusToken in June this year, the stolen funds were still circulating in the wallet, and most of the funds were cashed through independent over-the-counter brokers running on the Huobi platform, indicating that the people involved were not all arrested. At least one or more suspects are still at large.

How can PlusToken fraudsters use mixers and OTC brokers to launder and cash out?

Although we tracked the $ 2 billion worth of cryptocurrencies sent to PlusToken by the victims, some of this money has been paid to early investors (presumably to maintain their illusion of high returns), while PlusToken was publicized at the time He is a legal company. Therefore, in most cases, it is difficult for us to judge whether the transfer made by PlusToken scammers is to those early investors or to a wallet controlled by ourselves. Nevertheless, we have tracked about 800,000 ETH and 45,000 BTC, and we can safely say that the money has been transferred to the fraudster's own address for money laundering. Moreover, they have cashed out at least 10,000 ETH of 800,000 ETH, while the other 790,000 ETH has not moved in the last month, all stored in an Ethereum wallet.

However, the flow of 45,000 stolen BTC is more complicated.

To date, approximately 25,000 BTC of them have been cashed out, and the remaining 20,000 BTC has been scattered among more than 8,700 cryptocurrency addresses, suggesting that scammers have made tremendous efforts to cover up the flow of funds. Scammers have cashed more than 24,000 BTC transactions using more than 71,000 different addresses, excluding cash transactions and exchange transactions.

Many of these transactions are operated through a mixer such as Wasabi Wallet, which uses the CoinJoin protocol to make the tracking of funding paths more difficult. Here is a Chainalysis Reactor analysis diagram from which you can learn a trace example:

Here we can see that the funds are divided into many new, unique addresses, and the fraudsters then recombine these addresses using a typical mixer.

In other ways, fraudsters use peel chains and other complex operations to obfuscate the flow of funds. A divestiture chain is a series of transactions used for money laundering. In this transaction, multiple entities can continuously and quickly send cryptocurrencies through different wallets, then cash out a small amount of cryptocurrencies, and finally send most of the remaining currencies. To another wallet.

The picture above is a good example of obfuscation by PlusToken fraudsters. Funding starts with the wallet in the upper left corner and moves to the right. Diagonal movement represents a change in address type, while vertical movement represents the use of a mixer.

In the end, the funds were transferred to an address of an over-the-counter broker in Huobi for liquidation, which is the current means of almost all PlusToken cryptocurrency cash. OTC brokers facilitate transactions between individual buyers who may or may not wish to trade on public exchanges. OTC brokers are usually associated with exchanges, but operate independently. If traders want to monetize a large amount of cryptocurrency at a set negotiated price, they usually look for an OTC broker.

Not only that, compared to most regular cryptocurrency exchanges, OTC brokers have lower requirements for KYC and are therefore extremely attractive to criminals like PlusToken. Formal cryptocurrency exchanges monitor transactions and retain customer information in order to report suspicious activity and comply with regulatory rules of the law enforcement agencies, but OTC brokers follow different rules. Although many rules are also legal, there are indeed OTC brokers use lower KYC requirements to provide services to illegal users. Some OTC brokers, even driven by high profits, may even specialize in the transfer of criminal funds and money laundering.

In this case, cashing through OTC brokers may be one of the reasons for the recent bitcoin price depression.

Is the monetization of Bitcoin by PlusToken fraudsters the reason for the bitcoin market price being depressed?

So far, PlusToken has monetized at least $ 185 million worth of stolen Bitcoins through OTC brokers. Those who analyze the cryptocurrency market know that a large number of cash-out transactions usually lower the price of bitcoin, and some people have already asked whether PlusToken cash-out will drag down bitcoin. Therefore, we decided to use Huobi OTC brokers to analyze the price of bitcoin cashed with PlusToken and try to answer related questions.

In this analysis, we first draw the Bitcoin price on the Huobi exchange based on the two methods of PlusToken Bitcoin transfer:

1. On-chain volume: On-chain volume refers to the amount of bitcoin transferred from a wallet controlled by a PlusToken scammer to any of the 26 well-known Huobi OTC brokers we have identified.
2. Trade volume: The off-chain transaction volume refers to the number of Bitcoins traded in USDT on Huobi. We chose this indicator because we can know from the analysis that PlusToken fraudsters have been converting stolen bitcoins into USDT, and then USDT into fiat currency. However, since these transactions are only recorded on Huobi's own order book, not on the blockchain, we cannot know which of them are Bitcoins sold by PlusToken fraudsters.

Our hypothesis consists of two parts:

1. We expect that as OTC brokers receive Bitcoin from the PlusToken wallet and exchange it for USDT, the growth of any on-chain transaction volume will increase as the transaction volume increases.
2. We expect that as more and more bitcoins are traded on the market, the price of bitcoin will fall rapidly on the chain and after the transaction volume rises.

Both of these assumptions have proven to be correct.

Our conclusion

As can be seen from the above, the PlusToken wallet started sending fixed Bitcoin traffic in mid-April, and in late June, it began to surge before criminals were arrested. After that, we did not see any special movements until several peaks in August, after which PlusToken cashed out again and a new peak appeared, while maintaining a high level throughout September. Then we saw more peaks in October.

As we have assumed, the surge in on-chain traffic to OTC brokers is related to the drop in Bitcoin price. However, because bitcoins transferred to the exchange on the chain sometimes do not trade immediately, the drop in bitcoin price will lag behind the PlusToken cash-out. We found a good example on September 20 when PlusToken fraudsters cashed in about $ 34 million in Bitcoin. After the transfer of Bitcoin, the market price steadily declined between September 24 and 26, from slightly above $ 10,000 to about $ 8,000, and the price stayed for about a month.

But what effect will the transaction volume have? Please see the figure below.

Here, our assumptions have also been proven correct. As we expected, from September 23, a few days after the PlusToken wallet sent a large amount of bitcoin to Huobi OTC brokers, USDT's bitcoin transaction volume increased significantly. Soon after September 24, the price of Bitcoin began to fall.

Through this analysis, we can conclude that PlusToken cashback is related to the decline in Bitcoin price.

Can I prove cause and effect?

We cannot say with certainty that the decline in the price of Bitcoin was caused by PlusToken cashing. The price drop may also be caused by other reasons, but it happened by chance after cashing. In order to resolve the cause-effect relationship, we performed a regression analysis to test how the increase in transaction volume between September 23 and 28 affected the price of Bitcoin. Generally, we only test how the transaction volume affects the price itself, but during this evaluation period on September 24, the Bitcoin price experienced only one large fluctuation. We need a way to assess greater volatility to judge the causality of this analysis and ensure that the results are not affected by outliers. Volatility can measure the deviation from the average bitcoin price at a given time. This indicator can be used to evaluate enough changes, and it also allows us to understand how the PlusToken cash-out method affects the price of bitcoin.

Our regression analysis shows that from September 23 to 28, there is a positive correlation between the transfer of PlusToken to Huobi OTC brokers and the price fluctuation of Bitcoin. This positive correlation is statistically significant. .

Monetization can lead to increased volatility in one of two ways, either directly by increasing the supply of bitcoin and changing market dynamics, or indirectly by affecting traders' perceptions of the market. Keep in mind that PlusToken cash-out is just one of many potential factors for Bitcoin price fluctuations. Media reports, co-planned market manipulation, algorithmic trading errors, or many other factors may also cause Bitcoin price fluctuations. However, in the absence of the influence of PlusToken, during the period we studied, none of these other factors could give a convincing explanation of the price fluctuations affecting Bitcoin.

Unfortunately, because we cannot distinguish between PlusToken funds that are traded through Huobi OTC brokers and other transactions on the Huobi platform, we cannot assert that PlusToken cashing has caused the price of Bitcoin to fall. However, we can say that these cash-outs will cause Bitcoin price volatility to increase, and there is a clear correlation with the decline in Bitcoin price.

Fighting fraud without saying a word

As of now, at least 20,000 BTC (valued at nearly $ 150 million) has not been cashed, so it will be interesting to continue to observe the relationship between cash-out operations and the price of Bitcoin. Based on this analysis and the market response we have observed so far, we believe that the large amount of illegally acquired cryptocurrency cashout is likely to drive down the price of cryptocurrencies.

The PlusToken scam is the most typical case of cryptocurrency fraud jeopardizing the public. Exchanges, law enforcement agencies and regulators need to be aware of this. In this case, millions of victims of fraud are likely to never be able to recover the funds that were seduced away. Exchanges should not allow OTC brokers to conduct uncensored business activities, as this will allow criminals to easily launder their illegally obtained funds. Exchanges should have KYC compliance requirements and monitor trading activities. Regulators around the world also need to pay attention to consumer protection of cryptocurrencies and consider how to apply anti-money laundering regulations to prevent such scams from continuing.

We will continue to update Blocking; if you have any questions or suggestions, please contact us!