The most devastating cryptocurrency Ponzi scheme in history may be contributing to Bitcoin’s 2019 price decline.
That’s according to blockchain analytics company Chainalysis, which has been tracking funds from the roughly $3 billion PlusToken scam since the thing blew up at the end of June 2019. As the scammers have scrambled to obfuscate hundreds of millions of dollars’ worth of Bitcoin they accrued, they’ve left a trail on the Bitcoin blockchain, and Chainalysis has been following it for months.
And according to its research, released in a recent blog post, these movement dead-end at a handful of independent over-the-counter (OTC) desks that operate on the Huobi exchange. If Chainalysis’s findings are to be believed, the scammers have sold some 25,000 BTC for just shy of $200 million in profit — and they’ve got at least another 20,000 that’s been untouched since September 2019.
PlusToken was a cryptocurrency Ponzi scheme that operated for nearly a year. The scheme coaxed “investors” to deposit Bitcoin, ether and other cryptocurrencies by promising monthly returns of up to 30 percent in Bitcoin or its eponymous plustoken. Before rupturing following the arrest of six employees in late June 2019, the scam corralled $2 billion in various cryptocurrency deposits.
The majority of these deposits were in Bitcoin — some 180,000 BTC or roughly 1 percent of the outstanding supply. Some of these funds were paid back out to token holders to keep up appearances, and Chainalysis was able to trace the movements of 70,000 BTC that was confirmed stolen by police reports shared by Primitive Ventures partner Dovey Wan.
PlusToken’s remaining team has apparently spent the second half of 2019 mixing these coins and liquidating them via OTC desks through Huobi, Chainalysis claimed. When asked how the blockchain analytics firm was able to trace the coins after they had been mixed, Chainalysis economist Kim Grauer said that the scammers’ mixing (or their attempt to transfer their coins to new wallets in a way that would make tracing their origin nearly impossible) was sloppy.
“They didn’t mix properly,” she told Bitcoin Magazine, adding that a couple of mixers were used, namely self-mixers and Wasabi wallet. Playing it on the safe side, Chainalysis was able to fully verify some 45,000 mixed coins out of the 70,000 attributed to the PlusToken team.
This corroborates findings by independent and anonymous researcher ErgoBTC, though they identified 54,000 mixed coins in total. These coins were shuffled between August and September 2019, ErgoBTC argued in an October 2019 blog post. Roughly 19,000 of these Bitcoin were mixed using CoinJoin through Wasabi, and another 35,000 were “self-shuffled,” per the post.
This self-shuffle was highly insufficient for obfuscating the funds, ErgoBTC concluded, partly because the scammers reused addresses. And the Wasabi wallet mixing wasn’t up to snuff, either, partly because they reused addresses again and partly because of other patterns in mixing behavior (such as sending BTC to Wasabi mixers in chunks of 10 to 25).
They also noted that the scammers were likely running multiple Wasabi clients to mix with themselves; this would essentially amount to a Sybil attack in which the PlusToken team assumed the majority of mixing volume on Wasabi and had to mix with themselves.
Most of these mixed coins have ended up on Huobi, and they’re being sent to accounts associated with OTC desks, Chainalysis claimed.
Grauer told us that Chainalysis has linked the Huobi addresses to OTC brokers “from years of investigators building up profiles” on these firms. Many of them, she continued, have low KYC requirements, something that causes a clear gap in compliance and regulation.
These low-KYC desks often accept Bitcoin at a discount — this amounts to a premium for buying up tainted, stolen or, in this case, scammed coins. They will then flip these coins on the market or sell them again to another OTC desk, which charges another premium.
“We see a lot of whirling around in this OTC world,” Grauer said, referring to how the firms play “hot potato” with dirty Bitcoin to launder it.
When I asked whether or not Huobi knows this is happening — or if it plays matchmaker for these unscrupulous market makers, who Grauer said provide “so much liquidity” for the exchange — she didn’t make any judgments.
“We don’t know exactly what’s going on with Huobi — what’s allowing [this] to happen. We can only see what’s on the blockchain,” she said.
Chainalysis has tried to contact Huobi to no avail; Bitcoin Magazine also sent Huobi a request for comment but did not receive a reply as of the time of this writing.
Grauer didn’t know how the OTC desks were paying out the PlusToken scammers, whether it be in cash, bank wires, puppet bank accounts or in USDT, though Chainalysis found that the team did…