How the PlusToken Scam Absconded With Over 1 Percent of the Bitcoin Supply
On June 27, 2019, a handful of leaders for a wildly popular ponzi scheme that spread across Asia were arrested by Chinese authorities after they managed to fleece unwitting customers out of roughly $3 billion.
PlusToken, as it was called, promised its “investors” monthly returns of anywhere from 10 to 30 percent in its eponymous token (PLUS), which traded on such popular exchanges as Huobi and Bithumb. This attracted more than 200,000 bitcoin (1 percent of the outstanding supply, or the entirety of the Winklevi’s bitcoin holdings), 789,000 ether and 26 million EOS. As of this report, the ringleader of the operation is still at large and funds are still on the move.
The racket reeks of the same chicanery and unrealistic promises of returns as the Ponzi scheme tied to now-defunct BitConnect, though to a drastically escalated scale. At its peak, BitConnect was only worth just north of $121 million. PlusToken, trading publicly across a number of popular Chinese exchanges, achieved a $17 billion valuation. With an all-time high of $340 a token, this would have made it the third-largest asset on CoinMarketCap if it were listed.
So how did PlusToken swindle even more people than BitConnect did, and where did all the money go now that the founders are facing legal consequences?
Anatomy of a Scam
“The first mention of PlusToken in my WeChat groups is July 2, 2018,” one source, whom we’ll refer to as “Tiresias” in this article out of respect for their anonymity, told Bitcoin Magazine. While the scam would be active for nearly a year before the arrest of its primary architects on the Pacific island of Vanuatu, the apparent homebase of the operation, Primitive Venture Co-Founder Dovey Wan told us that its peak operating time was March through June 2019.
Wan, who acts as an informational bridge between the space’s Eastern and Western communities and who brought the PlusToken situation to light on Twitter, mentioned that PlusToken holders began complaining that they couldn’t withdraw funds in the days following the Vanuatu arrests, as rumors began to spread that the organization was exit scamming. PlusToken’s remaining team attempted to quiet these talks by saying that the withdrawal issues were due to a hacking attempt.
The rumors, however, turned out to be true. Even as its primary orchestrators were in the custody of Chinese authorities, other PlusToken conspirators were busy fragmenting deposited funds into various wallet addresses, and the scheme’s alleged orchestrator, who goes by Leo, is still at large. Some of PlusTokens’s sullied warchest may have been offloaded onto exchanges for liquidation, though blockchain analytics firms have presented conflicting data on this front.
Much of PlusToken’s community, Wan stressed, is not comprised of typical cryptocurrency investors. Many of them were so easily duped because they are average citizens who knew little to nothing about bitcoin, let alone the altcoins in its orbit. PlusToken’s team even “educated” these unsuspecting investors on how they could buy bitcoin, ether and eos to contribute to the scam.
Tiresias told us that the scheme was widely advertised through WeChat, mainland China’s most popular messaging app. But, amazingly enough, its advertising wasn’t just limited to digital platforms. PlusToken hosted meet-ups (so called “salons”) to promote the scam and in-person training sessions for PlusToken users to teach them how to promote the platform to potential new users — they even advertised in grocery stores. One video shared with Bitcoin Magazine depicts hundreds of people congregated in an opulent auditorium swept by rave lights and punctuated with a background of K-pop music. In another, a young man holding flyers, his back strapped with a billboard blazoning PlusToken information, shoos away the person recording the footage.
It’s with these brazen market tactics that PlusToken defrauded an estimated 3 million people, according to PlusToken’s advertised user base (Blockchain analytics firm CipherTrace believes this number could even be as high as 4 million). While the six individuals arrested in Vanuatu were Chinese, the scam proliferated among retail investor circles in South Korea and Japan as well, along with many other countries in Southeast Asia. Wan claims to have even received direct messages from affected users from Russia, Ukraine, Germany and as far as Canada.
PlusToken also featured a sophisticated app, which allowed its users to instantly convert Chinese yen into bitcoin, ethereum, eos, doge, litecoin and other altcoins, which they could, in turn, convert to PLUS. Proportional to their original investment and how many new users they onboarded to the scheme, users were paid out exclusively in PLUS tokens. PLUS users could graduate to multiple echelons based on their promotional activity, such as the highly-sought-after “Big Boy” and “Great God” distinctions.
Most of the scheme’s early members received “their dividend as promised, but not the later investors,” Jeff Liu, head of U.S. operations for blockchain security company PeckShield, told Bitcoin Magazine.
But even those investors who did receive PlusToken dividends were ultimately scammed, as these tokens are, much like BitConnect’s own, worthless and offer nothing in the way of financial remuneration for the 3 to 4 million investors affected.
Where Are the Funds?
Over the course of its lifetime, PlusToken garnered investments of 200,000 bitcoin, 789,000 ether and 26 million eos, all of which were held in wallets the PlusToken team controls. A report released by the Prosecutor General’s office of Yancheng District says that “the flow and movements of funds are unclear, which is still under further investigation,” likely indicating that hardware and private keys were not seized during the arrest in Vanuatu.
All of the team’s ether spoils are still stowed in its Ethereum wallet, as are its EOS holdings. Funds from their bitcoin wallet, however, have been on the move — though blockchain analytics experts disagree as to how much is headed where.
“From [PeckShield’s] data, at least 1,000-plus BTC were moved to exchanges and liquidated, but the actual figure could be much larger,” Liu told Bitcoin Magazine. The exchanges in question are Huobi Global and Bittrex, according to the analysis, and the team has been allegedly dumping its hoard of bitcoin on them since July 2019. Research by another firm, CryptoQuant, alleges that over 39,000 bitcoin has also passed through Kraken, Bitstamp, Brazilian exchange Mercado Bitcoin and Bitcoin Mixer.
Another independent community member claims that the team is also sending bitcoin to Binance, though this has not been verified. And, according to North American blockchain analytics company CipherTrace, neither has PeckShield’s findings. CipherTrace told Bitcoin Magazine that it could not completely confirm that PlusToken has exit scammed in the traditional meaning of the term, nor could it confirm how many funds were involved in the fraud.
“This is unlike other exit scams where the insiders clearly made off with the funds — if there was $3 billion in crypto at the time of the collapse, it is not clear whose pockets it is now in,” CipherTrace’s director of financial investigations and education, Pamela Garner, told Bitcoin Magazine, adding that the raid on Vanuatu should have ended in law enforcement capturing hardware along with personnel (though, per the Yangcheng police report, it did not).
CipherTrace also found no evidence that the PlusToken team has been dumping its filched supply on exchanges. PeckShield and others that have been tracking funds have argued that PlusToken’s offloading of funds has contributed to bitcoin’s recent price decline. CipherTrace doesn’t believe this is the case. The company has tracked April transactions of 95,228; 15,000; and 68,562 bitcoin to various address, though the most recent movement of 22,922 bitcoin on August 13, 2019, which was broken up into several addresses, did not make it to exchanges, according to CipherTrace.
“The recent movements (of a few days ago) have not gone into any exchanges or made any attempts to dump the bitcoin into the market,” Garner said. “The August 13 movements went into private, single-use holding addresses. They have been sitting there for a few days. They have not been pushed to the market. That’s not dumping BTC. It could be a theft of some sort. Or an early attempt to obfuscate funds or movement.”
TokenAnalyst, another blockchain analytics firm, corroborated CipherTrace’s findings.
The discrepancy between CipherTrace and PeckShield’s analysis stems from the fact that CipherTrace “hasn’t independently verified Dovey Wan’s claims that these specific addresses belong to Plus Token,” according to the company. Wan claims that the following addresses were advertised on WeChat to newcomers:14BWH6GmVoL5nTwbVxQJKJDtzv4y5EbTVm, 31odn4bxF2TgM4pD7m4hdSr1vGMsjh9ugV, 33FKcwFhFBKWHh46Ksmxs3QBu8HV7h8QdF. Bitcoin Magazine was able to independently verify that at least one of these three bitcoin addresses is attributed to PlusToken, along with its Ethereum and EOS addresses.
Still, PeckShield, a Chinese company, is holding firm to its analysis. Such analysis, it told Bitcoin Magazine, will be crucial for recouping filched funds, some of which Liu claims have already been recovered (Bitcoin Magazine could not verify this information).
“The stolen fund can be intercepted by exchanges if they are moved in there and the exchanges are willing to do so,” Liu said. “PeckShield has worked with our customers to track and recover stolen funds before in similar ways. For this incident, to my knowledge, the Chinese law enforcement agencies are working on recovering the fund, and at least some of funds have been confiscated by the Chinese government agencies.”
How Did We Get Here?
Inherent in the discrepancies between PeckShield’s analysis and CipherTrace’s own is the gulf of information that exists between the Eastern and Western cryptocurrency communities — the same that made the West deaf to a multi-billion dollar scam that has been a hot topic in Chinese media for over a month. As we’ve learned over the years from the seemingly eternal false news reports of China banning bitcoin, reliable information has a hard time crossing the Atlantic.
The case also quantifies a crucial difference between the investing climates on the two spheres. Multi-level marketing schemes like this one are an all-too-common plague in Chinese retail investor scenes, Wan told Bitcoin Magazine. China has enjoyed an explosion of wealth creation in recent decades, so Chinese citizens used to quick capital growth and wealth accumulation “are less sensitive to this type of Ponzi when they front as ‘high-yield investments,’” Wan said.
This environment has bred plenty of unscrupulous activity, both within the cryptocurrency industry and outside of it. Wan says there are still other cryptocurrency Ponzi schemes out to swindle unaware investors. One of these that she pointed to, VDS, has a market cap of $1 billion.
These efforts only harm the cryptocurrency industry, Wan opined, stating that bitcoin is still largely identified with scammy activity in the country. The answer, then, is education and awareness. If retail investors are armed with the knowledge of how to spot these schemes, then they can combat against them.
Until such upstream measures make a difference, however, downstream measures, like action by law enforcement, will have to do for now. This could also mean damming up liquidity ramps so that the scammers cannot cash out of their holdings, or, assuming the funds are on exchanges to begin with, seizing the related accounts to redistribute their holdings to PlusToken’s victims.
The post How the PlusToken Scam Absconded With Over 1 Percent of the Bitcoin Supply appeared first on Bitcoin Magazine.
