Babbitt Exclusive | The case involved more than 100 million yuan! The police revealed how the country's first "digital currency arbitrage case" was solved

On July 9, the Cyber ​​Security Bureau of the Ministry of Public Security announced a criminal case of "Telegram digital currency arbitrage", which attracted widespread attention in the industry.

In the case, the suspect stated in the fake official Telegram group of the exchange that he could exchange ETH for platform coins at a ratio of "1:60", inducing the victims to transfer their ETH into the suspect's account, and then transferred fake platform coins to the victims, thereby committing the crime.

After careful investigation, the police of Ouhai District, Wenzhou City (hereinafter referred to as "Ouhai police") arrested 10 suspects after obtaining sufficient evidence of the crime, and seized more than 20,000 digital currencies such as ETH, BTC, USDT, and more than 30 mobile phones and computers used in the crime were seized on the spot, as well as three luxury cars and three properties with a total value of more than 13 million yuan.

This case is the first "Telegram digital currency arbitrage" crime case in the country , and it is also the largest criminal case involving the largest amount of money investigated by the Ouhai police. After the news was announced, Babbitt contacted the Ouhai police as soon as possible and obtained more details related to the case.

It is reported that the criminal gang used dozens of self-built Telegram groups to defraud victims of more than 50,000 ETH with the bait of arbitrage. After gathering a large amount of funds, the criminal gang transferred ETH to multiple transit addresses and exchanged ETH for a more concealed digital currency, Monero, on decentralized exchanges, and finally cashed out these Monero on other exchanges.

Ouhai police, in cooperation with a local blockchain company in Wenzhou, sorted out the association map of the criminal gang's smart contract addresses , and with the cooperation of exchanges, wallet companies and other parties, combined with traditional investigative methods, accurately located the identity information of the criminal gang members. On June 4, all members of the criminal gang in this case were arrested.

10 suspects, fully automated crime process

The so-called arbitrage refers to the phenomenon of " price difference between the same currency in different exchanges " to earn the difference by buying low and selling high. Compared with direct trading and leveraged trading, arbitrage has the lowest risk and stable returns. Therefore, as early as 2013, many cryptocurrency investors used arbitrage as one of the common means of speculation.

Since 2018, with the rise of the cryptocurrency market bubble, cryptocurrency scams that use arbitrage as a gimmick have begun to surface , among which the "Plus Token scam" is the most typical. The Plus Token project once promised high arbitrage returns and swindled more than $3 billion worth of cryptocurrencies from investors. In July last year, the project collapsed and the main people involved in the case fled. A month later, six people who organized Plus Token pyramid schemes were approved for arrest.

Unlike the "Plus Token scam", the "Telegram cryptocurrency arbitrage" scam uses third-party software (such as Telegram, Huobi exchange, imToken wallet, etc.) and is conducted entirely online . Therefore, it is more concealed and difficult to trace.

Babbitt learned that in this case, the division of labor among the 10 suspects was "3+2+5", namely 3 main culprits, 2 senior executives and 5 ordinary employees.

The three main offenders were all born around 1995 and were college classmates. After graduating from college, they co-founded a company in 2018 to attract traffic and promote Telegram communities. During this period, they came into contact with digital currencies and learned about the methods of arbitrage. Since July 2019, they have begun to use Telegram communities to commit digital currency arbitrage crimes.

At first, they pretended to be Huobi customer service representatives and mingled in Huobi's official Telegram community. Later, they set up their own groups, recruited people, and operated and maintained the community themselves. After the community reached a certain scale, they rented more than 100 overseas servers, used intelligent robots to realize automated management of the community, and recruited employees for business training.

The entire crime process is divided into three stages:

1. Create a fake official Telegram group, such as "Huobi Global Arbitrage HT Chinese Group Community", and the group administrator (robot) will post graphic tutorials on arbitrage in the group, guiding victims to register an account on the Huobi exchange, download the imToken wallet and purchase ETH.

Second, they promised that "1 ETH can receive 60 HT", guided the victim to transfer ETH to the designated ETH address, and returned the corresponding amount of fake HT to the user, which is the same name as the Huobi platform currency "HT" and is issued based on the Ethereum ERC20 standard. It is not the Huobi Token officially issued by Huobi. In this process, the robot will pretend to be a real user and speak in the group, claiming the various benefits of arbitrage.

3. When the victim finds that the fake HT cannot be transferred on Huobi Exchange, the criminal team will impersonate Huobi official customer service, take the initiative to privately chat with the victim, and induce the victim to transfer more ETH on the grounds of "insufficient deposit amount" and "insufficient arbitrage times", etc. Sometimes they will impersonate the official customer service of imToken, and induce the victim to enter the wallet mnemonic or private key on the counterfeit imToken website on the grounds of "rollback", so as to commit a second crime.

After the entire criminal process was automated and streamlined, from guiding users to register and transfer money to chatting with victims and selling stolen goods, the three main criminals began to cash out and spend lavishly, driving luxury cars, living in luxury houses, and going to entertainment venues. The daily operation and management work was handed over to another seven employees, some of whom were minors.

"The criminal gang is very smart. They will first exchange the defrauded ETH into Monero on a decentralized exchange, and then cash it out on the exchange. At the same time, they are also very confident. The door of their villa was open when they were arrested. During the interrogation, the second main culprit kept asking, 'How did you find us? Is there a problem with which wallet?' They think their crime process is watertight, so they are not afraid of being caught." Ouhai police told Babbitt.

More than 1,300 victims, with a total amount of over 100 million yuan involved

On April 8 this year, the Public Security Bureau of Ouhai District, Wenzhou City received a report from a victim who claimed that he was defrauded of 10 ETH worth a total of 12,000 yuan in a Telegram arbitrage group. After realizing the seriousness of the incident, the Ouhai police immediately launched an investigation. But it didn't take long for the police to find that traditional investigation methods were difficult to work against this new type of crime.

Although Ouhai police have many years of experience in network investigation, this is the first time they have faced a criminal case involving Telegram digital currency. Since Telegram is an encrypted instant messaging software with strong privacy, domestic users need to use VPN to log in, and the mobile phone number used for registration may not be real. Therefore, the idea of ​​tracking Telegram is obviously not feasible. When the investigation of the case reached a deadlock, they thought of another key clue- the Ethereum address of the criminal gang.

Therefore, the Ouhai police contacted the Blockchain Joint Laboratory of the Wenzhou Public Security Bureau and requested a well-known local blockchain company in Wenzhou to assist in the investigation.

It took them a month to sort out all the Ethereum addresses related to the criminal gang, and used self-developed software to draw the relationship between addresses, which is the "association map" mentioned at the beginning of this article.

Babbitt interviewed the head of the blockchain company that assisted the Ouhai police in the investigation. For the sake of confidentiality, he did not disclose the technical details of the case.

“The magic of blockchain is that it can record your history completely. Even if you are very careful now, there is no guarantee that there will be no loopholes in the future. You may not make mistakes now, but the mistakes you made in the early days will still be permanently written on the blockchain.”

He further explained,

"This is like a smart contract attack. Hackers will first go to 'scout', that is, rehearse and try out the attack methods in advance, and then choose a suitable time to officially launch the attack. There will always be some loopholes. We will trace back and trace back. The addresses and behaviors related to the suspects will gradually surface, and finally draw a portrait of the addresses and relationship map to solve the case."

In order to solve this case, they invested a lot of manpower to analyze the addresses involved in the case. After a month of day and night analysis, they found the flaws left by the criminal gang in the intricate relationship map, which laid a solid foundation for the successful investigation of this case.

On June 4, Ouhai police, in cooperation with Fuzhou police in Fujian Province, successfully arrested all 10 suspects in Cangshan District of Fuzhou. On July 9, the five main members of the criminal gang were approved for arrest by the procuratorate. It is understood that the subsequent trial and sentencing will be handled by the court, and this process may take half a year.

During the investigation, the police found that the criminal gang had dozens of Telegram groups, each with 5,000 to 30,000 users, most of whom were "zombie users." In addition, tens of thousands of ETH had been cashed out.

So far, the police have obtained information on more than 1,300 victims across the country, and the amount involved is as high as more than 100 million yuan. Babbitt learned that among these more than 1,300 victims, more than 200 were defrauded of 20 ETH or more, and more than 1,000 were defrauded of less than 20 ETH. Most of them were defrauded of 1 ETH, and the one with the most was defrauded of more than 1,000 ETH. They are mainly born in the 1990s and have decent jobs. At present, 10 victims have been verified.

Victims please register a report as soon as possible

From the data provided by the police, we can see that the victims basically fell into this scam with a try-it-out mentality. "If the arbitrage is real, you can exchange a small amount of ETH for a stable extra income; if it is fake, the loss is within your tolerance." For this reason, many victims did not choose to report the case after discovering that they were deceived, but silently endured the loss.

In fact, such scams are not uncommon. In June last year, Babbitt reported that the "Brick Arbitrage" scam reappeared, and a user was defrauded of 885 ETH. It listed multiple cases of victims being defrauded, as well as announcements from exchanges and wallet companies and police receipts.

In the past two years, although the police in many parts of the country have received reports from victims, these cases are often not filed or no progress is made after filing. There are two main reasons for this.

First, in terms of cognition , the victim himself did not know enough about digital currency and blockchain, and was unable to explain the whole story to the police when reporting the case, which led to the police not paying attention and not filing a case;

Second, from a technical perspective , analyzing blockchain addresses is very technical, and it would be difficult to solve the case without professional technical means and resources.

The case was solved thanks to the Ouhai police's high attention and meticulous investigation, the blockchain company's technical support and the active cooperation of other parties. Babbitt learned that the case may be used as a typical case supervised by the Ministry of Public Security and distributed to police across the country for study.

Although the case has been successfully solved, the police found that some victims have not yet reported the case to the public security organs. The Ouhai police reminded people from all over the country who have similar experiences to report the case to the local police in a timely manner , and the local police will contact the Ouhai Public Security Network Security Brigade to recover the losses as soon as possible.

As for the follow-up progress of this case, Babbitt will keep a close eye on it!

Link to this article: https://www.8btc.com/article/621617
Please indicate the source of the article when reprinting