PlusToken Collapse One Year Ago: How Did the Former “Yu’e Bao” in the Cryptocurrency Circle Swallow 200,000 Bitcoins?

On June 24th, Beijing time, when the Chinese people were preparing for the Dragon Boat Festival, the on-chain transfer of 789,534 ETH attracted the attention of the industry, because these ETH were the ETH assets involved in the PlusToken incident, the largest case in the digital currency field to date. After a long period of silence, these ETH started new activities at a special time node.

There may be different opinions about the specific date of PlusToken's collapse, but the industry generally believes that the end of June 2019 is the approximate time range for the collapse of this digital currency scam involving more than 20 billion yuan. It has been one year since the collapse of PlusToken. So far, the case itself and the ownership of the related digital currencies are still shrouded in mystery, and the aftermath is not over. Beijing Lian'an has participated in the long-term tracking of the money laundering process of PlusToken-related Bitcoin and ETH funds, especially in the analysis of Bitcoin money laundering, and has worked closely with relevant institutions to make the most comprehensive analysis in the industry. Here, let us review some traces of the direction of related digital currency funds in the year of PlusToken's collapse.

The former "Yu'ebao in the cryptocurrency world" swept the cryptocurrency world, and the aftermath is still lingering

In fact, before the collapse of PlusToken, it was not the devil that everyone condemned and made the victims upset like it is today. Back then, it was considered a money-making tool, the "Yu'e Bao of the cryptocurrency circle", and it was extremely popular for a time.

At the time, PlusToken claimed to be the world's second largest digital currency wallet after imToken. The entire team was also very mysterious. In its early white paper, it used the usual routine of such projects to claim that it was developed by the original technical team of Samsung and Google with many years of rich experience, and its R&D laboratory was in Seoul, South Korea.

In its first official promotional material, it was mentioned that the founder was Google AlphaGo algorithm researcher LEO, and the co-founder was Samsung team core technology Kim Jong-in. PlusToken even claimed that Google and Samsung accounted for 17% of its shares. Later, they were too lazy to package it and directly said: Don’t care who the team is, Satoshi Nakamoto doesn’t show up, as long as you make money! At that time, PlusToken was in the limelight, and many people thought about it and it seemed to be true!

At that time, there were a lot of introductions about PlusToken on the Internet, including the "principle" of how to make money, and even various operation videos. All of these were not only produced by the official website, but many people also took the initiative to recommend and introduce it. The reason is that PlusToken itself has the nature of a pyramid scheme.

PlusToken has established two so-called income methods. One is called static income, or "smart dog" income, that is, depositing coins into PlusToken can enjoy "stable income of 10% per month". The name of "Yu'ebao in the currency circle" comes from this. To put it bluntly, this is a common routine of P2P, illegal fundraising in the name of high interest. In the P2P field, we often say that if the annualized rate of return dares to advertise 10% or 15%, then we must be vigilant. In the field of digital currency, it is even worse. For example, PlusToken's monthly income of 10% should have been a warning bell, but many people still fell into it.

At the same time, PlusToken has also designed a dynamic profit model, namely the so-called "sharing" profit, which has the nature of a pyramid scheme. Judging from the examples given in its official promotional materials, a ten-level profit structure is directly listed.

Therefore, at that time, you will find a large number of "teachers" appearing in various communities. They are eager to recommend PlusToken, a huge investment opportunity, to you, fearing that they will not be able to lead you to common prosperity.

The picture above is one of the PlusToken promotional materials at that time. It may seem funny today, but it was slogans like these that made many investors become victims today, and they may also participate in the pyramid scheme and become perpetrators.

One year after the collapse, funds were frequently transferred, which repeatedly became a hot spot in the industry

We already know the ending of PlusToken, which is a collapse, but you may also be a little vague about the grand scale of this scam and the scale of assets involved. Through relevant clues, we have already figured out the wallet structure of Bitcoin, the largest asset type of PlusToken, and can analyze its rise and collapse in detail from the perspective of on-chain data.

According to statistics, we can find that although PlusToken was launched in 2018, its large-scale Bitcoin inflow began in February 2019. Without considering possible repeated inflows and outflows, the cumulative number of Bitcoins flowing in has exceeded 200,000.

In terms of wallet structure management, PlusToken is roughly operated by two address clusters around three hot wallet addresses. Most of the addresses contained in these two address clusters are deposit addresses assigned by PlusToken users, with a total of more than 530,000. The three hot wallet addresses were switched in chronological order between August 2018 and June 2019. At the same time, the bitcoins collected in the hot wallets will be further transferred to some other addresses for low-frequency but large-scale collection, similar to the collection of hot wallets to cold wallets. In the end, PlusToken collapsed, leaving a large amount of digital assets in the relevant addresses. Then the actual controllers of these addresses began a year-long asset transfer and money laundering process, which has not been completely completed to this day.

During the money laundering process this year, Beijing Lian'an continued to follow up through the ChainsMap on-chain traceability system, and synchronized the latest developments with the industry through newsletters on many occasions. Next, let us review the newsletter clips we released at the time and review the general process.

June 30, 2019:

At that time, PlusToken’s main wallet assets were distributed in three addresses:

31odn4*** (68,562 bitcoins)

14BWH6*** (95,228 bitcoins)

33FKcw*** (37,922 Bitcoins)

August 13, 2019:

The address starting with 33FKcw in the PlusToken related address generated two huge UTXOs (15,000 and 22,848 bitcoins respectively) through transfer.

August 14, 2019:

The two UTXOs split on the 13th were split again to 9 new addresses on August 14th.

Among them, a main wallet address starting with 33FKcw transferred 22,922 BTC to four new addresses, with amounts ranging from 4,922, 5,000, 6,000, and 7,000 respectively;

Another major wallet address transferred 22,922 BTC to five new addresses, with amounts ranging from 2,000, 2,800, 3,000, 3,400, and 3,800 respectively.

August 17, 2019:

Then, after 18:00 on August 17, these addresses started transferring money again, but each time they were transferred to a newly generated address. After 11:00 p.m. to the early morning of August 18, the above addresses started transferring money again, mainly due to a large number of splits, which were further divided into a large number of small independent addresses ranging from 1 to 10 BTC.

August 18, 2019:

As of the 18th, a total of 37,922 bitcoins have been transferred from the Plustoken wallet address to the new address, and 29,805 BTC have been divided into small transfers.

August 28, 2019:

ChainsMap security personnel followed up and analyzed and found that a large number of split addresses occurred in the past few days. In the past two days, they were frequently split into a large number of small addresses ranging from 0.1 to 10 BTC, and were further aggregated and transferred out.

These funds did not flow directly into the exchange, but were obfuscated through tools like ChipMixer and then sold through over-the-counter (OTC) channels.

August 23, 2019:

Recently, another large asset wallet of PlusToken, the address starting with 14BWH6, has transferred 33,706 BTC to the address starting with 1Li4mU through a large number of split transfer operations.

August 29, 2019:

The address starting with 1Li4mU changed at 3:10 am today and split the transfer again. The relevant bitcoins were transferred to the following addresses today:

1Npr4Z***（1932BTC）

1Nrwpr*** (2433BTC)

1FEYD9*** (1937 BTC)

1BWvR7*** (3222BTC)

1QEEdd*** (1140BTC)

August 30, 2019:

Several large amounts of bitcoins split from the above-mentioned addresses starting with 1Li4mU were split again yesterday afternoon and early this morning. They have been split into single-digit BTC and stored in a large number of newly generated addresses.

After 4 a.m., some of the above addresses began to split again, continuing to generate a large number of single-digit BTC. Most of the related large-amount Bitcoin transfers that started in the early morning of the 29th have been split into less than 20 BTC, and the related Bitcoins are temporarily stored in independent addresses.

September 10, 2019:

The address starting with 1Li4mU started transferring money again. Since 22:20 last night, three large BTC of about 4,000 BTC have been transferred to independent addresses in succession, accumulating 12,646 BTC. After 11 o'clock today, these large BTCs started to be split and transferred again. The relevant process is still in progress, and single-digit BTC has been split.

The address starting with 1Li4mU was created on August 23 this year, and received 33,705 bitcoins on the same day. The number of bitcoins in its account has been reduced to 4,233.

September 16, 2019:

Another large-asset wallet of PlusToken, the 1H2zrV*** address, which holds assets starting with the address 14BWH6, is initiating a similar strategy split. At 23:08 in the evening, four large transfers of 3,000 to 3,800 BTC were made on the same block. The strategy features were similar to the previous ones, and each transfer was split into about 300 new addresses.

September 17, 2019:

Beijing Lian'an's on-chain monitoring system found that the funds starting with 1Li4mU were transferred again and basically "cleared".

September 20, 2019:

The first abnormal movement of ETH assets after PlusToken was exposed to have run away, 20,008 ETH were transferred from the address starting with 0xef13a2 to the address starting with 0xe380e0. No inflow into the exchange has been monitored yet, and there has been no abnormal movement of 789,534 ETH in the main wallet address.

December 19, 2019:

789524 ETH were transferred from the Plustoken address starting with 0xf4a2 to an unknown address 0x997114***

February 12, 2020:

After 4:34 am on February 12th, Beijing time, PlusToken further split the BTC related to money laundering yesterday. After splitting 11,999 BTC into 7 groups of large bitcoins, it further split them into single-digit to double-digit bitcoins. In addition, PlusToken still has an address with more than 7,000 bitcoins, and it is very likely to take further action in the near future.

March 6, 2020:

The two PlusToken related addresses that started the transfer yesterday were basically synchronized in time, but judging from the further behavior today, the initial strategies were slightly different. One group adopted a one-time split of about 1,000 BTC to several addresses, and then continued to split it into three-digit and two-digit numbers; the other group adopted a strategy of stripping out three-digit BTC during the continuous transfer process and then further splitting it.

June 25, 2020:

On the evening of June 24th, Beijing time, after two consecutive transfers, more than 35,000 ETH of the 789,534 ETH involved in the PlusToken case had been further split and transferred to new addresses through 52 transactions, of which the largest share reached 9,925 and the smallest share was around 100. Based on the analogy with its previous behavior pattern on Bitcoin, this is likely to be the beginning of a series of obfuscated money laundering processes.

The above are just fragments of PlusToken-related digital currency transfers, but each transfer will attract attention from victims to industry insiders. During that period, PlusToken even became the scapegoat for the decline in Bitcoin prices. After many Bitcoin declines, some people exclaimed "PlusToken is crashing the market again." There are even relevant security agencies that compared the popularity of PlusToken's money laundering activities with the Bitcoin price curve and conducted serious analysis. So how does PlusToken launder money? Is it really so powerful?

PlusToke’s on-chain money laundering: Professional and patient, but market influence may be exaggerated

Overall, PlusToken’s money laundering process is very professional, and the general strategy is as follows:

1. Periodically transfer out large UTXOs of more than 1,000 BTC from the starting address

2. Large UTXOs are transferred or split in dozens of layers in parallel, breaking them down into large amounts of UTXOs as small as a single BTC.

3. Further confusion among the split combinations of large UTXOs from different stages

4. Finally, dozens of UTXOs are collected and sent to the exchange

5. From launch to entering the exchange, it usually takes more than 40 layers of transfers

In 2019, this address starting with 1Li4mU was one of the most well-known whale addresses of the year, and the media mentions it the most. In fact, it is a gathering address for funds related to PlusToken, but under the watchful eyes of the public, it still calmly launders money in batches at a rhythm.

Their confidence comes from their complicated money laundering process. By tracing the process through the ChainsMap system, we can see that after each batch of Bitcoins enters the money laundering process, they will be immediately split layer by layer. Usually, they will be continuously split into two-digit and single-digit Bitcoins and then confused. Often, the intermediate process of processing a batch of three or four thousand Bitcoins may generate more than 200,000 transactions. It is difficult to analyze this process without professional technical means.

The most troublesome thing in this process is the confusion and re-splitting of relatively small amounts of bitcoins after different batches of bitcoins are split. If manual analysis is used, it is impossible to sort out this process.

For some reasons, although we finally went through the whole process, we cannot introduce the detailed process and details step by step here. I believe that readers have already understood its basic characteristics. So under such a process, can PlusToken deserve the name of "dumping" in the Bitcoin price decline in the past year?

Because the amount of Bitcoin involved in the PlusToken case is so huge, people are naturally worried about the risk of these Bitcoins being dumped all at once. However, through the general context of PlusToken money laundering introduced earlier, we can also see that this is not a quick "dumping" process. It took several months to clear out one of the assets of 33,000 Bitcoins, and the entire process was ultimately distributed in units of dozens of Bitcoins. It is a gradual and soothing process. Moreover, the main transactions in the middle are likely to be off-site, and the transactions involving the on-site will be further dispersed from the timing to the rhythm, and it is probably difficult to form a continuous "dumping" force.

Ending: The scam has no end

From the perspective of a Ponzi scheme or a scam, PlusToken can be considered to have come to an end when it collapsed, but from the perspective of legal and social impact, its end has not yet come. There are still many victims trying to recover their losses, and the judicial action and handling of this case are still ongoing, so I will not go into details here.

What we want to say is that the collapse of PlusToken does not mean the end of the digital currency scam. Even after the collapse of PlusToken, there are still new scams about the restart of PlusToken or the so-called "PlusToken 3.0". These scams can still attract many investors to participate, including some of PlusToken's victims.

After PlusToken, new types of digital currency Ponzi schemes have emerged, and "arbitrage" seems to have become a classic scam model that has been tried and tested, including the so-called "Iranian Exchange" scam that was recently exposed.

Although there have been no cases larger than PlusToken in the past year, we have found that large cases worth hundreds of millions or even billions of dollars continue to occur. Digital asset scams are also evolving from a new type of crime to a new type of crime , and are more frequently combined with traditional economic crimes.

Under such circumstances, on the one hand, the potential victims of digital currency-related cases are expanding. They do not understand digital currency and have not heard of cases like PlusToken, which makes them very easy to be deceived by the so-called "new opportunity to get rich quickly". On the other hand, for front-line judicial organs, digital currency-related clues are issued more frequently in various cases, and the improvement of the means of solving such cases has become an urgent problem to be solved.

At the end of this special topic, we remind you again that in a society where people frequently interact, scams never end. They may appear in front of you in new forms, new means, and new models at any time. Please use common sense and be highly vigilant against "opportunities to get rich quickly" that promise excessively high returns, avoid becoming the victim of the next scam, and become a more rational and mature investor.

At the same time, just as we were preparing to publish this feature, the ETH involved in the PlusToken case began the splitting process again. . .