Scam! Bitcoin has a high premium? This "Iranian exchange" defrauded 4,700 BTC in less than two months

In the field of digital currency, there are some rumors that are hard to tell whether they are true or false, such as the high premium of Bitcoin prices in Iran. You may often hear such news that due to severe inflation, geopolitical crisis and other reasons, the price of Bitcoin in Iran has a high premium far higher than that in other regions. Such news comes out from time to time, and the logic seems to be true.

When you see these news, you may also think, wouldn’t it be great if you could take Bitcoin to Iran to sell, how cool it would be to make money. It is normal to have such thoughts, but it may also be dangerous, because some scams are taking advantage of this mentality of investors, catering to your needs, arousing your desires, and finally running away with your money.

For example, if there is suddenly an "Iranian exchange" that advertises in China and opens the door to the world of high-premium arbitrage in Iran, would you be tempted? Yes, there was such an exchange before, Bitisis, which claimed to be the largest exchange in Iran and even in the Middle East. It once attracted many investors to invest, until one day a familiar drama was staged, users had difficulty withdrawing coins, and the website posted a notice that was almost equivalent to closing down.

Further information shows that this so-called Iranian exchange is most likely a Ponzi scheme organized by the Chinese, which takes advantage of the long-standing "perception" of some Chinese investors that Iranian Bitcoin has a high premium.

After the exchange was shut down and fled, Beijing Lian'an also received clues from some victims. Through our ChainsMap on-chain analysis system, we were able to outline the overall picture and scale of the exchange from the perspective of on-chain data, and from this perspective, we found possible evidence of the Chinese background of its organizers, as well as the possible destination of the relevant bitcoins.

According to the victims, the basic model of the exchange is to require users to register on the platform and then deposit Bitcoin into the deposit address assigned to the user, which is also a common practice of an exchange. Then it will allocate the so-called IRRT platform currency to the user, and then the user will sell it at the so-called local high premium and withdraw USDT from the exchange.

Based on the clues we obtained and the big data analysis on the chain, we found that the exchange Bitisis was mainly active from April 17 to June 8, and the total flow of Bitcoin inflow reached 4,700 BTC.

This picture shows the amount of BTC flowing into Bitisis every day. It can be found that the daily inflow of this exchange is in a state of continuous growth. On May 22, the daily inflow exceeded 100 BTC, on May 30, the inflow exceeded 200 BTC, on June 3, the inflow exceeded 300 BTC, and on June 7, it was close to 400 BTC, but it suddenly stopped the next day.

Along with this process, the exchange has been continuously promoting news in the country. If you search on search engines, you can still see news such as "The Iranian exchange Bitisis's Bitcoin price premium is as high as 350 US dollars" that appeared in many media from the end of April to the beginning of May.

From the distribution of user sources, we found that Bitisis does not have many transfers from independent wallets. Most of them come from withdrawals from other exchanges, most of which come from the three major HBO exchanges, especially Okex and Huobi. In other words, the main users of this so-called Middle Eastern exchange are actually from China.

So, where did the coins that users recharged go? According to the current addresses of the corresponding exchanges, they have all been cleared. From the perspective of the Bitcoin management method after users recharge, Bitisis also adopts the hot wallet collection strategy of most exchanges. Most of the Bitcoins recharged by users are concentrated in 10 hot wallets and withdrawn later.

Further analysis of Bitisis's withdrawal transactions revealed a feature that the exchange's withdrawals showed an extreme distribution. In the end, 61 addresses withdrew a total of no more than 50 BTC, while 40 addresses withdrew a total of more than 4,600 BTC.

It is worth noting that these 40 addresses all belong to the same large domestic exchange. The first transaction time of these addresses was mostly in mid-to-late May, and the last transaction time was mostly in early June.

Further clues are worth pondering. We all know that scammers must give you a sweet treat when they create a scam, so at the beginning, users of this exchange can trade at a high premium and withdraw USDT. From the withdrawal records provided by the victims, we found that several independent addresses transferred ERC20 USDT to user addresses, but these addresses first withdrew these USDT from the same exchange and then distributed them. You may have guessed that this exchange and the 40 addresses where Bitisis's Bitcoin withdrawals mainly flowed to belong to the same exchange. Since the organizers finally transferred the relevant assets through domestic large exchanges, they are likely to have a Chinese background.

Thus, Bitisis's fraudulent logic became clear, that is, taking advantage of the "common sense" cultivated by many investors about the rumors of Bitcoin's premium in Iran, packaging a so-called Iranian exchange, and then promoting it in China. At the same time, it released some news that the price of Bitcoin in Iran was at a premium in the transaction, in order to attract investors to enter.

At the same time, the organizers registered some accounts in a large domestic exchange, gradually withdrawing the bitcoins deposited by investors to these accounts, and then selling them on the large exchange. In the early stage, they deposited USDT to users who withdrew the bitcoins, giving investors the illusion that they really gained profits from arbitrage, which may further increase their positions or create a word-of-mouth effect to attract more investors to enter the market. Of course, the final outcome has long been doomed, and running away is always the last step of the scam.

On the whole, Bitisis's scam still follows the existing routine. The so-called "arbitrage" has become the entry point for a large number of digital currency scams. However, this scam cleverly used the story of Bitcoin's premium in Iran, making the high-premium arbitrage income seem to have an extra layer of "rationality", allowing investors to remove their psychological defenses.

Here, Beijing Lian'an once again reminds all friends that the key to preventing such scams is to maintain common sense in investment and financial management. Excessive returns often hide traps, even in the world of digital currencies where wealth myths often occur.