One of the more nefarious cryptocurrency scams in recent history, PlusToken, allegedly netted upwards of $3 billion from unsuspecting crypto victims. The money was moved into cryptocurrency wallets, controlled by the scammers, but since then, it has taken quite a journey.
PlusToken allegedly netted nearly $3 billion in Ethereum and Bitcoin, having started in mid-2018 offering a high yield investment return. Turns out that was just code for massive Ponzi scheme as the site suddenly went dead, and the money disappeared.
Now, through information procured by LongHash, who focused in on two Ethereum wallet addresses, it is possible to get a better understanding of where the funds went after they were siphoned off.
The two wallets, this one and this one, once held more than 800,000 in ETH. That’s worth more than $140 million at current prices, but even more when the money was first stolen and Ethereum prices were higher.
The transparent nature of the blockchain allows us to see what has been going on with the funds, and in the one address, we can see that a large majority of the coins have not been moved from there and are on hold.
It may be that the scammers no longer have access to them, as six of the men involved were arrested earlier this month by Chinese police on an island in Vanuatu. However, the other one, which contained 20,000 ETH, has seen almost all of the funds moved.
LongHash has produced an interesting graph to show just how the funds were moved.
“each dot in the figure above represents an Ethereum wallet, and each line represents a transfer. Colors represent the number of outgoing transfers from each wallet. Black dots are endpoints — wallets into which tokens were transferred and have not been removed. Dot size reflects the balance of assets left in the wallets after these transfers.”
It is a rather rapid and diverse distribution of funds: all told, PlusToken initiated a total of 7,722 transfers involving 4,592 addresses. This was probably done on purpose, diluting the funds, and making it harder to track and trace.
It is fascinating to see what operation scammers can run when it comes to obfuscating their funds and laundering them into normal circulation. According to LongHash None of the 4,592 addresses have connections to exchanges, so it’s likely that none of it has been cashed out.