PlusToken Scam Addresses Move $117M in Bitcoin

Share this article

Research VP of Peck Shield, Chiachih Wu, today identified the movement of ~12K BTC ($117 million) related to the PlusToken scam. The funds are currently parked, but comments from blockchain analysts predict further movement.

Mixed, then Dumped 

“These addresses are directly associated with mixer deposits from August/September,” said Ergo, an on-chain Bitcoin analyst. In January, the analyst revealed the full depth of last year’s PlusToken Bitcoin sell-off. 

Ergo added:

“My guess is [the funds will be] mixed first. Not sure how long before we’ll see an uptick in transfer to exchange.”

The addresses in question are directly linked to those linked to the multi-billion dollar PlusToken scam from 2019. Six suspects behind the operation have already been arrested, but the latest on-chain movement indicates other individuals are still at large. 

In the initial forensic sweep, Chainalysis indicated that a total of $2 billion in crypto funds were collected. Ergo’s research estimated that this figure is actually much higher. They estimated that the scam gathered a little more than 1% of BTC’s total supply. 

For now, the 12,000 BTC in transit is under close supervision. The coins have only moved two transactions, but they will likely be mixed very soon. 

Plustoken 12k $BTC address just moved again

Looks like a consolidation of UTXOs, need to closely track the downstream movement

The fund is latest on address 19bMszbozeHyjANgSyM9iyjsZU1sKsR6uM pic.twitter.com/90qW7hrczB

— Dovey "Rug the fiat" Wan (hiring) (@DoveyWan) February 11, 2020

Analysis from earlier this year indicated that the PlusToken culprits used Wasabi as the primary obfuscation service. Although the service is effective in hiding users’ funds, the poor execution on the scammers’ part revealed their activity. 

Reusing addresses, merging, and attempting to mix 20,000 BTC at one time all made up inadequate privacy hygiene. Still, tracking mixed Bitcoin is no easy task. “It’s very tricky and time-consuming to do manually,” said Ergo. 

Instead, the analyst will skip over most of the mixing activity and identify a single transaction that consolidates the mixing outputs. “From there, I can find a few more since they’re usually in the same few blocks,” they said.

None of this will likely happen in the near-term either — the duration of mixing is highly variable according to Ergo. As for its effect on the price of Bitcoin, this is also hard to determine. 

In 2019, off-loading the BTC gathered in this scam placed significant downward pressure on the cryptocurrency. This was because of the high, constant volume of the sell-off. 

The distribution rate has been slow as of late. If this changes, it could have an effect on prices. 

Share this article