Chinese Ponzi Scheme PlusToken Shows Signs of Exit Scam

Investigations
08.07.2020

Since mid-June, analysts have been noticing an active movement of funds associated with the Chinese PlusToken Ponzi scheme. Abnormal jumps in the price of individual tokens with subsequent emptying of hot wallets were observed at exchanges affiliated with scammers.

ForkLog looked into the matter to find out whether this could indicate an MLM exit scam and what impact these events will have on the price of Bitcoin. Goldfoundinshit, a Russian-speaking Telegram channel, helped us gather information.

What Happened

On the night of June 14th, in a matter of hours, the price of the Bitcoin Vault token (BTCV) on the Singapore World Blockchain Forum (WBF) exchange surged by 2500%—from $300 to $8,000.

BTCV/USDT chart

BTCV/USDT chart. Source: Blockbeats

WBF attributed the rapid growth to a lack of liquidity and the subsequent injection of funds.

Yet some users noticed that at the same time, the balances of the exchange’s hot wallets sharply decreased.

50 ETH were transferred from a single address. Another 25 ETH were moved the next day.

Ethereum transactions from WBF's hot wallets

Ethereum transactions from WBF’s hot wallets

Who’s Behind This?

WBF is a little-known exchange, but its parent WBF Group is the company behind the promotion of the PlusToken and CloudToken Ponzi schemes.

The creators of PlusToken are accused of misappropriating $3 billion of user funds—this is the largest cryptocurrency exit scam in China. The damage caused by CloudToken is estimated at $500 million. Alleged organizers of both schemes were arrested in 2019.

According to the WBF website, the World Blockchain Forum, managed by Sheng Zhao, was registered in New York in 2017. Another source says it was found in 2018.

Judging by publicly available information, the company shares registration address with five more companies with similar names: Digital Asset Fund Inc., Digital Capital Inc., World Blockchain Media Alliance Limited, World Blockchain Award Corp., and DigitalUSD LLC.

In addition to the Ponzi schemes already mentioned, Sheng Zhao is related to other MLM schemes: Exxa Wallet, S Block Wallet, Torque Trading System, and WoToken.

Connections between companies and people related to WBF, PlusToken, and CloudToken

Connections between companies and people related to WBF, PlusToken, and CloudToken. Source: Sue Zhu

Each of these schemes offered a 5% to 20% ROI, supposedly using a trading bot based on artificial intelligence. Withdrawals were allowed only in the tokens of each project and on internal exchanges.

As it turned out, the source code for the CloudToken site was a partial copy-paste of the MooToken project.

The comment pointing out that parts of CloudToken code came from elsewhere

The comment pointing out that parts of CloudToken code came from elsewhere. Source: Behind MLM

In early June 2019, the World Blockchain Forum severed ties with CloudToken.

Representatives of the WBF said they did not invest in CloudToken and urged the scheme participants to stop using Shen Zhao’s identity to promote the project.

Screenshots of WBF communications pertaining to Cloud Token

Screenshots of WBF communications pertaining to Cloud Token. Source: Behind MLM

CloudToken Technical Director Ronald Aai confirmed that he had to abandon WBF’s Singapore office. Though he explained this with local building codes that limit the number of people in the building.

Aai has been on the run since last year. In August 2019, he tried to promote his project at the expense of Binance exchange.

On May 5th, 2020, Ronald Aai uploaded a 13-minute video on YouTube in which he talked about surveillance and an attempt to kidnap his family. He also promised to revive the CloudToken project and return the missing funds.

On June 23rd, Aai-led CloudRedeem project distributed a press release announcing an expansion to Australia and the UK, the introduction of a cashless payment system in several Asian countries, and the development of the Cloud 2.0 platform.

What Does It All Mean?

In May, the police of the Chinese Guangdong province arrested 12 people who, under the guise of employees of the OTC unit of the Huobi exchange, offered to invest in their platform.

The suspects have been operating since November 2019 through thematic groups on WeChat. The money received was funneled abroad.

The total damage from the activities of the group was not reported, however, it is known that one of the victims transferred 3.1 million yuan to the scammers (almost $440,000).

In the same month, organizers of the WoToken pyramid were arrested in China. According to Dovi Wang, managing partner at Primitive Ventures, one of the detainees is a former PlusToken key defendant.

In June, in Guangdong, police froze 4,000 bank accounts owned by illegal OTC traders. They are suspected of money laundering using cryptocurrencies.

According to one version, it was a series of raids by the Chinese cyber police that could provoke the withdrawal of funds from PlusToken accounts on various exchanges.

On June 19th, 284 million XRP ($49.9 million) were transferred from wallets belonging to the Ponzi scheme.

From June 22nd to June 24th, $458 million worth of cryptocurrency went in motion: 22,000 BTC, 789,000 ETH, 26 million EOS, and 20 million XRP.

According to Twitter pundits, the huge withdrawals may indicate the closure of the World Blockchain Forum.

Impact on Bitcoin and Ethereum

The movement of PlusToken funds negatively affected the prices of BTC and ETH.

On June 24th, amid the withdrawal of $458 million, Bitcoin plummetted to the lower margin of its long-term trading range.

BTC outflows from Poolin

BTC outflows from Poolin. Source: CryptoQuant

In mid-June, analyst Frank Topbottom suggested that Ethereum transactions with unusually high fees were linked to the Ponzi scheme’s attempt to launder funds: an anonymous user transferred 0.55 ETH, paying 10 668 ETH (about $2.6 million) as a fee.

Later, it turned out that there is another Ponzi scheme behind the transactions—Good Cycle, which itself then became a victim of hackers.

Back in December 2019, Chainalysis analysts said that the PlusToken scheme will continue to put pressure on the market, as its organizers still are in possession of 20,000 BTC.

Read more about how the PlusToken Ponzi scheme launders Bitcoins in our previous investigation.

Follow us on Twitter and Facebook and join our Telegram channel to know what’s up with crypto and why it’s important.

Found a typo? Highlight text and press CTRL+ENTER

Subscribe to our Newsletter

<

Related posts

Tags: , ,