The Background — The Istanbul Connection — The US Remissions Framework — It’s Hammer Time in the US — They’re Not Friends (Everybody Lies) — The Devil is in the Details — The LIFO Forfeiture Machine — The Legal Side of the Crypto Scams Recovery Industry — No Deal

The Background

The DOJ has been trying to quietly settle with a self-described online gaming and wagering company, Infiniweb, for the $225M in USDT the US government has *frozen* in 2023 and filed for forfeiture in 2025. (To forfeit an asset is to legally entitle all ownership rights on it to the US government permanently.) Infiniweb claims the 225M USDT and contests its forfeiture. Month after month since early 2026, the DOJ kept on asking for an extension while it is trying to negotiate with Infiniweb on how to avoid trial on the merits of its claim and split the pot instead —likely since DOJ knows it cannot win forfeiture in open court. Detailed why, in my first post on this story:

Court records show that Infiniweb must be driving a hard bargain. Indeed, when has this ever been seen for the DOJ?

One fact about Infiniweb: it is a cancelled, shut down, and banned Philippine Offshore Gaming Operator a.k.a. “POGO”, which are widely known in the Philippines as hotbeds of online scammers and human trafficking during in their heydey circa 2020-2024. [Video: The Deep Web of POGOs]. Infiniweb, in fact, is accused by the US DOJ itself to be a shadowy shell company for Chinese human trafficking and cryptocurrency fraud factories.

Simultaneously, the DOJ has also been trying to strike out all scam victims claiming parts of the $225M, as well as other seized assets linked to pig butchering scams, as reported by the ICIJ: Questions swirl around US plans for record $15B Prince Group crypto seizure. The DOJ plan was to disqualify all scam victims’ claims and funnel them to a questionable and arbitrary “remissions” process. Assuming there are leftovers from a settlement with Infiniweb, the rest will go to the US Treasury’s Asset Forfeiture Fund — a slush fund created primarily for confiscated drug money. (More on this later.)

So we can be clear what’s going on here: the DOJ is negotiating away fraud victims’ money to criminals to save its own skin (detailed in my first post on this).

The court seemed to tire of the repeated extension requests for settlement talks outside of court, and had set July 23, 2026 for a hearing to make a ruling. Claimants rushed out with their motions in a do or die moment. It seemed imminent that the DOJ will be disbursing the bulk of the $225M to the Infiniweb criminals.

Nivie (introduced in my first post) came out with all guns blazing. She filed Document 79 on https://www.courtlistener.com/docket/70571294/united-states-v-approximately-225364961-usdt/. Don’t miss the exhibits.

I will summarize and discuss on the important points, the head-spinning timeline on how the US really got to get ahold of $225M in USDT. It involves senators, institutional arm-twisting, state-to-state unrelations, undue process, victims as unpaid skilled labor, whistleblowers-to-be, and the $225M’s sprawling links to other massive cryptocurrency forfeitures by the US, including the Prince Group’s ~$15B in BTC. There’s much to unpack, and its 45 pages of her filing was brimming.

The Istanbul Connection

Nivie is asking the court, first, for a Preliminary Injunction to stop any planned transfers of her portion of the $225M without first resolving all claims. As well, she is asking for an immediate open trial on the merits of all their claims. Finally, she is asking for a neutral custodian of those funds while claims are being resolved.

As already revealed in Nivie’s first Verified Claim, the biggest among the USDT wallets comprising the $225M, 0x82e1d4ddd636857ebcf6a0e74b9b0929c158d7fb, has already been frozen by Tether upon orders of a Turkish court, almost 4 months before its “voluntary” freeze by Tether for the US Secret Service. There was no coherent US seizure warrant for any of it until 2 years later.

See: New claim disputes facts of US landmark crypto seizure - Compliance Corylated

The Turkish court action stemmed from a case Nivie has initiated as a complainant and private prosecutor under their laws. It wasn’t a mere civil suit, but had morphed into a full-blown criminal trial of a large money-laundering ring, with hundreds arrested and real assets and physical evidences seized. In fact, the trials are still ongoing, with the Turkish state currently prosecuting it, but its courts have already held the 0x82e wallet in reserve for judgement holder Nivie.

This is in contrast to the US investigation underlying its original forfeiture claim, which was flimsy thin in evidence in comparison and trafficking in innuendos. It is likely an exclusively “desk-based investigation” — no arrests, no search warrants, no physical evidence, no surveillance, no informants, no undercover agents, no grand jury testimony, no charged defendants, nada. Now you see why the DOJ was squirming and haggling with Infiniweb over the $225M and shying away from open trial.

The US Remissions Framework

If one wonders why Nivie immediately got judgement for restitution in Turkey, it might be worth pausing to refer to Nivie’s filing which briefly explains the differences in the restitution framework between the US and other countries like Turkey.

Strikingly, the US DOJ’s position is that seized assets from scams are to be forfeited to the US government, but victims can later petition for remission of their losses. In the US framework, when assets are forfeited, the court will have awarded all rights to the assets to the US government. All prior rights to the assets by any claimants, including criminals, victims and all other past owners, are immaterial and over. So, it will be up to the DOJ to decide how much any one scam victim deserves back, based on nothing but feelings, legally speaking. It also gets to decide how much to absorb, for administrative costs (the US has a lot of bills to pay). There are no hard rules, no mandated formulas, no transparent accounting for who gets how much. This is why Nivie’s Motion for a neutral custodian was filed simultaneously, to not have a conflicted party adjudicating among victim claims AND its own interests.

To recount, Nivie was a US victim of a sophisticated, transnational organized crime. She did her own investigations to pursue her losses. She initially collaborated with US law enforcement (LE) agents, up to a point in early 2023 when they told her her assets are irrecoverable.

But her own investigations and research showed otherwise, and she persisted in recovering her stolen assets. Her findings led her to a money-laundering nexus in Turkish territory, where she hence initiated a civil, then criminal, cases against persons named Ling Sun Dylon and Kai Li Kelly. Her findings and evidence were communicated to US LE, but they took no action on account of hers or other scam victims of this money laundering syndicate. Instead, as is painfully common for US scam victims, US LE told her that her assets are all gone; all active investigations into her case have been ended because recovery is impossible. (Where US law enforcement think their jurisdiction ends with virtual assets and non-US exchanges is hard to fathom.)

Ironically however, her Turkish fraud case stemming from the same evidence set proceeded, and state prosecutors of Turkey took extreme interest in the criminal network Nivie’s case revealed. Soon the Turkish court awarded Nivie a judgement for immediate return of her assets. Her suit became the first domino to fall in the unraveling of this syndicate in Turkey. Not only money mules were arrested; Nivie was the lead prosecution witness against the founding members and managers of this syndicate, since her investigation has directly led to them. In her recent filing, she recounted being called in to Turkey at least twice (in 2023 and 2025) to testify to her existence and the methods she used that eventually snared the criminal defendants.

The criminals used USDT with OKX and Binance accounts. OKX and Binance were both legally registered in Turkey, and so Turkish state actions in 2023 for this case affecting both exchanges prompted them to do their own verifications, freezes, and belated mandatory compliance reports (Suspicious Transaction Reports). The two exchanges were generally cooperative with their host country, a far contrast to Tether. Tether was ordered by the Turkish court in August 11, 2023 to immediately freeze the 0x82e wallet, to which Tether complied only belatedly 2 months later, after some 14M USDT have left.

It’s Hammer Time in the US

Meanwhile, pressure has been building up in the US against the giant offshore crypto companies, that by late October 2023, even pro-crypto US lawmakers Senator Cynthia Lummis and Representative French Hill wrote to the DOJ urging criminal investigations into Binance and Tether. A hammer drop by the mighty DOJ seemed imminent. It is the year of serial US government lawsuits against Binance, Coinbase, Terraform Labs, Do Kwon and Sam Bankman-Fried, in the wake of the FTX, Celsius and multimillion dollar crypto meltdowns.

Tether, which was notoriously uncooperative and recalcitrant to US government authority, did a 180 degree turn. Uncharacteristic of its entire history, Tether became very pliant to US. In a letter to US Congress dated November 16, 2023, Tether responded to Lummis & Hill that it had just voluntarily frozen on its own accord numerous wallets with USDT it says are linked to scams, about $70M. Three days later, Tether made a joint announcement with OKX about freezing 225M USDT. In December 15, 2023 they sent another letter about freezing more wallets and “onboarding” US Secret Service and the FBI. In one month, Tether became an arm of the US government.

Nivie would later discover in the 2025 DOJ seizure complaint that Tether included 0x82e in the Nov 20, 2023 “voluntary” freeze. What Tether didn’t say in their public pronouncements is that 0x82e and likely others Tether has *voluntarily frozen* have already been frozen in compliance to judicial orders (from Turkey). Worse, Nivie asserts that the US authorities knew of the existing Turkish cases on those assets and knew of Nivie’s investigative findings. (In fact, the US has already attributed to her tracing the successful seizure of other scam assets in another federal case in Colorado.) Nevertheless US authorities proceeded to compel Tether to burn and re-mint the USDT, destroying evidence in the process —her. It is not an overstatement to say that she is the evidence; her testimony and evidence for the Turkish criminal case was indispensable to the preservation of those USDT. Moneys were moving out of 0x82e before then. But because of Tether’s actions under US pressure, the legal link between the $225M and the victims, assets, and predicate crime became further removed. Simply put, US authorities scrubbed Nivie out of the picture, and now the US has no evidence to prove the criminality of the $225M.

Infiniweb has helpfully pointed out in its own Motion to Dismiss (the US DOJ forfeiture attempt) that the DOJ’s forfeiture filing reads like backward tracing to scam victims after the fact of the seizure (see my first post). And now the DOJ has to suffer settlement talks with Infiniweb. This is not the only time the US DOJ was called out for seemingly making up tracing assertions out of thin air. The US has had a history of “parallel construction” investigations where the US agents make up a clean, legal trail of evidence to present in court but information was actually known through illicit and sometimes illegal means — “fruits of the poisonous tree”. (See the questions around the US seizing of $15B Prince Group Chen Zhi BTC.)

They’re Not Friends (Everybody Lies)

Reading the Tether, OKX and DOJ press releases about the $225M USDT freeze in November 20, 2023 would have you believing that crypto investigations and seizures involving hundreds of wallet hops, 3 blockchains, 93 deposit addresses, 140+ OKX accounts, tracing through the layering, can be done in 3 days (starting Nov 16). Their narrative is, OKX and Tether proactively identified 140+ of its accounts used for laundering USDT. OKX and Tether randomly shared data with each other and then approached the US DOJ… to say that all these $225M must be from US scam victims, please come take it?

The US DOJ admits in its original forfeiture complaint (Statements 45 & 50) and in contemporary interviews that the US just started its investigations to those wallets after OKX and Tether contacted US authorities about it. The US was informed of the wallets first, have not identified them beforehand, and had to trace backwards to victims to create an investigation to justify titling the $225M to the US government.

TRM Labs, Coinbase and Chainalysis followed suit in claiming credit. To describe the herculean task that has to be involved, circa 2023, let us quote TRM Labs:

Victim funds were initially deposited into 93 known scam deposit addresses. From there, the funds were routed through multiple layers of intermediary wallets and laundering structures. These included repeated use of peel chains, structured hops, and cross-chain swaps designed to complicate tracing. The funds moved across Ethereum, Bitcoin, and TRON networks before consolidation into USDT.

Note that most of these victims are from 2022. Coinbase itself could only attribute a paltry $2.3 million of the loot to 130 of its US customers, and retroactively: “Between February 26–29, 2024, Coinbase and several other exchanges joined a joint investigative sprint with the USSS to identify scam victims, analyze onchain flows, and help build the case for seizure.”

In spite of, and especially because, there are no US warrants (only granted in 2025), both Tether and OKX normally would have to verify on their own each wallet to be frozen. Without scam victim reports, how did Tether and OKX get the information about the $225M wallets? If the investigation went backwards, where did Tether get the confidence to start by freezing those wallets in the first place?

Answer: They already knew. They had external confirmation on those wallets, and they were already frozen anyway.

What inspired them to “voluntarily” freeze them for the unprepared US LE, unprompted?

Answer: They were forced to.

OKX, Tether and the US DOJ are 3 organizations we know jive very well like Mexican chili oil on an Irishman’s potato salad. OKX and Tether were allergic to having anything to do with US government just a couple weeks before their joint announcement, and Tether was notoriously antagonistic to freezing any USDT.

The record will show (from Nivie’s filings) that Tether and OKX prioritizes protection of VIP customers, including scammers and money launderers:

1. For one, the Turkish court ordered an immediate seizure of wallets to Tether and Binance in August 11, 2023, but Tether complied with it only in October 11, 2023. (Turkish authorities were not impressed with the delay.)

2. OKX received investigative requests for certain wallets they administer in early August 2023. They fully cooperated with Turkish investigators, but Turkish prosecution noted that the Seychelles-incorporated OKX belatedly filed a reactive mandatory compliance report to its regulator in the Seychelles, after the Turkish order. There was never a proactive identification of fake identities on OKX platforms.

3. Finally, the following text is worth showing (Exhibit N, partial):

Context is in order:

In 2022, during the initial surge of “pig butchering scams”, a now-defunct scam victims organization called GASO had formed to support victims and provide structured intelligence to law enforcement, to help recover for victims assets lost to the scams. (I was a founding member.) GASO was working hand-in-glove with the FBI and Secret Service, to take in shell-shocked scam victims and provide US LE with clean, organized tracing data and scam compound information (perhaps more on this in future court filings). The above writer was Brian Bruce, then a GASO officer liaising with US law enforcement and an OKX contact, Blake Cohen.

Blake Cohen was then a young, idealistic American working as a new investigator for OKX in the US. He had initially offered GASO help in freezing and blacklisting OKX accounts reported or traced from scam victims.

The rant above shows that the OKX leadership was not happy with what Blake was doing when they got VIP complaints. They prohibited his further contact with GASO and by extension, with US LE:

This is the attitude and culture inside the OKX mothership, of which Blake was still an outsider then. He went radio silent after this, but later (improperly) claimed credit for the supposedly OKX-driven seizure.

The Devil is in the Details

What did OKX get in return for volunteering scam account information to the US without warrants? Nivie put forth a very tantalizing chain of succeeding events:

To spell out Nivie’s allegation, “lost” scam victim funds were used to pay the DOJ’s “criminal forfeitures” of these crypto exchange(s).

In February 24, 2025, the DOJ announced that OKX agreed to pay $504M in penalties for money laundering offenses. This sum are also to be applied as discounts in any possible future fines from CFTC. $84M of the total was the criminal fine, calculated from the base fine of $187M, multiplied by the minimum multiplier (0.6), minus a 25% discount for cooperation since early 2024.

The rest of the fine —$420M— was criminal forfeiture to the US government. There was no formula basis stated for how $420M was arrived at in OKX’s plea agreement, and seems quite random. How do we know that these are still OKX’s corporate moneys and not from accounts already frozen and informed to be criminal e.g., from scams?

And what inspired Tether to send over $225M? Coincidentally with Tether’s letter to US Congress, the Binance plea agreement to pay an unprecedented $4.3B was also announced on November 20, 2023. The days leading up to this was already abuzz with anticipation of Binance’ impending deal with the DOJ. While $1.8B portion of the fine was explained as the amount in trading fees illegally collected by Binance from US customers over the years, $2.5B was simply criminal forfeiture. (Possibly more on this in the future.)

Where Binance ultimately sourced those funds to pay the billions will only be known to it, but Binance is an even bigger destination of scammed cryptocurrencies than OKX ever was.

The LIFO Forfeiture Machine

Regarding how the government uses victim information to construct ownership, Nivie raises a very troubling injustice (Document 79, page 18), especially as what eventually happened with the GASO victim data reporting pipeline: the government uses the Last-In-First-Out (LIFO) method of accounting when tracing cryptocurrency (and only for cryptocurrency), which mathematically destroys victim claims while preserving the maximum amount for forfeiture to the government.

LIFO was originally an inventory management principle where the last item stored is the first to be retrieved. The most recently produced items are the ones sold first, lowering inventory costs if earlier items cost lower (e.g. for tax purposes). When applied to crypto tracing, funds entering a crypto wallet last is counted as the first amounts leaving it.

While quick and direct, when used over series of mixing, commingling, splitting and other layering methods to launder money, LIFO will produce results where funds of the original reporting victims will be considered to have been lost and scattered, while the government will have new “tainted” moneys of vague criminal provenance to forfeit, in the final wallets frozen. The DOJ then uses the LIFO tracing results to disqualify scam victim claimants. LIFO is a “victim-exclusion mechanism”.

LIFO is just one among many accounting methods (FIFO, Pro Rata, etc.), but LIFO is widely recognizes as the one that produces the most inequitable results in trust law, insolvency, banking regulation, etc. In fact LIFO is prohibited in banking and in international accounting standards. The FBI manual itself doesn’t instruct using LIFO for tracing bank wire frauds —LIFO is only for crypto. There is no legal or judicial basis for choosing LIFO over other methods.

LIFO deserves its own long post. Here, Digital Defenders Group (DDG) excellently summarizes the problematic history, inherent inequity and dearth of legal basis for LIFO.

The practice of LIFO is made all the more concerning when it is further embedded into the crypto forfeiture architecture by US government contractors. Crypto analytics companies Chainalysis and TRM Labs promulgate LIFO, train US LE agents in it, and hire the top ex-LE agents versed in their methods. The DOJ Asset Forfeiture Fund —where forfeited criminal assets go— is not well known, but it is used to pay government contractors that provide operational and technical support. To quote DDG:

“The result: a closed loop in which the companies that profit from government contracts define the methodology that secures those contracts”

The Legal Side of the Scams Recovery Industry (A Preview)

The revolving door and conflicts of interest are seen also with US ex-DOJ Attorneys working on these fraud forfeiture cases. Nivie called out the most egregious example, the triple-conflicted ex-DOJ Attorney Dan Boyle, who is representing 118 victim claimants to the seized $225M in this case.

However, Boyle also represents Chen Zhi of the fraud factory/human trafficking-associated Prince Group conglomerate, fighting to keep the seized BTC for Chen Zhi in the concurrent $15B BTC forfeiture case (Case#3 in my last post).

Southeast Asian crypto fraud factories are connected in nested, transnational money laundering networks, and the fact is, “pig butchering” scam victims can be parties in any of the cases against the Prince Group entities, like Infiniweb.

See also: The Chen Zhi Paradox in the DDG website

Nivie’s investigation made explicit that Infiniweb and Prince Group are simply the same criminal entity. The directors and owners of Infiniweb park their other companies in Prince Group “hotels” owned by Chen Zhi, in Cambodia (Exhibit M). In a criminal syndicate, money leaks upwards.

Atty. Boyle is playing both sides of essentially the same case: for scam victims in one court, and its accused perpetrator in another. (Nivie has also pointed out that all pig butchering scam forfeitures are related and ripe for consolidation.) Atty. Boyle should know, as he was the US Attorney (AUSA) in the seizure warrants in 2022 stemming from related scam wallets reported from GASO (Case#4 in my last post). Indeed, he is in the best position to have insider knowledge, to be able to shred DOJ forfeiture cases for those wallets; he knows first-hand how the bland DOJ forfeiture sausage was made.

While being able to argue both sides could make good lawyers, the conflict above is not akin to being prosecutor in one murder case and being defense counsel in another. Murders with different characters can understandably be totally unrelated, but this is not the case for the thousands of scams connected to a web of transnational companies operating fraud factories in Asia. Additionally, it is not usual for US law firms to specialize on both sides, and even the appearance of conflicting interests is not permitted in legal professional ethics.

No Deal

Relying merely on blockchain tracing does not substitute for real world investigations. Victim claimants with only tracing data could not overcome the DOJ’s position, which itself is heavily dependent on tracing on its LIFO terms.

The lack of evidence, as well as conflicts of interest, could explain why enterprising lawyers for victim claimant groups could easily acquiesce to a settlement where criminals get the bulk of the $225M while also giving up of their clients’ rights to the assets. It was to be in exchange for backdoor priority for their clients on the remissions list for the remaining amounts, after discretionary costs. Signing off the assets to Infiniweb and accepting the flawed remissions framework will compound injustice to their clients. Remissions always result in pennies-on-the-dollar, and there is no legal recourse for petitioners as their rights have been extinguished. (But the lawyers still get paid, many upfront.) The quick and dirty deal is often not the most equitable nor in their clients’ best interest.

Nivie opposed the deal and asked for a Preliminary Injunction and for a trial. No doubt, Infiniweb is a criminal front. Investigations revealed in Nivie’s filings made headway on the real nature of Infiniweb (more than the DOJ ever did).

POGO licenses are thin legal covers for fraud factories, but POGOs like Infiniweb still has to be registered with Philippine Amusement and Gaming Corporation (PAGCOR), according Philippine regulations at the time. However, Infiniweb has never incorporated with the Philippines’ SEC, which was also a requirement for POGOs (Exhibit K - note the SEC certification would say if a company has ever registered and is now deregistered; the other similar-named companies are unrelated to gaming). Interestingly also, Infiniweb’s PAGCOR-listed address does not exist.

As such, Infiniweb never had a legal operation in its supposed home, let alone lawful income to justify claiming all $225M. Exhibit M further shows Infiniweb in the context of a Prince Group ecosystem. This still a subset of a bigger network.

Knowingly giving any part of the stolen $225M back to Infiniweb to avoid legal exposure is bordering unethical, and the DOJ was about to give most of it back to Infiniweb quietly. There are bigger implications that just this revictimization.

IF the settlement was allowed by the court, Infiniweb now gets to legally keep that bullion, because it will become a court-sanctioned settlement. Infiniweb can hence show to banks, regulators, and financial institutions around the world that its money is clean. Look, the US court approved it. That is judicial money laundering. This also creates a precedent for other forfeiture cases like the ~$15B Prince Group case, where the US also struggling to prove the criminality of the 127k BTC it wants to forfeit.

sdfkjbcsa;oifjdsogSfkjbxlkj

Subscribe now

******************************************************

Here comes a new blog post of The Coin Dryer, after a couple years of hiatus, with a bit of change in focus. Still on pig butchering scams and cryptocurrencies, but from another angle. Still the same genre.

******************************************************************************

The Conventional Wisdom

Here’s the way most people imagine things go for when one gets scammed in the US.

You report to the police. They open a case and investigate. The police track your stolen assets to the perpetrator and get a warrant to arrest him. The scammer gets tried in court and, upon getting convicted, gets his ill-gotten proceeds forfeited. After all is said and done, the court awards you your defrauded asset back.

Let’s try again, with modern elements.

You get scammed talking to someone online for a lot of money —crypto or bank wires. Unfortunately, it’s the notorious pig butchering scam, where your “lover” is someone chained in the KK Park casino city in Myanmar, where his fake investment website was made in the Philippines, and where your crypto assets got sent into the blockchain abyss, ending up in a wallet held by someone with a recently-acquired Cyprus citizenship.

You go to the police and get a police report. You report to the FBI, making an entry at the Internet Crime Complaint Center, ic3.gov. You send an email also to the Secret Service at CryptoFraud@usss.dhs.gov. You might even report to the US Federal Trade Commission.

Ideally, any of the law enforcement agencies opens a case, does an investigation, and with luck, freezes the crypto assets in time. With a lot of luck, it’s the elite Regional Enforcement Allied Computer Team (REACT) that takes the investigative lead and gets a warrant immediately to seize your funds.

Theoretically, law enforcement arrests a perpetrator or whoever is caught holding the bag, and proceeds with criminal proceedings. The government then argues in open court that the scammer is a scammer, likely using your testimonies and reports as evidence. A criminal trial runs its course, the scammer gets convicted, and the court awards the scammer’s forfeited assets to their rightful owner, you.

Let’s try again, being realistic.

Being the typical pig butchering scam case, US law enforcement is not able to arrest the perpetrators. Almost all of them and their conspirators are overseas. But it is able to seize fiat money and crypto assets here and there. To date in Mar 2026, assets seized by the US government under the aegis of stopping the so-called pig butchering scams has amounted to —without exaggerating— billions of dollars.

Without a defendant to try and legally deprive ill-gotten wealth from, what to do? The US government initiates a civil forfeiture proceeding in rem. Fancy legalese that somewhat means, to try the property itself, like it is a person. That is, government prosecutors will try to argue the criminal nature of the seized assets in a civil proceeding, in order for the court to award and title the seized assets in the US government’s name.

But it is not a criminal proceeding, and so the burden of proof is much lower. This is where problems arise. For one, think of all the black-box tracing solutions, arbitrary accounting methodology, and opaque attribution of address labeling sold to the government for its use by cryptocurrency analytics firms.

Also, does the government notify the owners that the government has custody of their asset and that it is getting forfeited? As part of a fair forfeiture proceeding, the government is required to give all potential owners ample opportunity to explain why they should not be deprived of their property. That is, for legitimate innocent owners to contest the proceedings that would forever title the asset in the US government’s name, be it cash, a car, gold bars, or cryptocurrency.

That US authorities have been unlawfully, unjustifiably, or unreasonably seizing and taking private property for itself, using civil forfeitures, at the expense of innocent owners not charged of any crime, has been a long-running, well-known problem tackled by libertarian nonprofit Institute for Justice. They document plenty of cases of abuse of civil forfeiture by US state and federal governments. It can only get worse with digital assets.

Unfortunately, the following is what typically happens to the multi-million/billion dollar seizures linked to pig butchering scams. There are big press releases by the US DOJ. The immediate owners of the frozen accounts, i.e. the last people caught holding the bag, comes out of the woodwork and hire prestigious US law firms to fight the forfeiture. Not having been convicted or even accused of any crime, they contest the seizure and forfeiture in US courts, as is very well their US 4th and 5th Amendment rights. In elegant filings, they argue quite forcefully of the hollowness of the US government’s entitlement to the seized property.

CASE #1: The Vanuatu Connection

The US government seized and alleges that about $1.6 million USDT and ETC were illicitly obtained and traceable to victims of scam platforms massusa.com and directedgebro.com (though not showing the work). The Binance account they were seized from belongs to a Vanuatuan citizen with a really Chinese-sounding name, Haiqiang Lu, after moving through two Malaysian-owned accounts.

Through Hongkong and Arizonan lawyers, Haiqiang Lu protested what in his view are insufficiently justified seizures, claiming to be an innocent buyer of those cryptocurrencies. In so many pages of court filings, he accuses the US government of failing to give due process, which invalidates the whole forfeiture. The US authorities never notified him the account owner, ignored his emails until far along the forfeiture process, and ghosted him.

In a country that prides itself in rule of law, everyone has the right to be heard, including the accused. It appears the court found this behavior by the US government concerning enough to not immediately grant the government’s prayer for forfeiture, and so the case is still ongoing today, for 3 years already.

CASE #2: Tether’s Victory Lap

Remember the monumental $225M in USDT frozen in Nov 2023 thanks to the sudden “collaboration” of Tether and OKX with the US Secret Service (USSS)? The government filed for its forfeiture only much, much later, in June 2025. Those USDT apparently belonged to InfiniWeb, a self-professed gaming and wagering company. From open source searches by the USSS agent affiant, Infiniweb operates in the Philippines and elsewhere in Asia, but is registered in the British Virgin Islands.

As it turns out, there was no warrant whatsoever for seizing that USDT bullion. Rather, Tether did a “proactive and voluntary” freeze of all of $225 million within 3 weeks of getting contacted by USSS and shortly after public pressure by US lawmakers for the DOJ to go after Tether. In fact, InfiniWeb says the warrant was made only retroactively, more than a 1.5 years after the US government has already seized the funds. And even then, the retroactive (!) warrant could only partially justify seizures of less than half of the wallets targeted.

Infiniweb maintains that even if those funds have been tainted (a point of dispute) long before it gained possession of those, it is an innocent owner. Its potential offense and criminality are also not the subjects being litigated. There is no criminal charge against Infiniweb; it argues that money laundering charges are being misapplied, with only flimsy and insufficient evidence at that.

Mere crypto tracing doesn’t prove criminality nor say anything about intent, which is true. The government’s original warrant application was trafficking in innuendos. Infiniweb complains as well that the USSS was being duplicitous and flaky also in its communications with it.

Read how Infiniweb’s ex-DOJ lawyers deliver a smackdown and school the DOJ on US money laundering statutes. Their message is a tour de force on the history and application of US money laundering statutes, if only who the messenger is isn’t so troubling.

Troublingly, the court has given enough credence to Infiniweb’s arguments. It seems even the DOJ has recognized Infiniweb’s standing as some owner of the $225M who can challenge the forfeiture. Other claimants as well have entered the forfeiture fight (more on this later). By March 2026, all these claimants and the DOJ went into active settlement negotiations. That the DOJ had to agree to negotiate says a lot about the inherent weakness of its case for civil forfeiture.

CASE #3 The Chen Zhi Paradox

You should have heard of the ~$15B worth of Bitcoins seized by the US government, which linked it to pig butchering scams by way of their owner Chen Zhi of Prince Group. In October 2025 the US unsealed a criminal indictment against its chairman Chen Zhi. The US and UK in addition jointly sanctioned the Prince Group, along with the notorious Huoine Group, for being hubs of scams and money laundering. Indeed, Prince Group has long been a notorious Chinese-Cambodian conglomerate that reportedly owns and operates many massive fraud factories in Cambodia that continues to fleece people around the world.

Right of the bat, questions swirled around how the US government was able to acquire that ~127,000 BTC. You see, this motherlode of a seizure hasn’t been shown by anyone to really be laundered pig butchering scam money. It is apparently from the rewards of Bitcoin mining and other sources way back from 2019, and then stolen in 2020 under mysterious circumstances. This is all before pig butchering scams started becoming a thing outside China in late 2021 (I would know when pig butchering scam cases started in the US, because I started that unfortunate English term).

Beijing-affiliated cybercrime and cybersecurity research center CVERC published a detailed technical analysis (original) and basically accused the US of state-sponsored thievery. It demonstrated that the 127k BTC under forfeiture now is the very same one hacked from the now-defunct LuBian Bitcoin mining pool. The 127k BTC was dormant for 4 years until a case of “thieves falling out”, and the BTC loot got moved to US government wallets in 2024. Is this another warrantless seizure? It doesn’t bode well at all if the US couldn’t explain how it acquired the BTC.

See: Coindesk | China Accuses U.S. of Stealing 127K BTC in High-Profile Crypto Hack

Naturally, the Prince Group behemoth fights back in US courts. Aside from pointing out the chronological impossibility of these Bitcoins stolen in 2020 being the same ones from pig butchering scam cases post-2020, they needled the refusal of the US government to explain the progeny of the Bitcoins in question and even the sloppiness of the DOJ forfeiture complaint. Random photos, like one from an old Mongolian news site, were added in the DOJ’s main forfeiture complaint. (The photo had no connection at all to human trafficking in Cambodian fraud factories. See: Questions swirl around US plans for record $15B Prince Group crypto seizure - ICIJ)

To compound things, Beijing had thrown a giant wrench in the US government’s plans to digest the $15B worth of BTC. It had Chen Zhi arrested and extradited back to China, in amazingly short order —2 months— with perhaps some Cambodian arms twisted. Chen Zhi has long been wanted in China for fraud cases against Chinese citizens. There is now no physical way for Chen Zhi to be tried and get forfeited of his $15B BTC in a US criminal case. There are speculations by experts of the region’s geopolitics that this is a power play by China, to not let the US get that Bitcoin bullion from Chinese citizens so easily. It would also rather not have its (the CCP’s) “dirty laundry” air in open US courts.

You bet that like in Case #2 above, the DOJ civil forfeiture of the 127k BTC is destined to collapse, and the DOJ will be forced to negotiate away justice for scam victims, on the back of scam victims. Or worse, the court may decide that the ownership of the entire BTC loot has to revert to Prince Group. For a detailed analysis of the issues at play and implications for scam victims, turn to page The Chen Zhi Paradox in the Digital Defenders Group website.

CASE #4 Legacy Forfeitures

There are more examples of assets seized in the course of investigating pig butchering scams that are still in limbo. The US government is using civil forfeitures to get ownership title to all those frozen assets. Take for instance, about $163M currently being litigated in US courts in Michigan. It is a long overdue forfeiture proceeding of the ~$112M seized in early 2023 and linked to pig butchering scams (difference due to varying cryptocurrency prices).

Its original warrant mentions a victim’s group, Global Anti-Scam Organization. In those days warrants related to pig butchering scams treated GASO as an authority on pig butchering scams, but stopped short of acknowledging GASO as an investigation source. GASO was a group of pig butchering scam victims from 2020-2022, reaching to more than 3,000 individuals from around the world. At that time GASO worked hand in glove with US law enforcement agencies, with monthly meetings and weekly data uploads at various times. I would know, since I was an officer of this now-defunct organization, and saw fellow volunteers working day and night organizing scam victim data, rushing powerpoint slides, making sense of the Funnull and other scam networks, among other things, in hopes of speeding up the day victims get their money and life back.

Fast forward to 2026, and none of the victims we know of whose scam platform was stated in the original 2023 warrant, the resultant FBI advert, and the Michigan forfeiture complaint has been called for testimonies that could support the criminal origin of the seized $163M in cryptocurrencies.

Increasingly, it has been left for intrepid victims to find lawyers (or intrepid lawyers finding victims) to intervene and assert their ownership claim in court, before their assets get divvied up to government bureaucracy and its contractors. In all the above cases, many victims of pig butchering scams, as well as other parties, have come to court to fight for their claim.

However, the official DOJ position, revealed in the $225M case, has been that victims have already forfeited their rights to their moneys when giving it away to scammers, and that victims have no more legal connection to the seized cryptocurrencies. Victims also do not have the specific evidence tying their case to the assets in question, never mind that most US government filings on those assets themselves lack specifics until recently, and unless forced to. (Never mind also the black-box tracing, imperfect attribution tags and arbitrary accounting methods.)

It also does not help allay fears of US victims of being revictimized by their own government that the vaunted US Strategic Bitcoin Reserve is supposed to be funded from asset forfeitures. As everybody knows, the US government has much, much bills to pay.

Questions swirl around US plans for record $15B Prince Group crypto seizure - ICIJ

Now Here Comes N.K.

The figurative conference table where the DOJ, Infiniweb, and other claimants hash out their differences for settlement must have flipped over when, on March 17, 2026, a scam victim, Nivie Kaul, filed a verified claim on the biggest wallet in the seized USDT pool. In 10 pages of sworn testimony, she flips over the conventional narrative of how the USSS found and compelled Tether to freeze an unprecedented $225M —all in under a month—and whether Tether’s freeze was truly voluntary.

Briefly, she details how her investigations into her own scam led to the unraveling of a criminal financing nexus in Turkey and the arrest of ~70 conspirators, including the owner of the wallets in question. This involved physical participation in criminal court proceedings and lengthy questioning by Turkish prosecutors, judge and opposing lawyers. An interim outcome was that of the Turkish courts ordering the “freezing” of the Tether wallets involved in criminal proceedings. This was after Tether arbitrarily refused to comply with a civil order earlier, per its supposed policy of complying only in criminal cases. (Rich, given that Tether complies with US civil forfeitures.)

The events in Turkey predated the joint announcement of Tether, OKX and US Secret Service on the $225M freezing by months. Around those months in early 2023 Nivie Kaul has also been actively communicating, reporting and exhorting US law enforcement agents all details and findings about her case, the same agents who are then later credited in press releases, to great acclaim, for the good job they did in finding and getting Tether and OKX together to freeze all $225M.

See: New claim disputes facts of US landmark crypto seizure - Compliance Corylated

…………………………..

So why is her verified claim a big deal, aside from belying the government narrative? Because if accepted, it would supersede the claims of all the other parties. It can stop the forfeiture until her claim is resolved. It can stop Infiniweb, the next strongest claimant, setting up the space for equitable return of ALL assets to their rightful owners —the scam victims.

Setting aside whether foreign judgements have bearing in US courts, we can see that Nivie has the material information to succeed in a criminal trial that entitles her to those assets, a bar the US itself could not or did not bother to meet in its civil forfeitures of pig butchering scam victim assets. In making her claim, Nivie doesn’t merely have asset traces of her scam’s links to the cryptocurrencies in question. She has a bona fide criminal case that pinpoints an actor to a crime, which had justified a conviction and a forfeiture of those assets.

What is the Big Deal in All These?

The US government’s use of civil forfeitures in these instances are leading to awkward situations where it is forced to settle or even disgorge assets back to shady actors. Its weak, tortured cases are easily challenged by well-resourced “innocent” owners. Even if the US government succeeds in fighting off the challenge, victims lose in the opaque, discretionary remissions process —another can of worms.

Couple this with the DOJ’s inscrutable policy of not acknowledging scam victims as having legitimate ownership stake in the seized assets. Instead, victims’ claims are all being rejected outright. The DOJ would rather not involve the very victims of those scams themselves in the forfeiture proceedings. In court filings, the DOJ considers victims of those scams as general unsecured creditors — last in line, paid only after all secured creditors, priority creditors, administrative expenses and lawyers, and with NO rights to any specific assets (Thomas Reuters).

Imagine you got misled into lending your car to a fraudster who drove it away, never to return it. You report to police, and maybe even help the police narrow its whereabouts. The police finds your vehicle, but once they put their hands on it, it doesn’t belong to you anymore. Your car title means nothing. You have no more rights to it. You are now a ‘general unsecured creditor’, to be compensated for that car at their whim, if at all. Your compensation will simply be another agenda item competing for priority in their general funds.

The Institute for Justice has been advocating for the abolishing civil forfeiture as a tool for US government, to end its abuse, misuse, and overuse. Victims of cryptocurrency scams lose too much under the current modality. Civil forfeitures might be a potent tool to disrupt and deter drug and gang crimes, but it is patently inimical to the interests of victims of large-scale criminal frauds. Do victims have to first trade away their rights as owners of the crypto asset to then, maybe, probably, get something back as discretionary “restitutions”?

For the government, seizing assets has already disrupted and deprived fraudsters the fruits of their crime. Criminals can get frustrated and deterred. The public has been served by the very action of freezing assets. Does the government still have to insist on owning the frozen crypto for itself first, or can it step aside and sincerely give scam victims a real opportunity to prove their ownership of their stolen assets?

These real-life cases hopefully demonstrate to you that US victims of pig butchering scams have no real pathway to be made whole in the US. One should see from all these cases the Kafkaesque impossibility of getting back one’s defrauded assets from the US government. As seen in Nivie’s case, she did all her civic duty to report, cooperated fully, jumped through all the legal hoops, and yet is still being denied her claim to assets inexplicably held by the US government.

**********************

The significance of Nivie’s recent filing is that it cuts through the US government’s position on the standing of scam victims as unsecured creditors. The DOJ cannot easily dismiss her claim outright because she presents a criminal actor and a (foreign) conviction that can invalidate Infiniweb’s claim to the $225M. Making her still a ‘general unsecured creditor’ will be peak absurdity when she has a judicial lien on those assets, and when it was her actions in pursuit of her assets that were responsible for their freezing in the first place.

**********************

As it is now, scam victims will have to roll up their sleeves and step up in asserting their rights as the rightful owners. They need to save their assets from being disbursed and negotiated away. Nivie Kaul is also the founder of Digital Defenders Group (DDG), a US non-profit whose sole mission is to make scam victims whole by pursuing their assets anywhere in the world, wherever those may be, in a legal and equitable way. DDG is looking for more scam victims to join and participate for free in upcoming lawsuits it is planning, and to get a real shot at recovery.

For everyone, follow here or DDG LinkedIn for future updates. There are many, many more worms in the can to unpack.

a.kdslicwmfljrdg;kdsajfLSAKNGFLKDAJG;OIE

Outline for Part 2:

Decentralization is the Word

DEXsters

Decentralization in Practice

• The BTC bridge

• Matchmaking is done on their servers

• They choose their market makers and offerings

• Voting through a “DAO”

• Non-public relayers

• Functions only through an app

The Word, Again

A Personal Eulogy

***

Decentralization is the Word

Almost every time someone or some organization says that their thing is ‘decentralized’, they likely mean that their thing is spread out to so many computers around the world, such that it is impossible for them to control their thing, and that they cannot control who uses their thing. Therefore, they cannot be responsible for bad actors using their thing. What a wonderful thing! If so. You might notice though that they still have to continue supporting it for the thing to work at all, and that they are still developing, investing, and even profiting from it.

In decentralized finance a.k.a DeFi, financial services are ideally automated without any third-party intermediary. Exchanging assets, sending payments, borrowing, derivatives, insurance, etc. can arguably be completely automated by using freely accessible programs on the blockchain network. Under this conception, the people who push such blockchain programs out into the network are mere software developers writing code and not providing financial services.

However, upon closer examination, the people behind many so-called decentralized blockchains, tools, and blockchains aren’t quite limited to just writing code.

Take for example Tron (blockchain), a payment network covered in a previous post.

Take for example Tornado Cash (tool), whose developers are alleged to not just be writing code but also conspired to run a business based on their creation (as anonymous relayers or “privacy enhancers”)1.

Take now for example Tokenlon (exchange). This will be an exercise in peeling off claims of decentralization.

DEXters

Decentralized Exchanges, or DEXs, run on smart contracts to execute trades directly between users, or more precisely, between wallet addresses. This means that users maintain custody of assets at all times; his asset was swapped in situ. Supposedly, no third-party entity temporarily holds or takes custody of the assets to be traded. Normally, any such entities would have been obligated by society to check their customers’ identities (Know-Your-Customer or KYC mandates) and stop the furtherance of any crime, being in such positions of trust and power.

DEX swaps are pseudonymous since no personal information or off-chain metadata is exchanged. In decentralized finance, the only KYC info needed is one’s wallet address. This fact really makes DEXs attractive to people avoiding KYC and in need of exchange services, like turning BTC and ETH into good-as-cash USDT. It is somewhat doubtful that it’s the “un-banked” masses with no acceptable IDs that are forming the bulk of legitimate demand for swapping cryptocurrencies on exchanges.

Should it be surprising that pig butchering scammers use DEXs like Tokenlon so much? Along with the convenience and utility, there is no need to give out personal information to use of Tokenlon. Meanwhile PBS victims and investigators who approach Tokenlon for help are invariably met with unhelpful responses. The refrain by Tokenlon is that they are a decentralized exchange or DEX and that they do not take custody of funds, so they cannot help.

When Tokenlon say they are decentralized, they imply, among other things, that they do not need to ask for KYC, because such requirements are inapplicable to DEXs like them.

Decentralization in Practice

If being decentralized is a spectrum, Tokenlon is quite far from being one. Tokenlon isn’t quite decentralized for at least six reasons that anyone can see, to be explained: 1) they operated a custodial BTC bridge, 2) matchmaking is done on their servers, 3) they choose their market makers and trading pairs, 4) its governance is concentrated, 5) they use private relayers, and 6) Tokenlon is almost only used through the wallet app by the ImToken company.

1)      BTC bridge

While Tokenlon swaps on the Ethereum blockchain are non-custodial, i.e. Tokenlon does not hold user Ethereum assets, this is not true for their bridging service for converting Bitcoin into an Ethereum blockchain token. The BTC of users are sent to an address controlled by Tokenlon, which then issues to the user’s ImToken wallet the corresponding amount of imBTC (Tokenlon’s tokenized version of BTC on the Ethereum blockchain).

In most pig butchering scam cases where victims sent BTC, the BTC is immediately transferred to 3JMjHDTJjKPnrvS7DycPAgYcA6HrHRk8UG, which is Tokenlon’s BTC-imBTC bridge address. Many victims and investigators in the past had difficulties tracing where assets go next after BTC reaches this address.

According to Tokenlon’s instructions, up to 20 BTC (depending on spot price, $400,000 to over $1 million) can be converted into Ethereum tokens (imBTC) without triggering manual review by Tokenlon.

This BTC cross-chain service was suddenly curtailed for retail users with only 1 week notice in August 2023 and permanently ended by early 2024. Interestingly, such a momentous decision was undertaken without voting by the Tokenlon “DAO”2. Perhaps coincidentally, it came on the heels of the August 2023 news that Singaporean police arrested 10 ethnic Chinese suspects for laundering, by final tally, $2.8 billion in Singapore.

2) Matchmaking is done on Tokenlon servers

DEXs have been likened to automatic vending machines on the blockchain, where one can for example put ETH in to get USDT back out. It is doubtful however that a distributed vending machine analogy fits Tokenlon’s “automated over-the-counter desk” / matchmaking platform. Matchmaking in Tokenlon’s system3 is done off the blockchain and inside its servers i.e., not decentralized, even if final settlement of trades is done on-chain, i.e., decentralized.

Tokenlon brings buy/sell orders into their servers to find counterparties for their customers. This almost makes Tokenlon no different from competing centralized exchanges and information brokers that intermediate trades, except for the holding of assets. However, even though many other exchanges’ employees use computers and software, they don’t call themselves fully automated and “decentralized”.

One could imagine that taking Tokenlon’s servers off would stop its efficient matchmaking from functioning. Would it slow down if anti-money laundering controls were put?

Tokenlon is better called an aggregator, though with few select market makers (for definition, see next). Contrast this to the prototypical decentralized exchange, Uniswap, which runs on an “automated market maker (AMM) model”: only blockchain programs maintain the “liquidity pools” that users of Uniswap DEX trade with. Anyone can freely contribute assets to that liquidity pool in return for earning some of the trading fees. All of that is on-chain.

Note that I say ‘blockchain programs’ to mean ‘smart contracts’, and that I use ‘liquidity providers’ and ‘market makers’ interchangeably.

3) Tokenlon chooses its market makers and trading pairs

Market makers are independent players on exchanges that provide liquidity to traded assets, by being the always-available counterparty to trades. (Liquidity refers to the ease of trading an asset without affecting its market price, because lots of it are available.) Exchanges would be very sluggish without market makers, since not all end buyers and sellers of given assets may be available at all times at various price points. Hence while exchanges historically serve as physical meeting spaces for traders, market makers connect traders across time. Market makers often also trade on multiple other exchanges. They arbitrage and profit from the differences in market prices across time and place.

As seen in that Tokenlon Server, two figures above, Tokenlon facilitates user trading with an unknown but limited number of market makers. Aside from Uniswap, Sushi Swap and Curve Finance, Tokenlon does not disclose who the other market makers are. Interested market makers will have to contact Tokenlon and be onboarded, as in their technical documentation. Is having market makers apply first to the Tokenlon team done for quality control? That is Tokenlon gatekeeping the privilege of who gets to market-make on Tokenlon.

One can see in an early Tokenlon interface that some market makers are centralized exchanges themselves, like Binance and KuCoin.

As an aside: If one traces a lot of Tokenlon trades in pig butchering scams or looks at its top counterparties, one will see just a handful of trading firms, big and small, who are market-making on Tokenlon and supplying all the USDT, at tens of billions.

Now normally, market makers on traditional exchanges also have to have some KYC checks on their counterparties, to not inadvertently trade with a money launderer and clean the launderer’s money. Well, on the blockchain, one can literally see big-name trading firms from US, UK, Singapore or Hongkong directly taking in stolen victim funds from pig butchering scammers and cleaning it for them, via Tokenlon.

One has to wonder that with the one-way demand for billions of USDT that each of these trading firms are giving away to a small, unknown exchange in Asia, if they ever wondered why. They certainly have the budget for due diligence.

Along these lines, only a few cryptocurrency trading pairs are available on Tokenlon, partly because of who the market makers are on Tokenlon. Certainly, what trading pairs gets listed on Tokenlon is under Tokenlon’s control. The initial trading pairs on Tokenlon were curated by the Tokenlon team, and later pairs were added by Tokenlon upon DAO voting results. The DAO finally voted to delegate listing of pairs to the team following approved criteria.

4) Tokenlon Decentralized Autonomous Organization is tiny, and some members are whales

Notably, only a tiny, tiny fraction of all Tokenlon governance token holders —the Tokenlon DAO— participate in the voting of 40 Tokenlon Improvement Proposals to date. They averaged less than 80 voters per proposal. In any case, all DAO proposals have to be proposed, and decisions had to be implemented, by the Tokenlon team. Otherwise, they remain as mere opinion polls.

And some voters are whales (own disproportionate amounts of Tokenlon governance tokens, or shares) that makes them have the real say. They must be early investors, supporters and market makers known to the Tokenlon team.

5) Tokenlon has non-public relayers

Just briefly, relayers are used by blockchain protocol developers to subsidize gas fees for users of the protocol, to help promote it. Relayers pay for user gas fees to help successful trades. Like Tokenlon market makers, relayers are reimbursed from Tokenlon’s trading fees, as shown in the tokenomics model of LON below, affirmed and supplemented later by small DAO votes (36 participants). The tokenomics of Tokenlon will not be discussed here, but their own diagram is below.

If relayers are necessary for Tokenlon’s operation, there is no visible way for members of the public to become one of its relayers. Likely, current relayers are also parties known to Tokenlon, if not the Tokenlon team itself. It is also not apparent how anyone would want to be a Tokenlon relayer if there were no financial rewards.

6) Tokenlon functions only through ImToken.

The need for a centrally hosted website or app interface is a common counter to decentralization of DeFi protocols, including of Uniswap. It is possible, with enough technical proficiency, to directly call a protocol’s smart contracts on the public blockchain and bypass the centrally hosted website. However, this presents a high enough barrier for most crypto users that, in practice, virtually everyone uses pre-existing solutions.

Tokenlon does maintain a public interface that is accessible from other cryptocurrency wallet browsers. But using Tokenlon only makes sense through the ImToken app. The ImToken wallet app gives access to useful Tokenlon operations not available from outside the app, like: 1) the Bitcoin bridge service, as in above, and 2) the sending of swapped tokens to other wallet address, rather than back to the original address, as with most other (mainstream) crypto wallets.

Note: ImToken is a regular software development company. Its team maintains and regularly updates the features of their app, including the Tokenlon integration.

It is with these functions that scammers use to try to confuse crypto tracers, as crypto would go through a series of smart contracts and market makers. They even appear to sometimes even ‘wash’ their crypto back and forth by swapping it into various ETH tokens, ETH, imBTC, DAI, wETH, etc, to finally USDT, through Tokenlon.

The Word

Tokenlon is far from being popular and is just one of among more than 250 DEXs existing at this point, but it is disproportionately used pig butchering scams since 2021 and on, likely because of ImToken. Much of these are old news by now, as other blockchain investigators have earlier called out Tokenlon and its market makers / USDT suppliers (here and here). But the abuse of the term ‘decentralized’ as a regulatory shield still needs to be called out and hammered again and again, especially in nascent financial regulatory regimes in Asia.

Recently, other DEX developers physically operating in Southeast Asia (though officially incorporated in elsewhere offshore) have been used in pig butchering scams, like SWFT AllChain Swaps.

Crypto platforms have to balance minimizing criminal use while making their services customer-friendly. Unfortunately, many claim decentralization seemingly to absolve themselves from obligations and liabilities. Various regulatory bodies around the world have long taken positions that DeFi projects are not exempted just by name. There is a need to clarify what counts as decentralized and what ought to be expected from services that claim to be DeFi, to prevent them from becoming natural havens for criminality. Consider the billions demonstrably laundered through Tokenlon, enriching it and its market makers, as an example of an undesirable result of a DeFi experiment and a logical outgrowth of exempting DEXs from all regulations on what essentially is a traditional financial activity.

(Singaporean authorities hopefully have noticed. The Monetary Authority of Singapore had put the ImToken company on its investor alert list for lack of regulatory licenses, and have rolled out amendments to its Payment Services Act regulating money transmitters to include cross-border crypto transmitters.)

As seen with Tokenlon, the narrative that regulations are inapplicable to DeFi should be critically examined, as decentralization often ends up being a façade. Pig butchering scammers are using Tokenlon and other DEXs not because they are decentralized, but because they are unregulated.

***

Part 3 in this series should have been this, which probably went over many people’s heads the first time. Perhaps now it’s more understandable:

***

A Personal Eulogy

I’d like to put in here a personal eulogy of a fighter against crypto scams and pig butchering scam syndicates, who everyone should know: Miffy Chen. The world shockingly lost this hero.

She was really just beginning, yet she has already done so much-- in cracking crypto cases, raising awareness of scams, and repatriating and helping human trafficking victims of cyber-scam syndicates reintegrate back in Taiwan, almost all on her dime!

During our time with a nonprofit, GASO, back in 2022, Miffy was instrumental in preparing, explaining and successfully pushing lawmakers in Taiwan to budget resources for police departments to have cryptocurrency training and tools, as well as with helping judicial authorities there understand cryptocurrency cases. Taiwan, maybe even longer and more so that others, has been facing increasing numbers of pig butchering scam cases. Who knew that she just had a biology degree and background in the nonprofit sector (Justice Reform Foundation), prior to being a self-taught crypto investigator?

Her shocking loss was just too sudden, unexpected, and undeserved. Here’s an article
Crypto expert’s death to be investigated - Taipei Times

Below is a fuller accounting of her accomplishments in Chinese, as revealed now by another friend: 「反詐女王」陳梅慧國道喪命！　反詐組織成員嘆：台灣配不上她 ("Anti-fraud Queen" Chen Meihui died on the national road! Members of the anti-fraud organization laments: Taiwan is not worthy of her).

Share

A Multi-Billion Dollar Crypto Scams Economy

Pig Butchering Scammers— Why Tokenlon?

Does Anyone Use Tokenlon, Outside of Pig Butchering Scams?

Because ImToken?

Who is Tokenlon/ImToken?

Conclusion I

Crypto is Money

BTC (Bitcoin) is money. ETH (Ethereum) is money. In sprawling casino cities of Southeast Asia, digital tokens of USDT (USD Tether) are as good as paper USD. In fact, USDT had become the common currency for cross-border “trade” there —including of humans and drugs.

It stands to reason, then, that firms that facilitate crypto-to-crypto transactions are treated as money changers and transmitters, which carry some social expectation that they not also facilitate criminality. Many governments now are trying to clarify those expectations and develop regulations for crypto companies.

However, there is an ongoing, raging confusion over whether developers of “decentralized” crypto services are mere software developers or actual financial service providers.

We’ll look into the case of crypto companies serving the pig butchering scam industry.

A Multi-Billion Dollar Crypto Scams Economy

Last year, I and a colleague Raymond Hantho of Chainbrium, did a study tracing as many pig butchering scam cases as we can, everything we can find from 2020 to 2023. It was an attempt to quantify and show the massive scale of pig butchering scams going on, with hard blockchain data coming from ~7,000 real reported scam addresses.

Our data was used in a study showing that at least $75 billion has been laundered through cryptocurrency by criminal entities and activities associated with pig butchering scammers. (The study is by University of Austin researchers Kevin Mei and Prof. John Griffin, of the Bitcoin-market-manipulation-by-USDT theory.) My own estimate of pig butchering scams with Chainbrium, counting our own way, got to about the same magnitude, at ~$45 billion. In any case, the numbers are very likely still not comprehensive enough, for reasons I explained in a past issue ($75B Crypto in Pig Butchering is Not “F*cking Absurd”, Actually).

*****

Our findings on the massive amounts of crypto involved in the pig butchering scam industry got covered in TIME and Bloomberg reports, and the shocking numbers reported by Mei & Griffin were immediately —and rabidly— slammed by hard cryptocurrency supporters (example). All their criticisms have been addressed in my previous post, too:

In fact, later on, just this year, leading blockchain intelligence firms reported that, since 2021, $49B has flowed through a notorious crypto marketplace catering to the pig butchering scam industry. The marketplace is administered by a Cambodian financial conglomerate Huoine Pay tied to Cambodia’s ruling family.

We’re all seeing the same big blob on the blockchain.

*****

With that as background, this post will go into the other big findings in our study— the enablers of all that scammed crypto.

Pig Butchering Scammers— Why Tokenlon?

Crypto stolen in pig butchering scams ultimately end up in a crypto exchange, for cashing out into real fiat money. We see the big Chinese-origin exchanges like Binance, Huobi and OKX are the common cash-out points for Chinese scammers, which is not that surprising.

Binance was the biggest baddie exchange by far, and it paid much dearly for that. Its regulatory troubles, multibillion-dollar fines, and brief jailing of its founder-CEO Changpeng Zhao have been covered extensively by mainstream media, so Binance won’t be covered here.

The more interesting surprise was how much a little-known “decentralized” exchange* called Tokenlon is involved in pig butchering scams. By some accounts1, close to a billion USD worth of BTC tainted by pig butchering scams went to Tokenlon’s Bitcoin bridge address 3JMjHDT(…)2, which could be around 20-50% of its total BTC transaction values, depending on the price of Bitcoin. When including ETH and USDT, scam-tainted crypto going to Tokenlon amounted to $5.2B, or over 40% of Tokenlon’s real trading volume of ~$13B3 by 2023.

For context, having even 1% illicit transactions detectable is alarmingly high for any major financial institution. Even by standards of crypto exchanges, US-sanctioned Garantex, considered among the worst money laundering crypto exchange, has merely 30% of its volume traceable to criminal activities, according to Chainalysis.

********

(*What a “decentralized exchange” is will be in Part 2 of this post.)

********

Pig butchering scammers often use Tokenlon to convert BTC or ETH into USDT, which is as good as cash where they are, as mentioned earlier. No need to go to a centralized exchange like Binance to cash out. Indeed, Tokenlon has long been the signature move of pig butchering scams, for law enforcement and private sector analysts (See: The Prevalence of Sha Zhu Pan AKA Pig Butchering Scams by Paul Sibenik).

BELOW: Pie chart of the first known entities hit when bulk tracing ~7,000 pig butchering scam crypto addresses (see our original report for more of the methodology). Binance and Tokenlon at 41% and 29%, respectively.

BELOW: Scammed money is flowing from crypto exchanges on the left to those on the right, and most passing first through Tokenlon, with a few through Uniswap, another “decentralized” exchange. (Fig 1 of Griffin & Mei, 2024)

Additionally, from crypto addresses we got from scam company workers and Telegram channels, we saw that Tokenlon is widely used in that industry for their quick swapping needs. Reportedly Chinese scam bosses in Myanmar used ImToken wallets to store and send their cryptos when it is too risky to use banks.

Does Anyone Use Tokenlon, Outside of Pig Butchering Scams?

Tokenlon has only a miniscule market share among decentralized exchanges. From its inception to the end of 2023, Tokenlon has less than 0.5% of all decentralized exchange daily trading volumes and is only the 30th in size among decentralized exchanges (source: CoinGecko.com). Tokenlon is far down the list.

Month-by-month trading volume on Tokenlon cratered since a surge in mid-2021 to barely $500M in the next 2 years (see below). But, we know that pig butchering scams were just ramping up in 2021... One can take this to as mean that pig butchering scams were becoming a bigger and bigger proportion of Tokenlon’s trading volume and sustaining its business.

Given that Tokenlon sees relatively little usage, why is Tokenlon used so much by pig butchering scammers?

Because ImToken?

Likely, one major reason pig butchering scammers often use Tokenlon has to do with the ImToken Wallet app. Tokenlon is part of the ImToken app and is the ImToken’s default crypto exchange.

Tokenlon in the ImToken app has a couple of special functions that are helpful for pig butchering scammers:

One is Tokenlon’s Bitcoin bridge or “wrapping” service that exchanges Bitcoins into Ethereum tokens. Since Bitcoin and Ethereum are entirely different blockchain networks that cannot communicate with each other, scammers use Tokenlon’s Bitcoin bridge to “chain-hop”4 and convert BTC ultimately into USDT, which is highly liquid and readily acceptable in their illicit economy, i.e. as good as digital US dollar cash.

Two is that Tokenlon inside ImToken allows users to send their swapped tokens to another crypto address while doing the coin swap, instead of going back to their original wallet address. In most (Western) wallet apps, swapping crypto almost always means a crypto asset stays in your wallet at all times, and the tokens are atomically swapped in place without leaving your wallet. In Tokenlon, kicking off the swapped token to another address complicates crypto tracing a bit, as you would have to trace through a series of smart contracts (blockchain programs).

The two functions in ImToken are useful for early crypto launderers, since most BTC-ETH bridge exchanges keep custody of the BTC or ETH and require KYC information of the user, and of course launderers won’t want to give their info. Also, most other decentralized exchanges only send tokens back to the original sender address, which doesn’t add more to crypto tracing.

*******

A third potential reason scammers use Tokenlon: to hide their money trail, as just alluded above. That is what they think they’re doing, at least, and anecdotally, that is what one former human trafficking victim/forced scammer swore to me as to what they use Tokenlon for — to frustrate crypto tracing. Indeed, crypto tracing becomes confusing for many amateur crypto tracers and law enforcement, once crypto enters through a series of Tokenlon smart contracts.

It is even thought that pig butchering scammers also keep swapping with Tokenlon first, before cashing out in a centralized exchange like Binance, to also defeat automated anti-money laundering controls at those cash-out exchanges that only look a few hops backwards for suspicious sources. Maybe doing Tokenlon swaps has developed into a kind of superstition for pig butchering scammers…

Who is Tokenlon/ImToken?

According to its founding story, Tokenlon was incubated within the ImToken company, which develops the eponymous ImToken cryptocurrency wallet app. ImToken was founded in Hangzhou, China in 2017 by serial tech founder and self-taught programmer Ben He (何斌). During a crypto crackdown in China, ImToken relocated to crypto-friendly Singapore around in 2019/2020.

Tokenlon was originally the in-house crypto exchange inside the ImToken app, so that ImToken users do not have to send their cryptocurrencies outside to swap. But in 2019, ImToken announced to have spun off Tokenlon to become a separate entity from ImToken, presumably as a legal firewall, because Tokenlon exchange is already doing regulated financial activities— unregulated. While ImToken, Ltd incorporated as a tech company in Singapore, doing “development of software and applications, (except games and cybersecurity”, Tokenlon was housed under another entity called Digital Era Global, Ltd., in a Carribean offshore haven, in the British Virgin Islands5.

Though, for all intents and purposes, ImToken and Tokenlon are still the same people, same teams, same employees, based on their many public appearances, pronouncements, and online presences.

Tokenlon launched its native token (think ‘equity stocks’) with much fanfare in late 2020, giving it away to tens of thousands of accounts6. It made a big promotional campaign especially among Chinese speakers. The ImToken wallet app was indeed popular7 then among Chinese-speakers for its intuitive, Chinese-language interface, unlike other many early popular crypto wallets app that have no Chinese language mode or had clunky Chinese.

The earliest case of a pig butchering scam involving Tokenlon was in February 2021.

Conclusion I

ImToken is far, far from the only “Decentralized Finance” crypto company in Singapore that puts for its business purpose “development of software…”. It is just one example among multitudes.

For the convenience and utility of cashing out BTC or other kinds of crypto into USDT, there is no need to give personal information to avail oneself of Tokenlon’s exchange services, as is required in any traditional money exchange. PBS victims and investigators who approach Tokenlon for help are invariably met with unhelpful responses.  The refrain by Tokenlon is that they are a decentralized exchange and that they do not take custody of funds.

When Tokenlon say they are decentralized, they imply, among other things, that they do not need to ask for KYC, because such requirements are inapplicable to decentralized exchanges like them.

Really?

Up next: Money Changers that Front as Tech Companies, Part 2

.o fijsfljdsngo;sijf’saijg;oingk;jrgkdhgs

Leave a comment

Share the whole The Coin Dryer series:

Share The Coin Dryer

***************

What has over $64 billion USD running within it; is run by 27 computers; was founded by someone who has ran away from US and Chinese authorities; allows one to run off with millions of dollars instantly and cheaply to anywhere; and earns investors 20-40% interest annually?

Would you want to invest in it?

Investing in Tron can be actually quite profitable — if one is willing to overlook that scammed, stolen, extorted, and sanctioned moneys could be 50% or more of its business. See Part 1 and Part 2.

This is Part 3 of 3. This might be the longest installment, so here’s the punchline upfront:

To become the high-speed, low-cost payment network for USDT, the Tron blockchain is run by a few, specialized and interconnected operators. These Tron operators don’t check illegal and criminal activities on their service, since they claim Tron is “decentralized”. On close examination, Tron’s decentralization seems less a matter of technical fact, but rather, a matter of muddying who’s making money and avoiding any accountability.

For sure, Tron is far from the only crypto project that claims that normal diligence around money transfers could not apply to them. Some people argue that all crypto experiments are just schemes to outwit regulators and law enforcement. In any case, USDT-Tron is certainly the biggest unregulated payment network in Asia right now.

Here, this post will try to disentangle, demystify and de-jargonize the decentralization talk of Tron and try to follow the money. Nothing will be proven here, since nailing down all the details requires more time, tools and legwork. This is more of a roadmap, and maybe at the end of the money trail there will be a rainbow.

Much of these aren’t news to people in crypto, but who probably haven’t considered Tron at this detail.

OUTLINE:

How Ethereum & Tron Makes Money

How to Make More Money: Staking

• Form a Cartel

How to Make Even More Money: Energy Markets

Blockchains are Man-Made

• What’s Seen Cannot Be Unseen

HOW ETHEREUM & TRON MAKES MONEY

People running blockchains make money not just from their ETH or TRX rising in value. One way of making money from blockchains is by becoming one of its transaction validator (“miner” for Bitcoin and the like). As a refresher, I’m paraphrasing my Thing Explainer-style primer about blockchains:

A public blockchain is like a shared spreadsheet or accounting ledger that always keeps track of who owns how much of what. Computers that update the spreadsheet constantly talk to each other, acting as nodes in a network. These nodes confirm or validate new batches of transactions and reach consensus with other nodes on what the shared spreadsheet says.

People running those computer nodes need to be compensated, preferably profit also, so that people are incentivized to help maintain this giant spreadsheet. Generally, blockchain validators earn rewards with:

(1) newly created cryptos native to that blockchain e.g., BTC in Bitcoin, ETH in Ethereum, TRX in Tron; and

(2) the transaction fees paid by users of the blockchain.

The precise mix of newly created crypto and user transaction fees getting rewarded to validators varies with different blockchains.

As a potential Tron investor who wants to earn real value, not just more of TRX tokens, you’d want to understand the business model deeper. Let’s take the Ethereum blockchain.

Running Ethereum nodes is the business of selling limited block space, i.e. the accounting entries that will be included in the next update i.e., transaction block. Node operators chase after the rewards coming from validating Ethereum transaction blocks. They then broadcast the validated transactions to other nodes.

Presumably, every node operator is an independent entrepreneur chasing after profits. And because of the clever ways the Bitcoin/Ethereum/Tron/etc. protocols work, all nodes working individually, even competitively, arrive at an agreement on the current transaction records on the giant spreadsheet.

The more nodes independently validating a transaction, the harder it is to make accounting lies on the giant spreadsheet. In fact, having more node operators is encouraged to prevent editing of the spreadsheet by any organization, authority, hacker, and other unilateral interventions. This reason is a part of why blockchains are called decentralized and “censorship-resistant” (!).

To join an open network as a validator, there is ideally no one to ask for permission from. Technically anyone can download the validation client software for free, start validating and make more money (crypto). With thousands of individual nodes (Ethereum currently has ~6,000 nodes, for example) distributed across continents, it’s virtually impossible for any one actor to manipulate or disable the Ethereum blockchain.

Does being a blockchain validator look like a sensible investment? One more point to add:

Software programs (a.k.a smart contracts) can also be built on blockchains like Ethereum , most commonly to automate financial stuff — like exchanging cryptos, tokenize stablecoins and memecoins, etc. For a little more detail how it works, see:

Validators push along the execution of these blockchain programs1, which costs more ‘gas’ fees to execute than simple ETH transfers. For example, whenever you send USDT stablecoins to someone, you actually execute the USDT software on the Ethereum blockchain to move the USDT, and therefore have to consume some of your ETH as ‘gas’. Mostly the same process goes for USDT on Tron.

Hence, blockchain programs like that of USDT stablecoins create a lot more demand and value for ETH. In the case of Tron, USDT very much makes the Tron Business exponentially more valuable, as in Part 1.

HOW TO MAKE MORE MONEY: STAKING

ETHEREUM

An additional way to make money on crypto is by Staking. It exists in so-called Proof-of-Stake blockchains like Ethereum. Basically, you lock or “stake” some amount of ETH to the Ethereum validation protocol and share in the validation rewards. The more ETH you stake, the higher your rewards.

Staking is another way to make money aside from being a validator, because in reality, running a node is not for everyone. No matter how much cheaper validating transaction blocks is supposed to be getting now2, doing it as a business proposition is still costly. Rigging up some exquisite computer server to run a node 24/7 to maximize profits is a very deliberate investment. The software clients are not welcoming to non-specialists; you’ll most probably end up just buying full-service Ethereum node packages from specialist vendors and/or rent some kind of cloud computing service. Furthermore, Ethereum validation requires some ETH staked, and 32 ETH is the minimum stake to start validating— around a US$84,000 minimum bet (2024 average).

Fortunately, you can delegate and pool your ETH staking with others in a way where you can still share in the validation rewards. Most ETH investors join cooperative pools like Rocket Pool and Lido to go over the 32 ETH threshold, or entrust their ETH to companies like Coinbase, all of whom takes care of all the details of staking and operating a node, for a small cut (management fees?).

ETH when staked directly gets locked up and is unusable often for weeks. But if you invested your ETH in staking pools, you get staked ETH tokens (stETH) in return3 to your crypto wallet. The stETH is like a certificate of deposit that digitally proves your claim to your staked ETH and its rewards, which should accrue automatically at a variable ~3% annual interest4.

Again, your passive income when validating/staking ETH comes from (1) newly created ETH as a reward, and (2) gas fees paid by ETH users for the processing of their transactions. This is aside from the price of your ETH itself. Your regular ETH is like an equity stake into the Ethereum Business5.

To note, those stETH tokens aren’t just for show in your crypto wallet. They can be traded, loaned and used as collateral in various blockchain programs and schemes, for even more income. It is as if your locked ETH is still liquid and usable. It’s why this is called “liquid staking”, and even “liquid re-staking” …

You could think that there is a real business generating validator & staking income— the business of securing the Ethereum blockchain and pushing ETH around. Well, as long as there are demand for those. The same goes for Tron income.

TRON

Many of these money-making setups in Ethereum were copied into Tron, just replace ‘ETH’ with ‘TRX’, and stETH with staked TRX, ‘sTRX’, above. Tron staking gives on average higher interest (~5%) than Ethereum staking (~3%).

If you have suspicions that Ethereum validation and staking are just monopolized in practice by a few big entities, in Tron it’s blatant. Tron has only 27 validator nodes, and Tron validation has more expensive computing requirements. sTRX is the only TRX staking pool that matters and is managed by JUST Foundation, or JUST “DAO”. There is almost only one sTRX lending operator that matters on Tron, JustLend — named after Justin Sun, naturally.

You already have hints from Part 1 where/who/what are all the activities generating the income for Tron.

Tron only has 27 validators?

Consensus validation on Tron is a little more interesting than Ethereum. You see, having to get validated by sooo many nodes all over the world, Ethereum transactions are quite slow and expensive (15 transactions per second), compared to, say, Visa’s payment network (24,000 to 65,000 transactions per second). Transaction costs can also get painfully high in times of Ethereum network congestion —which is almost all the time (~$70 to ~$200 USD at very peak times). Ethereum has been criticized as being too slow to be a global payments network since forever. Such is the trade-off with being decentralized.

FORM A CARTEL

To get fast, Justin Sun’s Tron deals with the slowness issue by reducing the number of nodes required to validate Tron transactions to a mere 27, and with so Tron transaction speeds reach up to ~2,000 per second. While there are a few thousand proclaimed Tron nodes, in Tron’s system called Delegated Proof-of-Stake nevermind, aspiring Tron validators first have to be voted by TRX stakers to become validators. Every six hours, the top 27 vote-getters become Tron “Super Representatives” (SR) that will get to validate all Tron transactions in that period6. They are the approved approvers of Tron transactions, if you will.

Why bother voting? Because validator nodes that become SRs can share to their voters a % cut of the validation rewards. As a potential Tron investor, you’d want to maximize your returns by voting for the Tron SRs that will bribe you with the biggest cut.

The more TRX you stake to the Tron protocol, the more votes you can have to give. If the node you vote for wins enough votes to become one of the SRs7, it will reward you in proportion to your contributed votes.

Some Tron node operators try to attract voters with cool plans for Tron development, but frankly, most TRX stakers don’t care. It all comes down to how much $$$ will you give me for my votes.

Predictably, the top SR Tron node operators promise to give away virtually 100% of their validation rewards to their voters, to stay on top as one of the top-voted SRs. Predictably, the big gets bigger, and the top 27 barely change day after day, month after month, as early as I have been checking on them since ~6 months ago. Someone can maybe make a tracker to look historically if the 27 incumbents ever change.

How can the SRs make a living then if they give away all their validation rewards?

They most likely own giant stakes of sTRX and vote for their own nodes. They hence earn by being one of the voters themselves. As to who they are, they include some of the usual suspects — Binance, OKX, some minor or lesser-known investment firms, and then Huobi (Justin Sun), Poloniex (Justin Sun), JUST Foundation (Justin Sun) and other suspected Justin Sun fronts.

Take the top-voted node operator Binance. Below is the list of Binance’s staking voters. The top 3 addresses making 95% of its voters are all Binance cold wallets.

The second-most voted node is Crypto Labs. Its majority voter and biggest beneficiary of validation rewards is the TRX Staking Pool, which is managed by the JUST Foundation… by Justin Sun. Same with #3 Poloniex (owned by Justin Sun), #4 TRONALLIANCE, #5 callmeSR, and #6 BlockAnalysis. (Huobi is somewhere further below.) Their biggest voter, single-handedly contributing >50% of vote share and rewards, is the JUST Foundation’s TRX Staking Pool8. If the 5 node operators have nothing to do with Justin Sun, it’ll be interesting to know if and how they convinced the JUST Foundation to put life-changing amounts of votes (7,705,739,014 votes) to the five of them.

Going down the list of SRs and looking at their list of voters, one will frequently see among their biggest Tron voters are the exchange wallets of Huobi, Poloniex, various suspect Justin Sun entities. I haven’t done this systematically and thoroughly, but it looks like a trend to me. And the way voting is proportioned within many individual SR nodes doesn’t look organic:

What does this all mean?

This looks like that the handful of the top Tron validator operators are also the biggest Tron stakers (investors), who are also the biggest Tron beneficiaries.

Capeesh? Wait, there’s more.

HOW TO MAKE EVEN MORE MONEY: ENERGY MARKETS

If this is already getting too long, please bear a little more. This is the part discussing how to get 20% - 40% more of guaranteed, consistent, passive income, which many US crypto investment analysts often miss with Tron.

While Ethereum needs ‘gas’ to run, Tron has 2 kinds of invented resource: ‘Bandwidth’ and ‘Energy’.

Tron Bandwidth is consumed for TRX withdrawals and for some minor state changes, like placing your votes on a node, or giving permissions to blockchain programs to your crypto wallet. Tron Energy is used for executing Tron software programs, like that for USDT stablecoin. Indeed, transferring any amount of USDT on Tron requires a lot of Energy.

Only when Bandwidth or Energy is used up would TRX be burned, at some equivalent ratio to the needed Bandwidth or Energy. Transaction fees in Tron is already cheaper than that in Ethereum, and using Tron Energy makes those instant transfers of hundreds to millions of USDT to anyone practically free.

So how do you get Bandwidth and Energy in Tron?

Primarily, by staking TRX.

Everyone who stakes TRX gets assigned Bandwidth and/or Energy, the amount depending on how much TRX they have locked9 for staking. Those are renewable Tron resources that are programmed to replenish every day.

But what if you don’t need to use your Bandwidth or Energy every day?

Here’s the real money-maker: You can rent and sell your Bandwidth/Energy to others.

There are thriving Tron energy ‘markets’ for renting Bandwidth or Energy, which is basically selling the rights to use someone’s Bandwidth/Energy temporarily. In those platforms, you can sell your Bandwidth/Energy or buy someone’s Bandwidth/Energy for 10 minutes, 5 hours, a week or 30 days, and so on. Energy rentals are paid for with TRX, and rental costs are dynamic, but it’s always much, much cheaper to rent Energy than to burn TRX straight up like gas fees. As a rule of thumb, renting Energy saves you 70% of TRX transaction costs.

Moreover, a few TRX staking pools and Energy rental platforms have spun up bots to automate leasing and rentals of staked TRX Energy, some which can earn you 20% - 40% more annually to your passive TRX staking income. That is on top of your Tron staking voting rewards. Tron energy rental bots take at least 30% sales commission —more than double the staking management rates in most other blockchains. The JUSTLend staking pool program by JUST Foundation seem to even take over 50%.

It’s Tron USDT transaction demand powering those incredibly high interest rates, and you should probably suspect by now who, how, where, and why the majority of that demand for energy is coming from10. (Again, in Part 1.) Heavy USDT users, like crypto exchanges and informal high-volume USDT merchants, will need hundreds of thousands to millions of Tron Energy points. (Executing one USDT transaction on Tron costs about 64,000 Energy points, equivalent to burning 13 - 27 TRX, or $2 - $5 USD.)

USDT merchants can save so much more in fees with this Tron Energy system, compared to, say, using the Ethereum blockchain11 or dealing with physical sacks of US dollars and bankers. And entities with the biggest stockpiles of staked TRX can generate so much income renting out excess Energy.

Who is delegating Tron Energy to who can be tracked on the blockchain, like on Arkham Intelligence and on TronScan under ‘Staking Details’ information tabs. With the right tools, perhaps there could be a systematic mapping of all the Energy sources and sinks in the Tron network over time. That might reveal more interesting relationships and amazing profit margins.

I have seen high-volume Tron wallets connected to pig butchering scams getting delegated energy by others. This could be an interesting way to find connections, similar to tracing ETH gas fees on Ethereum…

BLOCKCHAINS ARE MAN-MADE

Promoters of Tron12 maintain that Tron is decentralized. That is, the operators of the Tron infrastructure have no control and cannot control others’ use of Tron. That is, they cannot be responsible for (attracting) criminal use of Tron.

In response to the UN report saying that USDT on Tron has become “the preferred choice for [Asian] cyber fraud operations and money launderers”, Justin Sun hit back with “professional facts”: that in essence, that UN statement is wrongheaded since Tron is decentralized and happens to be very popular.

In furthering Tron’s ‘decentralization’, Justin Sun’s Tron Foundation declared itself in early 2022 to be officially, purely, a Decentralized Autonomous Organization (DAO), by which it means a stateless, virtual mass of pseudonymous TRX crypto holders who vote on its governance — which almost becomes laughable when you start wanting to do something actually useful, like hiring employees or signing contracts, or to find someone responsible (see: How to Sue A Decentralized Autonomous Organization).

In any case, Tron developer-investors still want to capture the maximum amount of profits from all activities on Tron. They continue promoting, expanding, and designing Tron into a tax-free money-making machine, which thrives on the perpetual demand for unregulated, cross-border, pseudonymous US dollar stablecoins. They are continually improving the product-market fit, so to speak.

Despite its size, Tron has the fewest active developers among major blockchains, a mere ~10 daily (see on TokenTerminal), meaning that Tron’s development is very likely concentrated to a handful of entities. As discussed, Tron also technically needs only 27 validators, whose relatively high computing requirements —and connections to whales— makes them somewhat a specialized and exclusive club.

Given their central role, well-capitalized operations, and profit margins between the vertically and horizontally integrated Tron conglomerates / DAOs … is it truly impossible to also deputize Tron node operators to have anti-money laundering controls?

There are ideas about having regulatory supervision embedded into blockchain technologies in a way that is technically feasible. It’s especially doable with Tron, I reckon. Reportedly, barriers to doing so more have to do with cultural mindset of the crypto community and also the regulators themselves than with technical feasibility. Simply put, if they want to, they can.

WHAT’S SEEN CANNOT BE UNSEEN

Tron recently partnered with both Tether and blockchain intelligence firm TRM Labs to form the T3 Financial Crime Unit, that, to quote Justin Sun: “sends a clear message that illicit activity is not welcome in our industry.” TRM Labs had previously publicized the report saying that biggest bulk of criminal crypto is on Tron.

I have 2 comments on this:

One, the Tron DAO certainly did not hold a public vote to let Justin Sun enter such an agreement. Likely because Justin Sun doesn’t actually need to ask the TRON DAO for consent about the big decisions concerning Tron. This is not the only time this happened.

Two, while the partnership is a good first step, it’s unclear what will be Tron’s contribution to this trifecta. Sharing technical knowledge and publishing sternly worded statements are good first steps, but would Tron (validators) be deputized soon to block scam and illicit transactions? Blacklists?

What about sanctions screening? For instance, consistently among the 10 top Energy-consuming programs (smart contracts) on Tron, aside from USDT and Justin Sun entities, are a US-sanctioned Iranian crypto exchange Nobitex and a curious Russian crypto gaming site. This Cryptocalypse post has more about how US-sanctioned Iranian entities are being allowed to use USDT by Tether.

Businesses that process money for others have obligations that governments impose, as a matter of public good or national security, especially if massive volumes are involved. Is it too convenient that the way Tron DAO found to facilitate high-speed, low-cost, no size limit transmission of US dollar credits at amazing profit margins is (still) decentralized and (therefore) exempt from those obligations? To law scholars, DAOs are “promising organizational innovations as long as they are not constructs for risk-taking without liability.”

What’s seen cannot be unseen. Would the tri-partnership make the 27 Tron SR nodes more liable now for money laundering? Actually, are they already liable for all the money laundering, illegal gambling, grifting, scamming, ransoming, smuggling, phishing, hacking, tax evasion, and human trafficking through USDT on Tron all this time?

**********

It’s fun to wonder about those questions, because ironically, 2 of the top 3 countries with the most (candidate) Tron nodes are in the US and China, both of which are either ban or block13 usage of Tron. See all Tron node locations and IP addresses here: https://tronscan.org/#/blockchain/nodes

Interestingly, many of the Tron nodes are in Cambodia, where the human trafficking & pig butchering crypto scam industry is state sanctioned and still expanding as of Nov 2024. Talk about short supply chains…

asdafgtagana;sdfogvni’aogj;odfgn;asj’oijfg;oasdijvuhgilrkljarefgroijarfgn

***********

Up next: 99% of Pig Butchering Scammers Use This Crypto Exchange. Here’s Why. (Part 1 of X)

Subscribe now

SECTION HEADERS:

Part 1 Addendum

“Decentralized Entertainment”

A Short History of Smuggling Billions On-chain

- Issue Here, Redeem There

- High Velocity Money

- The Rise of USDT on Tron is Tied to Burning

Pig Butchering in the Opposite Lane

Where Did SBF Get so Much Money?

- Bullshido Premium

- The Thing

- MOOONNNEEEYYY TTTIIIIMMMMEEEE

Shadow Central Bank

*********

ADDENDUM to Part 1/3

To people who haven’t seen, Part 1/3: What proportion of USD Tether on Tron is not criminal?

Fun Fact: To get a better idea where Tron users are, below is the popularity of the search term “波场”, the Chinese name for Tron, on Google, from 2020 onwards.

It’s not so surprising that the Chinese for Tron “波场” is most looked up in China, albeit a little funny since Google is blocked in China. But who knew there can be so many Chinese interested in Tron in Laos, Cambodia and Myanmar?

One can also go look up ‘USDT’, ‘Tether’ (Topic: Cryptocurrency), and ‘泰达‘ (Tether in Chinese) on Google Trends to see which countries those search terms are most popular on Google for the past 5 years. You might (not) be surprised again of the three top countries that is not China.

*********

How did Tron get so popular in Asia in the first place?

“Decentralized Entertainment”

Tron or TRX coin was first created by Justin Sun in 2017 with a stated goal of facilitating content creation, sharing and monetization of artists for their work. It would be a peer-to-peer network that cuts out the middlemen and be the ultimate entertainment content-sharing platform. This use case for Tron didn’t really fly, and so then in 2018 Tron became a full-fledged blockchain network marketed as the best blockchain for developing decentralized apps (programs on blockchains), just like Ethereum but better and faster. Its goal to outdo Ethereum is not really unique to Tron among all competing blockchain projects.

Nevertheless, to the crypto commentariat, Tron is a rather dull, uninteresting and mostly ignored copycat that is all about marketing. That is, unless the topic turns to Justin Sun or his many supposed shenanigans. I’m not going to recount them all here; instead, I’ll point readers to some of the greatest hits on Justin Sun:

• Justin Sun: Hype Man of the Century - The Verge

  “So these people would get on our [Tron] blockchain and scam. Scam all day, 24/7. It never ended,” a former employee said.

• Tron founder Justin Sun and his many escapes (theverge.com)

  “Justin’s tolerance for risk is absurdly high. Like, absurdly high.” [former employee]

• Justin Sun’s International Game of PR - Global Coin Research

  Without shame, he once announced publicly: “I measure the person by how much money he’s made.”

This is definitely not an exhaustive list of everything Justin Sun is (in)famous for; looking up ‘Justin Sun’ on Protos media will have plenty more. These characterizations of Justin Sun aren’t unique among crypto-preneurs, by the way, though some might say he’s the biggest bad-ass of them all.

A Short History of Smuggling Billions On-Chain

Honestly, what Tron became most successful for is being the cheaper and faster payment network for stablecoins like USDT. As early as April 2021 USDT circulating on the Tron network has surpassed USDT on Ethereum.

The following will be a short primer history of how billions of USD were smuggled on crypto through very grey areas. These were largely worked out by Jon Reiter of blockchain research firm ChainArgos in his blog series, by Protos media, and others hyperlinked here. I merely summarize and repackage information for new and non-followers of crypto.

Some basic jargons for those who don’t know:

Minting

Issuing or “minting” stablecoins means that someone gives real fiat money to a stablecoin issuer company, who then creates or “mints” stablecoins for the buyer. Stablecoin issuers like Tether control the stablecoin programs (i.e. smart contracts) for creating stablecoin tokens. Theoretically, they should only be issuing USDT on-chain that they have USD backing on hand in their dollar reserves.

Burning

The opposite process is redeeming stablecoins. That is, a redeemer returns his stablecoins to its issuer, who then destroys or “burns” the on-chain stablecoin tokens and gives the equivalent fiat money to the stablecoin redeemer. The total amount of circulating stablecoins on-chain should decrease to reflect the burned amount of stablecoins.1

• The important point here is that whenever there’s minting and burning, money is moving between different bank accounts somewhere.

Issue here, redeem there.

You can maybe see now how this mint/burn process can be abused for cross-border transfers. One can imagine a very simplified scenario:

Vivian is restricted from having USD or sending funds outside her country (e.g. China). Fortunately, her bank/fund manager has a way2 to credit money to the bank account of the stablecoin issuer (e.g. a Hongkong bank). The issuer, thus credited, mints an equivalent number of stablecoins for Vivian’s crypto wallet.

The stablecoin issuer’s bank conveniently has its headquarters in another country, maybe an offshore Carribean country. Or the stablecoin issuer even has a custodial entity with a trust company inside the USA. Our imaginary Vivian or her fund manager might redeem her stablecoins into real fiat USD in those places.

So in this way, at least in essence, Vivian could have moved her millions across borders. She might claim that the withdrawn money is from crypto trading or so. Maybe she played around with her stablecoins first by sending them to various wallets before redeeming to not make it so obvious, but it isn’t really necessary.

High Velocity Money

Every mint and burn of stablecoins is permanently recorded on the blockchain. ChainArgos analysis finds that there are a few wallets that receive newly minted tokens, only to pass them straight to a burn address for destruction. And that’s almost what all those wallets do and nothing else. Although seemingly pointless, it makes sense if minting and burning actions correspond to banks moving money or credit somewhere.

ChainArgos finds that such short, closed mint/burn cycles were happening on an industrial scale. For example, below is the total market cap over time of USD Paxos (USDP), issued by Paxos, a US company that did business with Chinese exchange Huobi.

Its market cap throughout this period barely went over $1B. But those flat portions don’t mean there’s no activity with USDP. In fact, Paxos wallets minted and burned over $5B in the time period shown. The total burned is ~5X its market cap, and its burn rate was ridiculously high; it was burning way more than >5% of its market cap every day, for many months on end. Simply, USDP customers were not using USDP as a store of value or for trading, but as a pass-through to somewhere. With lots of churning was going on, some banks must have been very, very busy. This is unbelievably high “velocity of money” for something that almost no one uses.

More eyebrow-raising is Huobi USD (HUSD) issued by Huobi, which is now admittedly owned by Justin Sun. HUSD market cap never strayed far from $250M, but Huobi has minted and burned a little over $10B HUSD before getting discontinued (40X burn-to-market cap ratio). Around this time at 2021 a Huobi Trust was incorporated in Nevada, to custody Huobi’s USD reserves and access the US banking system.

There are other little-known small-cap stablecoins like TUSD, mostly active between 2019 to 2021 (update3), that also had extremely high turnover ($8.9B minted and $8.5B burned on a mere constant $380M market cap). The biggest known minters of TUSD are, in order, FTX/Alameda and Justin Sun. TUSD’s custodial entities had associated with a Chinese conglomerate associated with Justin Sun.

The Rise of USDT on Tron is Tied to Burning

There are clues that stablecoins issued by certain Chinese-affiliated entities4 were burned to be converted ultimately into USDT on Tron, at scale.

ChainArgos shows that the burning of such ‘minor’ (little-known) stablecoins closely tracked the increase of USDT on Tron around until 2021, suggesting that the minor stablecoins were used to feed the growth of USDT on Tron. In comparison, their correlation with the rise of USDT on Ethereum is not as tight.

Combined Burning of ‘Asian’ Stablecoins vs. USDT on Ethereum vs. USDT on Tron

More convincing details in Jon Reiter’s original posts. Along with the fluctuations in USD cash reserves declared from public quarterly reports in the 3 or 4 banks dealing with crypto, these coincidences highly suggest that it is the same USD billions that went from the minor stablecoins to USD Tether on Tron. The minor stablecoins ended up becoming a highway to onboard/smuggle money into USDT (on Tron). It could also be that USDT on Tron soon replaced whatever functions the minor stablecoins were fulfilling before.

***

Pig Butchering on the Opposite Lane

Surprisingly, or not, pig butchering scams use the same payment rails, although seemingly in reverse, from US to Asia. (Actually, wouldn’t that money flow perfectly complement the theoretical imbalance in demand for real USD on one end?)

I might talk about it in detail in a future post. It’s just too rich. But to summarize, US Secret Service investigations beginning in 2023 unraveled a money laundering network from US to Cambodia. Basically, US pig butchering scam victims who used bank wires sent their money to dozens of shell companies that forwarded them to a New York bank account, which then “domestically” transferred all of those to a bank in the Bahamas. Not coincidentally, the Bahamian bank is Deltec Bank and Trust, most known now as the bank of Tether. In a curious way, it privately sold USDT on Tron to the pig butchering scam perpetrators. The Binance accounts receiving the USDT were controlled from Sihanoukville, Cambodia. About $80M of life savings from US victims were smuggled to Tron in this way.

Where Did SBF Get so Much Money?

Generally speaking, private individuals are not the ones directly, personally, getting issued and redeeming stablecoins5, but trading firms called market makers. We are talking about tens to hundreds of millions of US dollars’ worth of stablecoins getting issued and redeemed at a time. Retail crypto traders and users simply buy stablecoins on crypto exchanges. It is the market makers that sell those minted stablecoins on exchanges.

You may have heard already of one —infamous— market-making trading firm: Alameda Research, established by FTX Exchange founder and convicted grifter Sam Bankman-Fried.

This isn’t news, but Alameda Research was among the biggest market maker that bought and redeemed USDT. Actually, at that time, Alameda was the biggest buyer of USDT from Tether, and it was receiving practically all of those USDT on the Tron network. In its heydays around 2020-2022, Alameda Research was by far, by huge margins, the number one market maker that is pumping USDT to hungry Tron users. By its downfall in late 2022, Alameda Research/FTX Exchange was responsible for about $40B in USDT on Tron.

To this day (August 2024), no one else has broken Alameda Research’s record for the amount of USDT anyone has brought into Tron — wherever in the world Tron is used.

Additionally, ChainArgos CEO Jon Reiter in a Bloomberg reporting says that the USDT on Tron bought by Alameda or FTX weren’t really being used for normal trading expected of a trading firm. Rather, nearly all of Alameda’s USDT went to FTX customers and traders, more like a one-way USD-to-USDT money changer.

Where did Alameda Research get all the money to buy the billions of USDT on Tron?

Bullshido Premium

As SBF would like to tell publicly, Alameda Research got its early break in 2017/2018 milking the Bitcoin arbitrage in Japan or Korea (it’s really ambiguous which country), which is called the “Kimchi Premium”. He and his team of cowboys would profit off the price differences of Bitcoin and USD in and out of the currency-controlled Korean market. As SBF would have you picture it, they’d be on the edge of their computer chairs, jiggling their legs, constantly checking prices and bank accounts, clicking buy/sell Bitcoin as fast as they can, as soon as money hits their bank account on one shore or the other. Then rinse and repeat.

People really familiar with the Japanese or Korean bank culture call bullshit. Getting white, foreign, college-aged kids to open a bank account there and serve their needs in hauling millions of USD in and out the country sounded like bovine manure to them. In any case, South Korean regulators at the time found a mere $600M in illegal cryptocurrency foreign exchange. Not enough cow dung.

By the way, below is a LinkedIn ad in Korea from 2018:

Protos posit a theory where more Alameda funds came from — Sam Bankman-Fried got funded from Chinese capital flight. FTX got seed investment from a mysterious Chinese venture capital Redline DAO that boasts over a billion USD in funds under management. Maybe still not enough, but connections are what matters, right? Alameda Research didn’t headquarter in Hongkong for no reason.

Then there’s the well-publicized fact that in the early days of Alameda, long lines of people holding bags of cash would form to buy crypto from an over-the-counter trading desk, Genesis Block, which is partially owned by and shared some personnel with Alameda/FTX. Genesis Block ran an informal network of crypto exchanges and banks across Asia. As in the original FT report, “the business traded in places where other investors would not be confident, such as Cambodian peer-to-peer markets” (direct boast). It was additionally quite transparent on the blockchain that Genesis Block was a cash intake for Alameda Research/FTX.

The Thing

To illustrate even more the shadiness of SBF’s early sources of money, during his trial, his ex-confidante, ex-lover, and ex-Alameda Research CEO Caroline Ellisons tantalizingly recounted a $1B in crypto that in early 2021 got caught up in a Chinese money laundering investigation and frozen in Chinese crypto exchanges Huobi and OKX. After trying in turn to hiring mainland Chinese lawyers and Thai prostitutes to try getting their $1B out, they resorted to bribes to Chinese officials amounting to $150M. This explained an expense she cutely annotated in their rudimentary bookkeeping as the infamous “the thing?”.

What was the thing about? SBF was indicted by the FBI for alleged bribery of Chinese officials in 2021. In that same year, the Chinese government was conducting a sweeping crackdown of telecom and online fraudsters in the country, cracking 220,000 cases, arresting 296,000 suspects (twice the previous year), busting 6,800 smuggling gangs on the border with Myanmar, and averting more than $40B in financial losses (Xinhua reporting).

Unfortunately, the public might never know more what the whole thing was about, since the US DOJ shelved plans to try SBF on those charges. It would also have been an excellent opportunity for US and Chinese law enforcement to compare notes on issues of mutual concern6.

MOOONNNEEEYYY TTTIIIIMMMMEEEE

Indeed, a huge bulk of SBF’s billions was from FTX victim-customers.

SBF was convicted in November 2023, after a highly public trial in New York, on seven charges of fraud and conspiracy, after embezzling FTX customer deposits and lying about it. He lied where FTX customer money went and was being used for, which is to plug losses from reckless trades of Alameda Research.

Now in February 2024, a civil class action lawsuit came out from FTX victims against Deltec Bank, the bank of both FTX and Tether. It referred to 7,000 pages of chat logs from a Telegram group chat including senior FTX/Alameda and Deltec executives.

It gets good. Whenever an FTX customer wired in money for their FTX account, the Deputy CEO of Deltec Bank and Trust Gregory Pepin would scream different variations of “MONEY TIME”. Someone would then manually reconcile and update through a Google spreadsheet their account balances.

See:

More juicy excerpts on https://x.com/ZekeFaux/status/1759253220751229101. It gets too gratuitous. You might just have to see the rest of the lawsuit.

Aside from showing the intimate relationship between Alameda, Deltec, and Tether, the lawsuit is revealing here in the banks it mentions that are feeding moneys into FTX/Alameda accounts.

They are Silvergate Bank, Signature Bank, and Prime Trust. These names weren’t specified above, but they were the bank reports analyzed by ChainArgos as those custodying and processing Chinese-affiliated ‘minor’ stablecoins that seem to feed into USDT on Tron.

***

Shadow Central Bank

To think of it, USD achieved such high reach and liquidity in certain Southeast Asian countries thanks to Tether and Justin Sun’s Tron. And in an insight by ChainArgos, Sam Bankman-Fried and Tether, through Alameda’s dominance of the USDT mints and burns on Tron, became de facto a central bank / reserve currency manager of an Asian shadow payment network.

Let me rephrase:

SBF was by all accounts reckless, and all the “trading” he did with Alameda Research and FTX was unregulated. SBF actually ran a one-way USD to USDT exchange that supplied the almost $40B worth of USDT for a payment network largely used in the Southeast Asian scams and human trafficking industry. Much of the billions SBF used to supply USDT on Tron came from murky sources in East Asia, perhaps via other stablecoins, and certainly also from FTX customer deposits.

To think of it, there’s a high probability that any of the $52B in USDT coursing through the Tron blockchain today were originally FTX customer money. And the real dollars backing them could be in some Bahamian bank account (after all the layering). Given what we can tell of where USDT on Tron is being used, Sam Bankman-Fried could really qualify as the biggest pig butchering scammer.

****

aslkudnkFDOAIJFLINSdkjfbagf;A’FDSFMEWFO

Up Next:

Charting the Shadow US Dollar Network in Asia, Tron, Part 3 - How to make money moving others’ money on Tron. If something goes wrong, can you sue someone?

Part 2/3 here:

Part 3/3 here:

**********************************

In January 2024 the UN Office of Drugs and Crime called out cryptocurrency, specifically, USDT on Tron, for enabling the explosive growth of transnational organized crime in Southeast Asia, leading to the proliferation of scam sweatshops, fraud factories, casino cities, and mafia ministates.

Per UNODC":

USDT on the Tron blockchain has become a preferred choice for regional cyber fraud operations and money launderers alike due to its stability and the ease, anonymity, and low fees of its transactions

To be clear, USDT is a virtual currency that purports to represent US dollars, while Tron is a blockchain network. A refresher on what a blockchain is, if needed:

*********

Much attention then fell on the role of the Tether company in facilitating the Asian scams cottage industry and on Tether’s barely diplomatic response to the UN report. On the other hand, Tron ‘decentralized autonomous organization’ had a similarly colored response to the UN report, claiming that Tron is simply a decentralized network with no way of controlling how it is used.

While lots of controversies have been written about USD Tether, its untransparent backing and its role in illicit financing, it seems not as much has been said about Tron, perhaps because Tron is not really understood. Even crypto watchers find Tron to have many inexplicable things about it.

For one, why is Tron a big deal? Well one reason Tron is a big deal is because Tron’s founder and biggest booster Justin Sun says so.

In going into how “decentralized” Tron really is, it will be worth looking at how Tron is actually, currently, and almost exclusively used: as an unstoppable network for moving US dollar tokens cheaply. There will be 3 installments to this.

Part 1 is an exploration of what the Tron network is really used for. Whatever that is, Tether for sure owes much of its business to Tron.

Part 2 will look into past evidence of USD smuggling from greater China through Tron. Spoiler alert, the biggest character there may turn out to not (just) be Justin Sun, but the famous MIT alumni, Samuel Benjamin Bankman-Fried.

Part 3 will talk about how anyone can today make money from helping move others’ money on Tron. It’s not just from boring blockchain “staking”, but really raking in dough. And possibly, cui bono? (who benefits?)

INTRO

Tron is another blockchain network, just like its competitors the Bitcoin, Ethereum, Solana, and other “L1” blockchains. The value today of all its native currency in free circulation, TRX (pronounced “tronix”), is only a measly $12B compared to BTC ($1.2T) and ETH ($395B), ranking it only 12th in market cap among cryptocurrencies (coingecko.com). However, market capitalization doesn’t really say how valuable a blockchain is. Market cap is only one metric among many.

In terms of number of users (number of active wallets), Tron is by far the biggest blockchain. Tron just dwarfs everyone else, as below:

Tron has highest active users daily for the past 365 days, when averaged monthly.

For a blockchain that seemingly suggests such high number of daily users though, Tron has barely any mention in the English-speaking crypto world, and particularly not in the US, the country with the noisiest and richest crypto users. Except for Justin Sun’s marketing, there hasn’t been that much interesting developments with Tron.

So who and where are the millions of people supposedly using Tron? What is it being used for?

The US dollar is moved around on Tron in the form of USD Tether (USDT). Briefly, USDT are virtual tokens pegged one-to-one in value to USD and issued on Tron and other blockchains by the company Tether, which maintains their real USD backing. USDT enjoys the stability of the USD, hence called stable-coins, while being usable on-chain and without the attendant regulations for cross-border transfers and banking. One can theoretically redeem blockchain USDT for real US dollars from the Tether company.

Tron is essentially an alternative USD payment network, much more than any other blockchain. Consider that—

• More than half of all USDT minted today is on Tron

• 87% of the monetary value of assets on Tron network is just USDT, and much of the rest is also USD stablecoins and derivatives.

To illustrate—

There is More USDT on Tron than on Any Other Blockchain

As of July 2024, out of $114 billion total of USDT that has been issued by Tether to date, more than half is on the Tron network, or $58 billion.

Tron is really just USD, USD, USD, and nothing else.

Below is the total value of the top 10 tokens on Tron. One can see that $60B USDT simply towers over all other tokens on Tron. That is 87% of all that’s worth on Tron.

Note that the other top 10 (jUSDT, stUSDT) are just USDT derivatives, while USDD, jUSDD, TUSD and USDC are also USD stablecoins but by other companies.

(Note also that jBTC, BTT, USDD, jUSD, stUSDT, and jUSDD are all by Justin Sun companies. 🙃)

To further drive this point, below are topmost used projects on TRON:

From The DeFi Report:

When it comes to onchain activity on Tron there is Tether [USDT] ...and then there is, well, not much else. 92% of gas consumption on Tron comes from Tether

Elephant Tentacles in the Room

With supposedly millions of Tron USDT users (active addresses), where on earth are they? One cannot overemphasize how little Tron is mentioned in English-language crypto circles, news, blogs, podcasts, investment portfolios, analyses and commentary anywhere, despite Tron’s apparently gargantuan user base.

If you think there must be so many of them in Asia… you won’t be able to just casually find a random stall on the streets or in a public market in Asia that takes USDT-Tron like Visa or Alipay.

That is, unless you got to questionable places in Cambodia. In the book Number Go Up by Bloomberg journalist Zeke Faux, he finds USDT money changers in Cambodia clearly catering to the scamming cottage industry. In those, anyone can have USDT converted into cash without questions asked. Zeke even wrote about a badly-dressed customer that suspiciously looks like a scam compound boss walking out with bags of wads of cash.

There are many of those specialty USDT shops there.

Zeke happened to have shared with me the crypto addresses they told him to send USDT to— one Ethereum address 0x9D66839A4279C1dc12186D82a01E0B7655BfA6C4, and one Tron address TRVrv3GioupB7kCFN28pNgyCcFd3Dqs9fi

ETHEREUM vs TRON

You can go check yourself on Bitquery.io, but the Ethereum network address received at total of $3.7M until its owner stopped using it after nine months, while the Tron network address received $70.0M for 14 months and counting, to this day. The Tron address was also used much more frequently and had larger transactions.

While the USDT broker could have multiple Ethereum addresses and/or switched to another one, I think it’s evident that the Chinese scams industry prefer Tron a lot more than Ethereum.

Moving USDT is cheaper and faster in Tron than in Ethereum. It is for this reason that pig butchering scammers increasingly want USDT on TRON. Although, they could only induce scam victims in the US into sending USDT or USDC (another USD stablecoin) on the Ethereum network just because USDT-Tron and TRX, the native currency of Tron, are not so easily available in the US and most other “Western” countries.

It’s all Tron.

Very recently, UK-based crypto analytics firm Elliptic exposed the Cambodian financial conglomerate Huoine Pay, tied to the Cambodian prime minister’s family, for laundering at least $11B worth of USDT from pig butchering scams. (And that is just in one scam epicenter country.) A Hongkong-based crypto analytics firm Bitrace, which are longtime watchers of illicit crypto in Asia, shortly identified those Huoine crypto accounts as Tron network addresses. (Tron addresses start with a ‘T’, while Ethereum addresses start with ‘0x’).

Additionally, Bitrace found the Huoine business Tron addresses to have had billions of USDT in monthly volumes in two years. Totaling them adds up to $103 billion.

To note, the Tron address earlier from Zeke’s USDT changer does a lot of business with Huoine Pay. I’ll note here also, for later, that the money changer’s Ethereum address cashed out a lot on OKX Exchange.

Elsewhere, USDT sees heavy use in underground banking in China:

• Laundromats and VPNs: How China’s Crypto Traders Are Evading the Rules (WSJ)

• Chinese police bust $1.9B USDT underground banking racket

• Chinese traders among the biggest stablecoin holders

These reports didn’t mention, but it is almost for certain, that those USDTs are in the Tron network.

Smuggling money out of capital-controlled China is big business — $500B at a peak year. As discussed in my most popular post.

Tron is for ‘Gaming’

Tron is also closely associated with online gambling since its inception. In its earliest days, almost all Tron store apps were for gambling and gaming, and Tron was marketed to the gambling and ‘gaming’ industry. There are many websites for Tron casinos (tronbet.io, troncasinos.org, justbit, etc.) extolling the virtues of Tron, but let’s go to one Chinese offshore gambling website in Myanmar:

It accepts USDT from both Tron and Ethereum, but its Ethereum account address is practically collecting dust, while its Tron addresses has taken in $370k in 3 months. Additionally, the Tron address is an OKX Exchange deposit address(!)

In The Use of Cryptocurrency in Cybercrime report by Bitrace, it found that in two years between September 2021 and September 2023, a total of over $46.5B in USDT flowed into Tron addresses of “traditional” online gambling platforms (non-blockchain-based gambling).

The same report by Bitrace also surveyed money laundering, scams, phishing, thefts, arbitrage fraud, black custom profile/software-as-a-service, blockchain-based gambling, and other illicit or criminal activities in Chinese cyberspace. It included comparisons of illicit use of Tron vs Ethereum networks. Bitrace reports that:

• $17B in USDT went to illegal, 3rd party payment guarantors of black and “grey” market industries via Tron in one year (vs $670M USDT on Ethereum).

• $64B in USDT went to Tron addresses identified as laundering money between September 2021 to March 2023. See graph below:

Translated title: USDT Amounts Flowing into TRON Addresses with Money Laundering Risks

Bitrace comments that the inflows were relatively stable and aren’t affected by the large price swings from large events elsewhere in the crypto-verse (e.g. US Terra mega-meltdown in May 2022; the FTX bank run in Nov 2022). Hence, they reason that these TRON address activities weren’t from true crypto investors.

Money laundering is an all-season, all-weather business.

Bitrace rated Tron as “severely polluted” when compared to Ethereum:

• Over $41.5B in high-risk (dirty) USDT-Tron went to crypto exchanges between January 2021 to September 2023, comprising funds from online gambling, black and grey markets, and money laundering (vs $3.3B on Ethereum).

• Over $33.5B in high-risk USDT-Tron went to DeFi payment platforms mostly used in East and Southeast Asia in the same period (vs $7.04B on Ethereum)

• Suspected over the counter (OTC) broker addresses took in $3.5B in USDT-Tron

This rating on Tron was seconded by TRM Labs’ The Illicit Crypto Economy Report, which says that 45% of all crypto crime (that TRM counts) in 2023 occurred on the Tron blockchain. That is close to half of $35B in crypto crime that TRM Labs counted. As Bitrace and TRM labs could only be working on incomplete information, and given how conservative blockchain analytics companies are usually in estimating crime on-chain, the true rate of illicit activity on Tron is likely only to go up.

There is another major use case for USDT on TRON. In another Bitrace report, jointly made with Chinese blockchain analytics firm SlowMist, Bitrace analyzed a Tron address exposed as a payment address for human trafficking victims in northern Myanmar wanting freedom (from either Chinese police or scam compounds). The address took in $65M, mostly received within 2 months in late 2023. It is also connected to a cluster of almost 100 known Tron addresses tied to gambling, fraud, money laundering and other illicit activities

Tron is for What?

It is hard to sum up those tens of billions of USDT discussed above from the news and Bitrace reports ($46.5B, $17B, $64B, etc.) since there are probably some overlaps between their different estimates and recycling of funds, although Bitrace very clearly delineated the distinct categories for money laundering vs gambling vs others.

Nevertheless, the total amount of USDT on Tron is not that big. Just compare Bitrace’s money laundering chart above, to the chart below, at the equivalent time periods. (Note that one chart above does not yet include other illicit categories.)

TOTAL USDT ISSUED ON TRON, MONTH BY MONTH

Yes, we might be comparing apples to oranges (counting stock vs flow), but you can still probably appreciate how a chunky proportion of the total Tron dollar value is just for gambling, grifting, laundering, scamming, ransoming, smuggling, phishing, hacking, hiding money, and trafficking in one region of the world.

To spell it out, Tron is really big at moving around USD credit for people who can’t —or aren’t supposed to— get that USD.

******************************

Self-promotion: I had an essay published in a security weekly in the Philippines about crypto scam centers there: Authorities Must Look Into POGO Cryptocurrency. Here's What We Might Learn - SecurityMatters Magazine

******************************

Up next:

Tron Part 2/3 - What did Sam Bankman-Fried do? A history of smuggling billions on-chain.

o;idmxpehp9ewuf[uefiurngueangr’o

Note: Some brand names have been changed and anonymized.

DeFi - shorthand for Decentralized Finance, it refers to an aspirational vision of modern finance run in a decentralized manner and with no (human) intermediaries, because of the ability to automate transactions using computer programs, or smart contracts, on public blockchains.

Cryptocurrency - the scientific synthesis of the material dialectics of financial transparency versus privacy; an evolved mode of class struggle between the economic forces of the bourgeoisie state and the crypto-proletariat.

At least that’s what we’re made to think with what's happening in the US regarding some famous crypto anonymizers:

• Alleged founder of Bitcoin Fog convicted of money laundering (he is appealing)

• Large crypto advocacy non-profits helping defend the arrested developers of the US-sanctioned Tornado Cash

• Ethereum founder Vitalik Buterin sending $325,000 to and tweeting support for Railgun, labelled recently by analysts as a “prime alternative to Tornado Cash”

In any case, aside from these crypto privacy tools, there are still other things to be considered that are, in effect, used by bad actors to complicate cryptocurrency tracing. Consider that some cryptocurrency wallets offer functions that can and are being used to launder stolen cryptos — they’re less sexy than ‘anonymity sets’ or ‘zero-knowledge proofs’, they’re still traceable with extra effort and special tools, but they work well enough for most purposes of scammers of plain commoners.

Basics

As a primer, a crypto wallet is a software or app for managing (the private keys to) cryptocurrency addresses. For many crypto users, wallets mean self-custody wallets like mobile phone apps or a desktop extensions (e.g. Trust Wallet, Metamask). The owner has full control of his/her cryptos, as opposed to depositing at a centralized crypto exchange acting like a crypto bank.

More than just sending and receiving cryptos, crypto wallets allow users to directly interact with decentralized finance (DeFi) - decentralized exchanges, decentralized lending, etc. Ideally, this would be useful for things like automating payments, trading, lending, etc. — without intermediaries. It’s just you, your peers, and the immutable smart contract on the blockchain network.

When most users do cryptocurrency swaps like exchanging ETH to USDT through a “decentralized” exchange (DEX), swapped cryptocurrency are often described as never having left the crypto wallet but swapped in place by smart contracts. In many popular wallets, the built-in token swap function returns exchanged assets back to the same original sender address. So DEX swaps are conceived as “atomic” swaps because it either takes place or not at all, and there is no intermediate state where someone’s crypto is in limbo in the ether.

Wallet Abilities

So, that kind of swapping is not so useful to hide one’s tracks on the blockchain for whatever purpose. One should still easily see on free blockchain explorers the exchanged asset immediately going back to the same wallet in different form.

But there are wallets and DEXs that allow you to send the swapped tokens to another address. So it’s not just a swap, but also a transmission of assets to another address. Consider the originally Chinese-made TokiToki Wallet:

See also the Sundan DEX, accessible from any crypto wallet browser:

Still, tracing is not too hard if one knows to look at the notes section or the “internal transactions” of smart contracts the swapped cryptos are sent to. Usually, or hopefully, the final recipient address will be in there. Looking at the internal transaction / notes won’t be so obvious to new crypto users though, who might go on a wild goose chase tracing out of a smart contract address.

In any case, convoluted swapping are what scammers are using these wallets/DEXs for. That’s what they think they’re using it for, as I heard first-hand. Below are famous moves in pig butchering scams; this is how they use TokiToki and Sundan.

So far, the examples above are of token swaps in the same blockchain, in Ethereum.

TokiToki and Sundan DEX can also do cross-chain transfers. When swapping tokens across entirely different blockchains e.g., a cross-chain transfer from Bitcoin to Ethereum, the receiving address has to be supplied by the user or the multi-chain wallet. Because different blockchains can have entirely different computer languages, networks, and transaction histories, they can’t simply “talk” to each other with smart contracts. Assets have to go off-chain through… intermediaries.

(Are they custodial intermediaries that hold the swapped crypto in the original chain?Are they custodial intermediaries to hold the swapped crypto in the original chain and take a cut with transaction fees?)

It becomes a stretch to say that those DEXs are decentralized and not intermediating, and still not money service businesses. Where trading fee profits really accrue is a good question. Finally, even if one can trace cryptos through DEX smart contracts, is just being transparent on where the moneys go sufficient for regulations?

Well, their developers would probably say that they have no control over their DEX. In the goal of DeFi, the whole community of DEX token holders and users owns the protocol —and no one or everyone is responsible for it. As many crypto proponents might say, DEXs are only composed of immutable smart contracts running like automatons on the blockchain. Nevermind that many smart contracts can be upgradeable by their developers via proxy, i.e., developers can redirect wallet user business to changed, fixed, or newer versions of their smart contract protocols, i.e., control DEX behavior to become more compliant with the law.1

Note that banks and money changers have anti-money laundering measures not because they technically cannot function without them. It is a mandated choice2. Some other factoids: non-custodial peer-to-peer exchanges that match buyers and sellers together have to have KYC (know-your-customer) in most regulatory regimes now. Also, pure crypto-to-crypto transactions are considered money transactions in the eyes of courts in major financial centers.

Then there are self-custody wallets like Amfufu that have swaps that are practically fronts for a centralized exchange, like this one named Xchange. When Amfufu Wallet swaps cryptos, one will see on the blockchain that it just sends cryptos straight to Xchange, so tracing stops there. It’s hard to figure out from its transaction notes, if there is any at all, and if it’s possible at all, to what address at what blockchain does Xchange returns swapped tokens back.

Of course, one can subpoena Xchange to find out where the crypto was converted into and sent to. But in practice, if a crime is under a million dollars or two, no police will spend effort and time reaching out to Xchange, which is merely a P.O. box in an offshore island country as it is. If Xchange so wishes, it will comply only after a long and cumbersome cross-border mutual legal assistance treaty process3. In any case, Xchange would not know who sent and received the cryptos, because Amfufu Wallet itself doesn’t know who its users are.

So one can see how swapping “small” amounts through an unregulated offshore exchange is as good as using a crypto mixer. Even better, cryptos coming off an exchange back on-chain won’t have the taint of a crypto mixer. So, some of these crypto wallets are like automated over-the-counter broker for these transactions.

More Wallet Abilities

Finally, there is the interesting Alibokbok Wallet that allows creation and simultaneous control of up to 100 crypto addresses.

Allows splitting up of cryptos to send to up to 255 addresses, or collection from multiple addresses you control.

Batch and mass bulk senders have existed for a while, and they usually use smart contracts to do so. With Alibokbok though, one can simulate manual incoming or outgoing transfers to or from multiple addresses without the use of smart contracts, for a small monthly fee. One can imagine that batch transfers can make crypto tracing complicated and confusing, and I may have seen two or three instances of Alibokbok wallet being used downstream of pig butchering scams. It may not be a problem at all for people with powerful and expensive tracing softwares, but those are beyond the reach of mere commoners.

************

Crypto wallets are being described as just mere tools to communicate a user’s economic wishes to the blockchain network. Many wallets are also literally getting into the communications business (decentralized social media, decentralized messaging). With more and more features and functions being added to crypto wallets, it seems that the line between being just a cool network communication software app, and a bona fide money transmitter that should be regulated, is blurring.

.skdjf an;fij0r[wae faioeur ga’reh

For those who missed, I had an op-ed on The Diplomat: Why the US and China Should Work Together to Solve the Global Scam Crisis.

***********

A recent study titled “How Do Crypto Flows Finance Slavery? The Economics of Pig Butchering” stoked some outrage in the crypto space, because of its finding of $75 billion in potentially criminal proceeds, by tracing ~4,000 cryptocurrency addresses from pig butchering scams (PBS). It is sensational. News headlines say $75B has been lost to PBS. Even crypto-skeptics were skeptical. If one looks deeper into PBS and illicit crypto though, the scales mentioned shouldn’t be too surprising.

https://twitter.com/tayvano_/status/1767019490796314824

I’ll put the technical arguments at the end, because it’s best to tackle head-on first the biggest herring that critics of Griffin & Mei find hardest to swallow: that cryptocurrency associated with PBS is at least $75B.

SECTIONS:

• Is $75B Plausible?

• The Appeal to Chainalysis Fallacy

• The Long Short of $75B

  

Is $75B Plausible?

As someone who has been writing about the PBS industry since early 2021, I also initially thought that $75B in cryptocurrency is too big, but I knew then that they must be counting the total flows through the addresses just before stolen PBS funds exit on crypto exchanges. The addresses could belong to professional money launderers and informal OTC brokers that service other illicit needs, like illegal online gambling and Chinese capital flight. Nevertheless, I think the tens of billions of dollars in criminal cryptocurrency suggested in the paper have basis (to be discussed later), and the existence of a tight crypto laundering network has been found in this paper and by others. So this is more about what to call the funds being counted there.

It may be more accurate to say that the $75B is the criminal income of PBS syndicates, who do many other cybercriminal activities - online shopping scams, job scams, fake kidnapping, telecom fraud, sextortion, human trafficking ransoms, online gambling, money laundering, etc. Before I get accused of moving goal posts, I will point out that the authors never said inside the paper that $75 billion is all from PBS. Other figures given in the paper — $15B, $27B, $40B — were more identifiable as PBS. Rather, they said $75B or higher is what the criminal entities linked to PBS have taken in via crypto in total.

Conversations with the authors confirmed that this is what they meant. Unfortunately the distinctions can be easily glossed over, which got reflected in the headlines of TIME and Bloomberg. I think the authors could be more explicit on the distinctions, but that’s their editorial choice. (To disclose, I and Raymond Hantho of Chainbrium, were the source of most of those addresses, as acknowledged at various places in the Griffin & Mei paper. We collected those addresses for our own parallel research into PBS that is still embargoed.)

Do the distinctions matter though? Arguably, no. It is tricky to define what PBS includes, beyond the commonly known formula. Chinese scam companies doing PBS commonly also do many other online rackets simultaneously. The ‘dog pushers’ (low level scammer) can be assigned to do romance scams in one day, shopping scams the next day, group investment scams the same day, and online gambling the next month, all in the same floor (yes, using crypto). Ultimately, from a scam companies’ point of view, those are all income.

Nevertheless, based on some people’s a priori belief about crypto, irrelevant parts of the Griffin & Mei paper were taken as supposed flaws in its methodology and used to discredit the whole paper, never mind the dataset was interrogated from many angles for consistency and robustness. Admittedly, academic papers can be quite dense.

Forget the methods. Is $75B plausible?

Consider that:

• The Griffin & Mei dataset covers a period of about 4 years.

• The US Internet Crime Complaint Center (IC3) reports $429M in cryptocurrency losses to PBS in 2021, $2.7B in 2022, and $4.3B in 2023.

• PBS is severely underreported (by 3X or more) due to stigma and ignorance, especially early on in 2021, and especially among Chinese immigrant victims. PBS is also often miscategorized and unrecognized until recently.

• Reports of PBS is rampant also in other developed countries –Japan, Korea, Australia, Canada, European countries, etc.

• PBS is also not only a rich-country disease; Southeast Asian countries have long been heavily targeted.

• In China, police reports of PBS in one year for 2020 amounted to $5.7B USD – not yet including illegal online gambling.

• The UN estimated that Southeast Asian fraud factories earn $7.5B to $12.5B annually1.

In all, global losses to PBS syndicates can easily reach $20B a year in crypto and fiat.

Now consider the scam-adjacent industries in Southeast Asia:

• Smuggling money out of capital-controlled China is big business — at $500B at a peak year. Crypto is still included.

• Scholars have put the size of the Chinese gambling industry in Southeast Asia to be $100B to $500B a year (personal communication), and it has been estimated that $143B leave China per year through gambling.

• The human trade for scam compounds in Southeast Asia involve hundreds of thousands of people. The UN found that, conservatively, 100,000 and 120,000 are trapped in scam compounds in Cambodia and Myanmar, respectively; Chinese reports at least 300,000 of its nationals are working/slaving as scammers; there are up to 500,000 mostly Chinese workers in the Philippine online gambling sector. One also can easily find the many recent reports of hundreds or thousands of individuals freed from scam compounds per police raid.

The billions of dollars mentioned here is not to conflate, but for context. How are these relevant? One, PBS syndicates are likely using the same money networks that evolved from cross-border underground exchanges of the Chinese diaspora. Supposedly because of the big liquidity demands, this money network will tend to concentrate and be highly connected. Two, many notorious scam compounds in SEA are outgrowths of the gaming and casino industries in the region. Indeed, many of the top Chinese fugitives for cyber-scams have backgrounds in running casinos. Asian governments and scam companies often consider online gambling and cyber scams together.

If one finds these numbers to be unbelievable, one should visit the fraud factories in Cambodia, the glittering Chinese casino cities in Manila, and the mafia ministates in Laos and Myanmar to get a feel. Or read Zeke Faux’ book Number Go Up, on the two chapters on Pig Butchering Scams.

The Appeal to Chainalysis Fallacy

The Griffin & Mei paper is contrasted by its critics to Chainalysis’ own estimate of PBS that the study critics treat as the gold standard. According to Chainalysis’ previous Crypto Crime Report, only $5.8B has been lost to all crypto scams in 2022, including PBS, and even less in 2021.

Chainalysis’ statistic is often misused in debates around cryptocurrency regulations. The fact that Chainalysis’ numbers on scams are merely the floor minimum is often undersold, even by Chainalysis itself historically. Chainalysis count only cases that they positively recognize. And aside from massive underreporting and mis-categorization of PBS, crypto scam reports also have to reach their database. Anyway, I already wrote extensively about the many technical and epistemological ways Chainalysis’ estimate is inadequate and wildly misleading, so I will just have a few more things to add here.

Chainalysis’ approach is understandable given that its tracing is used for criminal convictions, but applying the same approach in counting cases is simply inappropriate for public policy. Expecting complete evidentiary standards to every scam address and inflow before counting them as criminal is not realistic. As a contrast to Chainalysis’ approach of needing proof beyond reasonable doubt, in the public health sector, many actions are based on the preponderance of evidence. For instance, smoking has not been proven to cause lung cancer, but statistically speaking, you wouldn’t want to bet your life on it.

Complaints about the proprietary aspects of the tracing done in the Griffin & Mei paper while extolling Chainalysis’ estimate is ironic, given that Chainalysis itself is accused of peddling proprietary black box tracing. Also, one can easily argue the opposite of saying that Chainalysis “face stiff competition from other chain analysis providers and hence have an economic reason to get these things right” (from the same complainer). One can equally say that Chainalysis has an economic incentive to promote crypto use by underestimating crypto crime, while in academia where reputation is the only currency, researchers have to be careful of being ravaged by peer reviewers. Finally, it does not matter that Chainalysis is a multi-billion dollar company.

Relying on minimum values is useless if the actual value is many multiples of the minimum. One does not decide to wade across a stream just by knowing its minimum / shallowest depth. Chainalysis’ published number for PBS is too conservative to the point of being pointless; just compare it to FBI statistics. We might as well say, “at least $10 million has been lost to PBS globally”. To say that only a couple billion dollars in crypto has been lost to PBS is the real “fully fucking absurd”.

The Long Short of $75B

The more technical attacks on the paper centered on two flaws supposedly in Griffin & Mei’s methods: 1) the double-counting of flows and 2) tracing through service provider addresses (related to: one cannot know that all cryptos sent to a tainted address are criminal). The rest of the paper actually addresses those concerns in some ways.

In the tweeted screenshots, Tay (Taylor Monahan, crypto forensics expert and MetaMask product lead) finds a couple of “gotchas” of alleged double-counting, to paint the rest of the paper as untrustworthy. But the sentences picked out as double-counting were not used to derive the $75 billion. They are just descriptions of the recirculation that was observed, shown inside Figure 4A of the paper (I point out with a dashed circle, below). Instead, as detailed further in the paper, it is at the exit points, the exchange deposit addresses that the $75 billion was calculated from (shown by my arrow and solid circle).

Is the exit point the correct place to count? Exits to exchanges are one-way, and we can make other reasonable assumptions. With the sheer sizes of PBS cases and the pervasiveness of the scam cottage industry in the region, it is hard to believe that controllers of recipient accounts in Asian exchanges are unaware of the origin of funds or are not part of the scam industrial complex. They may even specialize in servicing Chinese scam companies.

When summing the total inflows to the exit addresses, the authors get:

• $26B if they count the inflows to only the exit addresses revealed from the starting 4,000 reported PBS addresses.

• $75B if they apply a logical heuristic to include other exit addresses controlled by the same owners of the initially identified exit addresses

• Up to $238B if they relax the heuristic to include more exit addresses

How much of the exiting funds are likely from PBS?

• The authors find that many of the largest exit (deposit) addresses are, individually, endpoints of up to 400 known reported PBS addresses; see Fig 13 in the paper. There are certainly thousands more unknown PBS intake addresses than the 4,000 we have gathered.

• Tracing backwards revealed that $40B of the $75B come from exchanges within 5 hops; $15B of that came from US-facing crypto exchanges used by Western victims (Coinbase, Kraken, Crypto.com, Gemini)

• The authors only counted transactions leaving exchanges that are below $500k, because victims are unlikely to send above that amount all in one go. The authors also do this to minimize double-counting of cashed-out funds reentering and going through the exit addresses again, which the authors surmise to be the scammers shifting internal money.

So which of these numbers is PBS?

My take is that $15B is the absolute minimum of PBS crypto from “Western” victims. I think the short, exchange-to-exchange transfers of $40B suggest that the global crypto defrauded by PBS could be as high as $40B. Those $40B in exchange-to-exchange crypto transfers below $500k certainly don’t look like retail trading. In our experience (Chainbrium) tracing by LIFO (Last-In-First-Out), stolen cryptos from PBS are quickly cashed out to exchanges, i. e. not circulating on-chain indefinitely as one would expect if they were traded away to unconnected crypto users.

**********

Aside from estimating the total size of PBS, there were interesting things the study authors found to support their claims. Alternative explanations will have to fit all the observed data as nicely as PBS money laundering.

1. Almost all addresses in the trace were connected as a large but bounded network

2. The network was distinct from a “placebo” group of non-PBS scam addresses

3. Looking at subsets of addresses show the same characteristics (see sensitivity and robustness sections).

4. Inducement payments2 to (Western) scam victims (a common trick in PBS) are identifiable as round-number payments below $10k from the network to Western exchanges (Benford’s Law?)

5. Curiously high usage of decentralized exchange Tokenlon, long known to be a signature of PBS, to swap cryptos for USDT, almost exclusively

6. The inflow into the PBS network and shift to victims outside China seem to be affected by events relating to crypto and scam crackdowns:

Note that the shape of (b) may just be artifacts of the time period the PBS addresses were reported and collected, but the authors note that inflows were persisting despite the crackdowns.

********************

This piece is not about putting down the crypto movement, but if people think that these Asian syndicates are getting only ~$2B worth of criminal funds in crypto, they are kidding themselves.

UP NEXT: Laundering money through TRON (maybe)

dk.fj sav;dwocgliawo meimklebhfjkshfke;uh

Follow the Gas Money

A New Mode of Scamming

Made in Chinese Fraud Factories

Who got approved? 

Follow the Gas Money

Many victims of pig butchering scams found that they just became one when their cryptos magically disappear from their Coinbase Wallet app. They didn’t send out anything, and they certainly didn’t share their private key or seed phrase to anyone. What happened?

Crypto, like money, doesn’t move by itself. There are no ghosts or poltergeists in Ethereum. No uncaused cause there. There will always be (1) someone moving it and (2) ‘gas’ fees for transferring anything in the Ethereum blockchain. The hidden hand will leave traces that way. This is one of the ways blockchains can be interesting. 

To review, USDT is a token on the blockchain, and one USDT signifies one US dollar held by the company Tether. (See smart contracts and joojoos). In almost all cases, one must have ETH to spend for gas to move any amount of USDT from one crypto address to another. Those ETH have to come from somewhere.  

Scammers creating new crypto addresses to launder USDT have to first invest some ETH into that address, if not provided by a scam victim. Those ETH can sometimes come from surprising places. ‘Following the money’ can be more than just following a victim’s stolen crypto. Sometimes, you can get lucky tracing upstream for who’s paying the gas fees.  

In fact, with the infamous cryptocurrency anonymizing tool Tornado Cash, tracing who is paying the gas to withdraw laundered cryptos from it can give away the user’s identity. Tornado Cash gets around this by employing paid third-party “relayers”, which is just another money service business, no?1  (Among the reasons the US DOJ is suing the Tornado Cash founders.2) So much for “disintermediation” and “decentralization”… 

In the case of common pig-butchering scams, looking at gas might be helpful, though only if you can confidently identify ETH meant for gas, and if it can be reliably traced to a compliant exchange. Thinking about gas can also be useful in investigating the “liquidity mining pool” variant of pig butchering scams. 

A New Mode of Scamming

“Liquidity mining” scams is a later variant of pig butchering scams, incorporating elements of blockchain technology into a social engineering scheme.  

Prior to it, pig butchering scammers were quite conventional in using cryptocurrency, using it like bank wire frauds. Victims are tricked into sending payments to an account the scammers control, be it a crypto address or a bank account. With liquidity mining scams now though, scammers are taking advantage of smart contracts. 

What is a liquidity mining pool? If you really want to know, Google it. What exactly it is doesn't really matter here. I can call it "jamba wamba", and if you stake your USDT to "jamba wamba", your 1,000 joojoo will grow 1,200 joojoo, 2,000 joojoo, 10,000 joojoo, or whatever the scammer tells you. 

You will have to know what cryptocurrency wallets and dApps are. A cryptocurrency wallet is essentially software for managing the cryptocurrency addresses. But more than that, wallets allow for direct interaction of your wallets’ contents with smart contracts for e.g. automating payments, swapping tokens. Meanwhile, dApps or decentralized apps are simply apps not hosted on one server, so that no evil corporation can easily take them down. Smart contract code live on the blockchain, and dApps serve as their snazzy user interface. It's only fitting to have decentralized, censorship-resistant user interfaces for decentralized, censorship-resistant blockchains.

Liquidity mining scam works as follows:

It starts the same way as with any pig butchering scam, with scammers finding targets on dating, messaging, or social apps, grooming them over time, and teaching them crypto. But instead of victims being tricked to send cryptos to the scammers’ accounts, victims are convinced to download their own crypto wallet from app stores and to deposit money (cryptos) into it. Ostensibly, victims feel safe having full custody of their cryptos. The scammers would emphasize this point as much, and it is true. 

But then victims are told to connect their wallets to a “liquidity mining pool”, so they can start participating in its rewards. Crucially, when connecting to the dApp, the victim unknowingly gives unlimited token approval (approval to move unlimited tokens) to the scammer. Well, the dApp is a smokescreen, and the "mining pool" doesn't really exist.

Normally, token approvals are used in non-malicious dApps to pre-approve payments, exchange tokens, stake, etc. In liquidity mining scams, unlimited token approval is requested, disguised as a small service fee, connection fee, or "mining certificate". This is akin to a phishing attack in traditional computer security terms.

Note that the victim has not shared their private key and has not initiated transfers out of his/her wallet. Nevertheless, with unlimited token approval the fraudsters can now drain the entire contents of the victim's wallet address at will at any time.  

All that remains for the scammers is to keep persuading their victim to load up on his/her wallet. Say for example, the higher the deposits, the higher the yield. Other tricks are showing fake earnings on the dApp screen display, asking withdrawal fees or "taxes", and/or sending back worthless, counterfeit USDT tokens as the profits. The scammers do not have to drain the victim's wallet immediately, in order to keep up the charade and maximize the final theft. 

Made in Chinese Fraud Factories

The liquidity mining scams are conducted wholesale by the same Chinese pig butchering scam syndicates in Southeast Asia. Based on human sources there and in illicit Telegram groups, their criminal tech developers developed this way of scamming in late 2021, as seen below in a contemporary instruction manual for scammers: 

Total losses to the mining pool version of pig butchering scams has been at least $388 million to date, according to a Dune Analytics dashboard tracker that displays a running daily tally of losses to pig butchering liquidity mining scams (USDT Approval Mining, Liquidity Mining & Sha Zhu Pans). It has found ~25,000 victims of liquidity mining scams, and the largest single victim loss to it is $9.7 million.

Importantly, the tracker counts only USDT losses, and it must be said that it does not include direct transfers made by victims themselves, nor any stolen ETH, Bitcoin and USDC (another USD-pegged stablecoin). The tracker looks to be made by an associate of MetaMask, a popular cryptocurrency wallet app. From experience and a news report though, I know a majority of liquidity mining scam victims were Coinbase Wallet app users.

It is also mostly looking at scams most active for 10 months in 2021-2022. Up to now, liquidity mining scams peddled by pretty Asian profiles online are still rampant, with appeals from its latest victims for help coming almost every week on Reddit. 

Who got approved? 

To where are token approvals sent? Yes, token approval costs gas, too. When a victim (inadvertently) gives token approval, it takes the form of some ETH going from the victim address to a scammer-controlled address, authorizing that scammer address to spend the USDT content inside the victim’s address. 

That approved spender address is typically not the receiving address that the scammer moves money to. Scammer receiving addresses are typically not used for long, but approved spender addresses are re-used by scammers many, many times.

One can see any approved spender of an address using Etherscan.io, under More —> Services —> Token Approvals. Also on revoke.cash

The Dune Analytics dashboard above actually tracks approved spender addresses, to whom the victims unwittingly approved to control their wallets. Amazingly, only about 200 approved spenders account for all those losses.

Now, for the approved spender to move victim USDT around, he/she must be consuming some ETH. The hidden hand have to prime his approved spender address with ETH. Where did that ETH come from?

The approved spender seems to be an OKX customer. A good target to subpoena? Good luck convincing a 70-year old judge to approve that.

Below is another scammer approved spender address, taken from the abovementioned Dune Analytics dashboard and responsible for stealing from multiple victims. He looks like a Binance user(s).

Scammers are prepared for people following the scammed money, and so they’d throw some obfuscation and money mules behind them. They might not be so careful though with their gas money. You bet that the people sending ETH to approved spender addresses must know what the ETH is for, if they’re not the hidden hand themselves.

Caveat Emptor!

For some tokens like USDC, they can have so-called ‘permit signatures’ that do not need gas for approval! The approval process is ‘gas-less’ and happens off-chain! It won’t show up in an victim address’ list of approved spenders!

However, while the approval process itself leaves no trace on-chain, moving USDC or any tokens still needs gas, and the approved spender address can still be discovered in the transaction log when the USDC was stolen. See case study and references3.

The Wild West of crypto is a dangerous place.

UP NEXT: How-to launder money using TRON (maybe)

awnflkfndslnwae;ovc WVOINAEOVN[N[V

Slavery is ancient, abhorrent and alive, in the age of cryptocurrency and social media. In fact, it is through cryptocurrency, social media and other remote work/internet technologies that modern slavery has continued and broadened its destructive tentacles. There is currently a thriving cottage industry in Southeast Asia (SEA) where semi-legal enterprises deceptively recruit guest workers to online businesses (call centres, digital marketing, translation, etc) [1] In actuality, these companies are running massive boiler room scams that are behind the recent surge of relationship-investment frauds (i.e. pig-butchering scams) worldwide [2], usually via cryptocurrency. Recruits are trapped and forced to work on online gambling, investment frauds and sextortions their companies run. Lives are ruined on both ends -- in the slavery that fuels the criminal enterprises, and in the output, which is the proliferation of sophisticated cybercrimes.

Recording from inside a scam compound

In these human trafficking (HT) cases, unemployed men and women are deceived by recruiters or online ads about overseas jobs in Cambodia, Thailand or other SEA countries [3], if not outright kidnapped. Upon arriving, the recruits are trapped for months to years and forced to run the unsavoury parts of online scams [4] and/or held for ransom to their families [5]. They are taught to target users of social media and dating apps and to patiently drive victims online into burning through all their moneys on well-scripted schemes. Non-performers can suffer beatings [6], electrocutions and rape [7], among others, and are frequently sold off as labour to other companies like chattel.

The numbers involved in this human trade are not trivial. It has its roots in Chinese telecom fraud and illegal gambling industry targeting the mainland Chinese, so Chinese citizens comprise most HT victims of SEA scam syndicates at ~80%, followed by Taiwanese, Chinese Malaysians, then Thai, Vietnamese and other nationalities. Chinese media has reported that 300,000 Chinese are employed as online scammers in SEA [8] (note that their primary target, China, has a population of 1.4 billion). Trafficking of Chinese citizens has been so severe, the Chinese government has implemented draconian measures on its citizens heading to and returning from high-risk countries [9], as well as awareness campaigns about syndicates targeting its citizens on those countries. Likewise, Thai police has tried cross-border operations aimed at saving an alleged 3,000 of its citizens that have been trafficked into Cambodia to do scams [10]. As the scam syndicates are expanding their reach to the “foreign” non-Chinese market, they have been recently trafficking also English-speaking South Asians [11],[12].

It is hard to know the proportion of truly captive, since they range from some kidnapped off the street, some who were tricked, some who knew but naively thought they can just wing it, to the free agents who rotate through different scam companies. However these schemes are time-consuming, labor-intensive and, for most, morally sickening, hence the reliance on large numbers of indentured labor. Also, in absence of labor protections inside the large “technology parks”, “special economic zones” and private real estates where many scam companies are based, wanton human rights abuses are almost expected. And in light of well-documented beatings, starvation, rape and other abuses that happen to guest workers, local authorities are almost singularly concerned only with the HT victims’ visa statuses [13].

Economic Damage

The principal perpetrators profit off the backs of indentured workers and scam victims. It is hard to quantify the economic and opportunity cost to HT victims, but there is data on the criminal earnings of these “fraud factories”. In 2021 online romance-investment frauds of the kind perfected on China by these SEA scams companies (so-called pig-butchering scam) has netted $429 million in losses from only 4,325 victims in the US [14], which averages an astounding $100,000 loss per victim! This is likely still much under-reporting and does not include the other online investment frauds they perpetrate on US residents, which should approach $1 billion [14]. Other countries have seen similar numbers when adjusted for their own currencies. From estimates on the blockchain, tens of billions of US dollars’ worth of cryptocurrency has been reaped by the SEA scam boiler room companies [15]. These numbers still do not count wire fraud, which predominated earlier, and which we estimate to be ~30% of the amounts defrauded in 2021 [16]. Finally, numbers from China itself, the original target of the SEA fraud factories, Chinese police reports of just pig butchering scams in 2020 amounted to 40 Billion RMB in 2020 [17] -- $5.7 Billion USD – not yet including gambling scams.

REFERENCES

[1] https://www.globalantiscam.org/modern-slavery-job-scam

[2] https://www.scmp.com/magazines/post-magazine/long-reads/article/3165149/online-fraud-how-chinese-nationals-forced-run

[3] https://zhuanlan.zhihu.com/p/79366408

[4] https://vodenglish.news/lured-with-the-promise-of-jobs-thai-nationals-detained-sold-to-scam-operations-in-cambodia/

[5]

[6] https://zhuanlan.zhihu.com/p/155702568

[7] https://www.globalantiscam.org/post/some-chinese-lured-by-high-paying-jobs-end-up-in-telecom-fraud-prostitution-in-myanmar

[8] https://mp.weixin.qq.com/s?__biz=MzI3MTA2MTk4NQ==&mid=2650589928&idx=1&sn=7e562d899029fe725d65230f11eba9fb&scene=21#wechat_redirect

[9] https://finance.ifeng.com/c/86e88MUfxCR

[10] https://www.bangkokpost.com/thailand/general/2285998/illegal-workers-to-be-caught-returned

[11] https://vodenglish.news/four-pakistanis-rescued-from-captivity-forced-labor-in-sihanoukville/

[12] https://www.globalantiscam.org/post/tricking-english-translators-for-shazhupan-scripts

[13] https://vodenglish.news/49-thais-repatriated-amid-trafficking-scourge-police-say-they-dont-ask-about-their-work/

[14] https://www.ic3.gov/Media/PDF/AnnualReport/2021_IC3Report.pdf

[15] https://cipherblade.com/blog/the-prevalence-of-sha-zhu-pan-aka-pig-butchering-scams/

[16] https://www.globalantiscam.org/post/statistics-of-crypto-romance-pig-butchering-scam

[17] http://www.xinghuozhiku.com/59618.html

SECTIONS:

• Persistent scripts

• Nothing is free

• What is a token

• Skip this if you don’t want to understand how joojoos work

• Jumping the USDT joojoo

Persistent Scripts

Ethereum and similar blockchains have a further functionality that makes them more than just a glorified account book. They can run "smart contracts" – basically computer programs on the blockchain. This allows for many applications to be built on Ethereum, especially when smart contracts communicate with and build on each other. In a Microsoft Excel spreadsheet, they would be the formulas and macros. Examples of simple applications are automating monthly payments, having escrow addresses that automatically release funds once specified conditions are met, creating virtual tokens (more on this later), etc. In fact, because of smart contracts, the Ethereum network as a whole acts as one, global computer --the Ethereum Virtual Machine1 – powered by its native 'currency', Ether.

Smart contracts can be coded and published by anyone to the Ethereum blockchain, and once there every user can use it, forever. Smart contracts also have cryptocurrency addresses, but instead of just values, it would also contain instructions. Think of again Microsoft Excel cells (crypto addresses) containing formulas (smart contracts) for the macros. There are no private keys for using smart contracts; they are executed by sending Ether to them.

Just to note, smart contracts aren't really smart, and they for sure aren't legal agreements between parties. The Ethereum network merely follows what's programmed in smart contracts. It’s more accurate to call them "persistent scripts" that are saved forever on the blockchain network, as principal Ethereum co-founder Vitalik Buterin wished he had originally named them2.

Nothing is Free

Running a blockchain is not free. (The internet isn't free either.) Why would thousands of people spend money on a high-end computer consuming electricity all day, to act as Ethereum network nodes for the benefit of the world? It is because all of them believe in the promise of Ethereum. Also, it is because they all earn a small amount of Ether when validating transaction blocks.

Every transaction sent to the Ethereum blockchain needs to be paid for with a bit of Ether as 'gas' fees, part of which goes to node operators as thank you. (In Bitcoin the fees are called miner fees because transaction validators are called ‘miners’, for mechanistic reasons.) Doing anything that will result in a state change on the Ethereum blockchain costs gas. For example:

• sending Ether

• publishing smart contracts to the blockchain

• executing a smart contract (e.g. to transfer tokens)

You can increase the gas you pay to bribe the validators / miners to prioritize processing your transaction faster. Gas fees get more expensive the more transactions get sent into the network, so gas actually also help prevent mindless spamming of the network.

What is a Token

Smart contracts allow the creation of tokens to represent anything: US dollars, game rewards points, stocks, real estate, art, voting rights, bragging rights, membership in a cult, tokens for a laundry machine, you name it. Specifically, they represent ownership of something that is tracked on a blockchain ledger. Therefore, tokens can be bought, sold, traded and of course, speculated. People often use the term ‘token’ interchangeably with ‘coin’. Here ‘token’ will be used interchangeably with ‘joojoo’.

Skip This If You Don’t Want to Understand How Joojoos Work

A joojoo is created through smart contracts. Say that you want to create a joojoo representing a Jejemon. You call it the JUJU Coin. You’ll write a smart contract saying how much supply of JUJU there will be on the blockchain and what extra things JUJU does. You then publish your joojoo smart contract to the blockchain, which costs gas for the memory space. Gas for deploying a joojoo smart contract can range from around $200 for the most basic joojoos with just the required standard functions3 (e.g., a name function, a total supply function, ‘transfer’ function, etc), to thousands of US dollars for joojoos with very complex smart contracts and big egos.

The JUJU smart contract also maps all the crypto addresses that have JUJU. To transfer JUJU, you must pay gas to the JUJU smart contract to run the transfer function that you wrote inside it. Again, everything in Ethereum costs gas. In effect, you are telling the Ethereum blockchain through the JUJU smart contract to subtract, say, 800 JUJU coins from a sender address and add 800 JUJU coins to the recipient address.

Imagine that you are paying a robot (Ethereum), who can now speak JUJU (smart contract), to move JUJUs, whenever you want to move JUJUs.

Whether you transfer 80 JUJU or 8,000,000 JUJU costs about the same amount of gas. It is just gas to execute the transfer function in the JUJU smart contract.

Jumping the USDT Joojoo

The most popular joojoo in the world is USD Tether or USDT. It is pegged to the value of the US dollar, so one thousand USDT joojoos should be as good as $1,000 in bills. Theoretically the equivalent $1000 USD is locked in some bank in the Bahamas4, ready to back up any redemption request. Theoretically. (It’s a long story5, bro.) The issuing Tether company, registered in empty offices and P.O. boxes in Hongkong6, guarantees that the billions of dollars of USDT have equivalents in real USD.

A purported use for USDT is as a ‘stable’ store of value for cryptocurrency traders, to get away from volatile Bitcoins, Ether or Dogecoins, when resting. It is virtually for cashing out casino chips. This is why it is called a stable joojoo or stablecoin.

There are other stablecoin issuers now like USDC, GUSD and PayUSD, but arguably, the more popular use of USDT’s is for illicitly moving USD across borders, US borders included. (Another long story, for future post.)

Anyway, one thing law enforcement should know is that stablecoins like USDT have centralized control. The Tether company manages the USDT smart contract, and that the Tether smart contract has functions to effectively blacklist crypto addresses from ever transferring its USDT, i.e. freeze USDT wherever they are. This is true for almost all other stablecoins.

So, police with warrants can conceivably freeze and seize USDT anywhere. No need to wait for suspect USDT to hit an exchange before pouncing.

****** ********

UP NEXT: Ethereum has no God.

alidfnisdfni;fjhrgijagvigh[9wr80w\wirhg’oiehgo;

The Thing Explainer

Cryptocurrency runs on a 'blockchain'. A public blockchain is like a globally shared spreadsheet that keeps track of who owns how much of something. For everyone to see the same information, computers that hold the spreadsheet constantly talk to each other, acting as nodes in a network. These nodes confirm or validate new batches of transactions (transaction blocks) and reach a consensus with other nodes on what the shared spreadsheet says. Every validated transaction block is linked securely to the previous block by a unique solution to hard math problems (cryptography), forming a chain all the way to the first ever block. Hence, a block - chain.

The two biggest blockchains in the world are the Bitcoin and Ethereum networks.

Public blockchains are open to everyone. Anyone can become a node, and anyone can search through all valid transactions ever added to a blockchain, using various blockchain explorers online (see below figures for examples). As it is, any searcher can just download from a node a copy of a blockchain's complete history --about 507 GB for Bitcoin and 1.2 TB for Ethereum as of September 2023. Because of this openness and transparency, cryptocurrency transactions are inherently traceable.

Cryptocurrency activity is pseudonymous (under a false name), not anonymous (no name). A cryptocurrency account is represented by one public address, which looks like a string of alphanumeric gibberish e.g., 0x3f50ejdhy465f8h1ddfwq8dfd99. Anyone can send cryptos to a public address and see all the cryptos it had over time, but only the holder of the private key to that address can move cryptos out of it. So, while transactions are transparent, there is no way of knowing who is sending and receiving the cryptos, just by looking at the blockchain.

We can discover the identity of a private key holder when we trace crypto transactions to places where cryptocurrencies and national currencies are exchanged. That is assuming that the receiver in the exchange knows who sent him/her the cryptos, if they’re not the same person. In most countries, money service businesses are supposed to know who their customers are. Usually the so-called Know-Your-Customer (KYC) information is only divulged by the businesses to the police and the courts, after due process. 

Blockchain Proof is Good as Gold

Blockchains are immutable. They provide time-stamped, verifiable and unalterable evidence of transactions that happened. This would also mean that one can easily go back and examine any suspect transaction at any time in the past, forever. Transaction blocks are permanent once validated by a majority of nodes. It is practically impossible to go back and change historical data for say, Ethereum, unless one can convince more than 50% of about 7,873,840 Ethereum nodes around the world1.

Related to this is why public blockchains are said to be decentralized. No one entity can reverse a transaction or stop the whole network, so long as there are validator nodes. This is why cryptocurrency boosters like to say that cryptocurrency is "censorship-resistant".

Cui Bono?

When investigating a financial crime, no matter how convoluted, the most useful question to ask is: cui bono (who benefits)? You find out by following the money.

Often the money trail stops at a bank or other money service business before a legal process is needed to trace beyond it. For cryptocurrency, the trail almost always has to end in a cryptocurrency exchange, no matter how many addresses or blockchains or virtual black boxes the perpetrators launder their crypto through. The world still runs on government-issued ‘fiat’ money, so crypto thieves will still have to convert their cryptos into usable cash to buy their sports cars and mansions.

So, in both fiat money and cryptocurrency cases, you still trace to a point where you need law enforcement powers to trace further. So, what's the difference?  

With crypto you can also:

• Check the contents of an account in real-time. The amounts are visible to everyone, since public blockchains function as open networks.

• See the other addresses, likely belonging to other victims, that sent to the same criminal crypto address.

  

• See the transaction histories.

• See the distinct actors involved in the money flow. You know they can be distinct because of their behavior or from their connections to publicly known addresses.

• And many more. Like, see the accounts that pseudonymously used “smart contracts” to steal and launder cryptos (a topic for next time).

Hence, tracing cryptocurrency on the blockchain gives some more information than tracing fiat money can. Whether we can act on those information to apprehend criminals is altogether another question.

********************

UP NEXT: What are Smart Contracts and Joojoos?

aw;oiweioprfgarae;irfgiam;orfgnafgolfnge

The Scale of Pig Butchering

Criminal Activity Off-chain but Still Involving Crypto Don’t Count

• The crypto schemes you heard of don’t count

• Don’t ask, don’t tell

• Exchange volumes are dark matter

The Denominator is Grossly Inflated

• Trading a wash

• Bitcoin change addresses are confusing, 8 times

What is the Game?

• The Glass is Half Empty

Just 54% of All Crypto is Clean

It is almost dogma on Twitter that "just" 0.15% of cryptocurrency is used in criminal activity. This is in reference to Chainalysis' annual Crypto Crime Report for 2021. For 2022 the reported percentage rose to still "just" 0.24% of all cryptocurrency transactions of that year, amounting to $20.6 billion. The normal use case of this statistic in public is as if all 99.76% of crypto transactions is legitimate and economically positive.

Chainalysis' statistic certainly does not match the public perception of cryptocurrency as being riddled with fraud and crime. What's with the jarring disconnect between public perception and the 0.15% or 0.24% numbers, which often get spun into soundbites and truism about crypto?

A Conservative Case for the Minimum Rate

Chainalysis formed its estimates based only on illicit cryptocurrency addresses known to it. Its numbers would necessarily be the conservative minimum, as it only counted addresses that it accepts to be from criminal activity. Cases that are unreported, undetected and with insufficient proof of criminality weren't counted. Since Chainalysis gets its data mostly from its clients among law enforcement and crypto institutions, their dataset might rather reflect their clients' priorities. Case-building of multimillion-dollar hacks, sanctioned entities, and business ransomwares would likely to be more complete compared to petty cryptocurrency crimes. If the following is any indication, 43% of illicit transaction estimate by Chainalysis for 2022 are transactions from OFAC-sanctioned entities – priorities of US national security and foreign policy.

The average netizen hardly cares about OFAC. But he/she is vastly more exposed to petty crypto-scammers and criminals online, in addition to unending news of crypto frauds and hacks. These form the basis of public perception, which affects public policy downstream.

Chainalysis researchers are open about being conservative when labeling which transactions are criminal [1]. Chainalysis always insists on screenshots and a lot of supporting data before blacklisting any crypto address. On principle, it is akin to only counting cases where there are identifiable witnesses or victims who could testify in a court of law. It is not a wrong approach, and it is an understandable approach. Chainalysis' core business is in providing law enforcement the most accurate data to conduct investigations and not make reputation-damaging mistakes. But that standard is inappropriate for the purpose that their statistic is being used for in the public.

It wouldn't matter if Chainalysis only missed the mark by a few half-percent. As the below can illustrate, there are rather many, many more universe of possibilities that Chainalysis underestimated crime on the blockchain by many, many fold.

The Scale of Pig Butchering

Take romance and investment scam victims, notoriously too embarrassed to report their victimhood. The bigger the loss the more painful the reporting. This writer has had the experience having to push and teach US immigrant pig butchering scam victims to (please) report their losses somewhere official, and individual losses are in the $100,000 range. If a tree fell in the forest with no one to hear it, does it make a sound?

To give an idea of the scale of the crypto scams in the real world, consider that the US FBI reported that $3.3 billion has been lost to cyber investment scams in 2022, mostly with pig butchering scams [2]. US Deputy Prosecutor Erin West, who has become the tip of the spear of US law enforcement efforts against pig butchering scams, has been vocal in her opinion that the true losses to pig butchering scams could at least be 3 times more – $9.9 billion [3]. We are mostly talking about US statistics, and pig butchering scams have been a massive plague also in Japan, Korea, Australia, and in European and Southeast Asian countries. In contrast, Chainalysis only reports that total crypto scams, including pig butchering scams, "fell" to $5.9 billion in 2022. Fascinating.

Criminal Activity Off-chain but Still Involving Crypto Aren’t Counted

The crypto schemes you heard of don't count

Chainalysis did not include the epic collapses of mega crypto entities like FTX ($8 billion in real, fiat money missing), Celsius ($4.7 billion lost), Three Arrows Capital ($3 billion lost), among others. When Terraform Labs of the infamous US Terra coin collapsed, $45 billion in total market cap (a nebulous idea [4]) vaporized. They were excluded because those schemes did not occur on-chain, Chainalysis argues. That is, they mostly exist as (criminally) reckless borrowing and fraudulent accounting. Unsanctioned use of other people’s money, like buying swanky apartments, are done off-chain, strictly speaking. Never mind, if you will, that their victims believed that they were doing crypto investments.

The founders of the above collapses may argue that their ventures were simply failed but honest investments. Only after many long years may the courts determine that much if not the entirety of those crypto enterprises was fraudulent, and even convict their founders as criminals. When that comes, should those billions of US dollars' worth of cryptocurrency that went into, through and from those crypto entities be put under the 'criminal' and 'illicit' side of the crypto ledger?

Don't ask, don't tell

Crypto transactions can be illicit and criminal by their origin off-chain. Drug sales, arms sales, child exploitation sites, kidnapping ransoms, illegal online gambling etc., require someone reporting them as such and making it to the right database. The shame and stigma of being a victim of romance / investment scams won't be belabored here. Even if reported, local police generally don't bother with them, let alone properly document them with all the crypto addresses and TXIDs. In any case, individual cases are likely a magnitude or two more than what police can have time to investigate or document (or care[5]).

Pig butchering scam is not just a rich country disease. Losses in developing countries may not be as not eye-catching in USD terms but are no less substantial in number of victims or impact. This author has encountered numerous victims from Malaysia to the Philippines [6], some of whom had to sell their houses or cars, or go into debt [7]. There are little data on how much, because police there don’t keep track of crypto crimes, as far as I know. They presumably have even much less resources and know-how than ‘developed’ countries on what to do with crypto crimes.

Then there are illicit transactions that are hardly reported because they are rather 'victim-less' — victimization is indirect. Good (bad) examples are tax evasion, bribing, stashing of proceeds of offline crime, and payments between criminals. In Southeast Asia, ransom payments for human trafficking victims of pig butchering scam gangs do not get reported. Reportedly, Chinese scam company owners in Myanmar trust only storing their cash loot back into crypto on their ImToken wallets. In transactions between criminals, mostly with money they shouldn't have, obviously neither party would self-report.

Exchange volumes are dark matter

Cryptocurrency transactions between accounts of the same cryptocurrency exchange are not visible on-chain. They become an internal accounting matter only known to that exchange. There are early cases of pig butchering scam victims sending crypto to scammers using the same exchange. Additionally, almost 10 times more cryptocurrency trades occur inside exchanges [8]. Money laundering disguised as trades inside exchanges wouldn't be visible on-chain.

The Denominator is Grossly Inflated

Chainalysis also did not include in their $20.6 billion estimate for crypto crimes in 2022 the $23.8 billion of money laundering they detected. While Chainalysis says that it tries to only count meaningful economic activity (value actually changing hands) when analyzing money laundering [9], they were not applying the same treatment to the vast number of non-suspect transactions. This may well be inflating the total cryptocurrency transaction volumes being compared to, the denominator to the 0.24%.

Trading a wash

For one, cryptocurrency activity is rife with wash trading, the practice of self-dealing, self-trading and carrying out of circular transfers, to create the appearance of bustling activity with a particular token or exchange to entice investors. It can get very elaborate, with millions of dollars moving around in a large circular direction through multiple addresses [10]. A study reported that up to 70% of transaction volumes in the biggest exchanges is just hot air [11] . The US SEC accuses Binance.US of precisely that, in addition to market manipulation and trading against their customers. Hell, even one study concluded that 90% of Bitcoin transactions is not economically meaningful and mostly transfers over long chains [12].

I will dedicate more attention to a potentially under-appreciated bloat in estimating transaction volume on blockchains that operate on the UTXO model, like Bitcoin. This bias may be more operative when counting "normal" transactions than with money laundering.

Bitcoin change addresses are confusing, 8 times

Some basic terminology first:

• Cryptocurrency address - a string of letters and characters where you send crypto to.

• Cryptocurrency wallet - the software generating and managing for you a collection of cryptocurrency addresses that you control.

That's all for now.

In cryptocurrencies like Bitcoin that function on the UTXO or Unspent Transaction Output model, a Bitcoin wallet software contains (keeps a list of) Bitcoin addresses that have received Bitcoin before. These are considered "unspent transactions". When a user spends Bitcoin, the wallet software spends a number of unspent transaction outputs or UTXOs (i.e., non-empty addresses) it controls, to cover the desired amount. Most likely, the wallet will overshoot and spend more than the required amount. It is rare that the amount to spend is the precise value of sums of individual UTXOs.

Amounts over the desired value are sent back to the spender as change to new addresses generated by his/her wallet. This is akin to wanting to spend $25, but you only have a $20 bill and a $10 bill in your wallet. You give both bills to the cashier, and the cashier gives you back a $5 bill as change. You put $5 back into your wallet. (Yes, UTXO sounds needlessly convoluted, but it is what it is for design and privacy reasons. The account model of Ethereum is more intuitive.)

A Bitcoin wallet software automatically handles the juggling of the UTXOs. Unless a wallet owner determines the content of each UTXO in his/her wallet and deliberately spends the exact value of individual UTXOs in his/her wallet, his/her Bitcoin transactions will almost always generate change.  A well-worn Bitcoin wallet may well have many odd UTXOs containing like 0.3482 BTC, 1.342 BTC, 0.0245 BTC, 0.000563 BTC, etc.

You might see how this complicates the tracing of Bitcoin. A Bitcoin transaction will typically list multiple input and output transactions. One mostly infers which of the receiving addresses belong to the intended recipient, and which ones are just change addresses belonging to the original sender. When looking up a conventional use case scenarios of Bitcoin on blockchain explorers, like someone purchasing a good or trading in Bitcoin, only part of the total transaction amount seen is the actual transfer of value from one Bitcoin holder to another. The rest of the Bitcoin is sent to change addresses and has no change in ownership.

In the case of money launderers, since they use many addresses merely as pass-through, they typically send all the BTC they control at that point in time. That is, the entire transaction is the entire amount they want to move. Change addresses aren't generated as much.

Hence transaction volumes of regular Bitcoin users will be inflated by Bitcoin just going back as change, while in money laundering, all the volume can be taken at face value, minus transaction fees. Chainalysis scientists of course know about change addresses. Any blockchain tracing software worth their server space has algorithms to take change into account. However, I doubt those are being applied to the vast majority of transactions not under investigation. Likely, their transaction volumes are just taken at face value when finding the total transaction volumes for a given year as the denominator.

This is how the denominator, the total transaction volume for a given year, gets bigger. How big? Researchers that examined this question reports that the UTXO bias inflates estimations of Bitcoin transaction volumes by 8-fold [13].

What is the Game?

Chainalysis' approach is quite conservative, doesn’t count all criminal activity that involves crypto, and the denominator used is too much inflated. Saying that anywhere between 0.24% to 50% or higher of crypto transactions in 2022 is illicit is still consistent with Chainalysis' data. After all, their estimate is the conservative minimum, and evidences on the amount of legitimate transactions were not detailed. (Chainalysis covers that in another report, The Geography of Cryptocurrency.) It would be more appropriate for Chainalysis to give a range – a minimum and a maximum. A report on crypto that sounds fishy to the public will only hurt public trust and mass adoption of crypto.

To give credit, the Chainalysis report is quite transparent with its caveats. Its authors "stress that this is a lower bound estimate". They do revise their estimates when more criminal addresses become available to them. They have for example later revised their 2021 estimates of total crypto crime from 0.15% to 0.22%, representing a change from $14 billion to $18 billion. Furthermore, they admit their figure "doesn't capture proceeds from non-crypto native crime." (See above)

All this modesty, however, doesn't make it to news headlines and crypto puff pieces. Everyone has agendas, in the end. Even Chainalysis' own Crypto Myth Busting Report, written to encourage more use of crypto, disputed the "myth" of cryptocurrency being mostly used for crime, by saying that "just" 0.24% of crypto is illicit, without mentioning any of the serious caveats.

Imagine crossing a stream by foot, but the depth you're told is actually just the minimum depth. Imagine making decisions on how much to budget for crypto departments and supervision, based on misleading underestimates of crypto crime. More likely, you will hear Chainalysis' statistic if you are a policymaker urged to vote for crypto-friendly regulations.

The Glass is Half Empty

Here is one way a maximum could be calculated. Chainalysis looked at all the illicit and criminal crypto transactions they recognize and compared them to the year's total transaction volumes. One could instead try quantifying all the transactions demonstrably made by law-abiding citizens for legitimate purposes, then compare that to total transaction volumes. While more work, this approach shouldn't be any less valid. In the most optimistic scenario, say that we managed to positively identify 54% of cryptocurrency activity as demonstrably made by law-abiding citizens for legitimate purposes. (One study did estimate that 46% of Bitcoin transactions are illicit, the maximum estimate of crime any one study has found [14].) Like Chainalysis, we don't scrutinize the rest of the transactions to remove fat. So, a headline by CoinDesk could be:

JUST 54% OF CRYPTO IS CLEAN

Up next: New ways of doing crime and investigations — follow the approver

[1] How Big Is Crypto Crime, Really? (coindesk.com)

[2] ‘Pig Butchering’ Scams Are Now a $3 Billion Threat | WIRED

[3] California prosecutor Erin West on the massive wealth transfer to Southeast Asia from a crypto scam called 'pig butchering' | CyberScoop

[4] The meaning of market capitalization is nebulous, to the point of meaninglessness. Crudely, market cap is calculated by multiplying a token's current market price by the total number of tokens. Imagine though if most of their owners sell most of their tokens. Of course, they won't. The token's price would quickly be worthless. Consider also that a large portion of tokens in most crypto projects are locked up in the projects' treasuries. Releasing them will ironically sink the market cap.

[5] "Crypto is not real; it's air," the police told me (globalantiscam.org)

[6] https://www.cosmo.ph/relationships/online-dating-pig-butchering-sa-zhu-pan-scam-a1213-a1213-20211101-lfrm

[7] Statistics of crypto-romance / pig-butchering scam (globalantiscam.org)

[8] Decrypting New Age International Capital Flows | NBER

[9] 3 Misconceptions about Cryptocurrency Crime Estimates - (securitiesanalytics.com)

[10] https://medium.com/chainargos/stablecoin-mechanics-3-circle-of-life-216b94c3d162

[11] Crypto Wash Trading by Lin William Cong, Xi Li, Ke Tang, Yang Yang :: SSRN

[12] Blockchain Analysis of the Bitcoin Market | NBER

[13] Can Bitcoin be Trusted? Quantifying the economic value of blockchain transactions - ScienceDirect

[14] Sex, Drugs and Bitcoin: How Much Illegal Activity is Financed Through Cryptocurrencies?| University of Technology Sydney (uts.edu.au)

asfds;ofdnsobnso; nbdfk.vdjteuhzim

Subscribe now