PlusToken Scam Could Be Much Larger than $2.9 Billion

If 2018 was crypto’s Year of the Hack, cybersecurity CipherTrace’s description of 2019 as “The Year of the Exit Scam” has hit the nail on the head.

“On top of the QuadrigaCX disaster, which is updated in this report, one alleged Ponzi scheme in this quarter appears to have defrauded millions of users out of $2.9 billion in crypto assets,” the firm's Q2 anti-money laundering report explained. “Other exit scams, such as Coinroom and Bitsane, are still under investigation and those losses are not included and this report’s total.”

Now, it seems that 2019 will also be remembered as the year of the uncovering of PlusToken, a cryptocurrency Ponzi scheme that allegedly took roughly $2.9 billion from investors--so far, it's been identified as the largest Ponzi scheme in crypto history, and the story is still unwinding.

What happened? Where did the money go? And can affected users expect to receive compensation (or any kind of help at all)?

Let’s back up for a moment

The South China Morning Post reported on June 29th that six individuals were arrested in connection with an unidentified cryptocurrency scam. However, rumors quickly spread on China’s social media platforms that the scam was a self-described cryptocurrency wallet scam known as “PlusToken.”

3/ The #PlusToken scam is alleged to have been ended by #Vanuatu Police on the 27th of June. According to reports in Chinese media on the 1st of July that showed photos of some of the suspects arrested in Vanuatu & the alleged ring leader in China who was reported to be at large. pic.twitter.com/9knaWlSzIa

— DLT Vanuatu (@DLT_Vanuatu) July 14, 2019

What is PlusToken?

PlusToken is a South Korea-based “cryptocurrency wallet” that has all of the trappings of a typical cryptocurrency Ponzi scheme: it promises to reward its users with high rates of return if they use PlusToken’s platform to store their funds.

The "rewards" are allegedly generated by “exchange profit, mining income, and referral benefits.” Despite the arrests and the negative press, PlusToken’s website and social media accounts appeared to be up and running at press time.

Law enforcement originally took action against PlusToken in June

Despite the fact that Eastern news media sources were hot on PlusToken’s trail from the point of the arrests at the end of June, news that something funny was going on with PlusToken appears to have only hit western news media on August 12th, when Cybersecurity firm CipherTrace released its Q2 cryptocurrency anti-money laundering report.

The report said that although “CipherTrace has not definitively confirmed this apparent fraud or exit scam,” $2.9 billion in deposits “appear to have been lost when Chinese police broke up an alleged Ponzi scheme involving the purportedly South Korea-based crypto wallet and exchange, PlusToken.”

While the exact number of people affected by the scam is unknown, CipherTrace said that “PlusToken claimed to have between 2.4 and 3 million users/investors.”

CipherTrace added that most of the details surrounding where the funds may have disappeared to were “currently shrouded in a mystery involving Chinese nationals, Chinese police, the government of Vanuatu, and the two supposed co-founders—a Russian known only as ‘’Leo’ and South Korean who uses the name ‘Kim Jung Un,’” who are allegedly still on the run.

After CipherTrace’ report was published, a spokesperson for the Yancheng Municipal Public Safety Bureau confirmed to The Block that the six individuals arrested in June were, in fact, associated with PlusToken.

Where did the money go?

It seems that the rumors of PlusTokens’ deceptive behavior were enough to have stopped the majority of PlusToken victims from sending funds onto the platform: an analysis of Ethereum transactions on addresses associated with PlusToken by blockchain analytics firm Elementus shows “a sudden halt in deposits near block 8,040,000 (June 27th). This is the same day that several members of the PlusToken team were reportedly arrested in Vanuatu.”

But where did the money that had been deposited onto BitConnect go? In the same report, Elementus claimed that “most of the funds have been paid out.”

The report, which analyzed the ETH tokens that flowed out from PlusToken, said that indeed, “of the 9.9 million ETH collected by PlusToken, 9.2 million ETH has already been sent out” to “248k different addresses.”

However, the vast majority of the ETH that left the platform was highly concentrated in a handful of addresses: “assuming each of these addresses truly represents a single PlusToken participant, half of the ETH intake (~5 million ETH) was paid out to just ~7k ‘big winners’(less than 1% of participants),” the report explained. “Those at the very top took out ETH valued at millions of dollars.”

Elementus also noted that “it is unclear whether these addresses truly represent users at the top of the pyramid, or a PlusToken exit scam disguised as user withdrawals.”

The scam could be even bigger than expected

Interestingly, however, the vast majority of the PlusToken payouts appear to have been sent through Huobi, a well-known cryptocurrency exchange based in Singapore: almost 50% of all withdrawals were sent to Huobi, indicating an unusually strong bias toward the Chinese exchange,” the report reads. ZB.com, Upbit, Okex, and Gate.io also received high amounts of capital outflow from PlusToken-associated addresses.

A number of other cryptocurrency exchanges may have also been used to facilitate the outflow of other kinds of Cryptocurrencies from PlusToken: “PlusToken took in nearly $2bn in ETH alone,” Elementus explained, adding that “considering the scheme was also highly active in BTC, XRP and EOS,” the scale of the scheme could be even larger than currently reported.

Indeed, CoinDesk contributor Dovey Wan, who often acts as a bridge between the Western and Eastern cryptocurrency spheres, tweeted that she had discovered a handful of high-volume BTC addresses that had sent or received transactions from BitConnect. The majority of the Bitcoin wallet addresses associated with PlusToken appear to be unknown.

Just dig my old chats (was in their chat rooms) there are two others BTC addresses belong to PlusToken

74K $BTC ???1Dd5VTCkRtMG8bpuHZrjkLf1TeZ8cwZGDe 95K $BTC ??? 14BWH6GmVoL5nTwbVxQJKJDtzv4y5EbTVm pic.twitter.com/eZEYQmB8ST — Dovey Wan ? ? (@DoveyWan) August 14, 2019

Wan also pointed to several other unusual phenomena that seemed to be happening in connection with BitConnect:

I couldn’t find the chat but starting a few days ago, Chinese traders are saying someone has been dumping 100BTC non-stop on Binance, will post here once I find the chat detail.

Which i suspected related to PlusToken as well pic.twitter.com/0Uiamc8qn4 — Dovey Wan ? ? (@DoveyWan) August 14, 2019

Wan also speculated that an influx of new investor victims into PlusToken might have been powerful enough to help fuel the rise of Bitcoin’s price.

It’s most active period is between March and June. Last active time was around June 28th when people widely complained not able to withdraw and allegedly exit scam.

This interestingly coincided with bull rally, an aggregated 200K $BTC buy wall can def push the market upward — Dovey Wan ? ? (@DoveyWan) August 15, 2019

As such, it has been speculated that a massive outflow of BTC from PlusToken could be contributing to the downward pressure that the price of BTC has been experiencing over the past month.

When can we expect PlusToken to be shut down?

Now that the scam seems to have been exposed, the community and the affected victims are left to deal with the aftermath. However, the language used and the promises made by the scheme may be bringing up some painful bells for some: the guaranteed profits promised by Plus Token are particularly reminiscent of the now-defunct BitConnect, another well-known scam within the space.

Like PlusToken, BitConnect also promised high returns in exchange for users keeping their tokens “locked” within the BitConnect system, although the details were slightly different: customers who chose to participate in BitConnect’s “lending program” were promised outrageously high returns; those who could lend their cryptocurrency to the platform’s “trading bots” for longer periods of time were promised correspondingly higher amounts of profits.

Although PlusToken has been identified as a scam, the fact that its website and social media accounts are still live (in addition to the fact that two of its founders are still at large) may mean that some could continue to fall victim to its deceitful promises.

Therefore, while cryptocurrency community insiders may be aware of the fact that PlusToken is nothing but a scam, newcomers to the crypto space--in particular, members of populations that may be especially vulnerable to financial scams--could still fall victim to PlusToken’s scheme.

FYI - PlusToken like scams usually don’t scam typical “crypto ppl”, victims are ordinary ppl who never interact with crypto.

They have tutorial teach you how you buy BTC with fiat (in this case mostly through Huobi/OK OTC) So it also partially contributed to BTC rally IMO — Dovey Wan ? ? (@DoveyWan) August 15, 2019

But when can we expect a shutdown? Well, if the past is any indication of the future, then justice won’t be served anytime soon--more than a year passed in between the time that BitConnect was identified as a scam within the space until law enforcement began taking action against BitConnect in various corners of the world; public suspicions that PlusToken may have been a scam seem to have originated around September 2018.

(And, interestingly--although BitConnect ultimately shuttered its doors in January 2018, a number of individuals formerly associated with BitConnect were arrested in India in connection with yet another Ponzi scheme in July of this year.)

What can affected users do? Since BitConnect shut down last year, the FBI has posted a voluntary survey that victims of the scheme can fill out in order to inform law enforcement of the fact that they were victimized, but there really are no guarantees of help or compensation.

The unfortunate fact of the matter is that in spite of the fact that law enforcement may have taken action against PlusToken, there simply isn’t very much help out there for the individuals who fall victim to cryptocurrency scams of any flavor.

While victims of hacks, Ponzi schemes, and exit scams could call their local police (who could potentially direct them to another law enforcement agency that may be able to help), there aren’t many options out there; searching the internet for help with Ponzi schemes and other kinds of cryptocurrency scams reaps scant results, if any at all.

Given the scale of the PlusToken scheme, law enforcement agents could have an opportunity to improve the way that crypto scam victims are assisted--only time will tell.