What did Chinese police do with the 200,000 bitcoins they seized during the PlusToken takedown?

In the summer of 2019, Chinese police arrested six masterminds behind PlusToken, one of the largest crypto Ponzi schemes in history.

Then, mysteriously, the scheme’s $4 billion crypto-stash started to move.

A barrage of new PlusToken-associated on-chain transactions following the arrest suggested that more accomplices might be at large and were trying to run away with the funds. What we didn’t learn until more than a year later is that, in fact, Chinese police seized almost all of the 200,000 bitcoin and other assets connected to the scheme at the same time they made those arrests. 

The new details about law enforcement’s takedown of PlusToken — which in just over a year swindled more than 2 million people out of cryptocurrency worth $4 billion at today’s prices — were made public in November in a Chinese court’s final judgment. 

The judgment closed the book on the years-long international crime drama. But it raised a new question about the ordeal: Why did the law enforcement apparently allow the sale of such a massive amount of seized cryptos, under a veil of secrecy, while the case was ongoing?

The Hunan crew

When the news broke on July 6, 2019, that six Chinese nationals had been detained and deported from Vanuatu, the secrecy shrouding the operation drew speculation that the arrests were related to PlusToken.

The six — five men and one woman — were escorted from the Pacific island of Vanuatu into a private aircraft with plainclothes Chinese police holding one arm and Vanuatu counterparts holding the other. 

A week later, the names of the detainees were revealed. Five were the initial PlusToken crew — all from Hunan province — who hatched the devious scheme: Chen Bo, the scheme’s 37-year-old ringleader, his girlfriend Yuan Yuan, and his three right-hand men, Ding Zanquing, Peng Yixuan, and Wang Renhu.

PlusToken launched in May 2018. To participate in the scheme, a user had to lock in $500 worth of crypto-assets. A website and mobile app advertised a feature called “Smart Dog” that was said to yield more than 10% to 30% monthly return via crypto arbitrage opportunities. But “Smart Dog” wasn’t real.

The rewards for recruiting sub-layer members were even more attractive than the purported yield from Smart Dog. And that was how the payout could be sustained.

Chen was a management pro. While he, Ding and Peng were in charge of extensive online and offline talks and promotions in China, Japan and South Korea, his girlfriend delegated a full team to handle crypto deposits, withdrawals and rewards allocation. Wang Renhu, on the other hand, was the main tech guy who made sure the system’s back-end could handle traffic spikes. 

At its peak, the elaborate scheme entailed more than 3,000 pyramid layers.

But it grew too fast to stay under the radar. In March 2019, officials from Hunan’s provincial finance regulator raided PlusToken’s office in a small condo in the capital city of Changsha. Three months earlier, Chen made the call to relocate the main team to Vanuatu.

Before apprehending the leadership group, police in the city of Yancheng in Jiangsu province took several other key personnel into custody.

On June 28, the police detained Gu Zhijiang, a core PlusToken associate in charge of managing members via WeChat groups and rewards allocation. On the 29th, Peng Bo, a member of PlusToken’s wallet management team, was taken into custody. That same day, PlusToken users stopped being able to see reward updates and began encountering difficulties withdrawing funds,

Finally, on July 5, Liu Jia, the No.2 on PlusToken’s wallet management division, found himself in police custody, too.  

While Peng Bo and Liu Jia were released on parole after initial detainment, Gu Zhijiang and the five deported masterminds from Vanuatu were all formally arrested on August 2, 2019.

Seized assets on the move

After the arrests, on-chain analytics firms, including PeckShield and Chainalysis, made headlines when they identified blockchain addresses associated with PlusToken that were holding at least 200,000 BTC and 800,000 ETH. 

PeckShield published a blog post on August 30, 2019 stating that, in mid-August, more than 91,000 BTC from dozens of multi-signature bitcoin addresses associated with PlusToken had been consolidated into five single-signature addresses. 

These addresses then moved the funds through coin mixer platforms, and PeckShield concluded that at least some of those were traded at over-the-counter (OTC) desks for fiat cash in August.

The initial speculation was that other accomplices who were still at large were behind the transactions. But that wasn’t the case, apparently.

Details from the November court judgment specified that the police seized over 194,000 BTC, 831,000 ETH, among other assets, from Chen Bo, Ding Zanqing and Peng Yixuan. The police also seized additional cryptos, albeit in much smaller amounts, from other suspects arrested between August and September 2019. In the end, the police seized nearly all of the PlusToken funds.

In the final judgment handed down last month, the court ordered that the seized funds be converted into fiat currencies and that the proceeds shall be handed over to China’s national treasury.

But is that what happened? The on-chain transactions flagged by PeckShield and OXT suggest there is much more to the story than meets the eye.

The November judgment added more intrigue with its revelation that law enforcement allowed Chen, in a plea to reduce his sentence while under arrest, to sell seized crypto assets with the help of a Chinese on-chain forensic firm called Chaindigg. The judgment didn’t elaborate on when and where those deals happened, their terms, or the amount of money that actually exchanged hands.

That may have something to do with the lack of clear guidelines for execution procedures in China’s criminal laws when it comes to law enforcement liquidating seized assets in criminal cases, as pointed out by Chinese state-owned mouthpiece Legal Daily in an October report. 

The report argued that under the presumption of innocence, there should be no liquidation of assets seized from suspects until they are proven guilty in a conviction. However, it may be a different story if Chen, while not yet convicted, made a plea to sell the assets voluntarily. 

What’s also intriguing is that following extensive media attention last month by Chinese and international media about the court’s revelation about the police's PlusToken asset seizure, the November judgment appears to have been taken down from China’s court database. 

Research firm OXT, which has also tracked the PlusToken coins, published two in-depth reports over the past year that hint at whatever happened behind the scenes. 

The firm’s report in March said that as of February 2020, a total of 177,647 BTC out of PlusToken’s 201,151 BTC was sent through mixers in a possible attempt to obfuscate the end destinations. Among the mixed coins, 139,922 BTC were believed to have been distributed to exchanges between August 2019 to February 2020 when bitcoin’s price was between $7,000 and $11,000. 

“Additionally, distributions were highest into the September and November [2019] price strength, peaking at nearly 4,500 BTC per day,” the March report said. 

Ergo, an independent researcher at OXT, who goes by ErgoBTC on Twitter, told The Block that the remaining PlusToken stash remained largely unmoved between March and early May.

But the distribution started again from May to late June. Small amounts with typically 100 to 500 BTC per day were sent to OKEx and Huobi at a ratio of roughly 3:1, Ergo said. All told, based on Ergo’s accounting, the estimated upper bound of PlusToken’s remaining bitcoin bounty as of July stood at around 30,000 BTC. That’s as far as Ergo’s analysis goes at this point.

The Huobi connection(s)

OXT not only found that Huobi was the most popular destination for PlusToken coins but also that the coins were likely traded via the exchange’s OTC merchants. But why?

The forensic analysis firm Chaindigg — the one that apparently handled the sale of Chen’s seized assets — and a cold wallet company called ColdLar would probably be able to fill in the missing puzzle pieces. 

Throughout PlusToken’s years-long operation, the scam relied heavily on cold wallets made by ColdLar for managing rewards allocation and crypto deposits and withdrawals, the November judgment showed. In fact, eight ColdLar hardware wallets were also confiscated by the police during the investigation.

There are also extensive connections between Chaindigg, ColdLar, and Huobi, based on China’s business registration records.

Yuan Dawei, one of the earliest co-founders of Huobi in 2013, is the founder and a shareholder of ColdLar. While records show Yuan stepped down from ColdLar’s management on August 31 of this year, the cold wallet company’s website still identifies him as its CEO. Yuan has also been the second-largest shareholder of Chaindigg since its launch in October 2017.

Then there is Du Jun, also one of the earliest co-founders of Huobi who returned to the exchange in October, who has invested in both Chaindigg and ColdLar.

Finally, the Beijing investment arm of Huobi was also an investor of ColdLar from July 2017 until it transferred its stakes to the exchange's overseas-registered entity called Huobi Universal (HK) Limited in November 2019.

When reached by phone, a representative from Chaindigg declined The Block’s interview request, citing confidentiality with law enforcement. ColdLar also did not reply to multiple requests from The Block to answer questions about the PlusToken asset sales.