Chainalysis has traced the PlusToken team’s attempts to sell ill-gotten bitcoin through Huobi OTC desks, potentially influencing the BTC price.
The most devastating cryptocurrency Ponzi scheme in history may be contributing to bitcoin’s 2019 price decline.
That’s according to blockchain analytics company Chainalysis, which has been tracking funds from the roughly $3 billion PlusToken scam since the thing blew up at the end of June 2019. As the scammers have scrambled to obfuscate hundreds of millions of dollars’ worth of bitcoin they accrued, they’ve left a trail on the Bitcoin blockchain, and Chainalysis has been following it for months.
And according to its research, released in a recent blog post, these movement dead-end at a handful of independent over-the-counter (OTC) desks that operate on the Huobi exchange. If Chainalysis’s findings are to be believed, the scammers have sold some 25,000 BTC for just shy of $200 million in profit — and they’ve got at least another 20,000 that’s been untouched since September 2019.
Ponzi Shuffle
PlusToken was a cryptocurrency Ponzi scheme that operated for nearly a year. The scheme coaxed “investors” to deposit bitcoin, ether and other cryptocurrencies by promising monthly returns of up to 30 percent in bitcoin or its eponymous plustoken. Before rupturing following the arrest of six employees in late June 2019, the scam corralled $2 billion in various cryptocurrency deposits.
The majority of these deposits were in bitcoin — some 180,000 BTC or roughly 1 percent of the outstanding supply. Some of these funds were paid back out to token holders to keep up appearances, and Chainalysis was able to trace the movements of 70,000 BTC that was confirmed stolen by police reports shared by Primitive Ventures partner Dovey Wan.
PlusToken’s remaining team has apparently spent the second half of 2019 mixing these coins and liquidating them via OTC desks through Huobi, Chainalysis claimed. When asked how the blockchain analytics firm was able to trace the coins after they had been mixed, Chainalysis economist Kim Grauer said that the scammers’ mixing (or their attempt to transfer their coins to new wallets in a way that would make tracing their origin nearly impossible) was sloppy.
“They didn’t mix properly,” she told Bitcoin Magazine, adding that a couple of mixers were used, namely self-mixers and Wasabi wallet. Playing it on the safe side, Chainalysis was able to fully verify some 45,000 mixed coins out of the 70,000 attributed to the PlusToken team.
This corroborates findings by independent and anonymous researcher ErgoBTC, though they identified 54,000 mixed coins in total. These coins were shuffled between August and September 2019, ErgoBTC argued in an October 2019 blog post. Roughly 19,000 of these bitcoin were mixed using CoinJoin through Wasabi, and another 35,000 were “self-shuffled,” per the post.
This self-shuffle was highly insufficient for obfuscating the funds, ErgoBTC concluded, partly because the scammers reused addresses. And the Wasabi wallet mixing wasn’t up to snuff, either, partly because they reused addresses again and partly because of other patterns in mixing behavior (such as sending BTC to Wasabi mixers in chunks of 10 to 25).
They also noted that the scammers were likely running multiple Wasabi clients to mix with themselves; this would essentially amount to a Sybil attack in which the PlusToken team assumed the majority of mixing volume on Wasabi and had to mix with themselves.
OTC Laundering
Most of these mixed coins have ended up on Huobi, and they’re being sent to accounts associated with OTC desks, Chainalysis claimed.
Source: Chainalysis
Grauer told us that Chainalysis has linked the Huobi addresses to OTC brokers “from years of investigators building up profiles” on these firms. Many of them, she continued, have low KYC requirements, something that causes a clear gap in compliance and regulation.
These low-KYC desks often accept bitcoin at a discount — this amounts to a premium for buying up tainted, stolen or, in this case, scammed coins. They will then flip these coins on the market or sell them again to another OTC desk, which charges another premium.
“We see a lot of whirling around in this OTC world,” Grauer said, referring to how the firms play “hot potato” with dirty bitcoin to launder it.
When I asked whether or not Huobi knows this is happening — or if it plays matchmaker for these unscrupulous market makers, who Grauer said provide “so much liquidity” for the exchange — she didn’t make any judgments.
“We don’t know exactly what’s going on with Huobi — what’s allowing [this] to happen. We can only see what’s on the blockchain,” she said.
Chainalysis has tried to contact Huobi to no avail; Bitcoin Magazine also sent Huobi a request for comment but did not receive a reply as of the time of this writing.
Grauer didn’t know how the OTC desks were paying out the PlusToken scammers, whether it be in cash, bank wires, puppet bank accounts or in USDT, though Chainalysis found that the team did trade some BTC for USDT directly on Huobi through accounts unrelated to the OTC desks.
Plus Equals Minus?
Chainalysis’s months-long research concluded with the hypothesis that bitcoin’s recent price declines coincide with an influx of bitcoin flows from the PlusToken scammers to OTC accounts on Huobi.
“… spikes in on-chain flow to OTC brokers correlate with drops in Bitcoin’s price,” the Chainalysis report emphasized.
The post also made particular note of a September 20, 2019, transaction of $34 million that was followed by a roughly $2,000 drop in the bitcoin price from $10,000 to $8,000 from September 24 to 26, 2019. It found that PlusToken had cashed out roughly 25,000 BTC (about $165,000,000 at today’s valuation) since August 2019 and has another 20,000 BTC (roughly $130,000,000 at the time of writing) waiting on the sidelines.
This correlation doesn’t prove that PlusToken is causing the price to decline, Chainalysis admits. However, it ran a regression analysis to check bitcoin’s average 40-minute volatility against movements to the OTC accounts, and it found a “statistically significant relationship between PlusToken transfers to Huobi OTC brokers and Bitcoin price volatility for the period of time between September 23rd and 28th.”
Source: Chainalysis
As with the example of the $2,000 price drop, this relies on analysis of a singular price event within a single, multi-day window. John Jeffries, the chief financial analyst at blockchain analytics company CipherTrace, agreed that the scammers are cashing out on Huobi but believes “it has nothing to do with the current BTC price action.”
Chainalysis ultimately thinks it’s impossible to tell for sure, but it still believes that PlusToken’s selling has impacted overall price volatility to some degree.
“Unfortunately, because it’s not possible to distinguish between trades made by OTC brokers in possession of PlusToken funds and all other trades made on Huobi, we can’t say for sure that PlusToken cashouts caused Bitcoin’s price to drop,” per the Chainalysis blog post. “However, we can say that those cashouts cause increased volatility in Bitcoin’s price, and that they correlate significantly with Bitcoin price drops.”
Coin Metrics co-founder Nic Carter commented that he finds Chainalysis’s general analysis “persuasive,” and he said that he wouldn’t be surprised if PlusToken helped to inflate 2019’s mini-bubble.
“I do think it's plausible,” he told Bitcoin Magazine. “I think the converse is also likely true, that PlusToken scooping up huge fractions of supply in the first half of 2019 was one of the main reasons we shot up to $14,000.”
He also thinks that Chainalysis is “lowballing [its] figure” for how much has been liquidated “out of prudence or incomplete data.”
Grauer mentioned in our conversation that some of the coins Chainalysis was following got lost in the mixing process, so they were left out of the final findings.
Shadow Brokers
Whether or not PlusToken’s cashing out is crashing the market, Grauer believes that the OTC web of liquidity (much of which is from dirty funds) exposes a serious gulf in the current regulation and compliance landscape for the mainly Chinese and Southeast Asian OTC desks.
It also offers a glimpse into how this underground band of OTC desks is providing criminals with liquidity in the shadows of the financial system.
“Anecdotally, we’ve been honed in on this laundering infrastructure of people who move stolen and scammed money and they have a process,” Grauer said.
If Bitcoin is the cyber wild west, then these OTC desks are like fences — black-market merchants who buy stolen goods at a discount and resell or trade them.
Huobi probably doesn’t audit these OTC desks’ customers or their KYC requirements, Grauer assumes, and she said that there’s generally a lot of regulatory ambiguity over what these KYC requirements should be. Moreover, there’s little to no transparency into the order books of these market makers for their trades via Huobi.
These missing pieces leave even the most determined blockchain analyses with a puzzling picture of how this dark liquidity affects bitcoin’s market and spot price. The role of these “usual suspects,” as Grauer calls them, in Bitcoin’s shadow markets is up for debate, but events like PlusToken’s attempt to obfuscate its movements give researchers the ability to shine a little light on them.
Still, questions about their direct impact on market dynamics will take a long time to answer.