Unveiling the largest Ponzi scheme in cryptocurrency history

Formation of the Scam As some of the larger cryptocurrency scams in Europe began to fade away, the largest Ponzi scheme in the cryptocurrency space started to spread in China and other Asian countries. This scam directly siphoned off $6 billion from investors and was once valued at $17 billion before its founder fled, leaving investors with just one message: "Sorry, we have run away." In June 2018, information about a new cryptocurrency wallet and exchange flooded chat groups on various social media platforms in China. Starting from a group led by a community leader from an unknown crypto company, it quickly spread across China and soon reached most parts of Asia through WeChat and other messaging apps. Overall, these groups initially seemed innocent. Some people offered free basic knowledge about cryptocurrencies in the groups, teaching users how to start buying and trading, and providing examples of making money. The groups were small, with chat rooms containing 100 to 200 people, and anyone who raised questions that the organizers did not want to address would be kicked out. Soon, PlusToken—the company behind the group—began hosting meetings and gatherings in China and South Korea. Before long, events were also held in much of Southeast Asia and far-off places like Russia, Ukraine, Germany, and Canada. In those largest cryptocurrency scams, there were some commonalities. Just like OneCoin and Bitconnect, the organizers behind PlusToken knew how to attract crowds. 【OneCoin is a Ponzi scheme disguised as a cryptocurrency, and BitConnect was accused by the SEC of illegally raising $2 billion.】 Their venues were packed with people eager to learn more about the buzzwords of Bitcoin and cryptocurrencies, and how they could start owning some digital currency. Despite the cryptocurrency market crashing, those who had yet to enter the space remained optimistic, hoping to replicate the wealth myths of previous years. PlusToken easily attracted these individuals. They released captivating promotional videos featuring their members, or paid actors, passionately delivering speeches, drawing more and more people into their fan groups and ever-growing chat rooms. These individuals—unclear if they were compensated—were treated as brand ambassadors, urging PlusToken's Korean and Chinese audiences to join their groups. It seemed no one noticed (or cared) that no employees (or anyone claiming to be company staff) stepped forward. However, the leaders of PlusToken appeared to have a clear plan, and it was effective: gain people's trust, build their expectations for high investment returns, and then suddenly respond to their true demands. Shortly after the groups were created, representatives from PlusToken began mentioning an investment platform that promised high returns of 6% to 18% per month, as long as members first invested $500. Is "Decentralization" Safe? "Decentralization" has been a buzzword in the cryptocurrency market, both in the past and present. It is heavily promoted; if something is decentralized, especially if it uses blockchain technology, then it must be good. In some cases, this is indeed the reality. Centralized institutions are notoriously easy to hack. Countless companies that store data on centralized servers have been breached, with hackers exposing users' private data for all to see. There have been many such examples in the mainstream media. Experian, Adobe, LinkedIn, and Yahoo are just a few of them, showcasing what happens when large companies holding vast amounts of highly sensitive and valuable user data fail to take adequate security measures or neglect to protect customer data—websites are often breached, and millions of users' data are exposed. In the cryptocurrency space (as we will soon see with the examples of Quadriga and Mt. Gox), many cryptocurrency exchanges that did not take sufficient cybersecurity measures were hacked, resulting in millions of cryptocurrency investors losing all their funds. Anything that mentions the term "decentralization" is considered safe. A decentralized cryptocurrency wallet and trading platform was launched shortly after PlusToken, and it was effective—a perfect marketing strategy. PlusToken repeatedly assured that its platform was secure, boasting that they used artificial intelligence technology and invested billions of dollars in research on security technology, with core members coming from the original tech team of Samsung and Google Pay, and their development was conducted in research labs in South Korea. Buying, storing, and spending cryptocurrencies is generally considered the most challenging aspect, especially in the years leading up to PlusToken's launch in 2018: user experience was once non-existent. There were many cryptocurrency wallets on the market, but none provided a simple user experience. Cryptocurrency users needed a wallet that offered the best and simplest user experience while ensuring security. The first company to create a wallet with a good user experience would create extraordinary wealth. For promising cryptocurrency wallet companies, they once (and still do) had a massive user base and could earn transaction fees from every remittance. PlusToken was not the first company to realize this. PlusToken and its wallet and exchange were eager to gain more users and funds to maximize the utility of their new wallet. The community PlusToken built had no typical early adopters, investors, or users of cryptocurrencies, only ordinary people with a mindset of getting rich quickly. People trusted PlusToken because it was seen as a builder of online community relationships, as the team was dedicated to popularizing knowledge. Of course, this gave them a perfect opportunity to set up educational courses to mislead and deceive community members. Arbitrage AI Dog In 2015, the PlusToken team claimed to have developed an artificial intelligence robot for arbitrage trading (a trading method that involves buying and selling assets repeatedly to profit from price differences in different markets). The robot was said to focus on price arbitrage of different cryptocurrencies and other crypto markets. Cryptocurrency arbitrage trading is highly risky. Due to the marginalization and lack of regulation in the cryptocurrency market, there is virtually no security: cryptocurrency exchanges frequently shut down and run away, and investors are likely to become victims of hackers or the founders exiting the scam. Exchanges can also close certain wallets, preventing users from sending or accessing certain cryptocurrencies; trades can easily result in lost coins, sometimes losing them during the transaction process. Therefore, arbitrage trading is the riskiest type of cryptocurrency trading. PlusToken seemed to pay little attention to these risks. They told investors that their robot—the AI Dog—would make money for each user. The AI Dog would capture the price and trading volume of each major cryptocurrency across different exchanges—according to PlusToken's website—and would conduct arbitrage trading on its own. All users needed to do was deposit any cryptocurrency worth $500 into the PlusToken platform. Then the AI Dog would automatically trade at the highest yield and return the cryptocurrency and profits to the user's wallet. Ordinary cryptocurrency wallets, aside from storing cryptocurrencies and ensuring their security, do not provide any other benefits to the owner. PlusToken boasted that its users could not only store cryptocurrencies in their wallets but also earn profits from the cryptocurrencies they held. PlusToken also touted the security of its wallet, assuring users that their products were genuinely decentralized and that the cryptocurrencies held by users would be securely stored in their decentralized wallets. A small factor regarding how PlusToken maintained its users' cryptocurrencies was obscured. PlusToken claimed to earn profits for its users through arbitrage. According to the definition of "arbitrage," for the AI Dog to benefit from arbitrage trading, it would have to transfer these cryptocurrencies from the users' wallets and trade them between different exchanges, which is one of the most well-known high-risk operations in the cryptocurrency space and can easily result in lost coins. PlusToken never explained how they could profit from arbitrage trading while securely storing users' cryptocurrencies in their wallets. For anyone with experience handling cryptocurrencies or trading them, this makes no sense. It is impossible to securely store cryptocurrencies while sending them between exchanges for repeated trading. The people behind PlusToken were not experienced in cryptocurrency; their target was those who could be lured into sending their funds to their platform. Promises of High Returns "FOMO" (fear of missing out) is another popular term in the cryptocurrency space, meaning the fear of missing out. This sentiment also applies to PlusToken. They explained to investors that the opportunity to profit from cryptocurrency arbitrage trading would only appear in the short term, and soon the cryptocurrency market would stabilize with more investors' funds entering, subsequently losing volatility, and thus no big money could be made. This was excellent high-pressure marketing, creating a misconception among investors that they must act immediately, or they would miss out! To attract a large number of people to take immediate action and deposit money into their platform, just like OneCoin and Bitconnect and countless other cryptocurrency scams, they had to offer high returns to investors. Anyone holding $1,000 worth of cryptocurrency on the platform would receive returns of $60 to $180 per month, or $720 to $2,160 in the first year, paid in their own digital currency, PlusToken. Just like all other scams offering such high returns, these returns are unsustainable and cannot be reliably guaranteed by any trading robot, no matter how good it is. Anyone promising high returns should be wary of whether it is a "scam," but these high returns coincided with the phase of the cryptocurrency market's explosive growth. From early 2017 to mid-2018, when PlusToken was launched, the cryptocurrency bubble caused some investors' investments to multiply by hundreds of times. In this context, some people considered a monthly return of 6% to 18% to be a safe or even moderate guarantee. These promises also occurred against the backdrop of multi-level marketing scams that plagued China and Asia in recent years. Facing the same investors, the returns offered by PlusToken seemed reasonable for those eager to get rich and a lifeline for those wanting to enter the seemingly inaccessible cryptocurrency space. Thus, within a year of its launch, PlusToken transformed from an unknown entity into a large platform with millions of users, each depositing at least $500 into the platform. It is estimated that by June 2019, when it fled, PlusToken had funds from 3 to 4 million (perhaps more) investors on its platform. This rapid growth was partly due to their cunning marketing, attracting crowds through so-called educational WeChat groups and high-pressure marketing campaigns; partly due to their high return promises and initial payouts; and partly due to investors' hopes or greed. The key was that PlusToken paid out investment returns in its early development and for a time seemed to be running smoothly. Generous Rewards and Creative Marketing PlusToken set up an exciting reward structure for its referrers. All people needed to do was invest at least $500 on the platform. If someone's friend joined and invested $1,000, that person would not only earn from their own investment but also receive an additional reward of $60 to $180 from each person they referred. If they referred 10 people, and each referral invested $1,000 on the platform, they would earn an additional $600 to $1,800 monthly from their referrals, in addition to their own monthly investment returns. Just as we saw in multi-level marketing scams like OneCoin and Bitconnect, referral commissions were divided into several levels. PlusToken would pay referral commissions to 10 levels of referrers. Investors could earn from their direct referrals, and anyone whose direct referral brought in new investors would receive 10% of the new investor's investment as a reward, with a pyramid structure extending up to 10 layers. Even those who merely brought in their friends and family could earn a monthly income greater than their initial investment by referring enough people. Some people did question whether this was a Ponzi scheme, but the general consensus seemed to be that as long as the money kept flowing in, everything was fine. The high referral rewards offered by PlusToken stimulated some quite aggressive marketing and recruitment behaviors among investors. Some placed a PlusToken logo in the vegetables at supermarkets, using this logo to tell their YouTube followers that even supermarkets accepted PlusToken tokens. Presumably, the supermarket never realized this incident. Keen investors, incentivized by high commissions, also launched their own recruitment activities. They disguised recruitment as information-sharing events, encouraging everyone they knew to invest. In no time, about 10,000 people were brought in to invest by their friends, family, followers, and acquaintances, with PlusToken bringing in about $4 billion in additional funds. Some of these individuals believed they could get rich on the platform but did not care how the process worked. Many others thought they were genuinely buying Bitcoin and other cryptocurrencies and believed they had found a safe way to store these assets in a decentralized wallet, without researching how the platform operated or stopping to question the risks. PlusToken maintained the illusion that all the funds obtained by the platform were used to develop the wallet and exchange, aiming to dominate the cryptocurrency market when the next bubble arrived. The more actively investors promoted PlusToken, the more rewards PlusToken would give them, increasing compensation based on their referral results and offering accolades. Members would upgrade to highly coveted titles based on their promotional results. "Big Boy" and "Master" were the most popular titles awarded to the most outstanding recruiters. Everyone wanted to reach these levels. As long as investors continued to invest, the platform would keep paying rewards until the investments stopped. Hidden Cryptocurrency Information From the launch of PlusToken in June 2018 to June 2019, just one year later, investors began to complain about delays in their withdrawals. Some posted complaints on Chinese social media, stating that their withdrawal requests had been submitted for 35 hours without any response. Soon, still in June, investors were unable to withdraw. The PlusToken team initially tried to quell these complaints by claiming that the withdrawal issues were due to a hacker attack. Cryptocurrency transactions, such as sending Bitcoin to another address, display details of the sending and receiving addresses, as well as how much was sent. With Bitcoin and some other cryptocurrencies, information can be left in the transaction data. In the earliest generated Bitcoin genesis block, Satoshi Nakamoto (the anonymous creator of Bitcoin) left a message in the transaction: "The Times 03/Jan/2009 Chancellor on brink of second bailout for banks." The founder of Bitcoin wanted to show the world that the creation of digital currency was a response to the failure and manipulation of the global banking system. When the founders of PlusToken fled, they still desperately tried to steal users' cryptocurrencies from the exchange, sending them to their wallets on other exchanges. During the escape, the unknown founders of PlusToken left a message hidden in one of their transactions, similar in style but lacking any of Satoshi Nakamoto's elegance and goodwill. The PlusToken team left a message: "Sorry, we have run away." Users collectively lost $4 billion, while the founders and the PlusToken team fled. Before this, users had essentially watched their funds accumulate in the app without cashing out. PlusToken charged a 5% transaction fee on any funds transferred out of accounts, and with the fantasy that the AI Dog could earn more money, users seemed to have ample reason to leave their cryptocurrencies on the platform. The way PlusToken was set up meant that investors could not control the assets in their wallets. Therefore, when the founders exited, all users' funds were suddenly locked. All contact points for PlusToken had disappeared. With no other options, over 200 investors pressured authorities in Seoul, South Korea, to investigate, as people quickly realized this was a massive Ponzi scheme. The South Korean authorities took appropriate action, launching a nationwide manhunt. For many internationally, this was their first time hearing about this rapidly developing and large-scale scam in Asia. If this was just the direct investment of people in the platform (totaling up to $6 billion), then the losses would stop there, and no one else would be directly affected. However, the token had been pushed up to $340 each by Chinese investors under the influence of FOMO, bringing the project's total market value to $17 billion. If PlusToken had been listed on mainstream cryptocurrency information site CoinMarketCap, it would have made it the third-largest cryptocurrency in the world, fortunately, it did not. Although the identities of the PlusToken team and its founders remain a mystery, within days of the team's escape, Chinese police collaborated with Vanuatu police in Vanuatu to arrest six Chinese citizens and extradite them back to China. While those arrested were all Chinese, the scam's impact extended far beyond China. Investors from much of Asia, as well as Russia, Ukraine, Germany, and even Canada, suffered losses. PlusToken's investors faced significant losses. However, the people arrested did not seem to be the masterminds. The head of PlusToken was never caught. It is said that the project was led by a young Korean named Leo, and aside from some strange photos, there are no further details; it remains unknown who the true mastermind behind the $17 billion PlusToken scam is. Where Did the Money Go? In all other cryptocurrency exit scams, it seems that the founders took the money. In PlusToken, it is unclear who took the funds, which is where the story of PlusToken becomes interesting. The raid on the six suspects in Vanuatu was supposed to provide police with some clues, but according to police reports, it did not. Cryptocurrency analysis firm Chainalysis tracked down cryptocurrencies worth hundreds of millions of dollars belonging to investors, which they could no longer access; the money was entirely under PlusToken's control. A notable feature of cryptocurrencies is that, aside from some privacy-focused cryptocurrencies that hide transactions, most cryptocurrencies (like Bitcoin and Ethereum) have all transactions publicly visible on the blockchain. This makes it easy for cryptocurrency analysis firms to track digital assets associated with PlusToken wallets and notice if anyone has moved those tokens. For observers, it is worth noting that since the project was halted in June 2019, PlusToken's sell-offs have been directly linked to the price crashes of Bitcoin and cryptocurrencies at different times.

The total value of the cryptocurrencies involved in the PlusToken case has exceeded 15 billion yuan.

On November 26, 2020, the Intermediate People's Court of Yancheng City, Jiangsu Province, made a final ruling on the PlusToken case, clearly ruling to confiscate all cryptocurrencies seized in the case and to turn over the resulting funds and their appreciation to the national treasury in accordance with the law.

According to the information disclosed in the judgment, law enforcement agencies successfully seized various cryptocurrencies during the investigation, including 194,775 Bitcoins, 833,083 Ethereum, 1.4 million Litecoins, 27.6 million EOS, 74,167 Dash, 487 million XRP, 6 billion Dogecoin, 79,581 Bitcoin Cash, and 213,724 Tether.

Ultimately, the main organizers of the case were sentenced to criminal penalties for their serious illegal activities involving pyramid scheme fraud, and all funds from the platform have been legally confiscated.

This scam may have been stopped, but many stolen cryptocurrencies remain unaccounted for, controlled by its leaders. They can still sell these cryptocurrencies at any time, causing further crashes in the entire cryptocurrency market, affecting everyone. The Second Scam by the Same Team Another Scam: A $1 Billion Clone Scam Just a month after PlusToken began, a new multi-level marketing cryptocurrency scam was born in China. WoToken claimed to be a smart cryptocurrency wallet that could provide users with high returns without requiring them to do any work; they just needed to invest some funds, and the platform would magically make them rich. Although the return rates were lower than PlusToken, anyone other than those accustomed to the promised returns of multi-level marketing scams would realize this was a scam, and these schemes had become quite common in some parts of Asia. Those investing $1,000 were promised returns of up to 0.5% daily and up to 182.5% annually. Those investing over $5,000 would receive daily returns of up to 0.65% or annual returns of 237.25%. Given that annual returns above single digits are already considered high, these return rates are essentially impossible to guarantee. However, as we have seen, one scam after another has made such guarantees. Like PlusToken, WoToken claimed that its users' earnings came from algorithmic trading robots. Just like PlusToken, it never managed to prove the existence of these robots. The two also shared other similarities—such as offering generous referral commissions to their partners, a common tactic in the cryptocurrency space, leveraging partners to bring in as many investors as possible. WoToken also employed some rather creative marketing tactics. The website claimed to have partnered with a Mastercard issuing company, Global Cash, which would allow its users to spend the cryptocurrencies stored in their WoToken wallets. To prove this, they wrote the word Mastercard on their website but did not include the Mastercard logo. Clearly, they had no partnership with Mastercard. In short, it was identical to PlusToken in appearance and behavior. Fortunately, the Chinese police realized this scam within a few months, and just over a year later, by the end of 2019, many investors began to complain about being unable to withdraw funds, after which the scam was shut down. By the time WoToken ceased operations at the end of 2019, it had defrauded over $1 billion from 715,000 individual investors, using a "super large multi-level marketing network" to siphon off investors' money. Less than two years after PlusToken's collapse, Chinese police dismantled a second cryptocurrency Ponzi scheme that almost completely replicated PlusToken, involving amounts exceeding billions of dollars. Six people were arrested and sentenced for this latest scam, and its leaders appeared to come directly from PlusToken. It is incredible that any criminals could escape from a scam of such scale, let alone two. In July 2020, after WoToken was shut down, 109 people were arrested in connection with the PlusToken case, including 82 key members of the scam and 27 identified as core team members, all deemed primary suspects. Given the scale and complexity of the scam, there should be many more people at large. It is still unknown how many people were involved after PlusToken and how much they managed to scam from people and keep.

This August, a news report about PlusToken once again drew widespread attention in the cryptocurrency market.

According to strict monitoring by Lookonchain, a batch of wallets that had been dormant for 3.3 years recently began transferring large amounts of Ethereum (ETH) assets, potentially involving a total of 789,533 ETH, worth approximately $2 billion.

Further on-chain tracking and analysis indicated that these funds originated from a wallet named "Plus Token Ponzi 2."

During 2020, this wallet dispersed a total of 789,533 ETH across thousands of different wallets and had remained silent since April 2021, with no transaction activity recorded.

The Latest Cryptocurrency Ponzi Scheme

On October 17, 2024, the U.S. Department of Justice announced that Juan Tacuri, the initiator of the Forcount cryptocurrency "Ponzi scheme," was sentenced to 20 years in prison.

Tacuri was not only sentenced to a lengthy 20-year term but was also ordered to pay $3,610,718 in restitution and to undergo one year of supervised release after serving his sentence.

Prosecutors noted that Tacuri's fraudulent scheme targeted victims worldwide, primarily within the Spanish-speaking community. The scam defrauded a significant amount of money from investors mainly speaking Spanish from around the world, causing substantial losses to numerous investors.

Judge Analisa Torres imposed the 240-month sentence, representing the maximum penalty prescribed by law, highlighting the U.S. judicial system's strict crackdown on fraudulent activities in the cryptocurrency space.
Perhaps the scammers are repeating the tricks they learned from PlusToken.