The story of one pyramid: how PlusToken got 1% of all bitcoins


  • PlusToken’s organizers have played on all human weaknesses

  • The activity of scammers affects the dynamics of the cryptocurrency market

  • Investors should scrutinize and verify projects

International consortium of news organizations developing transparency standards.

Despite continued attempts at regulation, fraudulent projects are still common in the digital asset world. The history of the PlusToken cryptocurrency pyramid once again proved that against the background of the absence of laws, with the help of aggressive marketing and promises of huge profits to investors, you can build a highly profitable financial pyramid.

Find out how the organizers of the largest fraudulent project in the history of the digital asset market managed to get hold of 1% of all bitcoins from our review. 

How it all began

PlusToken was launched in 2018. The developers positioned the project as a decentralized wallet for digital assets with the functionality of a trading platform. Its creators managed to immediately attract the attention of members of the crypto community, to whom they promised an investment income of 10% to 30% (from 6% to 18% according to other sources). At the same time, PlusToken representatives did not hide that the project was built according to the classic Ponzi scheme (pyramids).  

PlusToken advertising in one of the Chinese supermarkets

Almost nothing was required to generate profit from users. The organizers of the company promised to pay dividends for the fact that customers will store their digital assets in the PlusToken wallet.

The founders of the startup focused on Asian countries. The company was actively promoted in China, Japan, Vietnam, but many users from Russia and the EU countries also took part in the project.. 

According to legend, PlusToken was developed by a South Korean team of programmers, led by the company’s founder, a certain Mr. Leo. There was no other information besides the name on the site. 

The first investors received payments, which the organizers gave out for dividends, from the funds of the newly arrived participants. A token was issued to settle with users within PlusToken.As the use of cryptocurrencies grows, new types of tokens appear. They can represent value or something intangible like voices. Two … More PLUS. The cryptocurrency could be found on popular digital asset exchanges such as Huobi and Bithumb.

The organizers of the project quickly realized that some potential investors could not invest in PlusToken, because they did not understand the principle of interaction with cryptocurrencies. In order to attract maximum money, the organizers of the company trained potential users to work with digital assets. For this, they, among other things, conducted master classes.

PlusToken app interface

To simplify the process of converting fiat into cryptocurrency, which is incomprehensible to many, the creators of the project took the trouble to develop a special application. With its help, users could easily exchange Chinese yuan for Bitcoin, Ethereum and other popular coins. Investors were offered to convert the resulting cryptocurrency into PLUS tokens for further earnings in the project. 

Investors received payments, the number of PlusToken members continued to grow. New users were attracted not by unsubstantiated stories of other project participants about large payments. 

To enhance the effect, the current investors of the pyramid used not the most honest methods of promotion. For example, at the beginning of 2019, community members of the project actively disseminated a video on the network, according to which an advertisement for PlusToken appeared in the heart of New York – in Times Square. The video, of course, turned out to be a fake, but many managed to believe in the company’s success and give the organizers their money.

The active advertising of PlusToken by the current members of the crypto community can be easily explained. A referral program worked within the framework of the project. The more users the investor attracted, the higher his income level was.

Participants of the current PRIZM scam use similar methods. 

The project participants received dividends in PLUS. Those who managed to withdraw the project’s cryptocurrency into other coins or fiat were able to make real profits. PlusToken members who stored dividends in pyramid tokens ended up losing everything.

Game over, or finita la comedy

The idyll ended at the end of June 2019. During this period, the first alarming messages from users of the project appeared on the network..

“Has anyone managed to withdraw money from PlusToken after June 28?”, Some asked modestly, while others began to guess that something went wrong with their investments.

Comments of project participants

At the beginning of July 2019, the media erupted with loud headlines, which said that PlusToken organizers disappeared with $ 3 billion of their clients’ investments. Many publications called the project the largest pyramid and exit scam (the scheme involves fraudsters raising a large amount of money from investors, with the subsequent withdrawal into the shadows). 

PlusToken is known to have 3 million registered members as of June 2019. At the same time, the organizers of the pyramid announced their desire to reach the mark of 10 million customers by the end of the year..

Detention of PlusToken organizers

Representatives of the Chinese police were among the first to become interested in the company. In March 2019, information appeared on the network that the law enforcement agencies of Hunan province organized an investigation of the PlusToken Ponzi scheme. During this period, according to the investigation, the suspects fled..

The first members of the scam team were detained on June 25 in Vanuatu. According to some reports, the scammers chose the island state to organize the company’s headquarters. Subsequently, information about the detention of the creators of the pyramid, after its exit scam, appeared on the network in mid-August 2019. Dovi Wan, Managing Partner of Primitive Ventures, was one of the first to share information on the case.. 

The picture presented to her shows five men and one woman. All of them are Chinese citizens. One of them, Chen Bo (in the lower right corner), according to the investigation, turned out to be the head of the Beijing office of the project.


as per sir @loomdart’s request, this thread is abt the on-going sells off made by PLUS Token, the biggest Chinese PONZI which scammed ~ 70K $ BTC + ~ 800K $ ETH

I mentioned it briefly in my last Coindesk oped but worth additional attention as it may cause further sells

– Dovey 以德服人 Wan (@DoveyWan) August 14, 2019

According to Dovi Wang, despite the fact that key suspects were detained, the PRC police were not sure that all the organizers of the scam were in their hands. In particular, law enforcement agencies noted that they cannot get access to funds that fraudsters stole from investors..

Later, the researchers found out that PlusToken organizers used transaction mixing services. With their help, you can increase the anonymity of Bitcoin transactions by erasing information about the real sender of funds. 

PlusToken Ponzi Scheme the cause of the $2000 Bitcoin Crash?

Scammers also used the capabilities of the CoinJoin technology to hide transaction data. Its protocol was introduced in 2013 by the developers Bitcoin Core and Blockstream. The essence of the technology lies in the deliberate aggregation of transaction data, so that later it would be impossible to determine who exactly owned any part of the sent amount. It is known that cybercriminals used the WasabiWallet for transfers using CoinJoin technology.

Confirmation of the version of the investigation that not all of the participants in the scam were arrested was not long in coming. Shortly after the arrest of the suspects, funds from wallets related to PlusToken began to flow to digital asset exchanges. Including Bittrex and Huobi. According to Dovi Wan, scammers sent funds to exchanges in small batches, 50-100 BTC each..

2. Above addresses are only the known ones, according to police report the total scammed amount is about $ 3B. The core team member were chased down by police 2 months ago and will be in jail for decades.

However, the cryptocurrency they scammed is not able to be crawled back

– Dovey 以德服人 Wan (@DoveyWan) August 14, 2019

Case researchers managed to find two addresses where PlusToken organizers stored large amounts of bitcoins. One of them had 74 thousand BTC, the other – 95 thousand BTC (about $ 1.5 billion, as of June 26, 2020). 

In total, according to an analyst who runs a blog under the nickname Ergo, scammers had about 200 thousand bitcoins (about 1% of the cryptocurrency issue) in their hands. At the same time, during the existence of the project, according to another version, its founders managed to attract over 480 thousand BTC. In addition to bitcoins, the organizers of the pyramid got 789 thousand ETH and 26 million EOS.

Just dig my old chats (was in their chat rooms) there are two others BTC addresses belong to PlusToken

74K $ BTC 1Dd5VTCkRtMG8bpuHZrjkLf1TeZ8cwZGDe

95K $ BTC

– Dovey 以德服人 Wan (@DoveyWan) August 14, 2019

Impact of PlusToken activity on the bitcoin rate

After the exit scam, the PlusToken organizers ended up with a large amount of cryptocurrency. Many members of the crypto community agreed that with the help of the stolen money, scammers were able to manipulate the digital asset market. For example, Dovi Wan that Bitcoin price movement in 2019 was largely due to PlusToken’s operations..

“PlusToken’s actions from April to today remain the basis for [bitcoin’s] rise and fall,” she said at the end of November 2019..

IMO PlusToken is the main force for both the bull and bear from April to YTD

What I can share publicly here

1.After CNY 2019 (Feb 5th) PlusToken on-ramp spike up significantly in Mar and Apr

2. Its team were arrested Vanuatu time on 6/25 .. BTC crashed a day after

– Dovey 以德服人 Wan (@DoveyWan) November 27, 2019

As an example, Dovi Wan led the growth of bitcoin in April 2019 – right after the active phase of fundraising by scammers. She also drew attention to the behavior of BTC after the first arrest of the organizers of the scam on June 25.

Bitcoin exchange rate movements referenced by Dovi Wan

In December 2019, analysts from Chainalysis concluded that a large amount of cryptocurrency is still in the hands of PlusToken organizers. The movement of coins, in their opinion, is capable of influencing the digital asset market. Bloomberg analysts, in turn, came to the conclusion that the beginning of the decline in the value of BTC in the summer of 2019 fell on the date of the arrest of the organizers of the scam.

Bitcoin chart

Stolen PlusToken money movements

After the pyramid began to collapse, the researchers began studying the scheme of the project. Clain analysts were able to clarify many details of PlusToken. In particular, the research team has drawn up a graph of the movement of the pyramid funds. A number of conclusions can be drawn from it:

Is Bitcoin a Pyramid or Ponzi Scheme?

The story of one pyramid: how PlusToken got 1% of all bitcoins
  • Assets were consistently transferred to the company’s accounts until July 2019.
  • Throughout the entire life of the pyramid, you can observe a gradual increase in attracted funds.
  • The withdrawal of large batches of coins began in March 2019. From time to time, the organizers of the project sent cryptocurrency to their wallets. Based on the regularity of the withdrawal of assets, it can be assumed that the scammers were preparing for an exit scam.

The blue line is the total amount of bitcoins in the company’s accounts, the columns are the attracted (green) and withdrawn (red) funds. Data: Clain study

The researchers also drew attention to the statistics of the platforms, to which the scammers subsequently transferred the received cryptocurrency. The project representatives sent about 60% of the funds to their pre-registered wallets. More than 15% of fraudsters transferred to the Huobi Global digital asset exchange. Part of the funds went to HaoBTC and ChBtc. 

Data: Clain study

Clain researchers also analyzed the geography of PlusToken inbound and outbound transactions. It turned out that most of the project’s operations took place in China (CN). 

Data: Clain

Clain analysts found that the most active fraudsters withdrew funds from their wallets in November 2019.

Data: Clain

The chronology of the movement of fraudsters’ funds is as follows:

  • On November 21, 2019, cybercriminals started selling on the market at 1,300 BTC per day. 
  • On December 19, 2019, members of the crypto community recorded the movement of 789 525 ETH, which are related to the pyramid.
  • On February 11, 2020, information about the movement of 12 thousand BTC of the company appeared on the network.
  • On March 8, 2020 13 thousand BTC PlusToken hit the mixers.
  • On March 12, 2020, information appeared on the network that 37,725 BTC of the scam organizers were frozen in the transaction mixing services.
  • June 22, 2020 transfer of 26 316 340 EOS to an anonymous address.
  • June 24, 2020 transfer of 789 534 ETH to an anonymous address.

According to analyst Alistair Milne, the behavior of the pyramid organizers is in many ways similar to the actions of the Ripple crypto project team..

Read also: PlusToken Pyramid Powered Millions of XRP

How PlusToken launders money

The fraudulent scheme is based on hiding real addresses using transaction mixing services. In order to attract less attention, the scam organizers transfer small amounts. In addition, most platforms, within the walls of which you can launder cryptocurrency, do not have enough liquidity to process a large amount of funds at once. According to a number of researchers, company representatives could also use wallets with built-in mixers..

“It haunts me” : The never ending bitcoin Ponzi scam

Having “whitened” the funds in this way, the fraudsters gained access to further operations with the stolen cryptocurrency outside the scrutiny of the crypto community members. In this case, the whole process of money laundering can be schematically represented as follows:

  • The first point is changing addresses to “not exposed”. For this, the cryptocurrency was carried through transaction mixing services, with the subsequent transfer of small batches to anonymous wallets.
  • The moment the fraudsters achieved anonymity, they gained access to a confidential transfer of funds to digital asset exchanges.
  • To make a profit, the organizers of the scam had to sell the cryptocurrency on trading platforms. Since a large amount of funds was in the hands of the scammers, the deals they organized could become a factor that provokes panic sales.. 

Thus, according to the researchers, PlusToken organizers were able to put pressure on the digital asset market.

Clain analysts tried to schematically represent the direction of transactions of the PlusToken cluster:

  • The red spot in the center is the WasabiWallet scammers’ addresses. The possibilities of money laundering with the help of the service, according to researchers, have become a key link in the fraudsters scheme.
  • The small red spot on the left reflects the transactions carried out by the scam organizers using the Huobi exchange.
  • Thin threads reflect connections between money laundering and exchange points. Many of them stretch from WasabiWallet to Huobi. From this, we can conclude that the scammers used the digital asset exchange to further distribute the already laundered money..

Scheme for the transfer of funds stolen by fraudsters. Data: Clain

According to OXT researchers, the organizers of the scam have already laundered at least $ 1.3 billion worth of cryptocurrency.. 

Some researchers have come to the conclusion that the number of digital asset exchanges through which attackers launder stolen cryptocurrencies is much wider. Including, Binance and MXC Exchange are accused of aiding scammers.

Something needs to be done. PlusToken is laundering funds through your exchanges. @ Cz_binance @binance @HuobiGlobal @OKEx @MXC_Exchange @gate_io @HBTCNews

– Leonidas Hadjiloizou (@LeoHadjiloizou) June 22, 2020

Many people believe that the organizers of the exit scam also use alternative methods of money laundering. For example, some researchers have linked PlusToken to recent Ethereum transactions in which the sender paid record high fees. According to a number of analysts, the fraudsters included funds that they needed to launder in the transaction cost. The proposed scheme is as follows:

  • Owners of stolen funds set high Ethereum transfer fees.
  • The mining pool processes the operation and receives a reward.
  • After the mining pool makes a rollback, returning the funds already laundered to the scammers.

On the network, you can find a lot of studies in which analysts from different companies are trying to draw up a scheme for the movement of PlusToken tokens. Unfortunately, there is no one-size-fits-all approach that would accurately track fraudulent asset movements. Each team uses its own tools for the job. As a result, research results vary. Time will tell whose approach to analysis will be more accurate.

Summing up

You can really make money on pyramids. In the case of PlusToken, the first scam participants were able to get profit, who immediately after the transfer of dividends transferred them to fiat or another cryptocurrency. Despite the fact that some of the investors in the fraudulent project still remained in the black, it is worth remembering that decisions to invest in pyramids carry high risks. At least no one knows when the scam organizers will decide to leave it, taking all the users’ assets with them. To other conclusions:

  • The crypto community still lacks tools to protect against exit scams.
  • Do not trust ads unconditionally. All information about projects must be independently checked.
  • Fraudsters are able to put pressure on the entire digital asset market, using for this sale of money stolen by them.
  • Often, pyramids are hidden behind promises of high, in comparison with other projects, profitability.
  • Don’t trust projects whose organizers are hiding.

Learn about other scams and methods that attackers used to deceive their victims from our material.


All information contained on our website is published in good faith and objectivity, and for informational purposes only. The reader is solely responsible for any actions he takes based on the information received on our website..

Share Article

The story of one pyramid: how PlusToken got 1% of all bitcoins
The story of one pyramid: how PlusToken got 1% of all bitcoins
The story of one pyramid: how PlusToken got 1% of all bitcoins