Attribution: pseudonymous — no public actor attribution at OAK v0.1 cutoff.
Loss: approximately $2B–$5.7B in investor losses depending on the source and the asset-price snapshot used. Chainalysis traced ~180,000 BTC (~1% of outstanding supply at the time) plus large balances in ETH, EOS, LTC, BCH, DASH, DOGE, XRP, and USDT into PlusToken-controlled wallets; Chinese authorities placed total investor losses at approximately 40 billion yuan (~$5.7B) when Yancheng court filings were published; the Yancheng verdict itself fixed the prosecuted-fraud figure at ~14.8 billion yuan (~$2.25B). Chinese authorities ultimately seized digital assets that, at the date of the seizure announcement, were valued at approximately $4.2B (194,775 BTC; 833,083 ETH; 27.6M EOS; 1.4M LTC; 79,581 BCH; 74,167 DASH; 6B DOGE; 487M XRP; 213,724 USDT). OAK Techniques observed: OAK-T11.005.002 (Fake-Custodian / Fake-Asset-Manager Fraud — primary; PlusToken presented as a multi-asset crypto wallet with a fictitious "AI-powered" arbitrage engine promising ~30% monthly returns; the on-chain receivables were real BTC/ETH/EOS/etc. deposits into operator-controlled wallets, but the displayed balances and trading returns were entirely database fictions, and payouts to early entrants were funded from later deposits in classical Ponzi structure) + OAK-T7.001 (Mixer-Routed Hop) + OAK-T7.003 (Cross-Chain Bridge Laundering — post-collapse laundering of ~180,000 BTC and ~833,083 ETH through Huobi OTC desks and mixer routing, with Chainalysis publicly correlating PlusToken cashout flows to BTC price declines). OAK-Gnn: not applicable. PlusToken was a Chinese-operated scheme; the masterminds are individually named in PRC court filings (Chen Bo et al.). OAK-G03 framing is explicitly NOT applicable — PlusToken sits outside OAK's Russian-cluster actor surface entirely. Attribution: Chinese authorities; 109 suspects detained in mid-2019 (27 alleged masterminds plus 82 core members repatriated from Cambodia, Vanuatu, Vietnam, and Malaysia); Yancheng (Jiangsu) Intermediate People's Court sentenced the ringleaders in late 2020 to terms ranging from two to eleven years.
Key teaching point: PlusToken is the largest crypto-Ponzi case on the public record at the time of the incident (until OneCoin's later prosecutions arguably surpassed it on a fiat-loss basis), and it is structurally distinct from every other case currently in the OAK corpus along two axes worth naming.
PlusToken (also "Plus Token") was a cryptocurrency Ponzi scheme that operated from approximately 2018 through mid-2019, primarily targeting retail investors in mainland China and South Korea. The scheme presented itself as a multi-asset crypto wallet promising monthly returns of up to ~30% sourced from a purported "AI-powered" arbitrage / exchange-trading engine; in fact, the returns paid to early investors were funded entirely by deposits from later recruits — a classical Ponzi structure with the additional feature that the investor receivables were denominated in on-chain cryptocurrency (BTC, ETH, EOS, LTC, and others) rather than fiat. The scheme grew to over 3,000 referral-tier layers and is reported to have enrolled in excess of two million participants before collapse.
PlusToken halted withdrawals in late June 2019, citing "system maintenance"; this is the canonical exit-scam tell, and the on-chain record from that window shows the operator wallets reorganising into laundering-stage clusters within days. Chinese authorities arrested the first six PlusToken operators in late June 2019, and in July 2019 launched the broader nationwide crackdown that ultimately produced the 109-suspect figure. The Yancheng Intermediate People's Court convicted the ringleaders in late 2020.
For OAK's purposes, PlusToken is the canonical worked example of an off-chain investment-fraud entry vector with on-chain receivables, catalogued at OAK-T11.005.002 (Fake-Custodian / Fake-Asset-Manager Fraud). The case is also one of the most consequential laundering events in the public on-chain record: Chainalysis publicly attributed material BTC market sell-pressure waves through late 2019 and into 2020 to the laundering of PlusToken-controlled coins through Huobi OTC desks, and the Chinese government's later auction of seized PlusToken assets is its own structural feature worth documenting.
| When | Event | OAK ref |
|---|---|---|
| 2018 | Chen Bo and co-conspirators establish PlusToken as a "multi-asset wallet" with promised ~30% monthly returns sourced from a purported AI arbitrage engine | T11.005.002 (fake-custodian platform established — operator-controlled wallet with fictitious AI-arbitrage engine and database-backed balance display) |
| 2018–2019 | Recruitment via Telegram channels and offline community events in mainland China and South Korea; multi-tier referral structure grows to >3,000 layers and >2M participants | (off-chain marketing — no OAK v0.1 Technique) |
| 2018–2019 | On-chain receivables accumulate in PlusToken-controlled wallets across BTC, ETH, EOS, LTC, BCH, DASH, DOGE, XRP, USDT | T11.005.002 (on-chain receivables accumulation — real deposits into operator-controlled wallets with fictitious balance growth) |
| 2019-06 (late) | PlusToken halts withdrawals under "system maintenance" pretext; classical Ponzi exit-scam tell | (collapse / extraction event) |
| 2019-06 (late) | First six PlusToken operators arrested by Chinese authorities | (law-enforcement response) |
| 2019-07 | Chinese authorities launch nationwide crackdown on PlusToken | (law-enforcement response) |
| 2019 H2 | PlusToken-controlled wallets reorganise; Chainalysis publicly traces ~180,000 BTC and ~833,000 ETH into PlusToken clusters | (forensic reconstruction) |
| 2019 H2 – 2020 | PlusToken-controlled funds laundered through mixers and via OTC desks (Huobi OTC publicly named); Chainalysis publishes correlation between PlusToken cashout flows and BTC price drops, including the September 2019 $10K → $8K decline | T7.001 (Mixer-Routed Hop) + T7.003 (OTC-desk-routed off-ramp via Huobi OTC) |
| 2020-07 | Chinese authorities announce arrest of all 27 alleged masterminds plus 82 core members repatriated from Cambodia, Vanuatu, Vietnam, and Malaysia (109 total) | (law-enforcement response) |
| 2020-11 | Chinese authorities announce seizure of PlusToken digital assets valued at approximately $4.2B | (asset seizure) |
| 2020-12 | Yancheng (Jiangsu) Intermediate People's Court sentences the ringleaders to prison terms of 2–11 years, with fines from 120,000 yuan to 6M yuan; prosecuted-fraud figure fixed at ~14.8B yuan (~$2.25B) | (verdict) |
| 2020 onward | PRC government auctions of seized PlusToken cryptocurrency assets; on-chain effects of these government-side liquidations are observable in the public record | (post-seizure liquidation) |
- The entry vector is off-chain, the receivables are on-chain. PlusToken's recruitment, referral structure, and return-promise narrative all lived off-chain (Telegram channels, in-person community events, multi-tier marketing literature). What lived on-chain was the deposit ledger: BTC, ETH, EOS, and other receivables flowing into operator-controlled wallets. A defender watching only on-chain artefacts would see a wallet cluster accumulating large multi-asset balances with broad retail-deposit fan-in, but the off-chain narrative — the thing that distinguishes Ponzi from legitimate custody — is invisible to on-chain instrumentation.
- The collapse signal is operator-imposed withdrawal halts, not an on-chain extraction event. The June 2019 "system maintenance" withdrawal halt is the canonical Ponzi exit-scam tell, and it precedes the on-chain laundering reorganisation. Defender risk teams who track only large outbound transfers would have missed the lead indicator entirely; the lead indicator was the off-chain customer-communication change, not an on-chain primitive.
- The laundering chain ran through OTC desks at named exchanges. Chainalysis's public reporting through 2019–2020 specifically named Huobi OTC as the off-ramp path for the PlusToken laundering, citing relatively lower KYC friction at OTC desks than at the underlying exchanges' on-platform deposit / withdrawal surfaces. The laundering pattern is structurally distinct from the mixer-only patterns seen in OAK-G01 cases of the same era.
- Cashout-flow correlation with BTC price was publicly documented. Chainalysis's reporting through late 2019 and early 2020 framed PlusToken cashouts as a material contributor to BTC price volatility, including the September 2019 $10K → $8K decline. This is unusual: most on-chain forensic work in the OAK corpus stops at attribution and recovery; PlusToken is one of the rare cases where the laundering chain was large enough relative to BTC market depth to produce a publicly attributed price-impact signal. Chainalysis later (March 2020) clarified that not every BTC price drop in the surrounding window was PlusToken-driven, which is itself a useful epistemic precedent.
- T11.005.002 (Fake-Custodian / Fake-Asset-Manager Fraud) is the canonical home for off-chain-investment-fraud cases with on-chain receivables. PlusToken is the primary 2018–2019 anchor for T11.005.002, alongside OneCoin (2014–2017, T11.005 historical anchor) and HyperVerse/HyperFund (2024, T11.005.002). The technique captures the structural signature: real on-chain deposits into operator-controlled wallets, fictitious balance growth in a database-backed UI, and Ponzi-funded payouts to early entrants.
- Defender-relevant signals for T11.005.002 are primarily off-chain. The lead indicator in PlusToken was the withdrawal halt; the supporting indicators are off-chain (Telegram-channel content, referral-tier depth, return-promise rate). The on-chain signal is the deposit-accumulation pattern — broad retail fan-in to operator-controlled wallets without corresponding on-chain trading outflow — which is distinguishable from legitimate exchange operational flow through concentration analysis.
- Government-side post-seizure liquidation is a structural feature of large state-action cases. The PRC's auction process for the seized PlusToken assets is a documented downstream effect that influences market structure for years after the original incident. A future Technique page covering post-seizure-liquidation patterns (PlusToken; the U.S. Marshals Service Bitcoin auctions from Silk Road; Bitfinex 2016 recovery proceedings) would have multiple worked examples already in the public record.
[chainalysisplustoken2019]— Chainalysis's December 2019 reporting on PlusToken cashout flows correlating with BTC price drops and the Huobi OTC laundering rail.[chainalysisplustoken2020btcimpact]— Chainalysis's updated March 2020 reporting clarifying the bounds of the PlusToken-to-BTC-price-impact attribution.[ergobtcplustoken2020]— independent on-chain-forensics write-up (ErgoBTC and others) on the PlusToken cluster reorganisation through 2019 H2.[peckshieldplustoken2019]— PeckShield reporting on PlusToken-controlled-wallet movements during the June–July 2019 collapse window.[scmpplustoken2020]— South China Morning Post coverage of the Yancheng Intermediate People's Court verdict and the ~$2.25B prosecuted-fraud figure.[chainalysis2024laundering]for cumulative cohort context on Ponzi / investment-fraud laundering patterns.
PlusToken is the largest crypto-Ponzi case on the public record at the time of the incident (until OneCoin's later prosecutions arguably surpassed it on a fiat-loss basis), and it is structurally distinct from every other case currently in the OAK corpus along two axes worth naming.
First, the off-chain entry vector with on-chain receivables structure is catalogued at OAK-T11.005.002 (Fake-Custodian / Fake-Asset-Manager Fraud). PlusToken's primary attack surface — Telegram-channel recruitment, multi-tier referral marketing, off-chain return-promise narrative feeding a fictitious "AI arbitrage" wallet — is the canonical 2018–2019 anchor for the T11.005.002 sub-pattern. The case demonstrates that the defender-relevant signal is at the deposit-accumulation layer (broad retail fan-in to operator-controlled wallets without corresponding on-chain trading outflow), while the off-chain marketing/recruitment apparatus provides the narrative that converts retail interest into deposits.
Second, the post-arrest BTC market-pressure pattern is unusual relative to the rest of the OAK corpus. Most OAK cases involve laundering chains that are large in absolute terms but small relative to global market depth for the asset being laundered; the laundering process therefore does not move price in a publicly attributable way. PlusToken was different: the operator-controlled BTC balance was on the order of 1% of all outstanding BTC at the time, and Chainalysis's 2019–2020 reporting publicly correlated PlusToken cashout flows with specific BTC price declines (notably September 2019). This is one of the few cases in the OAK corpus where the laundering chain itself produced a documented secondary market-structure effect, and contributors writing future cases at this scale (where the laundered balance is large relative to native-asset market depth) should expect to need to discuss laundering-driven price impact as a first-class artefact rather than a peripheral one.
The PRC post-seizure auction process is a related structural feature. The Chinese government's monetisation of the seized PlusToken assets is an additional, post-prosecution source of market-structure pressure on the affected assets, and is documented in the public record on a multi-year horizon. OAK's current Technique catalogue does not have a clean home for "state-side post-seizure liquidation" as a pattern, but PlusToken, the U.S. Marshals Service Bitcoin auctions of Silk Road–derived BTC, and the Bitfinex 2016 recovery proceedings together constitute enough worked examples that a future v0.x update could plausibly catalogue this as its own Technique family. The defender-side relevance is that the post-seizure liquidation surface is observable on-chain (auction-recipient wallets, government-controlled cluster outflows) and is distinct from the operator-side laundering surface that ran in 2019–2020.