jakiro
Written by: 0xjs@bitchainvision
The mantis stalks the cicada, followed by the oriole.
The largest electronic fraud group in Southeast Asia was finally “harvested” by the US government.
On the evening of October 14th, Beijing time, the U.S. Department of Justice charged Chen Zhi, founder and chairman of the Cambodia-based transnational fraud group “Prince Group”, and other accomplices for telecommunications fraud and money laundering.If convicted of these two crimes, the U.S. government will confiscate all property or proceeds obtained directly or indirectly as a result of the crime in accordance with the law, including but not limited to 127,271 Bitcoins (approximately US$15 billion).
The approximately 127,000 BTC were proceeds and instruments of the Prince Group’s fraud and money laundering scheme and were previously stored in a non-custodial cryptocurrency wallet where Chen Zhi held his private keys,Currently controlled by the US government.
The crypto community is more concerned about whether the 127,000 Bitcoins currently controlled by the U.S. government are related to the 127,000 BTCs stolen from Lubian Mining Pool, the sixth largest Bitcoin mining pool in 2020?
Bitcoin Vision reviewed the US Department of Justice indictment and compiled the key information, as follows:
1. 25 Bitcoin wallets 127,000 BTC
U.S. Department of Justice documents show:These 127,000 BTC were once stored in the cryptographic addresses of 25 non-custodial wallets controlled by Chen Zhi.andAs early as around 2020, Chen Zhi had accumulated so much BTC through huge fraud and money laundering.
Chen Zhi personally keeps a record of each wallet address, as well as the mnemonic phrase associated with the private key.The details of these 25 addresses are as shown in the following table:
2. Two key dates
December 29, 2020, and June 22, 2024.
Tracking the addresses in the above table, we found that taking the first address 3Pja5FPK1wFB9LkWWJai8XYL1qjbqqT9Ye as an example,On December 29, 2020, 20,452 Bitcoins at this address were transferred in multiple batches.
It is split into tens to hundreds of BTC and transferred to multiple BTC addresses:
These addresses (the first address bc1qut988zlc9uhmczj4yz3d8c4xn8qdh2g7rymdzy in the above picture is an example, 105.7 coins)BTC was transferred again to a new address (34x7umj1KZRH94F1nvyF6MtXQoLgQ3swRd) on June 22, 2024, and has not been transferred since.
The last address, 339khCuymVi4FKbW9hCHkH3CQwdopXiTvA, follows the same pattern.It’s just that on December 29, 2020, 1,500 BTC was transferred to a new address at one time.
3. How did the US government control the 127,000 BTC “stolen” from the Lubian mining pool?
The BTC addresses in the previous section are all labeled as Lubian hackers on Arkham.
and2December 29, 2020 was the day when 127,000 BTC were stolen from the Lubian mining pool.
According to Arkham research, the LuBian mining pool was one of the largest Bitcoin mining pools in the world in 2020. In May 2020, its computing power once accounted for nearly 6% of the total computing power of the entire Bitcoin network.It was attacked by hackers on December 29, 2020.
How to determine whether the Lubian mining pool has been stolen?Arkham research found that each hacker address received a transaction with an OP_RETURN message, in which LuBian requested the hacker to return the stolen funds.To send these messages, LuBian initiated 1,516 transactions, consuming a total of approximately 1.4 Bitcoins.
See previous reports from Bitcoin Vision, “Shocking BTC theft case exposed: 120,000 Bitcoins worth 14.5 billion US dollars, on-chain news reveals the truth“.
According to an announcement from the U.S. government, the Prince Group’s 127,000 Bitcoins are currently controlled by the U.S. government.This means that as of June 22, 2024 at the latest, the US government will have control of these 127,000 BTC.
On-chain intelligence agencies also mistakenly labeled the US government as Lubian hackers.
So, how did the 127,000 BTC once controlled by Chen Zhi, the founder of Prince Group, get into the hands of the US government?
We can boldly guess that the possibilities include but are not limited to the following four:
1. The U.S. government obtained Chen Zhi’s mnemonic before December 29, 2020, transferred the BTC from the Lubian mining pool on December 29, 2020, and the U.S. government sorted out the BTC on June 22, 2024;
2. Chen Zhi wrote and directed the “Lubian Mining Pool Stolen” case on December 29, 2020. After the “stolen”, the new address mnemonic was obtained by the US government, and the BTC was transferred by the US government on June 20, 2024.So the new question is, how did the US government obtain the mnemonic phrase?
3. Insiders around Chen Zhi attacked the Lubian mining pool. This person was later captured by the US government. On June 22, 2024, Bitcoin was controlled by the US government, and the carrot was pulled out and mud was pulled out;
4.real hackerAttacked the Lubian mining pool, the hacker was captured by the United States, same as 3.
More details of the case require further information disclosure by the U.S. government.
4. Individuals and entities related to the “Prince Group Case”
Prince Group Executive Organization Chart
According to the U.S. Department of Justice indictment, the relevant individuals and entities are as follows:
a. Chen Zhi: holds nationality of China, Cambodia, Vanuatu, Saint Lucia and Cyprus, and has lived in Cambodia, Singapore, Taiwan and the United Kingdom.
b. Conspirator 1: holds the nationality of Cambodia, Vanuatu, Cyprus and St. Kitts, and has lived in Cambodia, Singapore and the United Kingdom.
c. Conspirator 2: holds Cambodian and Cypriot nationality, and has lived in Singapore and the United States.
d. Conspirator 3: holds Chinese and Cambodian nationality, and has lived in the United States and other regions.
e. Conspirator 4: Cambodian citizens and residents.
f. Conspirator 5: Citizens and residents of Hong Kong, China.
g. Conspirator 6: Citizens and residents of Hong Kong, China.
h. Conspirator 7: Citizens and residents of Singapore.
i. Exchange-1: A cryptocurrency trading platform headquartered in China.
j. Exchange-2: A cryptocurrency trading platform headquartered in Seychelles.
k. Exchange-3: A cryptocurrency trading platform headquartered in the United States.
l. Exchange-4: A cryptocurrency trading platform headquartered in the United States.
m. Online trading platform 1 (Trading Platform-1): an online trading platform.
n. Financial Institution-1: A financial institution headquartered in the United States whose deposits are insured by the Federal Deposit Insurance Corporation (FDIC).
o. Prince Group: A holding company registered in Cambodia, operating more than 100 business entities in more than 30 countries around the world. Chen Zhi is the founder and chairman.
p. Yun Ki Estate Intermediary Co., Ltd. (“Yun Ki Estate Intermediary Co., Ltd.”): a subsidiary of Prince Group, mainly engaged in real estate development business.From approximately 2020 to the present, Conspirator 1 served as Chairman of the Company.
q. Awesome Global Investment Group (“Awesome Global Investment Group”): a subsidiary of Prince Group, mainly engaged in entertainment, hotel and real estate development businesses.From approximately 2017 to 2022, Conspirator 2 served as Chairman of the Company.
r. Prince Real Estate Group and Prince Huan Yu Real Estate Group: subsidiaries of Prince Group, both mainly engaged in real estate development business.From approximately 2018 to at least 2024, Conspirator 3 served as Chairman of Prince Huanyu Real Estate Group.
s. Prince Bank: a subsidiary of Prince Group, mainly engaged in financial services business.Conspirator 4 served as vice chairman of the bank from approximately 2015 to at least 2023.
t. Warp Data Technology Lao Sole Co., Ltd. (“Warp Data”): An entity registered in Laos that operates Bitcoin mining facilities.
u. Lubian: A Chinese Bitcoin mining organization with Bitcoin mining facilities in many places in Asia (including China and Iran).
v. Future Technology Investment (“FTI”): an entity registered in the Cayman Islands, of which Conspirator 6 served as a director and bank account signatory.
w. Amber Hill Ventures Limited (“Amber Hill”): an entity registered in the British Virgin Islands, of which Conspirator 6 served as a director and signatory on bank accounts.
x. Lateral Bridge Global Limited (“LBG”): an entity registered in the British Virgin Islands, of which co-conspirators 7 associated with FTI and Amber Hill served as directors.
y. Hing Seng Limited (“Hing Seng Company”, Hing Seng Limited): an entity registered in Hong Kong, China.
Prince Group Criminal Network
It is reported that Southeast Asian fraud syndicates lure unsuspecting job seekers from more than 70 countries, forcing them to work with people who actively participate in crime to carry out large-scale and complex frauds in almost all jurisdictions around the world.
In Cambodia, Laos, and Myanmar alone, it is believed that the workforce engaged in cybercrime has exceeded 350,000, some estimates put the annual revenue of Southeast Asian fraud syndicates at between $50 billion and $75 billion.This makes cross-border fraud likely to become the most important economic activity in the entire Mekong subregion of Southeast Asia – its scale is even equivalent to nearly half of the combined GDP of the main host countries.Among them, Cambodia’s fraud industry is particularly profitable, with estimated annual illegal income ranging from US$12.5 billion to US$19 billion.
Since approximately 2015 to the present, Chen Zhi and Prince Group executives have implemented cryptocurrency investment fraud and other fraud schemes, defrauding victims around the world and embezzling billions of dollars in funds.In order to implement the above plan, Chen Zhi and his co-conspirators instructed the Prince Group to establish and operate “forced labor fraud parks” throughout Cambodia, forcing people in the parks to carry out fraud activities on a large scale.Chen Zhi and his co-conspirators used their political influence in multiple countries to protect their criminal activities and paid bribes to foreign public officials to evade law enforcement.They then laundered the proceeds of the fraud through professional money laundering agencies and the Prince Group’s own “ostensibly legitimate” business network, including online gambling and cryptocurrency mining operations.
5. How do electronic fraud groups carry out fraud?
The U.S. Department of Justice’s indictment contains a large amount of information and details how Southeast Asian electronic fraud groups carry out fraud.
Chen Zhi is the founder and chairman of Prince Group.According to the group’s official website, its “core business units” in Cambodia include “Prince Real Estate Group, Prince Huanyu Real Estate Group, Prince Bank and Aoshi Global Investment Group.”These departments and other entities under the Prince Group are involved in various publicly disclosed business areas such as “real estate development, banking, finance, tourism, logistics, technology, catering and lifestyle”.
The biggest profits of the Prince Group come from illegal fraudulent activities led by Chen Zhi and assisted by his core executives and associates (including co-conspirator 1 to co-conspirator 7, etc.), mainly include:
1. Fraud park
The Prince Group occupies a dominant position in the above-mentioned online fraud industry.In this illegal industry, thousands of migrant workers go to Cambodia and other places in search of job opportunities, but are trafficked to fraud parks and commit cryptocurrency investment fraud and other fraudulent activities under the threat of violence.These fraud parks have large dormitories surrounded by high walls and barbed wire, which are actually “violent forced labor camps.”
Under the instruction of Chen Zhi,The Prince Group has established and operated at least 10 fraud parks across Cambodia, specializing in cryptocurrency investment fraud and other fraud schemes., including: (i) the “Jinbei Compound” located in Sihanoukville, Cambodia, associated with the Prince Group’s “Jinbei Hotel and Casino”; (ii) the “Jinfu Technology Park” (also known as “Jinyun Compound”) located in Chirethom, Cambodia; (iii) the park located in Kampong Speu Province, Cambodia, named “Mango Park” (also known as “Jinhong Park”, Jinhong Park).
Chen Zhi was directly involved in the management of the fraud parks and kept relevant records for each park, including fraud profit tracking records clearly marked with “pig killing” disks.An account book kept by Chen Zhi details various fraud schemes operated by the Prince Group’s Jinhong Park, as well as the specific schemes responsible for each building and floor in the park., including “Vietnam order fraud”, “Russian order fraud”, “European and American fine chat” (referring to fraudulent conversations), “Vietnam fine chat”, “China fine chat”, “Taiwan fine chat” and “Chinese order fraud” (referring to online retail fraud).
Chen Zhi and his co-conspirators designed the fraud park to maximize profits and personally ensured that the park had the necessary infrastructure to “reach as many victims as possible.”For example, in approximately 2018, conspirator 1 obtained millions of mobile phone numbers and account passwords from illegal online markets; in approximately 2019, conspirator 3 assisted in supervising the construction of Jinfu Park.Chen Zhi himself also retained documents describing and showing “phone farms” – automated call centers used to commit cryptocurrency investment fraud and other cyber crimes. The documents detailed the construction of two “phone farm” facilities: each equipped with 1,250 mobile phones, capable of controlling 76,000 accounts on a popular social media platform.
In addition, the internal documents of the Prince Group contain instructions on “how to build trust with victims” and instructions on “how to register social media accounts in bulk” (including clear instructions on “using ‘less pretty’ female avatars to ensure the accounts look authentic”).
In the summer of 2022, Conspirator 2 boasted,In 2018, the Prince Group made an average daily profit of more than US$30 million through fraudulent pig slaughtering trays and related illegal activities.
2. Promote criminal plans through bribery and violence
Chen and his co-conspirators used their political influence to protect the fraud from law enforcement in multiple countries.Among them, Prince Group executives paid bribes to obtain early warning information about “law enforcement agencies raiding the fraud park”; in addition, Chen Zhi assigned co-conspirator 2 to be responsible for the “risk control” function of Prince Group, supervise the progress of relevant investigations, and protect the interests of Prince Group by conducting “corrupt transactions” with foreign law enforcement officials.
Chen Zhi kept accounting books on bribery to public officials, one of which recorded the “reimbursement of hundreds of millions of dollars in bribes and luxury goods purchase expenses to persons associated with the Prince Group.”For example, the account books show that in 2019, conspirator 2 purchased a yacht worth more than $3 million for a senior foreign government official; Chen Zhi also purchased a luxury watch worth millions of dollars for another senior foreign government official.In 2020, the official assisted Chen Zhi in obtaining a diplomatic passport, which Chen Zhi used to travel to the United States in April 2023.
As part of his “risk control” responsibilities, Conspirator 2 served as the “executor” of the Prince Group, maintaining the Prince Group’s dominant position in the fraud industry through corruption and violence.For example, around July 2024, co-conspirator 3 communicated with Chen Zhi about “theft of illegal profits of the group by persons associated with the Prince Group,” saying that “a financial officer absconded with the money and tried to hide it,” and informed Chen Zhi that “measures are being taken to recover the stolen money,” and promised that “a thorough investigation will be carried out no matter what. I wonder if the boss (referring to Chen Zhi) and the group have any suggestions or methods that can be shared…The Mafia (Mafia) and the government are ready to take action to scare the monkeys.Boss, does the group have relevant experience or resources?” Chen Zhi then replied: “You should first communicate with the co-conspirator 2 and get all the information before deciding how to deal with it, and find out the current location of this person.”
Under Chen Zhi’s instruction, personnel associated with the Prince Group frequently used violence and coercion to achieve “commercial purposes” and advance criminal plans.For example, a person associated with the Prince Group discussed with Chen Zhi “beating people who ’caused trouble’ in the park.” Chen Zhi approved the beating plan, but instructed “not to beat them to death,” and added: “They must be watched and don’t let them run away.” Another example is that Chen Zhi once communicated with conspirator 4 about “two missing persons found by the police in Jinfu Park.” Conspirator 4 assured Chen Zhi that he would handle the matter, but suggested that Chen Zhi use his “police connections.”
(3)Brooklyn Network
The Prince Group’s investment fraud scheme targeted victims around the world, including those in the United States, and was carried out through local networks working for it.Among them, a network called the “Brooklyn Network” operates in the East District of New York and assists fraudsters in the Jinbei Park of the Prince Group to commit investment fraud: scammers (“introducers”) contact unknown victims through various instant messaging applications, falsely claiming to “make profits by investing in cryptocurrency, foreign exchange and other markets”, tricking the victims into investing, and introducing them to so-called “Account Managers” to handle transactions.The account manager then provided the victim with “bank account information to which investment funds should be transferred” and created false investment accounts and investment portfolios for the victim on mobile online trading platforms including “Online Trading Platform 1”.
However, the bank account provided to the victim by the account manager was not an investment account, but an account controlled by the Brooklyn Network and opened in the name of a shell company in Brooklyn and Queens, New York (the account opening institutions are located in Brooklyn, Queens and other areas of New York).Rather than being invested as promised, victim funds were misappropriated and laundered through these and other accounts.
At the same time, the “investment account” created by the account manager for the victim was artificially manipulated. It seemed that “the investment value continued to grow”, but in fact there was no growth.Initially, the “face value” of the victim’s investment portfolio will increase, leading the victim to mistakenly believe that the investment is profitable, thereby inducing them to continue investing; in addition, when the victim first requests to withdraw small investment funds, the account manager will cooperate.But when victims request to withdraw large amounts of funds from the trading platform, they will encounter many obstacles – for example, the account manager refuses to withdraw money on the grounds that “transaction fees, taxes or legal fees need to be paid.”In the end, the account manager and introducer stopped responding to the victim’s information, and the victim was unable to withdraw most of the funds transferred according to the account manager’s instructions.
The Brooklyn network ultimately transferred the funds back to fraudsters in Prince Group’s Jinbei campus and elsewhere through a series of accounts, where they were further laundered and then flowed to Prince Group and its executives.Money laundering techniques include moving fraud proceeds through shell company bank accounts, converting them into USDT and then transferring them to a complex network of non-custodial virtual currency addresses, or withdrawing cash to cut off the audit trail (the cash is then used to purchase cryptocurrency and transferred in the same way).
From approximately May 2021 to August 2022, the Brooklyn network assisted the Prince Group in fraudulently transferring and laundering more than $18 million from more than 250 victims in the Eastern District of New York and other parts of the United States.
Chen Zhi also personally monitored virtual currency addresses that received the proceeds of the fraud, including funds from U.S. victims.For example, records kept by Chen Zhi show that around June 2021, 100,000 USDT was transferred to a virtual currency address starting with “0x77” (hereinafter referred to as the “0x77 address”); in the summer of the same year, this address also directly received funds traceable to a victim in California (“Victim 1”).Specifically, between July and August 2021, Victim 1 transferred more than $400,000 in cryptocurrency from a popular cryptocurrency exchange account to an address starting with “0x1e” (hereinafter referred to as “0x1e address”); the funds were subsequently transferred to an address starting with “0x34” (hereinafter referred to as “0x34”) via an address starting with “0x83” (hereinafter referred to as “0x83 address”)Address”); between July and September 2021, the 0x34 address transferred more than $350,000 USDT to the 0x77 address monitored by Chen Zhi.
6. How were 127,000 BTC laundered?
Chen Zhi and his co-conspirators laundered the illegal profits (including cryptocurrency) of the Prince Group through a complex money laundering network, including using professional money laundering agencies and using the Prince Group’s own business (including online gambling and cryptocurrency mining) to launder funds; and then used the funds for luxury travel, entertainment consumption, and the purchase of luxury watches, yachts, private jets, vacation villas, high-end collections, and rare artworks (including a Picasso painting purchased through a New York auction house).
Professional money laundering agency:Sometimes called “money laundering houses”, “banks” or “water houses”, they receive the proceeds embezzled from victims by the Prince Group’s fraud activities and then return the funds to the Prince Group.A common method of operation is to collect fraudulent proceeds in the form of Bitcoin or stable coins such as USDT and USDC, and after converting them into legal tender, use cash to purchase “clean” Bitcoin or other cryptocurrencies.Chen Zhi directly coordinated such money laundering activities and discussed his use of “illegal banks” and “underground banks” with co-conspirators; Chen Zhi also retained documents that explicitly mentioned “BTC washing” and “BTC money laundering people.”
“Shell Companies” Money Laundering:Chen Zhi and his co-conspirators also laundered money through “shell companies” (companies whose sole purpose is to launder money) that were controlled by Chen Zhi, Conspirators 1, 5, 6, 7 and others associated with the Prince Group, including FTI, Amber Hill, LBG and dozens of others.Among them, FTI is used to launder illegal funds (including money laundering through the Prince Group’s mining agency Wop Data as described below).In the account opening record of Financial Institution 1 opening an account for FTI in January 2019, Conspirator 6 stated that FTI’s business activities include “mining and digital asset trading with its own funds”, but falsely declared that FTI’s source of income is “personal wealth”; at the same time, Conspirator 6 seriously underestimated FTI’s monthly transaction scale in the same account opening document, declaring “Estimated monthly deposits and withdrawals are approximately 200 eachmillion”, but the account statement shows that in February 2019, FTI’s account at Financial Institution 1 actually had deposits of approximately US$28 million and withdrawals of approximately US$27 million.Amber Hill’s purpose was similar, and she also opened an account at Financial Institution 1: In the account opening record in March 2019, Conspirator 6 called Amber Hill’s business activities as “proprietary trading and investment”, falsely declared the source of income as “personal wealth”, and also seriously underestimated the size of the monthly transactions (declared estimated monthly deposits and withdrawals of approximately US$2 million each), and the account statement showed that in February 2020, Amber Hill’s actual deposits in Financial Institution 1’s account were approximately$22.5 million, with withdrawals of approximately $21.8 million.
Money laundering by Prince Group’s business units:Chen Zhi and his co-conspirators also laundered money through Prince Group’s functional business units, particularly its massive online gambling business – which continued to operate in multiple countries even after Cambodia banned online gambling in 2020.In order to avoid law enforcement crackdowns, the Prince Group operates its gambling business through “mirror websites” (copying website content on different domain names and servers).Chen Zhi directly supervised the online gambling business of the Prince Group and discussed with others “laundering the proceeds of cryptocurrency fraud through this business”; Conspirator 1 was responsible for managing the salary payment of the online gambling business and retained employee salary books from 2018 to 2024, which were clearly marked “Employee salaries – please pay with clean funds”.
Bitcoin Mining Money Laundering:also,Chen Zhi and his co-conspirators also laundered money by “using illicit proceeds to fund large-scale cryptocurrency mining operations,”Involving Laos’ Wop Data and its subsidiary in Texas, the United States, and China’s Lubian,These institutions produce large amounts of “clean Bitcoin” that is not related to criminal proceeds.Lubian Mining Pool once became the sixth largest Bitcoin mining organization in the world during its operation.Chen Zhi showed off to others that the Prince Group’s mining business was “very profitable because there are no costs.” After all, the operating funds for these businesses came from funds stolen from victims.For example, between November 2022 and March 2023, Wop Data received more than $60 million from the shell company Xingsheng Company; Xingsheng Company was also used to make payments to the spouse of an executive at Aoshi Global and to purchase millions of dollars worth of luxury goods (including a Rolex watch and the Picasso painting mentioned above).Chen Zhi and his co-conspirators also systematically mixed “illegal funds” with “newly mined cryptocurrency” in wallets associated with mining organizations to conceal the source of the funds.
Multi-layered money laundering:Chen Zhi and his co-conspirators often use “multi-layered money laundering methods” to further conceal the illegal sources of Chen Zhi and the Prince Group’s profits.Under Chen Zhi’s instruction, persons associated with the Prince Group (including co-conspirators 5 and 6 who served as Chen Zhi’s personal wealth manager) used complex cryptocurrency money laundering techniques (including “spraying” and “funneling”): repeatedly splitting large amounts of cryptocurrency into dozens of wallets and then re-concentrating them into a few wallets without any commercial purpose and only to conceal the source of the funds (see examples below for specific processes).Some of the funds were eventually stored in the wallets of cryptocurrency exchanges such as Trading Platform 1 and Trading Platform 2, or converted into legal currency and deposited in traditional bank accounts; other funds (including funds laundered through the Prince Group’s mining institutions) were stored in non-custodial cryptocurrency wallets controlled by Chen Zhi personally.
