← back to the index
YL-001 Crypto Ponzi · China 2019

PlusToken — China’s $3 Billion Crypto Pyramid Unraveled Blockchain by Blockchain

yield-savingsconvictedico-era
Program
PlusToken
Total Losses
¥14.8B (~$2.25B at 2019 prices; $4.2B seized at 2020 prices)
Investors
2.7 million
Status
Convicted

Summary

PlusToken, a Chinese-operated cryptocurrency pyramid scheme founded in April 2018, defrauded approximately 2.7 million investors of cryptocurrency that a Jiangsu court valued at 14.8 billion yuan — roughly $2.25 billion at June 2019 exchange rates — before its operators fled in June 2019, leaving users unable to withdraw funds. The scheme presented itself as a high-yield smart crypto wallet offering monthly returns of 9–18 percent through an in-app feature marketed as the "AI Dog" arbitrage robot. No such trading engine existed; every return paid to early participants was funded by incoming deposits from new recruits.

In June 2019, withdrawal processing froze and the operators' farewell — "sorry, we have run" — circulated through the platform's WeChat channels. Six principals were arrested in Vanuatu and deported within weeks. A second enforcement wave in July 2020 arrested 109 individuals including all 27 identified ringleaders. On November 29, 2020, the Yancheng Intermediate People's Court in Jiangsu convicted fourteen operators — Chen Bo, the scheme's founder, received the maximum eleven years — with sentences ranging to two years and fines of 120,000 to 6 million yuan.

Chainalysis traced stolen funds through more than 70,000 Bitcoin addresses and documented their gradual liquidation through over-the-counter brokers on Huobi, a process that correlated with Bitcoin price suppression throughout the second half of 2019. Chinese police ultimately seized cryptocurrency then valued at approximately $4.2 billion, a figure higher than the court's 2019 valuation due to price appreciation in the intervening year.

Timeline

April 2018
Platform launches
Chen Bo establishes PlusToken, marketed as a South Korean-originated smart crypto wallet; the app offers the "AI Dog" arbitrage feature and promises 9–18% monthly returns on Bitcoin and Ethereum deposits.
2018 — early 2019
Rapid expansion
WeChat campaigns, in-person seminars, billboard advertising, and a ten-tier referral commission structure drive uptake across mainland China, South Korea, and Southeast Asia; membership reaches an estimated 2.6–4 million users.
June 2019
Withdrawals frozen; operators flee
PlusToken users report inability to withdraw funds. Operators send a message via WeChat group channels reading "sorry, we have run." The platform's app and website cease functioning.
Late June 2019
Vanuatu arrests
Chinese authorities, acting with the cooperation of Vanuatu police, arrest six core PlusToken operators — the first group of identified principals — and deport them to China.
September–December 2019
Bitcoin sell-off documented
Chainalysis publishes findings linking PlusToken-controlled wallets to large Bitcoin liquidations via Huobi OTC brokers; the firm correlates specific transfer events with Bitcoin price drops including a 4% price fall in seven minutes on December 16, 2019.
January 2020
Chainalysis 2020 Crypto Crime Report
PlusToken named the largest crypto Ponzi scheme in the report's dataset, responsible for at least $2 billion in investor losses in 2019 alone — the single largest contributor to a year in which crypto scam activity totalled $8.6 billion.
July 2020
Mass arrests
China's Ministry of Public Security announces the arrest of 109 PlusToken-linked individuals including all 27 identified senior operators; Chinese police simultaneously seize cryptocurrency assets then valued at approximately $4.2 billion.
November 29, 2020
Conviction and sentencing
Yancheng Intermediate People's Court convicts Chen Bo and thirteen co-defendants; sentences range from two to eleven years; fines range from 120,000 to 6 million yuan; criminal proceeds ordered forfeited to the state treasury.
2020
WoToken operators sentenced
A related scheme, WoToken — which shared at least one key operator with PlusToken — is prosecuted separately in the same Yancheng court; four operators receive sentences of 2.5 to 8.8 years for defrauding approximately 700,000 investors of $1 billion.
December 2020 — present
Asset liquidation
Confiscated cryptocurrency is converted by Chinese state authorities; $4.2 billion in assets are absorbed into the national treasury; no distribution to defrauded investors has been confirmed under Chinese law.

The Promise: Wallet, Robot, and the Language of Technology

PlusToken launched in April 2018 as a mobile crypto wallet that accepted Bitcoin and Ethereum deposits, displaying live portfolio balances and mimicking the interface of legitimate custodial services. Its distinguishing claim was the "AI Dog" — an in-app arbitrage feature operators said would scan exchanges for price differentials and execute automated trades, distributing the proceeds as PLUS token rewards. Monthly returns of 9–18 percent were framed not as yield but as a computational dividend: profits generated by software rather than human judgment. That framing moved the scheme out of the register of implausible investment promises and into the register of technological participation — algorithmic returns feel like infrastructure, not speculation.

Recruitment ran through WeChat, China's dominant messaging platform, which served as both the acquisition channel and the operational communication layer of the scheme. Members who reached higher deposit tiers — ranked internally as "Big Boy" and "Great God" — earned commission income payable across up to ten referral levels for each recruit they brought in. In-person seminars, supermarket billboard advertising, and a professionally localised app gave the platform the surface markers of a functioning enterprise. At its peak, PlusToken had an estimated three to four million active accounts across China, South Korea, and Southeast Asia.

The Mechanics: How Custody Was Established and Abused

PlusToken's fraud rested on a custody transfer users executed voluntarily and completely. To participate, a member deposited Bitcoin or Ethereum into a PlusToken-controlled wallet address; the funds immediately left the user's control. No smart contract governed their return, no independent custodian held them, and no legal structure in any jurisdiction created enforceable rights. The only link between investor and asset was the app's balance display. When operators disabled withdrawal processing, that link was severed with no further recourse.

The AI arbitrage revenue was fictitious. Chainalysis found no on-chain evidence of systematic trading activity. Inbound flows came from millions of depositors; outbound flows went to a small set of operator-controlled wallets, which dispersed funds through approximately 24,000 transfers across more than 71,000 Bitcoin addresses, with heavy use of CoinJoin — a privacy technique pooling transactions to obscure individual flows — before delivery to OTC brokers on Huobi. Chainalysis calculated the operators cashed out at least $185 million in stolen Bitcoin prior to the arrests, with an additional 20,000 BTC still unspent as of the December 2019 report. The full pool seized by Chinese authorities in July 2020 comprised 194,775 BTC, approximately 487 million XRP, 6 billion DOGE, and significant ETH and EOS holdings.

The Exit and Its Aftermath on Bitcoin Markets

The June 2019 collapse was not triggered by a hack or external enforcement. The operators stopped processing withdrawals and departed. Their farewell — "sorry, we have run" — sent via the scheme's own WeChat channels, was the entirety of the notice given to 2.7 million investors. Six operators were located in Vanuatu and arrested within weeks through Chinese-Vanuatu police cooperation. The remainder took fourteen months to detain: the July 2020 mass arrests swept up 109 individuals, including all 27 identified ringleaders, whose identities had been developed through blockchain forensic tracing. Charges were consolidated at Yancheng Intermediate People's Court, which issued convictions in November 2020.

The market consequences extended well beyond direct victims. Chainalysis documented that the operators' liquidation strategy — gradually converting stolen Bitcoin into Tether through OTC brokers to avoid triggering visible sell pressure on public order books — correlated with measurable Bitcoin price suppression throughout the second half of 2019. Researchers identified an average daily excess supply of approximately 1,300 BTC attributable to PlusToken liquidations during August–December 2019. A large wallet transfer to Huobi OTC desks on September 23, 2019 preceded a notable Bitcoin price drop the following day. When Chainalysis published its full report on December 16, 2019, Bitcoin fell 4 percent in seven minutes. PlusToken's laundering operation had functioned as a latent downward variable in global Bitcoin pricing for months before it was publicly identified.

The Five Factors

01
Yield-promise psychology
PlusToken exploited the cognitive gap between financial promises and technological claims: when a return is attributed to software rather than human judgment, skepticism is reduced. The AI Dog framing moved a stated 9–18 percent monthly return out of the register of implausible yields and into the register of infrastructural participation, specifically among users already primed to believe that cryptocurrency represented a technological paradigm shift. The packaging was designed to pre-empt the scrutiny the numbers would otherwise have triggered.
02
Custody without recourse
The moment a user deposited Bitcoin into a PlusToken wallet address, they surrendered all technical control of those funds. There was no smart contract governing conditions of return, no independent custodian, no audited reserve, and no legal structure in any jurisdiction that created enforceable rights against operators who could not be identified or located. Custody of digital assets without independent verification of solvency and legal accountability is not custody in any meaningful protective sense — it is donation on the assumption of good faith.
03
Referral-structure silencing of sceptics
The ten-tier commission structure created a large population of financially motivated advocates whose income depended on maintaining the scheme's credibility and recruitment momentum. Members who expressed doubt publicly risked being expelled from WeChat groups — and thus from their commission income. The social architecture of the platform was built to route scepticism out of the community rather than allow it to accumulate into a critical mass capable of triggering early withdrawal runs. This is a design feature, not a coincidence.
04
Jurisdictional arbitrage and enforcement lag
PlusToken recruited globally while operating across jurisdictions with limited crypto enforcement capacity. After the collapse, operators transited Vanuatu, Cambodia, Vietnam, and Malaysia. The first six arrests required Chinese-Vanuatu police coordination; the full network took fourteen months to detain. During that lag, identified operators continued liquidating stolen assets at scale. The cost of that fourteen-month window was borne entirely by victims with no recovery path.
05
OTC broker opacity as exit infrastructure
The operators' ability to liquidate billions in stolen cryptocurrency without triggering public exchange sell-off alarms depended on the existence of large-volume OTC brokers operating outside regulated order books. Chainalysis identified a small cohort of "rogue" OTC brokers through whom PlusToken funds were laundered; these brokers were operating at the margin of KYC and AML compliance, precisely because crypto OTC markets in 2019 had no standardised surveillance obligations. The fraud's exit infrastructure was built on regulatory gaps in secondary market structure, not just the primary scheme mechanics.

Aftermath

Chen Bo was sentenced to eleven years in prison by the Yancheng Intermediate People's Court on November 29, 2020, the longest of fourteen convictions. Co-defendants received terms of two to eleven years and fines ranging from 120,000 to 6 million yuan. The court ordered all criminal proceeds forfeited to the state; under Chinese law those proceeds — $4.2 billion in seized cryptocurrency — passed to the national treasury. No restitution mechanism for the 2.7 million defrauded investors exists under the Chinese prosecution framework.

The parallel WoToken prosecution, concluded in the same Yancheng court, convicted four operators of a scheme that defrauded 700,000 investors of approximately $1 billion. Court documents confirmed that at least one WoToken operator had been a central participant in PlusToken, establishing institutional continuity between the two schemes.

The Chainalysis forensic work on PlusToken became a foundational dataset for the firm's 2020 Crypto Crime Report and for subsequent regulatory and academic analysis of crypto Ponzi mechanics. The prosecution is frequently cited in Chinese regulatory literature as a primary justification for the 2021 comprehensive crypto trading ban.

Lessons

  1. A custody arrangement that provides no independent, on-chain-verifiable proof that deposited assets exist and remain under a neutral custodian offers no meaningful protection; an app interface displaying a balance is not evidence that those assets exist.
  2. Monthly returns exceeding 5 percent on crypto deposits, attributed to automated arbitrage or AI trading with no independently audited trade history and no published strategy documentation, are sufficient grounds to treat a platform as presumptively fraudulent regardless of the credibility of the marketing materials or the number of known participants.
  3. Multi-level referral structures in yield-bearing platforms create communities with direct financial incentives to suppress due diligence and silence doubt; the size and enthusiasm of a platform's user community is evidence of its marketing effectiveness, not its legitimacy.
  4. A fourteen-month gap between collapse and the arrest of all identified operators is not an anomaly; it is a baseline for cross-border crypto fraud enforcement in 2019–2020. Funds deposited in a fraudulent platform should be treated as irrecoverable from the moment the fraud becomes apparent, not from the moment convictions are secured.
  5. OTC crypto markets without standardised AML/KYC obligations function as exit infrastructure for large-scale fraud; investors should treat any yield platform that cannot demonstrate transparent, regulated custody arrangements as operating in the same regulatory environment that enabled PlusToken's prolonged liquidation.

References