PlusToken Wallet Scam · How a Multi-Billion-Dollar Ponzi Collapsed

Most of the wrecks in this archive are technical failures. Luna was the death spiral of an algorithmic stablecoin; FTX was the misappropriation of customer assets; Mt.Gox was an early exchange that lost its coins and went into bankruptcy proceedings. Each one needs a layer of mechanism to explain — you have to read some code or a financial statement to understand how the ship went down.

PlusToken needs none of that. Its mechanism is simple enough to write on a sticky note: bring in new people, use the new people's money to pay "returns" and commissions to the old people, let those returns attract more new people, and keep going until the new money runs out. The scam is older than crypto. The only thing different this time is that it shipped inside an app you could keep in your pocket.

I am filing it under Shipwreck Annals precisely because it was so simple: take a trick this old, wrap it in a few new words ("blockchain," "arbitrage," "wallet"), and it reached a scale of billions of dollars.

The numbers at a glance

First, the scale of the ship. The five figures below all come from the final ruling of the Yancheng Intermediate People's Court in Jiangsu, dated November 19, 2020, as reported in The Block's account of the ruling on November 27, 2020.

Set those boxes side by side and the contrast is jarring: on one side, a haul of more than two billion dollars; on the other, the weightless container of "an app." The size of a scam never depends on how complex it is. It depends on how fast it can replicate and spread.

What PlusToken was actually selling

The packaging had two layers:

• "This is a wallet that makes your coins grow." As Chainalysis describes it, PlusToken presented itself as a cryptocurrency wallet that would reward users with high rates of return: you bought its PLUS tokens with BTC or ETH and kept them there, and it did not just hold them — it made them grow. It blended "storing coins" and "earning yield" into one act, so the user believed they had merely upgraded to a smarter wallet.
• "The yield comes from arbitrage." Arbitrage means buying low on one exchange and selling high on another. The strategy is real, but its margins are thin and its capacity is limited. According to the ruling as reported by The Block, the crypto arbitrage trading platform PlusToken advertised did not exist.

Stacked together, the two layers buried the word "Ponzi" deep. What a member saw was not "recruit people and split the take" but "I am using a wallet that auto-arbitrages and pays me every day." Since the arbitrage platform did not exist, the "returns" handed to earlier members could only come from the coins transferred in by later ones. That is the standard definition of a Ponzi scheme, dressed in a respectable coat of technology.

The referral engine that inflated it

On the strength of "high-yield wallet" alone, PlusToken would not have reached this size. What pushed it past 2.6 million members was its second engine — multi-level referral commissions (MLM). In plain terms: depositing your own coins for "yield" was not enough; you could also recruit. When the people you brought in deposited, you skimmed a layer, and when those people recruited others, you skimmed again. The court counted 3,293 layers. Every member became a salesperson — you were not "investing," you were "building a downline," and the deeper and wider it grew, the more "passive income" you collected.

The terrifying part of this design is that it turns every victim into a recruiter for the next batch of victims. According to Wikipedia's entry, its investors were mainly in China and South Korea.

When commissions can only be sustained by the next person walking in the door, the scheme is mathematically guaranteed to break at some point, because both population and capital are finite. For PlusToken, that "some point" was June 2019.

June 2019: the arrests and the shutdown

A Ponzi usually ends when the new money coming in is no longer enough to pay the old money that wants out. For PlusToken, what the sources establish is the two dates below.

PlusToken stopped in June 2019: the court found that its fundraising period ended on June 27, 2019, and in the same month six Chinese nationals were arrested in Vanuatu and deported (see "Vanuatu, repatriation, and the trial" below).

One detail is worth pausing on: the "move your coins into the wallet" design meant that what the operators held were real crypto assets they could move on-chain immediately — not bank deposits that need a process to touch. That is exactly where the next section, the on-chain trace, begins.

The on-chain trace: can money hide?

This is where the PlusToken case differs most from an ordinary pyramid case — its money was on-chain, and the on-chain record cannot be deleted. In an analysis published in December 2019, Chainalysis tracked roughly 180,000 BTC and 6.4 million ETH, among other assets, moving from victims into PlusToken wallets — about $2 billion in all — of which roughly 45,000 BTC and 800,000 ETH were moved on to the operators' own addresses to be laundered. The methods were these:

• Mixing: CoinJoin mixers such as Wasabi Wallet, used to sever the link "this money came from PlusToken."
• Peel chains: funds hopping through a string of wallets, with a small amount cashed out at each hop. Chainalysis counted more than 71,000 different addresses used by the operators.
• Over-the-counter (OTC) brokers: nearly all cash-outs went through OTC brokers. Chainalysis identified 26 of them, most operating on the Huobi platform.

By that analysis, roughly 25,000 of the 45,000 BTC had been cashed out at the time of publication, with about 20,000 BTC left spread across more than 8,700 addresses.

On whether those cash-outs pushed the price down, Chainalysis's own wording is that it "can't say for sure that Bitcoin price drops are caused by PlusToken cashouts"; what it observed is that the cash-outs correlate significantly with price drops and increase volatility. In March 2020 it added an update: that month's drop was likely not PlusToken liquidations but the market turmoil set off by COVID-19.

The money took all those detours and was still marked out, transfer by transfer. Many fraudsters first treated the blockchain as an anonymous ATM; PlusToken is the counterexample. That permanent, public ledger is what let analytics firms reconstruct the flow of funds after the fact.

Vanuatu, repatriation, and the trial

Unlike many frauds that simply trail off, the PlusToken case reached a relatively clear conclusion at the legal level. In June 2019 six Chinese nationals were arrested in the South Pacific island nation of Vanuatu and deported to China; in July 2020 China's Ministry of Public Security announced the arrest of 27 major suspects and 82 key members (Wikipedia · PlusToken).

According to The Block's report, on November 19, 2020 the Yancheng Intermediate People's Court issued its final judgment, denying the appeals and upholding the first-instance ruling of September 22 that year: 15 people were sentenced to between two and eleven years in prison, with fines. The judgment lists nine crypto assets seized from seven of them, including 194,775 BTC and 833,083 ETH, and states that these assets will be processed according to law and the proceeds forfeited to the national treasury.

Assets being seized and members getting their money back are two different things. What the judgment says is "forfeited to the national treasury"; the report above mentions no arrangement for repaying members.

How to spot the next PlusToken

PlusToken has stopped, but the same skeleton can be reused under another name. Take it apart and four signals are more worth remembering than the name:

1. It promises a fixed, stable, high return. Real returns fluctuate and are never guaranteed. Treat any crypto product that says "a steady X% every month" or "principal and interest protected" as a Ponzi first, and make it explain where the yield comes from second — a high return that cannot explain its source is funded by the people entering after you.
2. The returns depend heavily on recruiting. If the core way to make money is building a downline rather than the product itself, you are almost certainly looking at a hybrid of pyramid selling and a Ponzi.
3. It asks you to move your coins into "its own wallet." Once you hand over the keys or control, no matter how lovely the interface numbers look, you no longer own those coins. "Not your keys, not your coins" is meant literally here.
4. It wraps an old scam in new words. "AI arbitrage," "quant bots," "blockchain ecosystem," "Web3 wallet" are not wrong in themselves — but when they are used to dodge the plainest question of all, "where does the money actually come from," the new words are a smokescreen.

For the question of "which money belongs in self-custody and which belongs on an exchange," see Archive Lesson One; the checklist for choosing a venue, drawn from the warning signs shared by eight exchange and lending-platform failures, is Archive Lesson Two.