In the light of the current collapse and movements on PlusToken wallets, the topic is extremely relevant.
On February 11, 2020, the media reported that 11,999 BTC from the cluster of the Chinese pyramid Plustoken, which has been putting pressure on the market for a long time, came into motion.
The first move took place on the same day, February 11th. 11,999 BTCs were sent from the wallet, which lay motionless from September 21, 2019.
🚨 🚨 🚨 🚨 🚨 🚨 🚨 🚨 🚨 🚨 11,999 #BTC (117,393,202 USD) transferred from unknown wallet to unknown wallet
— Whale Alert (@whale_alert) February 11, 2020
According to the ErgoBTC researcher, the original wallet was part of the PlusToken cluster and was marked with all the tools for blockchain analysis.
After that, the bitcoins again moved, which attracted the attention of PeckShields vice president Chiyachi Wu and the community. However, public interest was not enough for a long time, and only researchers with a small audience on social networks continued to monitor the development of the situation.
New #PLUSTOKEN parking addresses:
— Chiachih Wu (@chiachih_wu) February 11, 2020
In preparation for mixing, the coins were fragmented into small pieces at different addresses, since mixing a large amount is a very difficult task. Those behind the cash flow were most likely using wallets with built-in mixers and their liquidity pools. In order to completely whitewash such a significant amount, the purses have too little liquidity, but the “smash and hinder” approach has paid off.
The reader should understand that centralized exchanges use tools from analytical companies that assign transactions a risk rating (Risk Score). Based on this assessment, exchanges determine whether the transaction is “clean” or “dirty.” If assets are moved from the address marked in red, the recipient addresses will also be included in the cluster. However, this does not happen instantly; attackers have a gap for quick mixing and subsequent sale before transactions are marked. Exchanges are interested in high volumes, so most often they do not take action if there is no red flag.
Returning to the PlusToken cluster, it is necessary to add that bitcoins were split at 1-5 BTC. With the help of the KYCP service, I was able to track the path of the “branches” of exits – after mixing, the coins were collected on wallets of 300-400 BTC. The algorithm of actions was identical, which speaks in favor of a single owner.
At the time of writing, these clusters are still not marked in the free oxt.me service. I assume that at the time of transfers, service providers for exchanges did not manage to assign them a red risk level.
After the aggregation of relatively large amounts in wallets, coins began to be sent to exchanges.
The link allows you to follow how PlusToken bitcoins after mixing got on the OKEx exchange in batches of 20-50 coins. From this particular wallet, the last portion of 55 BTC went to the OKEx exchange on February 28.
According to ErgoBTC, in the first half of February, 50% of PlusToken’s funds moved through OKEx. At the same time, Huobi received only 25% directly (45% directly and indirectly). This means that only 5% absorbed other services.
OkEx has received nearly 50% of PlusToken’s distributions for February.
While 14scL4VjDC4CyUHm8G6Qx67arff12fQTex (OTC?) appears to have lost their appetite for the “tainted” coins in early January. https://t.co/RpfsVhOlcp
— Ergo ∴TxIDs Or It Didn’t Happen∴ (@ErgoBTC) February 16, 2020
11 999 BTC of the PlusToken pyramid, despite the attention of the media and the community, managed to get on exchanges for sale. Probably one of the main reasons is the insufficiently fast process of calculating the level of risk and the careless attitude of trading floors to checking incoming transactions.
Another interesting nuance is the output mechanism on OKEx. For visualization follow the link. Hover over IN15 with 33 BTC from the PlusToken pyramid cluster. It is clearly seen that the exchange worked as a classic mixing service, adding a gray entrance to the rest of the white ones. On the right you will see the recipients.
Comparing the February movements of PlusToken funds and the dynamics of the Bitcoin exchange rate, we can draw a reasonable conclusion about the strong pressure of these sales on the market.
In the summer of 2019, they stopped the rise in the price of bitcoin, now, apparently, a similar story has happened.
By mixing PlusToken inputs, exchanges set a precedent. Now there is no point in dividing the bitcoins of the pyramid into dirty and white, since they have already been washed.
This material reflects the private opinion of the author.