PlusToken · The Largest Crypto Ponzi, Traced On-Chain

Introduction: a money printer that fit in your pocket

Most of the wrecks in this archive are technical failures. Luna was the death spiral of an algorithmic stablecoin; FTX was a balance sheet that misappropriated customer assets; Mt.Gox was an early exchange that lost control of its own security and bookkeeping. Each one needs a layer of mechanism to explain — you have to read some code or a financial statement to understand how the ship went down.

PlusToken needs none of that. Its mechanism is simple enough to write on a sticky note: bring in new people, use the new people's money to pay "returns" and commissions to the old people, let those returns attract more new people, and keep going until the new money runs out. This is a scam that predates crypto by a century. The only thing different this time is that it shipped inside an app you could keep in your pocket, spread across dozens of WeChat groups and hundreds of Telegram channels overnight, crossed borders, and routed around every bank in between.

I am filing it under Shipwreck Annals precisely because it was so simple and yet swept up — reportedly — millions of people. Take a trick this old, wrap it in a few new words ("blockchain," "AI arbitrage," "wallet"), and a large number of people who would never otherwise have fallen for it handed over real money. Every figure, mechanism, and on-chain detail below follows public reporting and public on-chain analysis. Where a precise number is uncertain, I mark it as a reported approximation.

The numbers at a glance

First, the scale of the ship. The figures below all come from public reporting and from public analysis by firms such as Chainalysis. Every one of them should be read as "approximate" and "reported" — not a single one is a hard fact confirmed by all parties. A scheme whose books were fake to begin with never had authoritative accounts to publish.

Set those boxes side by side and the contrast is jarring: on one side, a balance comparable to a mid-sized country's foreign-exchange reserves; on the other, the weightless container of "an app." The size of a scam never depends on how complex it is. It depends on how fast it can replicate and spread.

What PlusToken was actually selling

The packaging was thorough — thorough enough that someone unfamiliar with crypto could find almost no seam in it. The core pitch had three layers:

• "This is a high-yield wallet." You move your BTC, ETH, or EOS into the PlusToken wallet, and it does not just hold them — it makes them grow. That single step is the whole con: it blends "storing coins" and "earning yield" into one act, so the user believes they have merely upgraded to a smarter wallet.
• "The yield comes from AI quant arbitrage." Arbitrage means buying low on one exchange and selling high on another. The strategy is real, but its margins are thin and its capacity is limited. PlusToken dressed it up as a fully automated "AI smart bot" and promised high monthly returns (reportedly advertised around 10% a month, sometimes more). Grafting an impossible-to-sustain promise onto a real-but-tiny strategy was its most insidious move.
• "And the platform token will moon." It also issued its own token (the Plus token), telling members it would soon list on exchanges and surge in price. That added a final layer of "asset appreciation" to the story — and conveniently let the operators fob off withdrawals with "the token" instead of real coins in the closing phase.

Stacked together, the three layers buried the word "Ponzi" deep. What a member saw was not "recruit people and split the take" but "I am using a smart wallet that auto-arbitrages, I earn steadily every month, and I get a token that will appreciate." According to public reporting and trial materials, the AI arbitrage either did not exist or came nowhere close to funding the promised returns — the payouts and withdrawals handed to earlier members were funded mainly by the deposits of incoming ones. That is the standard definition of a Ponzi scheme, dressed in a respectable coat of technology. To readers who lived through BitConnect in 2017 or the long saga of OneCoin, the shape will be instantly familiar; PlusToken is the same animal with a wallet skin.

The referral engine that inflated it

On the strength of "high-yield wallet" alone, PlusToken would have been a mid-sized fraud at most. What pushed it to a reported millions of members and roughly 200,000 BTC was its second engine — multi-level referral commissions (MLM). In plain terms: depositing your own coins for "yield" was not enough; you could also recruit. When the people you brought in deposited, you skimmed a layer of their "yield," and when those people recruited others, you skimmed again, reportedly stacking down many levels. Every member became a salesperson — you were not "investing," you were "building a downline," and the deeper and wider it grew, the more "passive income" you collected.

The terrifying part of this design is that it turns every victim into a recruiter for the next batch of victims — willing, enthusiastic recruiters, often acting out of genuine goodwill toward friends. That is why its victims clustered so tightly: Chinese-speaking communities (including the diaspora), Korea, and retail traders across Southeast Asia. The trust networks inside those WeChat groups, KakaoTalk chats, and Telegram channels are dense, and 2018-2019 carried a widespread expectation that "the next bull run is coming." Referral virality spreads through that kind of soil like wildfire.

It looks a great deal like an honest "referral rebate," but one hard line separates them: in a legitimate rebate the money comes from real business revenue, such as trading fees; in a Ponzi rebate every cent you receive comes directly from the deposit of the person who entered after you. When commissions can only be sustained by the next person walking in the door, the scheme is mathematically guaranteed to break at some point, because both population and capital are finite. For PlusToken, that "some point" was the summer of 2019. North American and global outlets, from Reuters to CoinDesk and The Block, would later cover it under almost exactly that framing — a referral-driven Ponzi that simply ran out of new entrants.

Summer 2019: why the withdrawals stopped

Every Ponzi dies the same way: the new money coming in is no longer enough to pay the old money that wants out. According to public reporting, around June 2019 large numbers of members began complaining that the app would not let them withdraw and that support had gone dark; the operators stalled with the usual excuses — system maintenance, a hacker attack, an upgrade in progress. That script should feel familiar — I wrote about it in the Luna volume: every "we are pausing withdrawals for system maintenance / due to a hack" notice can be read, by default, as "we have seen something we do not want you to see." For a Ponzi, "we cannot process withdrawals" is never a technical fault — it is the moment the new money finally fails to catch up with the old debt.

Once a withdrawal wave forms, the bank run is irreversible — everyone wants to be the first to pull their coins out, and there were never that many real coins to pull. After the collapse, core members fled abroad carrying the real coins members had transferred in (their arrest and trial are covered below in "Vanuatu, repatriation, and the trial"). One detail is worth pausing on: the "move your coins into the wallet" design shows its cruelest face at the instant of collapse. The coins were transferred "voluntarily" into a wallet the operators controlled, and what they held were real crypto assets they could move on-chain immediately — not bank deposits that need a process to touch. The collapse and the getaway were almost the same action, which is exactly where the next section, the on-chain trace, begins.

On-chain forensics: can money hide?

This is the most valuable stretch of the PlusToken case as far as this archive is concerned, and where it differs most from an ordinary pyramid case — its money was all on-chain, and what is on-chain cannot be deleted. A Ponzi has a counterintuitive property: to manage "yield" and withdrawals centrally, every coin members transfer in eventually funnels into a small number of controlling addresses. For the fraudster that is operational convenience; for the on-chain investigator it is the fraudster drawing a treasure map by hand — watch those few aggregation addresses, and where the money flows is plain to see. According to public analysis from Chainalysis and others, the PlusToken proceeds did not, and could not, simply vanish into thin air; instead a long laundering process began:

• Mixing: splitting large balances into countless small amounts that hop repeatedly between many addresses, trying to sever the link "this money came from PlusToken."
• Over-the-counter (OTC) trading: using OTC market makers, informal money brokers, and the OTC channels of some exchanges to convert coins into fiat or into assets harder to trace.

Per analysis from Chainalysis and others, this enormous wave of cashing out is believed to have contributed to some of the bitcoin selling pressure observed in 2019 — that much forced selling hitting the market may have exerted observable downward pressure on the price during certain windows. It bears emphasizing that this is a "believed to have contributed" correlation, not a "PlusToken single-handedly caused a given drop" causal claim; the bitcoin price is set by countless factors at once. Chainalysis laid out a version of this trace in its 2020 State of Crypto Crime report, which is part of why the case became a reference point in the English-language on-chain community.

But wherever the proceeds were ultimately laundered to, the trace itself proves a conclusion useful to everyone: money can be hidden on-chain, but it cannot be hidden from the chain. Many fraudsters first treated the blockchain as an anonymous ATM; PlusToken is the counterexample. It was precisely that permanent, public, immutable ledger that let analytics firms and law enforcement reconstruct the flow of funds transaction by transaction after the fact. This is one of the rare moments in crypto when the technology stood on the victims' side.

Vanuatu, repatriation, and the trial

Unlike many frauds where the operators vanish into thin air, the PlusToken case reached a relatively clear conclusion at the legal level. According to public reporting, several core members fled abroad after the 2019 collapse, with some of the principals hiding out in the South Pacific island nation of Vanuatu before being apprehended and repatriated to China. In November 2020, a court in Yancheng, Jiangsu province issued a first-instance judgment — per public reporting, more than one hundred defendants (reported by some outlets as 109) were convicted of offenses including organizing and leading pyramid-selling activity, the principals received heavy sentences, and the vast seized crypto assets were turned over to the state treasury under the ruling.

One harsh thing has to be stated plainly here: assets being seized and victims getting their money back are two completely different things. Turning the enormous crypto haul over to the state treasury means those coins were disposed of in a legal sense, but for the overwhelming majority of ordinary members, the principal they transferred into PlusToken was not repaid to them individually, one by one. This is the common ending of nearly every large Ponzi case — the ringleaders are caught, the assets are confiscated, and most of the millions of people at the bottom of the pyramid never see their money again. A legal victory and your personal loss often sit on entirely different balance sheets. For readers in North America, the closest familiar frame is how US regulators such as the SEC and CFTC characterize a Ponzi scheme: the operators may face penalties and forfeiture, yet investor restitution is partial at best and frequently arrives years later, if at all.

How to spot the next PlusToken

PlusToken is dead, but its template is not. Every so often crypto produces another "wallet," "ecosystem," or "smart arbitrage platform" with a new name and an identical skeleton. Take PlusToken apart and you find a handful of signals shared by almost all schemes of this kind — remembering them is far more useful than remembering any name:

1. It promises a fixed, stable, high monthly return. Real returns fluctuate and are never guaranteed. Treat any crypto product that says "a steady X% every month" or "principal and interest protected" as a Ponzi first, and make it explain where the yield comes from second — a high return that cannot explain its source is funded by the people entering after you.
2. The returns depend heavily on recruiting. If the core way to make money is building a downline rather than the product itself, you are almost certainly looking at a hybrid of pyramid selling and a Ponzi. A legitimate rebate is a nice extra; a Ponzi rebate is the only engine.
3. It asks you to move your coins into "its own wallet." Once you hand over the keys or control, no matter how lovely the interface numbers look, you no longer own those coins. "Not your keys, not your coins" is, here, a literal survival rule.
4. It wraps an old scam in new words. "AI arbitrage," "quant bots," "blockchain ecosystem," "Web3 wallet" are not wrong in themselves — but when they are used to dodge the plainest question of all, "where does the money actually come from," the new words are a smokescreen.

For the question of "which money belongs in self-custody and which belongs on a compliant exchange," the deeper framework is in Archive Lesson · Five Criteria for Exchange Selection, which distills the early signals of schemes like PlusToken into an operating checklist. Treat this volume as the extreme cautionary case behind that lesson.

The most direct takeaway PlusToken leaves behind is not "avoid crypto." It is "do not hand your coins to a wallet that cannot explain where its yield comes from and keeps begging you to recruit." The opposite of that is keeping your coins somewhere whose books you can independently verify — a platform that regularly publishes Proof of Reserves, segregates customer assets, and maintains a user-protection fund sits at the far end of the risk spectrum from an app that tells you to "move your coins in and wait for the AI to make you money."

The exchange I have used myself for the past few years is Binance, for a boring reason: it is one of the few large exchanges that publishes monthly Proof of Reserves, segregates customer assets, and operates the SAFU user-protection fund. None of that means it carries no risk — it only means its risk signals are not in the same dimension as a scheme like PlusToken. For why I chose this exchange and exactly how the affiliate relationship works, I have written a full disclosure on the Binance referral page.