Through a mixer, and the peel chain

Graduate · enrolled learners

This lesson opens with PlusToken Ponzi, 2019.

What happened

PlusToken was one of the largest cryptocurrency Ponzi schemes: based in China, it presented itself as a wallet paying high returns and took in from millions of people what Chainalysis tracked as 180,000 BTC, 6.4 million ETH and smaller sums, roughly 2 billion dollars, before six people connected to it were arrested in June 2019. The operators then had to launder an enormous sum on transparent chains, and they used two standard tools. Mixers pooled and re-emitted funds to break the direct trail. Peel chains did the quieter work: a large mother amount would move to a new address, peeling off a small slice to an exchange or cash-out point, then move the large remainder to another new address and peel again, so the funds trickled out in small, individually unremarkable amounts while the bulk kept moving. By December 2019 the scammers had moved their bitcoin more than 24,000 times through more than 71,000 addresses. Chainalysis tracked much of it regardless: 45,000 BTC and about 800,000 ETH it could say the scammers moved to their own addresses, roughly 25,000 of that BTC already cashed out, nearly all through OTC brokers operating on the Huobi exchange, at least 185 million dollars of it. The laundering added enormous noise and did not erase the recorded path.

The decision point

A peel chain is designed to exploit an analyst's attention, not to break the ledger. Every peel and every move is a recorded edge, so the trail is fully intact; what the technique adds is volume, thousands of hops and thousands of tiny outputs, betting that a tracer will lose the thread or run out of patience. The counter is structural: at each peel, the funds split into a small peeled amount and a large residual, and the residual is the thing to follow, because it carries the bulk and continues the chain, while the peels are catalogued separately as cash-out attempts to be checked against known services. Mixers are the harder wall, handled by the correspondence methods of clustering, but a peel chain is not a wall at all; it is a long, noisy corridor whose every step is written down. Following money through obfuscation is mostly discipline: know which technique you are looking at, and know the one thread that carries the value.

Recorded loss

$2,000,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.