Curriculum·G103 Fund-Flow Tracing and Forensics·about 31 min

Through a mixer, and the peel chain

By the end of this lesson you can

  • Recognize a peel chain: a large sum shedding small amounts through a long chain of addresses
  • Explain how PlusToken's operators laundered billions through peel chains and mixers
  • Compute how a peel chain hides a destination in noise without breaking the recorded trail
  • Follow value through obfuscation by tracking the large residual and the peeled amounts separately

Graduate · enrolled learners

This lesson opens with PlusToken Ponzi, 2019.

What happened
PlusToken was one of the largest cryptocurrency Ponzi schemes, taking in on the order of 2 billion dollars or more in bitcoin, ether and other assets from millions of victims, mostly across Asia, before collapsing in 2019. The operators then had to launder an enormous sum on transparent chains, and they used two standard tools. Mixers pooled and re-emitted funds to break the direct trail. Peel chains did the quieter work: a large mother amount would move to a new address, peeling off a small slice to an exchange or cash-out point, then move the large remainder to another new address and peel again, thousands of times, so the funds trickled out in small, individually unremarkable amounts while the bulk kept moving. Analysts at firms like Chainalysis tracked much of it regardless, following the large residual through the chain and flagging the peels as they hit known services. The laundering added enormous noise and did not erase the recorded path.
The decision point
A peel chain is designed to exploit an analyst's attention, not to break the ledger. Every peel and every move is a recorded edge, so the trail is fully intact; what the technique adds is volume, thousands of hops and thousands of tiny outputs, betting that a tracer will lose the thread or run out of patience. The counter is structural: at each peel, the funds split into a small peeled amount and a large residual, and the residual is the thing to follow, because it carries the bulk and continues the chain, while the peels are catalogued separately as cash-out attempts to be checked against known services. Mixers are the harder wall, handled by the correspondence methods of clustering, but a peel chain is not a wall at all; it is a long, noisy corridor whose every step is written down. Following money through obfuscation is mostly discipline: know which technique you are looking at, and know the one thread that carries the value.
Recorded loss
$2,000,000,000

What you will be able to answer

  • What is a peel chain?
  • How did PlusToken launder its ~2 billion dollars?
  • What does a peel chain break, and what does it not?
  • How do you trace through a peel chain?

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.

Sources and review

Confidence high·Volatility low·Reviewed 2026-09-15·Owner unassigned

Contested

PlusToken's total intake is estimated at roughly 2 billion dollars or more across several assets; figures vary by source and by valuation date. The use of peel chains and mixers to launder the proceeds is well documented.

Peel-chain and mixer techniques vary in implementation; the residual-following method described is the standard counter and does not guarantee following every peel to a named identity.