Ponzi scheme

The case

The originators of the Ponzi scheme operated a website on which so-called cloud mining was offered.
Here you can rent computing power, which is then used for mining cryptocurrencies (in this case Bitcoin).

But the computing power sold did not exist.
The amounts deposited for the rented computing power were used to pay the existing customers in order to give the impression that Bitcoin mining was actually taking place.

Our analyzes showed that a total of ~ 42,000 Bitcoin were deposited.
This amount is offset by payouts to customers of ~ 21,000 Bitcoin.

Date

2015 – 2018

(among other company name until today)

Damage amount

~42,000 BTC

(of which ~ 21,000 BTC paid back to customers)

Status

open

If you are interested in a demo version of the analyzes-data, please contact us.

The analyzes

In order to prove the Ponzi scheme, it had to be proven that no Bitcoin mining took place.
In addition, the amount of deposits by customers and payments to customers had to be determined.
Therefore we used the analyzes tools we developed for blockchain analyzes.
Our analyzes also included the following researchs:

  • Determination of the company operator, since the company was operated as a “mailbox company” in a country known for this.
  • Research on previous business activities of the actual company owners. These have already operated illegal companies in the past.
  • Research into the following business activities after the company described here was “liquidated”. These investigations showed that the company owners operate another company on exactly the same principle and continue to do so to this day.
  • Since this is an open case, we will not publish all the details of our analyzes here. We ask for your understanding.

Blockchain analyzes

In the first step of the investigation, we focused on the deposits made by customers and the payments made to them.
For this we have found all the company’s deposit addresses. That was over 300,000 Bitcoin addresses.
In addition, we have determined all withdraw addresses. These were only 35 Bitcoin addresses.
The comparison of the deposits and the withdrawals resulted in a difference of ~ 21,000 Bitcoin.

In the next step, we provided evidence that Bitcoin mining never took place.
The company described allegedly operated Bitcoin mining through 5 different mining pools.
So we have determined all the Bitcoin addresses of these mining pools. This resulted in ~ 280,000 unique Bitcoin addresses.
Next, we examined all the inputs to the previously determined deposit and withdrawal addresses and found that only a very small proportion came from the Bitcoin addresses of the mining pools. These can be explained by the fact that customers of the company had earned their bitcoins before depositing with these pools.
In order to provide final proof that no Bitcoin mining had taken place, we examined all inputs for the Coinbase transaction.
Coinbase transactions are the transactions through which the Bitcoin miners get their newly generated Bitcoins paid out in the event that they find a new Bitcoin block.
We were only able to find the mentioned Coinbase transactions in just as small numbers as the deposits from the pool addresses.

In the last step, we checked all payments to the withdraw addresses and provided evidence that all payments to these addresses can be traced back to the deposit addresses.
Furthermore, we have determined all outgoing payments from the deposit addresses in order to determine that around half of the bitcoins deposited have been paid out to the customers. For the remaining half, we have determined on which Bitcoin exchanges these were sold.

Further analyzes

As already described under the point “the analyzes”, we have carried out extensive further analyzes of the company operators, their previous activities and their current business activities.
Since this is an open case, we ask for your understanding that we will not go into further details of this investigation here.

The bottom line

The size of the case described shows that the procedure described was and is obviously very successful.
Obviously, a large number of investors were deceived by this and ultimately cheated of their money.
As explained in the case description, the authors are now continuing to operate their fraud model under a different company name.
In addition, we were able to find several other websites that work on exactly the same principle.
What we have noticed is the fact that fraudsters are becoming more and more creative and professional when it comes to disguising deposits and withdrawals.

If you are interested in the complete analyzes or in access to our demo version, please contact us.