The important link of the 'fraud empire' Tran Chi in Cambodia

Cryptocurrency mining company Lubian played a key role in Tran Chi's money laundering campaign, helping to convert illegal profits into "clean" Bitcoin.

The US Department of Justice (DOJ) has indicted Chen Zhi, Chairman of Prince Group, for allegedly running a “giant cyber fraud empire”, leading to the seizure of about $15 billion worth of Bitcoin, the largest ever.

According to US allegations, Chen's criminal network operated many disguised businesses in Cambodia, using forced labor to conduct online fraud activities, turning Cambodia into a hub for transnational "fraud farms".

Lubian appears several times in the DOJ filings. More than just a Bitcoin mining company, it is a key link in a complex money laundering network.

Prince Group headquarters in Phnom Penh (Cambodia). Photo: Yonhap.

Victim of the biggest Bitcoin attack

According to the DOJ indictment and public information, Lubian is a China-based Bitcoin mining company that has mining facilities in several Asian countries, including China and Iran.

Lubian was once a big name in the Bitcoin mining industry. At one point, the company owned the 6th largest Bitcoin mining operation in the world .

Although it was only founded in 2020, Lubian accounted for about 6% of the global Bitcoin network hash rate in May of that year. The company was involved in the largest Bitcoin theft in history, which occurred in December 2020, worth 127,426 BTC.

The information was released by blockchain analysis firm Arkham Intelligence in August. The theft occurred due to a vulnerability in Lubian's private key generation process, which is vulnerable to brute-force attacks.

The current state of Lubian's wallet after the December 2020 attack. Photo: Arkham Intelligence .

In the first attack on December 28, 2020, hackers stole more than 90% of Lubian's Bitcoin holdings. A day later, the second attack took another $6 million worth of Bitcoin and USDT from an address operating on the Omni Layer.

Lubian quickly transferred the remaining funds to a recovery wallet on December 31, 2020. At that time, the stolen Bitcoin was worth about $3.5 billion , but Lubian did not disclose the information.

According to data from Arkham, the attacker became the 13th largest Bitcoin holder in the world. Due to the continuous increase in BTC price since 2020, the value of the stolen coins has increased sharply after 5 years.

In an attempt to get his money back, Lubian made 1,516 small transactions (worth about 1.4 BTC in total), begging the hackers to return the stolen Bitcoin. However, these messages went unanswered.

Suddenly disappeared

The stolen Bitcoins remained dormant until July 2024, when they were transferred to a new wallet, after which they remained dormant. Currently, wallet addresses associated with Lubian's mining operations still hold 11,886 BTC.

As for Lubian, the company abruptly shut down without explanation. On February 28, 2021, Lubian's mining operations ended after Bitcoin block 672,636. According to Compass Mining , Lubian used its full mining capacity from May 2020 until it shut down, mining an average of 174 blocks per month.

Bitcoin's mining capacity was among the world's top before it stopped operating in early 2021. Photo: Arkham Intelligence .

Notably, the DOJ documents show that the Bitcoins seized from Chen were stolen in 2020. The documents list 25 wallet addresses, which indicate that the seized BTC were previously held. These are the Lubian addresses (controlled by Chen) from which the Bitcoins were stolen.

On October 15, the day after the DOJ announcement, a wallet associated with Lubian suddenly moved 9,757 BTC (about $1.1 billion ) to two other addresses after being inactive for three years. A few hours later, another wallet moved another 2,129 BTC. The total amount transferred was 11,886 BTC, matching the amount of Bitcoin transferred by Lubian to the recovery wallet after the 2020 attack.

On the same day, Arkham Intelligence confirmed that the 127,271 BTC confiscated by the DOJ from Lubian was under the control of the US government .

The US government is said to have seized an additional $2.4 billion worth of BTC following the previous $14.1 billion recovery. Photo: Arkham Intelligence .

According to the DOJ, Chen Zhi is accused of running a global cyber fraud ring, money laundering, and using forced labor.

According to the investigation results, the victims were deceived through the form of “pig butchering”. In this form, the scammer builds fake relationships on the Internet, creates trust and then lures the victims to invest in fake exchanges and wallet platforms.

“This is the largest virtual asset seizure in history,” the DOJ stressed in an official statement.

Important link

In Chen's money laundering campaign, Lubian played a key role in "transforming" fraudulent profits into "clean" Bitcoin.

According to the DOJ filing, Chen used the illegal profits to fund a large-scale cryptocurrency mining operation involving Lubian and a company called Warp Data Technology (based in Laos).

“Chen once said that the profits were huge due to low costs, meaning that the operating capital of these businesses came from money that Prince Group defrauded from victims,” the document stated.

Lubian’s mining operation generated “clean” Bitcoins, separate from the illegal profits. Chen and his accomplices combined the two funds to conceal their origins.

Chen's wallet addresses are subject to Bitcoin seizure. Photo: US Department of Justice .

For example, Lubian addresses receive large amounts of funds from sources unrelated to mining, the proportion of new Bitcoin in Lubian wallets is only around 30%.

The FBI's analysis found that the bitcoins were destined for unhosted wallets owned by Chen.

Based on records, the cryptocurrency was split up and dispersed across dozens, even hundreds of wallets before being pooled into Chen's wallets.

The FBI calls this process “spraying and funneling.” These patterns are consistent with existing money laundering techniques.

It is noteworthy that the transactions were sent in similar amounts and times. The similarity suggests that the Bitcoins from Exchange-2 (the scam money) were intentionally transferred to mimic transactions from Bitcoin mining funds, creating a cover for all the money in the wallet to originate from mining activities, hiding the remaining illegal funds.

Source: https://znews.vn/mat-xich-quan-trong-cua-de-che-lua-dao-tran-chi-post1595596.html