On-chain analysts flagged movement of approximately 7,000 ETH — roughly $16.7 million — from wallets associated with the PlusToken Ponzi scheme to exchange deposit addresses. PlusToken, which defrauded investors of approximately $2 billion in crypto between 2018 and 2019, generated the largest known accumulation of ETH from fraudulent activity in crypto history. When PlusToken-linked wallets move to exchanges, the market pays attention — at peak, the scheme held enough ETH to constitute a meaningful percentage of circulating supply.
The PlusToken scheme collected approximately 800,000 ETH and 45,000 BTC before its operators were arrested by Chinese authorities in 2019. The majority of these assets were seized by Chinese law enforcement, but a portion remains in wallets associated with operators who were not apprehended. These wallets have moved assets sporadically over five years, with each movement generating significant market analysis attention due to the potential liquidation volume involved.
The 7,000 ETH movement in this case represents approximately 0.9% of the estimated remaining unconfiscated PlusToken ETH. If analysts' projections that the full $1.3 billion in remaining assets will eventually be liquidated are correct, the movements to date represent a slow, deliberate disposal strategy designed to minimize market impact — rather than the dump-and-exit that characterized earlier Ponzi scheme liquidations.
The ability to identify and track PlusToken-linked wallets five years after the scheme collapsed demonstrates the maturation of blockchain forensics tooling. Chainalysis, Elliptic, and independent analysts maintain labeled wallet databases that connect on-chain addresses to known entities — including criminal schemes — through transaction graph analysis and cross-referencing with court documents, exchange data, and open-source intelligence.
"PlusToken is a perfect case study for blockchain forensics. The fraudsters thought they could mix and obfuscate the funds. Five years later, every movement of those funds is tracked in near-real time by multiple independent teams."
The PlusToken liquidations raise a relevant DeFi question: what happens when tainted assets enter DeFi protocols? Centralized exchanges have compliance mechanisms to freeze or refuse deposits from flagged addresses. DeFi smart contracts execute permissionlessly — a deposit from a PlusToken-linked wallet into Aave, Uniswap, or Curve is technically identical to any other deposit.
The $16M PlusToken movement is a market signal and a forensics demonstration. It is also a reminder that the permissionlessness that makes DeFi efficient creates regulatory surface area that protocols cannot fully outsource to their users. As law enforcement becomes more sophisticated in tracking on-chain criminal assets, the DeFi protocols that those assets pass through will increasingly face questions about what compliance obligations, if any, permissionless infrastructure creates.
Source: legacy