Money Changers that Front as Tech Companies
(Part 1/2) Having 0.1% criminal transactions is incredibly high for any bank. For crypto exchanges, maybe 1%. But this one has waaaaay, way higher % than even that.
Crypto is Money
A Multi-Billion Dollar Crypto Scams Economy
Pig Butchering Scammers— Why Tokenlon?
Does Anyone Use Tokenlon, Outside of Pig Butchering Scams?
Because ImToken?
Who is Tokenlon/ImToken?
Conclusion I
Crypto is Money
BTC (Bitcoin) is money. ETH (Ethereum) is money. In sprawling casino cities of Southeast Asia, digital tokens of USDT (USD Tether) are as good as paper USD. In fact, USDT had become the common currency for cross-border “trade” there —including of humans and drugs.
It stands to reason, then, that firms that facilitate crypto-to-crypto transactions are treated as money changers and transmitters, which carry some social expectation that they not also facilitate criminality. Many governments now are trying to clarify those expectations and develop regulations for crypto companies.
However, there is an ongoing, raging confusion over whether developers of “decentralized” crypto services are mere software developers or actual financial service providers.
We’ll look into the case of crypto companies serving the pig butchering scam industry.
A Multi-Billion Dollar Crypto Scams Economy
Last year, I and a colleague Raymond Hantho of Chainbrium, did a study tracing as many pig butchering scam cases as we can, everything we can find from 2020 to 2023. It was an attempt to quantify and show the massive scale of pig butchering scams going on, with hard blockchain data coming from ~7,000 real reported scam addresses.
Our data was used in a study showing that at least $75 billion has been laundered through cryptocurrency by criminal entities and activities associated with pig butchering scammers. (The study is by University of Austin researchers Kevin Mei and Prof. John Griffin, of the Bitcoin-market-manipulation-by-USDT theory.) My own estimate of pig butchering scams with Chainbrium, counting our own way, got to about the same magnitude, at ~$45 billion. In any case, the numbers are very likely still not comprehensive enough, for reasons I explained in a past issue ($75B Crypto in Pig Butchering is Not “F*cking Absurd”, Actually).
*****
Our findings on the massive amounts of crypto involved in the pig butchering scam industry got covered in TIME and Bloomberg reports, and the shocking numbers reported by Mei & Griffin were immediately —and rabidly— slammed by hard cryptocurrency supporters (example). All their criticisms have been addressed in my previous post, too:
In fact, later on, just this year, leading blockchain intelligence firms reported that, since 2021, $49B has flowed through a notorious crypto marketplace catering to the pig butchering scam industry. The marketplace is administered by a Cambodian financial conglomerate Huoine Pay tied to Cambodia’s ruling family.
We’re all seeing the same big blob on the blockchain.
*****
With that as background, this post will go into the other big findings in our study— the enablers of all that scammed crypto.
Pig Butchering Scammers— Why Tokenlon?
Crypto stolen in pig butchering scams ultimately end up in a crypto exchange, for cashing out into real fiat money. We see the big Chinese-origin exchanges like Binance, Huobi and OKX are the common cash-out points for Chinese scammers, which is not that surprising.
Binance was the biggest baddie exchange by far, and it paid much dearly for that. Its regulatory troubles, multibillion-dollar fines, and brief jailing of its founder-CEO Changpeng Zhao have been covered extensively by mainstream media, so Binance won’t be covered here.
The more interesting surprise was how much a little-known “decentralized” exchange* called Tokenlon is involved in pig butchering scams. By some accounts1, close to a billion USD worth of BTC tainted by pig butchering scams went to Tokenlon’s Bitcoin bridge address 3JMjHDT(…)2, which could be around 20-50% of its total BTC transaction values, depending on the price of Bitcoin. When including ETH and USDT, scam-tainted crypto going to Tokenlon amounted to $5.2B, or over 40% of Tokenlon’s real trading volume of ~$13B3 by 2023.
For context, having even 1% illicit transactions detectable is alarmingly high for any major financial institution. Even by standards of crypto exchanges, US-sanctioned Garantex, considered among the worst money laundering crypto exchange, has merely 30% of its volume traceable to criminal activities, according to Chainalysis.
********
(*What a “decentralized exchange” is will be in Part 2 of this post.)
********
Pig butchering scammers often use Tokenlon to convert BTC or ETH into USDT, which is as good as cash where they are, as mentioned earlier. No need to go to a centralized exchange like Binance to cash out. Indeed, Tokenlon has long been the signature move of pig butchering scams, for law enforcement and private sector analysts (See: The Prevalence of Sha Zhu Pan AKA Pig Butchering Scams by Paul Sibenik).
BELOW: Pie chart of the first known entities hit when bulk tracing ~7,000 pig butchering scam crypto addresses (see our original report for more of the methodology). Binance and Tokenlon at 41% and 29%, respectively.
BELOW: Scammed money is flowing from crypto exchanges on the left to those on the right, and most passing first through Tokenlon, with a few through Uniswap, another “decentralized” exchange. (Fig 1 of Griffin & Mei, 2024)
Additionally, from crypto addresses we got from scam company workers and Telegram channels, we saw that Tokenlon is widely used in that industry for their quick swapping needs. Reportedly Chinese scam bosses in Myanmar used ImToken wallets to store and send their cryptos when it is too risky to use banks.
Does Anyone Use Tokenlon, Outside of Pig Butchering Scams?
Tokenlon has only a miniscule market share among decentralized exchanges. From its inception to the end of 2023, Tokenlon has less than 0.5% of all decentralized exchange daily trading volumes and is only the 30th in size among decentralized exchanges (source: CoinGecko.com). Tokenlon is far down the list.
Month-by-month trading volume on Tokenlon cratered since a surge in mid-2021 to barely $500M in the next 2 years (see below). But, we know that pig butchering scams were just ramping up in 2021... One can take this to as mean that pig butchering scams were becoming a bigger and bigger proportion of Tokenlon’s trading volume and sustaining its business.
Given that Tokenlon sees relatively little usage, why is Tokenlon used so much by pig butchering scammers?
Because ImToken?
Likely, one major reason pig butchering scammers often use Tokenlon has to do with the ImToken Wallet app. Tokenlon is part of the ImToken app and is the ImToken’s default crypto exchange.
Tokenlon in the ImToken app has a couple of special functions that are helpful for pig butchering scammers:
One is Tokenlon’s Bitcoin bridge or “wrapping” service that exchanges Bitcoins into Ethereum tokens. Since Bitcoin and Ethereum are entirely different blockchain networks that cannot communicate with each other, scammers use Tokenlon’s Bitcoin bridge to “chain-hop”4 and convert BTC ultimately into USDT, which is highly liquid and readily acceptable in their illicit economy, i.e. as good as digital US dollar cash.
Two is that Tokenlon inside ImToken allows users to send their swapped tokens to another crypto address while doing the coin swap, instead of going back to their original wallet address. In most (Western) wallet apps, swapping crypto almost always means a crypto asset stays in your wallet at all times, and the tokens are atomically swapped in place without leaving your wallet. In Tokenlon, kicking off the swapped token to another address complicates crypto tracing a bit, as you would have to trace through a series of smart contracts (blockchain programs).
The two functions in ImToken are useful for early crypto launderers, since most BTC-ETH bridge exchanges keep custody of the BTC or ETH and require KYC information of the user, and of course launderers won’t want to give their info. Also, most other decentralized exchanges only send tokens back to the original sender address, which doesn’t add more to crypto tracing.
*******
A third potential reason scammers use Tokenlon: to hide their money trail, as just alluded above. That is what they think they’re doing, at least, and anecdotally, that is what one former human trafficking victim/forced scammer swore to me as to what they use Tokenlon for — to frustrate crypto tracing. Indeed, crypto tracing becomes confusing for many amateur crypto tracers and law enforcement, once crypto enters through a series of Tokenlon smart contracts.
It is even thought that pig butchering scammers also keep swapping with Tokenlon first, before cashing out in a centralized exchange like Binance, to also defeat automated anti-money laundering controls at those cash-out exchanges that only look a few hops backwards for suspicious sources. Maybe doing Tokenlon swaps has developed into a kind of superstition for pig butchering scammers…
Who is Tokenlon/ImToken?
According to its founding story, Tokenlon was incubated within the ImToken company, which develops the eponymous ImToken cryptocurrency wallet app. ImToken was founded in Hangzhou, China in 2017 by serial tech founder and self-taught programmer Ben He (何斌). During a crypto crackdown in China, ImToken relocated to crypto-friendly Singapore around in 2019/2020.
Tokenlon was originally the in-house crypto exchange inside the ImToken app, so that ImToken users do not have to send their cryptocurrencies outside to swap. But in 2019, ImToken announced to have spun off Tokenlon to become a separate entity from ImToken, presumably as a legal firewall, because Tokenlon exchange is already doing regulated financial activities— unregulated. While ImToken, Ltd incorporated as a tech company in Singapore, doing “development of software and applications, (except games and cybersecurity”, Tokenlon was housed under another entity called Digital Era Global, Ltd., in a Carribean offshore haven, in the British Virgin Islands5.
Though, for all intents and purposes, ImToken and Tokenlon are still the same people, same teams, same employees, based on their many public appearances, pronouncements, and online presences.
Tokenlon launched its native token (think ‘equity stocks’) with much fanfare in late 2020, giving it away to tens of thousands of accounts6. It made a big promotional campaign especially among Chinese speakers. The ImToken wallet app was indeed popular7 then among Chinese-speakers for its intuitive, Chinese-language interface, unlike other many early popular crypto wallets app that have no Chinese language mode or had clunky Chinese.
The earliest case of a pig butchering scam involving Tokenlon was in February 2021.
Conclusion I
ImToken is far, far from the only “Decentralized Finance” crypto company in Singapore that puts for its business purpose “development of software…”. It is just one example among multitudes.
For the convenience and utility of cashing out BTC or other kinds of crypto into USDT, there is no need to give personal information to avail oneself of Tokenlon’s exchange services, as is required in any traditional money exchange. PBS victims and investigators who approach Tokenlon for help are invariably met with unhelpful responses. The refrain by Tokenlon is that they are a decentralized exchange and that they do not take custody of funds.
When Tokenlon say they are decentralized, they imply, among other things, that they do not need to ask for KYC, because such requirements are inapplicable to decentralized exchanges like them.
Really?
Up next: Money Changers that Front as Tech Companies, Part 2
.o fijsfljdsngo;sijf’saijg;oingk;jrgkdhgs
Share the whole The Coin Dryer series:
According to an early victim’s advocacy non-profit GASO
Tokenlon has now shut down that BTC-ETH bridge service, likely for regulatory reasons
Real = when counting only one-way inputs as baseline, not both incoming and outgoing transactions to Tokenlon.
Which is also done by criminals to break the money trail for people tracing the crypto
Corporate name at the bottom of the Tokenlon website, and in Coingecko.com
For crypto people - Tokenlon/Imtoken did an airdrop, giving away LON tokens to 40,000 unique addresses
Refer to TokenTerminal.com chart above on Tokenlon usage