In search of an outstanding scam to investigate the TokenScope Team, as promised before, set out to investigate the circumstances of the theft of the clients’ funds of the GainBitcoin, the largest Indian-born pyramid.
The pyramid's performance is impressive:
Organizational structure of the pyramid:
GainBitcoin - an investment product, that attracted investments in BTC at interest and in cloud mining;
GBMiners - a mining pool possibly operating in China (One of the addresses of the pool: 1ELmaYHcMyPUTLuG9E1kTu7twF1LbuJ24E, graph of the funds withdrawal from the specified mining pool); the money was withdrawn to the exchange Poloniex, BTC-e, services CryptoLocker and Xapo.
Paybits - the pyramid's payment system;
Coinbank - the pyramid's crypto-bank;
MCAP Labs - a company that released its MCAP token in April 2017. Coin contract 0x93e682107d1e9defb0b5ee701c71707a4b2e46bc. Later, MCAP became more than just an alternative payment option, it became the only default payment option, replacing BTC, which was the cryptocurrency for payments on the original contract. The price of the coin mostly had a negative trend since launch.
Researching the BTC.
The research of the open source revealed one of the main addresses owned by GainBitcoin: 1EYSiRC2nUi2xLMTuwkWhHtpTTVVZ6KNrz. The turnover of the address was 46 899 BTC, last activity of the address was on November 27, 2017.
The study of the outgoing transactions allowed to establish the ways of the funds withdrawal and the pyramid’s addresses of the funds cold storage.
So the withdrawal of funds for the most part was carried out through the addresses located on the OKX and Huobi exchanges and the Zebpay and CryptoLocker services.
To see the full graph of the outgoing transactions click here.
The study of the incoming transactions showed that 1EYSiRC2nUi2xLMTuwkWhHtpTTVVZ6KNrz was deposited from the following resources: Bitfinex, Huobi, Polonex exchanges and 777Coin, BitcoinGrowthFund and Zebpay services.
To see the full graph of the incoming transactions click here.
Studying the transactions of the main GainBitcoin address, we faced with 1KK8K3VrabAeweEkiAZZjcqDZiHgsVUki6 wallet, which was created on April 30, 2015 and functions until now. The turnover of the address is 172 371 BTC, the current balance is 34.7 BTC.
Presumably, these 3 addresses belong to the service that served GainBitcoin interests. The funds to these active addresses in 2022 were transferred from OKX exchange and the withdrawal was made through the BetVIP wallet addresses.
To see the full graph of the mentioned wallets click here.
In addition, during our investigation we have identified several cold storage wallets: 1HR3LzHyBtNNN1Dq49WqSiSwzFK27yyn2b. During July 2022 the amount of 3 374 BTC was transferred to this address where it is currently stored. The amount of 1 084 BTC was transferred to the 34xwHezbUroufACKVBeFrWZEHEfiDsq6fj on July 7, 2022, where it is currently stored.
The creators of the GainBitcoin pyramid acted according to the classical scheme for such pyramids. Funds were collected from investors in BTC, while payments at the initial stage were also made in BTC. In April 2017, the organizers launched their own MCAP token and forcibly transferred payments into this token. Needless to say, the management of the price of the coin and its liquidity remained in the hands of the pyramid’s creators.
The total amount of the funds, collected by the GainBitcoin pyramid, revealed by the TokenScope investigation, was at least 46 899 BTC (which is more than $1 billion at the current exchange rate). There is also a large amount of funds raised in MCAP token. The collected funds were mostly withdrawn through the Bitfinex, Huobi, Poloniex exchanges and 777Coin, BitcoinGrowthFund and Zebpay services.
Additionally, we identified 3 pyramid addresses that are active up to now as well as the cold storage wallets with more than 4 000 BTC (equals to $80 million) on balance.