The hidden funds of the LUNA project

Upon requests of our clients TokenScope Team continues to follow the situation around LUNA project, which token price collapsed more than 100 times at the beginning of May this year (traded on the 7th of May, 2022 at $87.1 per LUNA token and on the 12th of May, 2022 the price fell to almost to $0.01).

This time we are examining the information about the developers of the “Luna Foundation Guard” coin that made a withdrawal from their wallet in BTC currency just before the collapse of the LUNA token, which may indirectly indicate a pre-planned scam. We also will check the theory that the withdrawal of funds from the coin developers’ wallet may have been aimed at maintaining the liquidity of the LUNA coin.

The study of the address of the "Luna Foundation Guard" bc1q9d4ywgfnd8h43da5tpcxcn6ajv590cg6d3tg6axemvljvt2k76zs50tv4q revealed that it was created on January 21, 2022, the address currently has a turnover of 70 736 BTC, the current balance is 312 BTC.

During the entire existence of the address, it has always been replenished, and only on May 9 and 10, 2022 the withdrawal of funds by 2 outgoing transactions was recorded:

• On May 09, 2022 for 42 530 BTC to the address bc1qwuwyt0q83gr4cvawgdwdqeum0y2mfkx44hl44hlzd7ke2syg3vddql8scn63rm, from which funds were sent to 2 addresses on the same day:

  • 30 000 BTC to the address bc1qlyfrxkwp2xg39cd6usx6aw45u5rlcgl3sygu2w, from where on the same day by one transaction (accompanied by 3 and more addresses) totaling 37 180 BTC was sent to the address 1NYAd6fA2dc5xowuweFUSDRqRTEzDwk28, located on the OKEx exchange, from where the funds were sent to 2 main addresses:

    • 1 000 BTC to the address 32V6a7K46pSb1XQNGdrmdE2wjgndVfJPet (located on the Coinbase exchange) from which a transaction to 127 wallets was made on different small amounts. Then, from each wallet funds were dispersed to even smaller transactions, that led us to the address 19om4Guv9QmVesS7AewMUyE5JUJ9H7xwNN, on which 9 789 BTC is stored now.

    • 36 815 BTC to the address bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2 (also a wallet on the OKEx exchange), from which on the same day the funds were sent in the following order:

      • 19 000 BTC to the address 1BejpJzSYnydbvpar1qwrjjMLuQY1c5DF, from which the funds were sent to the address bc1qm34lsc65zpw79lxes69zkqm6ee3ewf0j77s3h. The address bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h was mentioned in the media as related to the withdrawal of $42 million though the Coinbase exchange in December 2021, and as a “Whale” address trading on large sums, current balance is 26 841 BTC.

      • 4 700 BTC were sent to the address 1P3AfqQ9cdrr7TKUexuWQoyvYZu8wFeTh, from which via address bc1qtxg6h7gg3q8s3jdw2rxv0ldu503zn96m8y8x2 the funds were sent to the address bc1qeskrez68qp79kjvmx5zlw32s3y9l4dscsnevsf, where: 2 500 BTC via address bc1qfmztq2lcdvp5qrkkea2sf864yfgu4gaxdvkj5 were sent to bc1q4jchcr7nla277su5lpjzttxp3xg5j8wds5lcwg, wherefrom by several transactions 1 121 BTC were sent to the address 12Eqo4vhJUqHhnUYb3vSm9Kq4Eo1GCb5kC, where the current balance of 6 759 BTC.

      • 430 BTC were sent to the address bc1q8yjyrqjfac5993jueqtk7waaq3wxkp4lwc6uy6, from which the funds were transferred by 1 transaction to 2 addresses: bc1q6kyur2rn044ddp4j9gtdlswhdyrg7u7t9c0j36 and bc1q08sndvvmwz6ntaaqesv3fr5ycmg6p7vhuqsk5zj from which the funds were sent as part of a 936 BTC transaction to address 3Gw3m65Po8Vy4MLeLjsBBaASaUbD23gizw, from which the funds were sent through the chain of addresses to more than 100 addresses.

      • 2 000 BTC were transferred via address bc1q274r3spj5pn828qkdvv42d9sc9204q4vfgrngg to the address bc1q0t8qm6cj6dxrnvt2nsecfn2cu2pgju8jyte3fx, then to 3N1X5DPnSXQqTdrujPk27VGfP4Riw9s9Xo and finally in a set of addresses by a 3 000 BTC transaction funds were sent to more than 100 addresses through the chain of addresses.

      • 1 653 BTC were transferred to 3FupZp77ySr7jwoLYEJ9mwzJpvoNBXsBnE, where they are currently stored (current balance of the address is 36 438 BTC).

      • 10 002 BTC were transferred to 3Kzh9qAqVWQhQhEsfQz7zEQL1EuSx5tyNLNS (current balance is 40 132 BTC), from which by several transactions, before May 12, 2022 the funds were returned to the address bc1q29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2.

  • 12 530 BTC were transferred to the address bc1qslcc7cjghgg7dkyzjaj3jn6l9z6wr0rj9zpwhd7prhc8z2hraafstvq6jn, from which also on May 9, 2022 by a single transaction (with 3 more outgoing addresses) funds in the amount of 28 205 BTC were returned to bc1q9d4ywgfnd8h43da5tpcxcn6ajv590cg6d3tg6axemvljvt2k76zs50tv4q.

    The examination of the addresses, that replenished the initial address of "Luna Foundation Guard" on May 9, 2022, led us to another address, that presumably belongs to the same group: bc1q0wgz9gt8tyac5ct94czvyuu4v264fclrxlq8su4s2kk6u8nmwy9swjp6t7.

    The study of the abovementioned address revealed that on May 9, 2022, funds in the amount of 25 012 BTC from this address, were sent by one transaction to 2 addresses - 22 189 BTC were transferred to the already known address bc1qlyfrxkwp2xg39cd6usx6aw45u5rlcgl3sygu2w and 2 823 BTC were transferred to bc1q6nq2ulgndelg9duqg670grxj4yku8glwr3jmsgynxrh0muscywastqxh7r. Further, on the same day, from this address, funds were sent to the main LFG address bc1q9d4ywgfnd8h43da5tpcxn6ajv590cg6d3tg6axemvljvt2k76zs50tv4q.

    The study of the bc1qlyfrxkwp2xg39cd6usx6aw45u5rlcgl3sygu2w address transactions revealed that all of the 22 189 BTC were sent, through a chain of addresses, to the already known address 1NYAd6fA2dc5xowuweFUSDRqRTEzDwk28, located on the OKEx exchange, from which funds were withdrawn by transactions in the amount of 3 000 BTC through the address 1BejpJzSYnydbvbpar1qwrjjMLuQY1c5DF from which funds were sent to the address bc1qm34lsc65zpw79lxes69zkqmqk6ee3ewf0j77s3h (already known as “Whale”).

• On May 10, 2022, the entire amount of 28 205 BTC was sent to the address 163mp4eKBixViv7VPwG3aKvcNDkh3UmsSP, from which by a transaction of 28 243 BTC (consisted of 72 addresses) funds were sent to the address bc1qm34lsc65zpw79lxes69zkqm6ee3ewf0j77s3h.

  From the address bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h right after the replenishment, the amount of 41 229 BTC was withdrawn through the address 3M219KR5vEneNb47ewrPfWyb5jQ2DjxRP6 (reportedly, it’s a cold wallet on the Binance exchange), a part of which, on May 11, 2022, in the amount of 25 314 BTC was also withdrawn via 2 addresses:

  • 5 313 BTC to the address 37j8MPaE8JdtUBHGAmGUH7c931LsAonvDR, where the funds are currently stored.

  • 20 000 BTC were returned to the address bc1qm34lsc65zpw79lxes69zkqmq6ee3ewf0j77s3h, wherefrom on the same day the amount of 6 268 BTC was sent back to 3M219KR5vEneNb47ewrPfWyb5jQ2DjxRP6 (current balance of the address is 90 913 BTC).

Transaction graph is available at the link.

Thus, the funds from the wallets bc1q9d4ywgfnd8h43da5tpcxcn6ajv590cg6d3tg6axemvljvt2k76zs50tv4q and bc1q0wgz9gt8tyac5ct94czvyuu4v264fclrxlq8su4s2kk6u8nmwy9swjp6t7 owned by the “Luna Foundation Guard” in the amount of 80 432 BTC were withdrawn as described below:

• On May 9, 2022 funds in the amount of 30 000 BTC were sent to the OKEx wallets, 19 000 BTC of which were sent to the wallet of the “Whale” bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h, the rest amount was distributed among the cold storage wallets.

• On May 9, 2022 funds in the amount of 22 189 BTC were sent to the OKEx wallets, later they were redirected to the “Whale’s” wallet bc1qm34lsc65zpw79lxes69zqmqmk6ee3ewf0j77s3h, from where some funds were redistributed and stored on the cold storage wallets on the Binance exchange such as 3M219KR5vEneNb47ewrPfWyb5jQ2DjxRP6 and other cold storage wallets.

• On May 10, 2022 funds in the amount of 28 243 BTC were sent to “Whale’s” wallet bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h, from where some funds were redistributed and stored on the cold storage wallets on the Binance exchange such as 3M219KR5vEneNb47ewrPfWyb5jQ2DjxRP6 and other cold storage wallets.

After the examination of the outgoing transactions of the addresses to which the withdrawal transactions were made we can suppose that this is an attempt to hide funds, and there is no question of any recovery of the liquidity of the token.

Given this resonance and the large number of investors in the crypto community who have lost their funds, the LUNA story is unlikely to rest unanswered. If it is proved that the developers are involved in the collapse of the coin, the creators of the project will have to reimburse the losses with their own funds. Perhaps, with the understanding of the further development, Do Wong and the company are trying to deliberately conceal some of the savings and trying to lead a company into bankruptcy purposing that by the time the of LEA’s investigation there would be nothing left to reimburse.

While editing this article, the South Korean government announced on May 23, 2022 that they had decided to sequester funds of the “Luna Foundation Guard” as police had found the evidence of a connection between the company's cryptocurrency projects and organized embezzlement. For freezing "Luna Foundation Guard's" assets on exchanges, South Korean police held a meeting with the heads of major exchanges followed by directing official requests.

The week before, the South Korean prosecutor's office launched a formal investigation of Terraform Labs, following an appeal from five Korean investors that suffered a total loss of more than $1 million.