Use Case: Crystal Investigations for Understanding Ponzi Schemes

by the Crystal analytics team

Jun 02, 2020

The Problem: It can be difficult to differentiate between a legitimate cloud mining operation and a Ponzi scheme.

Cloud mining services have gained significant popularity over the past few years, enabling users to earn bitcoin without the hassle of managing their own hardware.

However, while these services offer obvious benefits, they have also been known to exhibit suspicious behavior. It is often difficult for users to know whether a service is legitimate or if it is a Ponzi scheme or other kind of scam.

Crystal makes it easy to determine the legitimacy of cloud mining providers. Read on to see how you can use Crystal to verify your cloud mining partner.

The Case: HashOcean Case

One cloud mining Ponzi scheme was HashOcean cloud mining, which began its operations on March 8, 2015. From the beginning, HashOcean seemed to provide great benefits for its clients, leading to a significant growth in users.

However, on June 27, 2016, the HashOcean website disappeared and payouts to its clients were suspended.

The average lifespan for Ponzi schemes is about six months; HashOcean operated for 18 months. This longer lifespan led users to trust its operation, which also led to a significant number of people affected by its fraud.

The Solution: Crystal algorithms can flag a Ponzi scheme early

The Crystal platform’s proprietary algorithms, upon review after HashOcean closed, indicated that HashOcean was most likely a Ponzi scheme due to its pattern of operations.

First, using Crystal, we found that within the last few days of the service operation, HashOcean had been receiving 2200 BTC per day and paying out 1900 BTC per day. This means that HashOcean had earned a significant amount of money before it closed – so the business likely did not close due to insolvency.

Second, we examined many of HashOcean’s payout transactions. Legitimate cloud mining services use recently emitted bitcoins to make payouts to their clients. There were no recently emitted bitcoins in any HashOcean transaction; rather, HashOcean only used bitcoin it had received from other users for their payouts. In the pictures below, you can see that the bitcoins used in payouts came from exchanges, payment processors, gambling, and darknet marketplaces.

From our research, it became clear that HashOcean was not using emitted bitcoins used in the payout transactions — as shown in the diagram above. Crystal enables a deeper look into the past, allowing us to see from which sources the HashOcean address received its bitcoins. As we can see in the pictures below, HashOcean’s bitcoins appeared to come from exchanges, gambling services, or even dark marketplaces — not from mining.

There are no recently emitted bitcoins in previous transactions. Instead, we can see payment processors, exchanges, and gambling.

In the picture Crystal shows that, for payouts, HashOcean used bitcoin that had been received from another cloud mining service — Hashnest.

Crystal Blockchain’s investigative toolkit was able to identify the following information on HashOcean:

  • Considering the sources of the bitcoins that were paid by HashOcean to their clients, this ‘mining service’ did not actually earn these bitcoins by mining them, but by receiving them from other users.
  • The outgoing flow of bitcoins (payments to clients) was significantly lower than the incoming flow of bitcoins, which was taken as ‘earnings’ by the HashOcean owners. This is typical behavior for Ponzi schemes.
  • If HashOcean was a legitimate mining service, there would have been a prevalence of recently emitted bitcoins in payments to users. The Crystal tool enabled us to determine the origin of HashOcean’s bitcoin payouts, clearly showing that this was indeed a Ponzi scheme.

With Crystal, future cases of fraud could be minimized or prevented by revealing such scams early in their lifespan.

About Crystal Blockchain analytics platform:

Crystal is the all-in-one blockchain investigative tool. As public blockchains and cryptocurrencies become more widely used, a broader set of tools is needed to track criminal behavior such as money laundering, terrorist financing, and other illicit darknet activities.

Crystal Blockchain is available as a web application, through an API, or can also be deployed on internal servers for added privacy.

Crystal supports Bitcoin, Ethereum, Bitcoin Cash, Litecoin, and Tether analytics.

See the Crystal Blockchain platform in action. Get a demo today

Similar news

Use Case: Crystal Investigations for Tracking Ransomware Payments

Crystal efficiently tracked payments from the victims of the WannaCry virus. It took four days for the virus to spread across 150 countries - it took Crystal only 3 hours to locate the online entity extorting payments from the affected users.

by the Crystal analytics team

Jun 02, 2020