Crypto-less Crypto Investment Scams: A California Case

My readers will know by now that I am addicted to PACER - the Public Access to Court Electronic Records.  When I see headlines like this one, I am compelled to dive in and read every publicly released document related to the case.  

USAO Central California

The headline last month was that Shengsheng He, a 39 year old Chinese native living in La Puente California (described as being a resident of Los Angeles and Mexico City) had been sentenced to 51 months in prison and ordered to pay restitution in the amount of $26,867,242. The press release quotes Matthew Geleotti from the Attorney General's office:

 "The defendant was part of a group of co-conspirators that preyed on American investors by promising them high returns on supposed digital asset investments when, in fact, they stole nearly $37 million from U.S. victims using Cambodian scam centers.  Foreign scam centers, purporting to offer investments in digital assets have, unfortunately, proliferated."

When talking about Crypto Investment Scams, they certainly have "proliferated." They are currently the number one form of cybercrime financial losses in America, for the third year in a row, according to the FBI's IC3.gov.  When we refer to these "Pig Butchering" scams as Crypto Investment Scams, it is easy to forget that many "crypto" scams still rely on the tried and true method of wire transfers to shell companies. When we first started exploring Romance Scams and their link to Business Email Compromise, the mostly Nigerian scammers referred to these as "Wire-wire jobs." A wire goes from the victim to a shell company, and a second wire goes from the shell company to the ultimate beneficiary of the crime. While West African Organized Crime continues unabated, Chinese Organized Crime has taken the top spot and is learning that many of the methods of their West African predecessors are still quite useful.

(figures from the ic3.gov 2024 report)

In the Shengsheng He case each of the victims believed that they were wiring money to fund their crypto investments.  Despite believing they have purchased crypto currency with these funds, they cannot be traced on the blockchain because they do not exist on the blockchain!  The first wire transfer went to any of the dozens of shell companies that had been set up across America under the direction of Lu Zhang, an illegal immigrant from China. (Zhang pled guilty to "conspiracy to commit money laundering on 12NOV2024.)  The second wire in the "wire-wire" job would then send those funds to one of two bank accounts at Deltec Bank in the Bahamas in the name "Axis Digital Limited." Deltec Bank's website is titled "Deltec Bank: Ultra-Sophisticated Private Banking" and boasts of their "robust anti-money laundering framework." 

 

Axis Digital Limited served as an off-shore crypto exchange that seems to have been created for the purpose of taking "wire-wire" proceeds from Crypto Investment Scams and converting the funds to USDT before transferring them on to the Chinese Organized Crime gangs operating the scam centers in Sihanoukville, Cambodia.

The case is being prosecuted in the Central District of California in four parts.

Zhang, Wong, Walker, Zhu - Sea Dragon Trading & the Shell Companies

One of the cases focuses primarily on the network of US-based shell companies created to receive the wire transfers from the victims.  The victims believed they were funding their crypto investments, and would see "deposits" into their imaginary crypto investment accounts that corresponded to the amount of their wire transfers.  Court records show that "at least 284 transactions resulted in more than $80 Million in victim losses." The defendants in this case, with their ages as of December 14, 2023, were named in an initial press release entitled: "Four Individuals Charged with Laundering Millions from Cryptocurrency Investment Scmas Known as 'Pig Butchering'" 

• Lu Zhang - (36, of Alhambra) was sentenced to 24 months + $7,560,014 restitution
• Joseph Wong - (32, of Rosemead) was sentenced to 51 months + $7,560,014 restitution
• Justin Walker - (31, of Cypress) was sentenced to 30 months 
• Hailong Zhu - (40, of Naperville, Illinois) has not been sentenced yet

Sea Dragon Trading, LLC and Sea Dragon Remodel, Inc were two of the companies created by Hailong Zhu, but the list of shell companies below collectively sent $20,083,987 in wires to Deltec Bank in the Bahamas:

• BFC REMODEL, LLC;  - 408 W Glendon Way, San Gabriel, CA 91776

• BFC SUPPLY, LLC; - 408 W Glendon Way, San Gabriel, CA 91776 

• CREATIVE HOMEGOODS, LLC;  - 823 W Huntington Dr. Apt B, Arcadia, CA 91007

• FUYU COMMERCE, LLC;  - 1140 S El Molino St, Alhambra, CA 91801

• GOOD LUCK TRADING, LLC;  - 2220 Falling Leaf Ave, Rosemead, CA 91770

• HONG'S TRADING, LLC; - 1140 S El Molino St, Alhambra, CA 91801 

• KAIS TEA SET SUPPLIES, LLC;  - 508 Bellows Ct, Diamond Bar, CA 91765

• LEADING CONSTRUCTION, LLC;  - (multiple - unsure)

• LJS REMODELING, LLC;  - 1441 Paso Real Ave SPC 254, Rowland Heights, CA 91748

• LJS SUPPLY, LLC;  - 650 W Duarte Rd Suite 100B, Arcadia, CA 91007 

• LQH SUPPLY, LLC;  - 823 W Huntington Dr, Apt B, Arcadia, CA 91007

• MINGXING REMODEL, LLC;  - 4661 District Blvd, Vernon, CA 90058

• MINGXING TRADING, LLC;  - 2220 Falling Leaf Ave, Rosemead, CA 91770 

• QAG TRADING, INC. - 8811 Garvey Ave, 202, Rosemead, CA 91770 

• QAG TRADING, LLC;  - 3254 Evelyn Ave, Rosemead, CA 91770 

• SEA DRAGON REMODEL, INC;  - 4661 District Blvd, Vernon, CA 90058

• SEA DRAGON TRADING, LLC;  - 1140 S El Molino St, Alhambra, CA 91801

• SHANGHAI FOOD & GROCERIES, LLC;   - 250 W Valley Blvd, Ste M, San Gabriel, CA 91776

• SUNRISE SUPPLY, LLC;    - 823 W Huntington Dr. Apt B, Arcadia, CA 91007

• XIEYUNZHU TRADING, INC;  - 1441 71st STreet, Apt 1, Brooklyn, NY 11228 

• YHM SUPPLY, LLC;  - 401 S Canyon Blvd Unit C, Monrovia, CA 91016

• YHM TRADING, LLC;  - 401 S Canyon Blvd Unit C, Monrovia, CA 91016

• YZX LUXURY, LLC;  - 1036 S Garfield Ave, B, Alhambra, CA 91801 

• YZX TRENDING, LLC;    - 1036 S Garfield Ave, B, Alhambra, CA 91801 

Li & Zhang - the Telegram Connection

In a second case, the defendants were: 

• Daren Li, 41
• Yicheng Zhang (39, of China) (sentenced to 18 months and $1,047,226 in restitution)

Zhang & Li controlled four additional shell companies: 

• B&C Commerce, LLC - 180 E Valley Blvd Ste 202, San Gabriel, CA 91776 

• Jimei Trading - 785 King St, San Gabriel, CA 91776 

• SMX Beauty, Inc. - 132 E Emerson Ave, Unit C, Monterey Park, CA 91755 

• SMX Travel, Inc. - 132 E Emerson Ave, Unit C, Monterey Park, CA 91755 

The DOJ described Daren Li as "41, a dual citizen of China and St. Kitts and Nevis, and a resident of China, Cambodia, and the UAE." He was arrested 12APR2024 at the airport in Atlanta.  The DOJ press release "Two Foreign Nationals Arrested for Laundering at Least $73M through Shell Companies Tied to Cryptocurrency Investment Scams" says that Li and Zhang (a resident of Temple City, California) "instructed co-conspirators in the laundering network to open bank accounts in the names of various shell companies. Once the victims sent funds to the shell companies, Li and Zhang monitored the lower-level co-conspirators who transferred the proceeds overseas to bank accounts at Deltec Bank in The Bahamas." The funds were then converted to cryptocurrency and sent to wallets, including at least one controlled by Li. 

Zhang's communications revealed "extensive coordination to facilitate the international money laundering, including chats discussing the commission structure for the network, various shell companies used, victim information, and at least one video from a co-conspirator calling a U.S. financial institution." 

Daren Li is described as being "the leader of the syndicate."  Daren used his Telegram id (@KG71777) to communicate with the Cambodia-based members of the conspiracy.  (Daren's email was: darren1575687@gmail.com).  In court documents, the primary USDT address of the conspiracy is referred to as "the TRteo" address (for the first five characters of the address.)  While TRteo is not an uncommon prefix, there are certainly very few such addresses that have received in excess of $39 Million in deposits, much less the higher number mentioned in the press release of $341 Million! In fact, there is only one. 

Chinese Blockchain intelligence company "BlockSec" blogged about that wallet on their QQ page.  Using their tool, MetaSleuth, they were able to successfully identify the full wallet address, TRteottJGH5caJyy9qFuM8EJJGGCpDaxx6.  The wallet became inactive on 29APR2024, but from its initial transaction on 16APR2021, more than $300 Million USD in more than 16,000 deposits  flowed through that address, including transactions to and from HuionePay. 

BlockSec QQ Post

Because Daren Li is described as being in control of this USDT wallet, it is generally considered that he was the leader of this entire enterprise. In July 2022, a meeting was held in Phnom Penh of the top leadership. Daren Li, JingLiang Su, Shengsheng He, and Jose Somarriba were all present.  Daren Li also controlled a Binance account that received at least $4.5 Million in USDT that originated from "Bahamas Account #2." He was also the source of funds to create that "Bahamas Account #2 at Deltec Bank by transferring $999,383 in USDT. 

Jose Somarriba, Axis Digital, and Itemized Victim Losses 

Jose Somarriba (55, of Los Angeles) (sentenced to 36 months and $26,867,242.44 in restitution) is being held responsible for the losses from 174 victims.  Those victims are listed by their initials and the dollar amounts that each had stolen from them.  The average victim lost $154,409.44!  (The median loss was $61,250.) The victims who had the most money stolen were in the amounts: $5,616,000; $2,340,000; and $1,030,279! Nine victims experienced a theft of $500,000 or more. 

(extract from loss amounts for 174 victims) 

Somarriba was a co-founder of Axis Digital, along with Shengsheng He and Jingliang Su.  He was the one who opened the "Bahamas Account #1" at Deltec Bank which received $36.9 million in wire transfers from American bank accounts. He prepared fraudulent KYC forms to present to the banks as well as being primarily responsible for converting Deltec funds to USDT and transferring the funds to Cambodia via a USDT wallet referred to as "TRteo" in the court documents. 

Jingliang Su - the Dubai Connection

The final of the linked cases is the case of Jingliang Su, (44, of China and Turkey). Su was sentenced to 51 months in federal prison and to pay $26,867,242.44 in restitution.  

Preferring the name "James," Su resided in Dubai.  He was a director of Axis Digital and was a signatory to "Bahamas Account #1" at Deltec Bank. He is described as being "a citizen of China and St. Kitts and Nevis" and a resident of Cambodia, the UAE, and the People's Republic of China.