PlusToken Aftermath: Dormant Wallet On-Chain Movements and Token Swap Secondary Harvesting

Who Gets Targeted

The core victims fall into two main groups: First are the veteran victims of the 2018–2019 PlusToken collapse, who still hold a glimmer of hope for recovering their assets after the platform allegedly fled. Highly sensitive to news of on-chain wallet movements, they easily believe the narrative that 'wallet activity means the project team is preparing for liquidation.' Second are new retail investors who entered after 2024. Seeing news of PlusToken wallets transferring ETH, they searched out of curiosity and were funneled into fake swap pages. Their shared psychological weaknesses are sunk cost fallacy and loss aversion; knowing it's a scam, they are still willing to pay a small activation fee to take a gamble. Coupled with a superficial understanding of on-chain data and an inability to distinguish real announcements from fake ones, they are extremely susceptible to falling for the trap a second time.

骗局怎么运作

• Step 1: Generating Hype. Scammers monitor on-chain tracking accounts such as Lookonchain. As soon as a PlusToken-linked wallet transfers ETH, they immediately push interpretation content such as 'Project wallet has moved, liquidation is about to begin' into communities and short-video platforms. They package neutral on-chain data into redemption signals, using the peak attention of old victims for precise user acquisition.
• Step 2: Building Fake Entry Points. They build swap websites or apps mimicking the old PlusToken wallet interface, using the pitch: 'Old PLUS tokens swapped for new chain tokens at a ratio of 1 to several, lock-up required during mapping.' The page fabricates exchange cooperation badges and countdown timers to create a false sense of urgency ('miss out and it's gone forever'), inducing users to import recovery phrases or authorize wallet connections.
• Step 3: Charging Gate Fees. They claim participants must pay hundreds of dollars worth of cryptocurrency as mapping fees or account activation fees, directly replicating the structural 500-dollar entry fee from back then. They have victims test with a small amount first, show them fake arrival records, and induce them to invest more. Some versions even require recruiting three new people to unlock withdrawals.
• Step 4: Stealing Tokens. Once a user inputs their recovery phrase or signs an authorized transaction on the phishing page, all other existing assets in the wallet are batched away. Many victims intended to revive worthless PLUS coins, but ended up losing their newly purchased BTC and ETH as well, resulting in losses far exceeding their old debts.
• Step 5: Cutting Off Escape Routes. The pages shut down and change domain names after operating for just a few weeks, and communities are disbanded. Because the users originally participated in a pyramid scheme themselves, many are afraid of taking responsibility and dare not report it to the police. Scammers thus dare to repeatedly rebrand and replay this scenario. Official exchange announcements stating non-support for swaps are instead distorted by them as 'mainstream platforms suppressing us; swap via our exclusive channel.'
• Step 6: Data Reuse. Stolen registration phone numbers, ID photos, and wallet addresses are packaged and resold to other fund-pool teams. Old victims are repeatedly and precisely targeted under names like liquidation commissioners or lawyer rights-defense groups, forming a long-tail harvesting chain targeting the same group of people.

红旗信号（看到这些快跑）

• 🚩 Any channel claiming PlusToken is about to liquidate, swap, or map new coins is fake. This case has already been characterized as a pyramid scheme by judicial authorities and assets have been recovered; there is no such thing as project self-rescue and redemption.
• 🚩 Guiding users to input recovery phrases, private keys, or sign strange contract authorizations on a webpage. Legitimate institutions and judicial authorities never require you to surrender wallet control during liquidations.
• 🚩 Models that require paying activation fees, mapping fees, or security deposits as prerequisites for claiming assets are structurally identical to the 500-dollar threshold fee of that year.
• 🚩 Citing screenshots of large on-chain transfers as proof of redemption, deliberately blurring the line between address transfers controlled by the police and the actions of the project team.
• 🚩 Communication channels limited to Telegram or WeChat groups; customer service urges time-limited operations and prohibits verification with official exchange customer service.
• 🚩 Claiming exchange announcements are suppression or fake news, demanding that users bypass official channels to use exclusive swap links. This is a classic tactic of announcement-impersonation scams.

真实案例

• July 2020 Ministry of Public Security briefing: In accordance with unified deployments, public security organs cracked down on the PlusToken platform online pyramid scheme. All 27 main criminal suspects and 82 backbone members who fled overseas were captured and brought to justice, involving over 40 billion yuan. This was the first major transnational online pyramid scheme using cryptocurrency as a trading medium, with over 2 million participants. (Source: [http://news.cctv.com/2021/04/09/ARTISnSGEG1wmxOVFxOCTyaG210409.shtml](http://news.cctv.com/2021/04/09/ARTISnSGEG1wmxOVFxOCTyaG210409.shtml))
• On June 27, 2019, the platform popped up a 'Sorry, we have run' exit prompt and stopped withdrawals. According to public reports, victim Mr. A had previously invested hundreds of thousands of yuan worth of digital currency and recruited downlines to earn rebates. After the collapse, all principal and earnings could not be withdrawn, making him one of the earliest domestic reporters to the police.
• August 2024 Lookonchain monitoring showed that hundreds of PlusToken-linked wallets dormant for 3.3 years began transferring ETH, involving approximately 789,000 ETH of historical scattered addresses. After relevant movements were reported by multiple media outlets, social media immediately flooded with fake swap acquisition content under the guise of liquidation, and multiple old victims reported receiving private messages inviting them to swap.
• April 2021 CCTV reported on the trial and asset recovery progress of the case. Principal offender Mr. Jia and others were sentenced in accordance with the law and fined, and the digital currency involved was disposed of according to law. The report explicitly reminded the public that such platforms use brick-moving arbitrage and tier-based rebates as bait with no real profitable business.
• In April 2021, according to CCTV reports, the principal offender of the PlusToken case was sentenced to eleven years in prison for organizing and leading pyramid schemes, and fined 6 million yuan. At the end of June 2019, task force police officers captured 27 main criminal suspects including the principal offender, and another 14 defendants were sentenced to prison terms ranging from 4 years and 10 months to 11 years respectively. (Source: [http://news.cctv.com/2021/04/09/ARTISnSGEG1wmxOVFxOCTyaG210409.shtml](http://news.cctv.com/2021/04/09/ARTISnSGEG1wmxOVFxOCTyaG210409.shtml))

Official Stance

• July 30, 2020: The Ministry of Public Security issued an announcement stating that it had filed and investigated the PlusToken platform online pyramid scheme case. All 27 main criminal suspects and 82 backbone members were brought to justice, thoroughly destroying this mega transnational online pyramid scheme organization.
• April 9, 2021: CCTV special reports disclosed that the scam lured victims with smart brick-moving monthly returns of 10% to 30% and built a multi-tier membership system, reminding the public to be vigilant against pyramid scheme money pools disguised in cryptocurrency.
• 2024 to 2025: MEXC Exchange released official announcements stating that it does not support PLUS token swaps and will delist the token, reminding users not to trust any swap channels and to prevent further losses.
• June 2025: Multiple media and self-media platforms reposted case warning content, reiterating that PlusToken is a Ponzi scheme wrapped in blockchain technology, reminding elderly and retired groups to guard against secondary fraud under the guise of old-token liquidation.

How to Protect Yourself

• ✅ Remember that this case has been characterized and its assets disposed of by judicial authorities. Any redemption promises claiming to be from the project team or liquidation group should be treated entirely as fraud. Verify first with local public security or anti-fraud hotlines.
• ✅ Never input recovery phrases and private keys on any webpage, and do not sign wallet authorizations of unknown origin. If an old wallet has interacted with suspicious pages, immediately transfer remaining assets to a new wallet.
• ✅ Only recognize official website and app announcements when checking exchange and regulatory information, and cross-verify announcements screenshotted in communities word-for-word against the official website.
• ✅ Participants from back then should actively retain transfer and chat records to cooperate with judicial authorities for registration, rather than remaining silent out of fear of being held accountable. Silence is the very soil that allows secondary scams to repeat.
• ✅ Popularize the trial results of this case to elderly family members who have come into contact with cryptocurrencies, making it clear that resurrection and compensation do not exist, and directly block and report anyone offering swap invitations.