Who stole 127,000 Bitcoins? Tracking the truth from the "Killing Plate Empire" to the roadside mine

The U.S. Department of Justice seized 127,000 Bitcoins, pointing directly at Chen Zhi, chairman of the Cambodian Prince Group, for allegedly operating a pig-killing plate and money laundering network, implicating Chinese mining companies. The incident revealed the absurd intertwining of political and business collusion, geo-finance and Bitcoin nationalization. This article originates from an article published by Galaxy Research, compiled and organized by DongZu.
(Preliminary summary: Confiscated 127,000 Bitcoins! The United States cracked down on the Prince Group in Southeast Asia and simultaneously sanctioned the Huiwang Group)
(Background supplement: The New York Times revealed the Cambodian money laundering empire "Huiwang Group", the world's largest black gold assembly line)

Contents of this article

The U.S. Department of Justice completed the largest asset seizure in history, seizing 127,271 Bitcoins worth nearly $15 billion. The indictment reads like a cross between a Netflix “Narcos” script and a Chainalysis case study.

The core figure in the case is Chen Zhi, chairman of the Cambodian Prince Holding Group. Prosecutors accuse him of running a vertically integrated criminal empire that spanned online gambling, forced labor parks and "pig-killing plate" investment fraud. Prosecutors said Chen and his associates laundered billions of dollars through a series of shell enterprises, including a large cryptocurrency mining operation. Two names in particular stand out: Warp Data, which is based in Laos and has a subsidiary in Texas, and LuBian, a Chinese mining company that has appeared in crypto forensic reports for years.

Note: The previous translation of "Luban" was a mistranslation. The mining pool referred to in this article is China's Roadside (LuBian), not Russia's LuBan Group (LuBan)

Roadside mining pool incident: a "Milk Sad" random disaster

Roadside mining pool is not an ordinary Chinese mining company. In 2020, it suffered one of the largest private key leaks in history. Due to a serious random number flaw in its wallet generation software (codenamed "Milk Sad"), hackers were able to steal an estimated 127,000 Bitcoins. Although LuBian never publicly admitted to being hacked, it allegedly spent approximately 1.4 Bitcoins sending OP_RETURN messages to the hacker’s wallet, pleading for the return of assets.

"Bizarre correspondence" in the indictment

Bizarrely, the U.S. Department of Justice listed a series of wallet addresses in the indictment and claimed that Chen Zhi "personally kept records of these wallet addresses and private key mnemonics." These addresses are exactly the same as the list of Luban weak random wallets identified by the security team Distrust in 2020. However, these wallets had little to no Bitcoin left when they were seized. Almost all of the 127,271 BTC seized came from the wallets of "roadside mining pool hackers."

Our observation: The roadside mining pool and the Prince Group are actually two sides of the same coin

The timing coincides with the size of the funds, and the on-chain data also supports that the Prince Group and LuBian may be two branches of the same organization. Those who operate the "Pig Killing Tray" and the offshore casino are likely to control the "hacked" mine at the same time. Is this internal collusion, faking a hacking incident to bury criminal funds and tax losses, or is the Prince Group forcing LuBian to hand over funds? Whatever the truth, the Justice Department obtained the private keys—the same ones the FBI claims to have found in Chen's possession. This means that the incident is more like "the FBI gets into your cloud drive" than "the NSA cracks Bitcoin."

Chen Zhi is currently on the run. The wallet under his name that was newly sanctioned by OFAC contains approximately US$1.8 billion worth of Bitcoins; there is also approximately US$1.8 billion in Bitcoins in the wallet marked by Lu Ban, which was transferred immediately after the indictment was made public.

Ownership confusion and geopolitical risks

This asset ownership dispute is a thorny issue. The roadside mining pool appears to be operated by the Prince Group, but it is not listed on the OFAC sanctions list, and the indictment does not explicitly state that LuBian is affiliated with the Prince Group. In theory, roadside mining pools can claim: "That's our wallet, we were hacked, and we should get it back." But the reality is that roadside mining pools are Chinese-registered mining companies that have been accused of money laundering links to Cambodian criminal groups, and U.S.-China trade relations are on ice. The chances of a U.S. court ordering the return of $15 billion in Bitcoin to Chinese companies are almost zero.

Washington’s fiscal narrative and “Bitcoin reserves”

This confiscation case also perfectly echoes Washington’s latest fiscal policy. Since March, the U.S. Treasury Department has been authorized to include confiscated digital assets into the "Strategic Bitcoin Reserve" as a "digital hard currency" mechanism to supplement gold reserves. As a result of the Prince Group's seizure, the reserve surged by 64% overnight, equivalent to approximately 3.5% of the U.S. gold reserve's dollar value.

Today, the number of Bitcoins held by the U.S. government is second only to Michael Saylor’s MicroStrategy. The Justice Department is no longer selling Bitcoin but is instead “holding it for the long term” — as required by a March 6 presidential executive order. Enforcement has now become a "cumulative" part. The U.S. government is officially a Bitcoin bull.

Bitcoin was originally a rebellion against the legal currency system, but now it has slowly become part of the legal currency collateral pile. Cryptopunks should probably raise a glass to this irony: the revolution was confiscated and then recorded under the name "Inventory".