E-Daily signed a Memorandum of Understanding (MOU) on the 5th of last month with Core Security, a leading domestic blockchain security firm, for the “Crypto X-File Project: Reporting Digital Asset Fraud and Tax Evasion Whistleblowing,” and has been tracking cases of digital asset fraud. As part of our first investigative report, we received tips regarding the KOK Coin multi-level marketing (MLM) scam—which caused losses totaling 2.5 trillion won to 570,000 victims in Korea and abroad—and conducted on-chain fund flow analysis. Through tips, reporting, and on-chain analysis, we have confirmed for the first time evidence of on-chain money laundering by the criminals and are publishing a related feature article. [Editor’s Note]

[Edaily Choi Hoon Gil Reporters Seo Min-ji and Jeong Yun-young] It has been revealed that over 120 billion won in assets were concealed in a virtual asset wallet believed to belong to the company behind the KOK Coin (KOK Token) multi-level marketing (MLM) scam, with the funds passing through domestic and international virtual asset exchanges. The perpetrators cleverly evaded the authorities’ investigation while victims were unable to withdraw their investment funds, thereby siphoning off the money.

According to the “KOK Play Token Analysis Report” released on the 10th by Core Security’s Digital Financial Crime Response Institute (DFCIA), outflows totaling $91.9 million (123 billion won based on the exchange rate on the 10th)—including cash withdrawals and coin transfers—were confirmed to have occurred from a virtual asset wallet (corporate wallet) presumed to be owned by the KOK Foundation’s management team, via eight domestic and international virtual asset exchanges between January and October 2022. This is the first time such a fund transfer route has been identified and revealed through on-chain analysis. However, this on-chain analysis has confirmed only a portion of the total losses, which exceed 2.5 trillion won.

The company carried out these fund transfers through domestic and international exchanges during a period when victims were unable to make normal withdrawals due to service disruptions and other issues. In January and February 2022, they began diverting $1 million (2 transactions) via ZB, $1 million (2 transactions) via Bittrex, and $300,000 (1 transaction) via Indodax; subsequently, in May and June of the same year, they siphoned off $840,000 (3 transactions) via Binance.

Subsequently, from January to September 2022, they concealed the majority of the embezzled funds—$82 million (110 billion won)—through the Chinese-based cryptocurrency exchange KuCoin. This period coincided with the announcement of the termination of KOK Play’s Korean-language service (March 2022) and a sharp drop in the token’s price (from $7 in early 2022 to $0.01 in November 2023), resulting in a surge of victims.

Furthermore, the KOK Coin company primarily used overseas exchanges to evade detection by financial regulators and investigative agencies. The amount siphoned off through overseas exchanges—including Kucoin, ZB, Bittrex, Binance, Bybit, and Indodax—totaled $88.31 million, accounting for 96% of the total embezzled funds.

Park Jeong-seop, Team Leader, and Koo Si-hyun, Senior Researcher, at Core Security’s Digital Financial Crime Response Research Institute, who authored the report, stated, “They employed a sophisticated scheme of diverting funds through overseas exchanges to avoid arousing the authorities’ suspicion,” adding, “It appears that most of the funds were siphoned off before the relevant domestic laws took effect.”

The amendment to the Act on the Regulation of Illegal Fund-Raising Activities, which includes regulations on virtual assets, took effect on May 28, 2024, while the Act on the Protection of Virtual Asset Users took effect on July 19 of the same year. The analysis revealed that the group’s fund outflows, including the conversion of funds into cash, occurred before these laws took effect.

Previously, starting in 2019, the group that issued KOK Coin promoted the project by claiming that depositing Bitcoin and other cryptocurrencies would allow users to receive monthly rewards through a process similar to staking. They also ran a multi-level marketing scheme, promising that by recruiting other investors to make deposits, participants could earn fixed monthly returns of up to hundreds of millions of won.

In 2022, as it became increasingly difficult to sustain this “pyramid scheme” model, the business collapsed. Subsequently, the group began systematically siphoning off the Bitcoin, Ethereum, and other assets deposited by investors through domestic and international exchanges.

The ringleader, Mr. Han, and his accomplices have fled overseas. Key organizers, including Mr. Kim, are currently undergoing their first-instance criminal trial at the Ulsan District Court without being detained. According to the indictment, from October 19, 2019, to July 2, 2023, the KOK Coin case resulted in a total of 570,707 victims both domestically and internationally, with total losses amounting to 2.5759 trillion won.

The victims stated that the flow of funds revealed so far is “just the tip of the iceberg” and called for a thorough investigation and severe punishment. On the 7th, a victims’ group held a press conference in front of the Ulsan District Court and appealed, “Please thoroughly track the accounts, virtual asset wallets, exchange transfers, and cash-out records of those involved to uncover the final destination of the victims’ funds.”

Hwang Seok-jin, Director of the Digital Financial Crime Response Research Institute at Core Security (and professor at Dongguk University’s Graduate School of International Information Security), emphasized in an interview, “The KOK Coin case is a classic Ponzi scheme that has produced countless victims,” adding, “I hope the court imposes severe penalties so that this case serves as a powerful test case.”

※ The “Crypto X-File Project for Reporting Digital Asset Fraud and Tax Evasion Whistleblowing” accepts online public interest reports. Anyone—whether an individual, corporation, or institution—can submit a report via the pop-up window or banner on the Edaily website.