US sanctions Philippines tech firm accused of aiding crypto scams

The US Treasury has sanctioned a Philippines-based technology firm and its alleged administrator, accusing it of providing services to thousands of crypto scam websites.

Funnull Technology is linked to most crypto scam websites reported to the FBI, with victims’ losses surpassing $200 million, the Treasury’s Office of Foreign Assets Control (OFAC) said on May 29. 

Funnull purchases IP addresses in bulk from cloud service providers and sells them to scammers, allowing them to host and operate clones of legitimate investment platforms, to deceive victims and steal their crypto, according to OFAC.

In one instance in 2024, OFAC said Funnell purchased a repository of code used by web developers and altered the code to redirect visitors of legitimate websites to scam websites and online gambling sites.

“These services not only make it easier for cybercriminals to impersonate trusted brands when creating scam websites but also allow them to quickly change to different domain names and IP addresses when legitimate providers attempt to take the websites down,” OFAC said. 

Crypto wallets, Funnull admin sanctioned 

The accused administrator of Funnull, Liu Lizhi — a Chinese national who managed the firm’s employees — was also added to OFAC’s Specially Designated Nationals and Blocked Persons (SDN) list as part of the sanctions. 

Generally, being on the SDN list means any assets the individual has in the US are frozen, and it’s illegal for people in the US to conduct any financial transactions or have business dealings with them; violators can face civil and criminal penalties. 

Related: US Treasury’s OFAC can’t restore Tornado Cash sanctions, judge rules

OFAC also sanctioned two wallet addresses it said are associated with Funnull, which blockchain analytics firm Chainalysis said in a May 29 report were likely “used to receive payment from cyber criminals.” 

“Additionally, the addresses show indirect exposure to various types of scams and domain management infrastructure vendors,” Chainalysis said.

Chainalysis claimed Funnell is a central player in a network known as the Triad Nexus, which includes over 200,000 unique hostnames associated with investment scams and fake trading apps. 

As a result of the sanctions, everyone in the US is now forbidden from interacting with all property and business interests where Lizhi and Funnull have a more than 50% stake, with violators possibly facing civil or criminal penalties.

Magazine: Coinbase hack shows the law probably won’t protect you: Here’s why