Treasury Sanctions Crypto Scam Ring Tied to China and Philippines—FBI Seeks Victims

A sweeping U.S. crackdown has exposed a massive crypto scam network based in the Philippines and linked to China, with Funnull fueling $200 million in fake investment fraud.

Treasury Targets China-Backed Philippine Crypto Scam—FBI Wants Victim Info

The U.S. Department of the Treasury took decisive action on May 29 by sanctioning Funnull Technology Inc., a Philippines-based company accused of operating at the heart of a vast online fraud network. In parallel, the Federal Bureau of Investigation (FBI) issued a public appeal to identify victims of these cryptocurrency scams, citing Funnull’s critical role in powering fraudulent infrastructure. The Treasury stated that Funnull “provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams, commonly known as ‘pig butchering.’”

These scams typically lure victims into online relationships, gain their trust, and ultimately deceive them into transferring funds to counterfeit crypto platforms. The FBI confirmed:

The FBI Washington field office is seeking to identify victims of cryptocurrency investment fraud scams facilitated by Funnull and other content delivery networks.

Many of the fraudulent platforms mimic legitimate crypto investment sites, complete with fake dashboards and fabricated returns, which manipulate victims into investing more before their funds are ultimately stolen. In total, U.S. victims have reported over $200 million in losses linked to sites supported by Funnull.

The Treasury’s designation also includes Liu Lizhi, a Chinese national who serves as an administrator for Funnull. The sanctions freeze all U.S.-linked assets belonging to both Funnull and Liu and prohibit American individuals and companies from conducting any transactions with them. Liu is accused of playing a central role in the company’s scam operations by overseeing the assignment of domain names used in fraudulent cryptocurrency platforms, phishing schemes, and online gambling websites—some of which have been linked to Chinese criminal money laundering networks.

The U.S. Department of the Treasury’s Office of Foreign Assets Control stated:

Funnull Technology Inc. enables virtual currency investment scams by purchasing IP addresses in bulk from major cloud services companies worldwide and selling them to cybercriminals to host scam platforms and other malicious web content.

In addition to supplying infrastructure, the company reportedly used domain generation algorithms to mass-produce website names and provided cybercriminals with design templates to make the scam platforms appear legitimate. These tactics made it easier for bad actors to evade shutdown efforts by quickly rotating domain names and IP addresses.