How a money launderer allegedly used Deltec, Binance, and Tether

Daren Li was recently indicted in the Central District of California on a charge of conspiracy to commit money laundering. Li is allegedly the mastermind behind a money-laundering syndicate that was moving funds for ‘pig-butchering’ scams.

The scammers allegedly used fake versions of CoinZoom and Crypto.Com to convince victims to transfer funds.

Often, the victims were induced to send funds to bank accounts of shell corporations set up by the scammers; these corporations include entities like CMD Export and Import.

The indictment describes two accounts held at a bank in the Bahamas. One of these accounts was opened by Li’s co-conspirators in Los Angeles, with Li providing funds to help open it.

The other received approximately $35.4 million from victims of the scam. After victims’ funds were transferred to this bank, they were converted to USDT and moved to Li’s account at Binance.

Besides those in the Bahamas, the syndicate relied on other banks, including Evolve Bank and Trust. This Evolve account was controlled by another shell corporation, Jingshun International Corporation, and funds at Evolve were subsequently transferred to Wise.

The indictment also references the fact that co-conspirators were indicted at the end of last year. It details a case covering the Sea Dragon entities and discusses funds the alleged money launderers had in a Deltec Bank account at Mitsubishi UFJ (MUFJ) Trust and Banking Corporation. The funds were transferred from a Bank of America account to this MUFJ account.

The affidavit in support of the seizure suggests that Deltec Bank misrepresented the purpose of this account to MUFJ.

Blockchain Analysis of Daren Li

The indictment describes how funds tracked in this scheme were withdrawn from a Binance account in Li’s name to an address described in the indictment as the ‘TRteo Address.’

A review of Tron blockchain data reveals that the only address that meets the description in the indictment is TRteottJGH5caJyy9qFuM8EJJGGCpDaxx6. According to the affidavit, “Li and/or his co-conspirators” are most likely in control of this address.

A closer review of this address gives us greater insight into the counterparties for this syndicate, including Binance, FTX, and Kraken.

The Li address received funds from six addresses that Breadcrumbs labeled as Binance.

The Li address received slightly less than $29 million in USDT from TTd9qHyjqiUkfTxe3gotbuTMpjU8LEbpkN, an address that both Breadcrumbs and Tronscan have labeled as Kraken. The last transaction with this Kraken address occurred approximately a year ago, in June of 2023.

The Li address also received slightly over $6 million in USDT from TYDzsYUEpvnYmQk4zGP9sWWcTEd2MiAtW6, an address that Breadcrumbs and Tronscan have labeled as FTX. The last transaction was a couple of weeks before FTX declared bankruptcy.

Binance was probably the most important identifiable exchange that the Li address interacted with. It received funds from six addresses that Breadcrumbs labeled as Binance and a total of approximately $28 million in USDT. Additionally, the Li address received approximately 100k TRX from Binance addresses.

These various transactions show how money launderers in the ecosystem rely on transferring funds between a variety of different financial institutions and crypto institutions to try to obscure the flows of criminal activities.

Source