red 
Earlier this month it was Jian Wen from North London convicted of money laundering, which relates to the proceeds of an investment scam that involved the theft of $5 billion from nearly 130,000 Chinese investors between 2014 and 2017. The proceeds of the scam were converted into Bitcoin.
The Metropolitan Police seized Bitcoin wallets from a house and safe linked to Wena in October 2018. But it wasn’t until May 2021 that investigators began accessing the wallets and realized they had made the biggest cryptocurrency seizure ever seen in the UK. About 61,000 BTC, now worth more than $4.3 billion, were found in the wallets.
Here we use Elliptic Investigator to follow the money trail and investigate one of the remaining mysteries from the case – what happened to the 4,500 BTC that disappeared from the seized wallets?
According to reports, starting early on May 30, 2021, 4,500 BTC disappeared from one of the wallets found by investigators – worth over $155 million at the time. Thanks to the transparency of the Bitcoin blockchain, we can identify this wallet by looking for transactions that match these parameters. Between 3:30 AM and 4:00 AM on May 30, 2021, a total of 6,241 BTC was moved from the Bitcoin address:
1HBM45n214sV9yXoizBwTksUgEysTPpk46
Of that, investigators appear to have recovered 1,741 BTC – leaving 4,500 BTC missing.
Bitcoin movement from a suspected seized wallet in the early hours of May 30, 2021. Screenshot by Elliptic Investigator.
We can track these funds using powerful investigator tracking capabilities. This indicates that most of these funds were sent to one of two services:
- A small cryptocurrency exchange with ties to China, previously implicated in money laundering.
- A mixer, which is used to mask further blockchain transactions.
Subsequent movement of funds, with the majority being sent to one of two destinations. Screenshot from Elliptic Investigator. The identities of the exchange and mixer are not disclosed in this chart.
We can also trace back to identify the source of funds held at this address. The bitcoins originated from a wallet that received large amounts of bitcoins between January and April 2017, almost all of which came from two sources:
- A large cryptocurrency exchange based in China.
- Wallet service based in China.
Source of funds for the suspect’s seized wallet. Screenshot from Elliptic Investigator. The identities of the exchange service and the wallet are not disclosed in this table.
Links to Chinese services in the source and destination of the funds provide further corroborating evidence that we have identified the seized wallet. Additionally, this wallet was emptied in mid-July 2021, which is appropriate registered time frame.
Suspect Seized Wallet Depletes July 2021 Screenshot from Elliptic Investigator.
It is not clear who is responsible for moving the 4,500 BTC from the wallet. It’s possible that there were backups that allowed someone to move the funds even after the wallet was seized by investigators. Interestingly, not all of the missing bitcoins were immediately moved and laundered. Some remained inactive until January 2024, when they continued to be sent to a small exchange.
Funds missing from suspected seized wallet continue to be laundered until January 2024. Screenshot from Elliptic Investigator. The identity of the stock exchange is not disclosed in this chart.
Elliptic Investigator provides powerful tracking capabilities across the vast majority of cryptoassets. This allows investigators to quickly find funds even when complex laundering techniques are used. Contact us for a demo.
