Skip to main content

Three-Tier On-Chain Transaction Architecture in a Sanctions-Linked Pig-Butchering Network: A Blockchain-Forensics Case Study

Matthew Stern ; Kyung-shick Choi (2026) — International Journal of Cybersecurity Intelligence & Cybercrime

View Original Source (opens in a new tab)

DOI: 10.52306/2578-3289.1249 (opens in a new tab)

Type:   Journal Article
Country:   Global
Tags:   AI-Enabled Fraud, Bitcoin, Blockchain Forensics, Cross Cultural, Cryptocurrency Laundering, Law Enforcement, Mining Pools, Money Mules, Pig Butchering Scams, Platform Policy, Sanctions, Transaction Networks, Virtual Asset Service Providers
Citation tools
Download RIS Download BibTeX 


              
              

            

          

        


      

      

    

        
Transparency

        
Evidence and review status

        
This page contains AI-generated content. No human content review or subject-matter-expert review is recorded.

    


    

                    

                
Source basis

                

                    Downloaded PDF
                

            

                    

                
AI-generated page content

                

                    Yes
                

            

                    

                
Automated checks

                

                    Passed
                

            

                    

                
Administrative approval

                

                    Yes
                

            

                    

                
Human content review

                

                    Not recorded
                

            

                    

                
Subject-matter-expert review

                

                    Not recorded
                

            

            


    

        
            How this was prepared
        
        

                            

                    
Source basis

                    

                    
RSRC downloaded and privately stored a copy of the paper for internal analysis. The PDF is not offered to viewers from this page.


                                            
    
                                                            
  • 
                                    PDF added to RSRC:
                                    
                                
    • 
                                                    

                    
                                        

                

                            

                    
AI-generated page content

                    

                    
AI-generated research notes displayed on this page: Synopsis, Identified gaps, Methods, Limitations, Future work. The paper itself is not described as AI-generated.


                                            
    
                                                            
  • 
                                    Document analysis recorded:
                                    
                                
    • 
                                                            
  • 
                                    Synopsis generation recorded:
                                    
                                
    • 
                                                            
  • 
                                    Page record updated:
                                    
                                
    • 
                                                    

                    
                                        

                

                            

                    
Automated checks

                    

                    
The current, source-bound synopsis passed the recorded versioned publication checks.


                                            
    
                                                            
  • 
                                    Checks completed:
                                    
                                
    • 
                                                    

                    
                                            

                            
                                View passed checks (3)
                            
                            
    
                                                                    
  • Length, completeness, repetition, refusal, boilerplate, and active-markup screening
    • 
                                                                    
  • Numerical claims checked against the available source text
    • 
                                                                    
  • English-source lexical grounding check
    • 
                                                            

                        

                                        

                

                            

                    
Administrative approval

                    

                    
An authenticated administrator approved the bibliographic record for public Library display. This is not a review of every research claim.


                                            
    
                                                            
  • 
                                    Approved for public display:
                                    
                                
    • 
                                                    

                    
                                        

                

                            

                    
Human content review

                    

                    
No human review is recorded for the AI-generated content displayed on this page.


                    
                                        

                

                            

                    
Subject-matter-expert review

                    

                    
RSRC has not recorded review of this content by a subject-matter or methods expert.


                    
                                        

                

                    

    


    

        Review-state definitions

        Found a possible error?
        Request a correction.
    



    



              

        
                  

            
Synopsis

            
This publication presents a blockchain-forensics case study of a sanctions-linked pig-butchering network, focusing on 29 Bitcoin addresses designated by OFAC as tied to the Prince Group and Chen Zhi. The authors frame their work as an enforcement-grounded examination of on-chain structure, using OSINT sources, cross-platform attribution checks, exposure screening, and thematic analysis of transaction behavior to illuminate how value moves within the network. Their aim is to describe the internal organization and transaction patterns of a suspected laundering system, rather than to adjudicate criminal liability. Methodologically, the study conducts blockchain tracing with the QLUE platform and cross-validates results with licensed tools from Elliptic, Crystal Intelligence, and Merkle Science. Addresses are coded by observed function into three layers—hub, intermediary, and holding—with the hub layer concentrating intake and showing near-universal exposure to F2Pool; intermediary addresses mostly relay funds with little balance retention; holding addresses accumulate and retain funds. The authors report that the hub layer concentrates mining-pool–linked inflows and that the intermediary and holding layers are largely funded by internal transfers within the sanctioned group. They argue these patterns reflect functional specialization across address types and may offer forensic indicators for VASPs and law enforcement. The discussion acknowledges limitations: the analysis is confined to a single enforcement-grounded sample, relies on inferential heuristics, and cannot determine control of mining infrastructure or definitive ownership. The authors propose a replicable framework integrating OSINT attribution, tracing, exposure analysis, and role interpretation for future investigations, while cautioning that results should be interpreted cautiously and in context.

          

        
                  

            
Identified Gaps

            
Prior work emphasizes victim grooming, deceptive intimacy, victim transfers, and general laundering mechanisms, but gives comparatively limited attention to the internal on-chain organization of sanctioned pig-butchering networks, including how transaction flows, address roles, and laundering functions are structurally embedded.

          

        
                  

            
Methods

            
Blockchain-forensics case study of 29 OFAC-sanctioned Bitcoin addresses linked to the Prince Group/Chen Zhi. The authors reconstructed transaction flows in QLUE, cross-validated attribution and exposure using Elliptic, Crystal Intelligence, and Merkle Science, reviewed public enforcement and corporate records, coded addresses as hubs, intermediaries, or holdings, and thematically analyzed aggregation, layering, retention, exposure, and connectivity.

          

        
                  

            
Limitations

            
The bounded sample covers only 29 addresses from one OFAC action and is a partial representation of the wider network. Clustering, attribution, and transaction-path reconstruction are inferential; largest-output tracing is probabilistic because Bitcoin transactions can include change outputs. Mining-pool proximity cannot establish direct mining control, direct payouts, source of funds, deliberate laundering use, or F2Pool knowledge or involvement.

          

        
                  

            
Future Work

            
Compare this sanctions-based sample with other Chen Zhi-related address sets and other OFAC-sanctioned cryptocurrency networks to test whether the hub–intermediary–holding structure generalizes. Examine both legitimate and illicit recipients of mining-pool-linked Bitcoin to distinguish routine mining-origin exposure from structured laundering or redistribution.

          

              

    
    

        
Related Research Insights

        

            See how this publication connects to RSRC's living evidence syntheses through current citations and research-topic mapping.