Treasury sanctions major crypto cyber scam facilitator

May 30, 2025

It’s not clear what these two pigs are looking at, but cyber criminals are looking for crypto scam victims for their so-called pig butchering schemes. One company U.S. officials say facilitated such schemes has been sanctioned by the U.S. Treasury’s Office of Foreign Assets Control. (Image by Herbert from Pixabay)

And the U.S. Treasury sanctioned this no-so-little pig butcher all the way home.

My liberty with the old nursery rhyme was prompted by the Treasury Department’s announcement on May 29 that its Office of Foreign Assets Control (OFAC) has sanctioned a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams.

The scams are commonly known as pig butchering.

You may remember hearing this porcine phrase back in November 2023, when the Internal Revenue Service Criminal Investigation (IRS-CI) unit warned taxpayers of these global internet schemes.

The con artists call their targets, often individuals looking for romance online, pigs. The financial slaughtering comes as the victims are convinced to invest in cryptocurrency trading platforms. When the duped investors try to cash out, the criminals butcher the pigs by seizing their funds.

OFAC actions: In a release announcing the sanctions, Treasury said (in one of the longest sentences ever written) that the action against Funnull Technology Inc. came after it “materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of cyber-enabled activities originating from, or directed by persons located, in whole or substantial part, outside the United States that is reasonably likely to result in, or has materially contributed to, a threat to the national security, foreign policy, or economic health or financial stability of the United States and that has the purpose of or involves causing a misappropriation of funds or economic resources, intellectual property, proprietary or business confidential information, personal identifiers, or financial information for commercial or competitive advantage or private financial gain.”

OFAC also sanctioned Funnull’s administrator, a Chinese citizen, for “having acted or purported to act for or on behalf of [the company], directly or indirectly.”

Connected to internet scam sites: The release said Funnull is linked to the majority of virtual currency investment scam websites reported to the Federal Bureau of Investigation (FBI), which worked with OFAC in investigating the case.

These scams are largely perpetrated by criminal organizations based in Southeast Asia who use victims of labor trafficking to conduct outreach to millions of unsuspecting individuals around the world, according to federal officials.

In the pig butchering schemes, scammers leverage create fictitious identities to form potential online relationships. Once they earn their victims’ trust, they convince them to invest in virtual currency through a fake website designed to look like a legitimate investment platform that reflects significant, but fabricated, returns on the investment.

When a victim is unable or unwilling to pay more into the scam, the scammer abruptly cuts off communication, and takes the victim’s entire investment.

Funnull-generation-of-new-domains_FBI-graphic

An FBI-created graphic showing how Funnull generated batches of new domains on a regular basis and mapped them to internet addresses on U.S. cloud providers.

Investigators say Funnull generates domain names for websites on its purchased IP addresses using domain generation algorithms (DGAs), programs that generate large numbers of similar but unique names for websites, and provides web design templates to cybercriminals.

“These services not only make it easier for cybercriminals to impersonate trusted brands when creating scam websites, but also allow them to quickly change to different domain names and IP addresses when legitimate providers attempt to take the websites down,” according to the Treasury release.

In addition, say U.S. officials, in 2024 Funnull purchased a repository of code used by web developers and maliciously altered the code to redirect visitors of legitimate websites to scam websites and online gambling sites, some of which are linked to Chinese criminal money laundering operations.

U.S.-based victims of these scam websites have reported more than $200 million in losses, with average losses of over $150,000 per individual, according to investigators. The announcement also said, “These figures likely underestimate the total losses, as many victims of scams do not report the crime.”

Sanctions’ effects: OFAC sanctions take various forms, from blocking the property of specific individuals and entities to broadly prohibiting transactions involving an entire country or geographic region, such as through a trade embargo or prohibitions related to particular sectors of a country’s economy.

Treasury’s OFAC announcement did not provide specifics on the sanctions against Funnull and the company administrator.

However, it did say in the Funnull case —

As a result of today’s action, all property and interests in property of the designated or blocked persons described above that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. Unless authorized by a general or specific license issued by OFAC, or exempt, OFAC’s regulations generally prohibit all transactions by U.S. persons or within (or transiting) the United States that involve any property or interests in property of blocked persons.

Also, officials noted that violations of U.S. sanctions “may result in the imposition of civil or criminal penalties on U.S. and foreign persons.”

Deputy Secretary of the Treasury Michael Faulkender said, via the Department’s statement, that the sanctions against Funnull and its employee show that “the United States is strongly committed to ensuring the continued growth of a legitimate, safe, and secure digital asset ecosystem, including the use of virtual currencies and similar technologies.”

The FBI also published a cybersecurity advisory with more information on Funnull’s operations, including technical details about the IP addresses and computer infrastructure that it uses.

Investigators hope that the information will help private citizens identify, and ultimately take down, websites associated with Funnull. Officials also encourage citizens to report online scams and other illegal online activity to the FBI’s Internet Crime Complaint Center (IC3).

And while the IRS wasn’t specifically involved in this anti-scam action, since Treasury and OFAC brought the sanctions, the move makes the ol’ blog’s Tax Felon Friday list.

You also might find these items of interest: