The U.S. Treasury has imposed sanctions on a Philippines-based technology company and its alleged administrator, accusing them of aiding the proliferation of thousands of crypto scam websites. The announcement comes as part of a broader effort by American authorities to curb cybercrime and protect crypto investors.
On May 29, the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Funnull Technology, alleging the firm played a critical role in enabling crypto fraud on a massive scale. According to OFAC, Funnull is linked to the majority of crypto scam websites reported to the FBI, with estimated victim losses exceeding $200 million.
The firm allegedly purchased large volumes of IP addresses from cloud service providers and resold them to cybercriminals. These IPs were then used to host clones of legitimate investment platforms, tricking users into transferring their digital assets.
In a particularly troubling case in 2024, Funnull acquired a commonly used developer code repository, modified its codebase, and deployed it to redirect unsuspecting users from legitimate websites to fraudulent crypto schemes and online gambling domains. These services not only make it easier for cybercriminals to impersonate trusted brands when creating scam websites but also allow them to quickly change to different domain names and IP addresses when legitimate providers attempt to take the websites down.
As part of the action, OFAC also sanctioned Liu Lizhi, a Chinese national and the alleged administrator of Funnull. Lizhi reportedly oversaw the firm’s internal operations and staff. His name has been added to the Specially Designated Nationals and Blocked Persons (SDN) list.
Inclusion on the SDN list means that all assets owned or controlled by Lizhi within the U.S. are frozen. Additionally, U.S. persons and entities are prohibited from engaging in any financial or business transactions with him. Violations can result in severe civil or criminal penalties.
OFAC also blacklisted two cryptocurrency wallet addresses allegedly tied to Funnull. According to a May 29 report by blockchain analytics firm Chainalysis, the wallets were likely used to receive payments from cybercriminals. Additionally, the addresses show indirect exposure to various types of scams and domain management infrastructure vendors, Chainalysis noted.
Chainalysis further identified Funnull as a key player in a broader cybercriminal ecosystem known as the Triad Nexus. This network reportedly comprises over 200,000 unique hostnames, most of which are associated with fake trading platforms, investment scams, and fraudulent apps.
Due to the sanctions, all individuals and entities within the U.S. are now barred from interacting with any assets or business interests where Funnull or Liu Lizhi holds a 50% or greater ownership stake.
