OAK — OnChain Attack Knowledge

Worked example · 2018-01

BitConnect Ponzi collapse — Bitcoin / BitConnect — 2018-01-16

Loss
BCC reached an all-time high near $430 with a market cap above $2.6B (TechCrunch) and fell roughly 80% within hours of the 2018-01-16 shutdown announcement. The February 2022 US indictment alleges Kumbhani and co-conspirators obtained approximately $2.4B from investors (Decrypt reporting of the indictment). Investor counts are not established in the sources cited.
OAK Techniques observed
OAK-T11.005 (Operator-Side Fake-Platform Fraud — BitConnect constituted a fake investment platform that solicited deposits with promised trading-bot returns; the indictment calls it a Ponzi scheme). OAK-T3.003 (Pump-and-Dump Coordination — the BCC token was promoted through an affiliate / referral network; this mapping is carried over from the earlier draft and is weakly sourced).
Attribution
confirmed (founder / director). A federal grand jury in the Southern District of California indicted Kumbhani, announced 2022-02-25/26, on conspiracy to commit wire fraud, conspiracy to commit commodity price manipulation, operating an unlicensed money transmitting business and conspiracy to commit international money laundering; he was reported at large (Decrypt). Glenn Arcaro, a US-based BitConnect promoter, pleaded guilty to wire-fraud conspiracy in September 2021 and was sentenced in September 2022 to 38 months (DOJ, per search listing).
Corrected 2026-10-11
removed the unsourced "DOJ 2024-01-12 supplemental filing", SEC case number, Arcaro $56M/$24M figures, the NC order date, "~$435 peak / ~90% one-day drop / exchange offline Jan 17" and "tens of thousands of investors"; indictment charges, the $2.4B allegation and Arcaro's sentence are now from cited sources.
Key teaching point
BitConnect is a large crypto Ponzi scheme (the US Attorney's office called the alleged fraud possibly the largest cryptocurrency fraud ever charged, per search listing) and a canonical worked example of OAK-T11.005 (Operator-Side Fake-Platform Fraud) in the CEX / lending-platform context. The scheme's alleged architecture — a multi-level marketing recruitment funnel that captured Bitcoin deposits, issued a proprietary exchange token (BCC), and recycled new-depositor BTC as "returns" to earlier depositors — established the template for subsequent high-yield-investment-programme (HYIP) frauds on crypto rails. The rapid off-ramp (BCC-to-BTC exchange flow, concentrated on BitConnect's own exchange) is the forensic pattern that defenders studying T11.005 laundering should recognise.

Summary

BitConnect operated as a cryptocurrency lending and exchange platform whose "lending programme" required BCC tokens and promised outsized returns generated by a purported trading bot (the specific rates and launch date in the earlier draft are not confirmed by the sources cited here). The February 2022 indictment describes it as a Ponzi scheme in which investors' funds were paid out to other investors (Decrypt).

BitConnect used an affiliate / referral model in which investors recruited others (Arcaro, a US-based promoter, pleaded guilty to wire-fraud conspiracy). The BCC token was traded on BitConnect's own exchange (TechCrunch notes BCC trading would continue on its "Bitconnect X" platform); the earlier draft's claims of operator control of the order book and of a YouTube promoter network are not confirmed by the cited sources.

Ethereum founder Vitalik Buterin was among those who publicly accused BitConnect of being a Ponzi scheme (TechCrunch). The BCC token nonetheless rose from under $1 to an all-time high near $430 (TechCrunch).

Securities regulators in Texas (cease-and-desist reported 2018-01-03) and North Carolina each sent cease-and-desist letters. On 2018-01-16 BitConnect announced it was shutting down, citing "continuous bad press", the two cease-and-desist letters and DDoS attacks, and said it would refund outstanding loans at $363.62 per BCC (the 15-day average). BCC fell roughly 80%, to about $37 from over $200 hours earlier (TechCrunch).

The February 2022 indictment charges Kumbhani with commodity price manipulation conspiracy among other counts (Decrypt); the specific wash-trading and wallet-siphoning allegations in the earlier draft are not confirmed by the sources cited here. Glenn Arcaro pleaded guilty in September 2021 and was sentenced in September 2022 to 38 months.

Timeline (UTC)

When Event OAK ref
2017 BCC rises from under $1 to an all-time high near $430 (TechCrunch); Vitalik Buterin among those publicly calling BitConnect a Ponzi T11.005 (fake-platform operation)
2018-01-03 Texas State Securities Board cease-and-desist reported (Wikipedia) (regulatory action)
2018-01 North Carolina regulator also sends a cease-and-desist (date not verified here) (regulatory action)
2018-01-16 BitConnect announces shutdown; refund of loans at $363.62 per BCC; BCC falls ~80% to ~$37 (TechCrunch) T11.005 (platform exit)
2021-09 Glenn Arcaro pleads guilty to wire-fraud conspiracy (DOJ action)
2022-02-25 Indictment of Satish Kumbhani announced (DOJ SDCA; Decrypt); he is reported at large (DOJ action)
2022-09 Arcaro sentenced to 38 months (DOJ, per search listing) (DOJ action)

Realised extraction

The indictment alleges approximately $2.4B was obtained from investors (Decrypt). The extraction mechanism alleged is the Ponzi payout structure itself: new depositors' funds paid earlier ones. BCC holders were left with a token that fell ~80% on the shutdown announcement.

T11.005 classification

BitConnect is the canonical anchor for OAK-T11.005 (Operator-Side Fake-Platform Fraud) at the CEX / lending-platform layer. The indictment describes a Ponzi scheme; the claims in the earlier draft that no trading bot existed and that the operator controlled the order book and deposit wallet are not confirmed by the sources cited here. The structural features that distinguish OAK-T11.005 from OAK-T11.001 (Third-Party Signing-Vendor Compromise) are that (a) the fraud originates from the operator, not from a vendor compromise, and (b) the operator's platform is the instrument of fraud, not a victim of an external actor. BitConnect — alongside OneCoin, Plus Token, and the HyperVerse / HyperFund cluster — anchors the T11.005 sub-Techniques at v0.1.

T3.003 classification

The affiliate-driven promotion of BCC is mapped to OAK-T3.003 (Pump-and-Dump Coordination); this mapping rests on the earlier draft's description, and the sources cited here document the Ponzi structure and the token's rise and fall rather than a coordinated pump. The T3.004 distinction in the earlier draft is retained only as a classification note.

Public references

Techniques demonstrated (2)