The United States (US) Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned Funnull Technology Inc., a Philippines-based firm, and its Chinese administrator Liu Lizhi, for facilitating massive virtual currency investment scams known as “pig butchering.”

These scams have led to over $200 million in losses reported by US victims alone, with an average cost of more than $150,000 per individual scammed, the US Treasury Department said in a May 29 statement.

“Today’s action underscores our focus on disrupting the criminal enterprises, like Funnull, that enable these cyber scams and deprive Americans of their hard-earned savings. The US is strongly committed to ensuring the continued growth of a legitimate, safe, and secure digital asset ecosystem, including the use of virtual currencies and similar technologies,” Deputy Secretary of the Treasury Michael Faulkender.

Funnull provided infrastructure for scam websites by purchasing large volumes of internet protocol (IP) addresses and creating fake domains and web designs used by cybercriminals to impersonate legitimate investment platforms, said the US Treasury.

The company also deployed domain generation algorithms (DGAs) to help scammers quickly switch domains and avoid shutdowns.

In 2024, Funnull reportedly altered open-source web code to secretly redirect users from legitimate sites to online scams and gambling platforms, some of which are linked to Chinese money laundering syndicates, the US Treasury said.

Liu, its administrator, oversaw these operations, managing internal documents and domain assignments for fraudulent use, it added.

The sanctions freeze all US-based assets of Funnull and Liu, and prohibit US persons from engaging with them.

OFAC emphasized that this move targets not only scam operators but also the foreign support infrastructure that sustains their global operations.

The US Federal Bureau of Investigation (FBI) is working alongside OFAC and has released a cybersecurity advisory to help the private sector identify and mitigate threats tied to Funnull’s infrastructure, it said.

According to the US Treasury’s website, Funnull is also known as Fang Neng CDN, with the following registered address: 3rd Avenue and 30th Street, 14th Floor, C6 Road, Purok 5, Net Cube Center, E Square Zone, Lower Bicutan, Fourth District, Taguig City, National Capital Region 1632, Philippines.

Blockchain data platform Chainalysis noted in a May 29 blog that the FBI Internet Crime Complaint Center’s (IC3) advisory specifically included the IP addresses and infrastructure used by Funnull.

“Funnull was a central player in a network dubbed by security researchers as Triad Nexus, which includes more than 200,000 unique hostnames, many of which are associated with investment scams, fake trading apps, and suspect gambling networks,” Chainalysis said.