Abstract
n October 2025, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned 29 Bitcoin addresses asso ciated with the Prince Group and Chen Zhi, providing an opportunity to examine the internal on-chain structure of a sanctions-linked pig-butchering network. This blockchain-forensics case study analyzes the group of 29 addresses using blockchain tracing, cross-plat form attribution checks across multiple commercial analytics platforms, exposure screening, and thematic analysis of transaction be havior. Because the case rests on OFAC designations and DOJ allegations, the traced flows are interpreted as patterns consistent with suspected laundering rather than adjudicated crimes; no fiat off-ramping or other clear integration-stage activity was observed during the study period. The findings indicate a three-tier architecture composed of three aggregation hubs, twenty intermediary relay ad dresses, and six holding addresses. The hub layer concentrated network intake and showed 99.64% combined direct and indirect expo sure to F2Pool, a major Bitcoin mining pool. By contrast, the intermediary and holding layers were funded almost entirely by internal transfers from within the sanctioned group, showing 99.30% and 99.99% volume-weighted inbound exposure to group addresses, re spectively. Across the network, the group exhibited pass-through behavior, limited value retention, dense internal redistribution, and concentrated mining-pool-linked inflows at the intake layer. These findings suggest that role differentiation, internal redistribution, and mining-pool proximity may serve as useful forensic indicators for VASPs and law enforcement examining sanctions-linked crypto currency laundering networks.
Recommended Citation
Stern,
M.
&
Choi,
K.
(2026).
Three-Tier On-Chain Transaction Architecture in a Sanctions-Linked Pig-Butchering Network: A Blockchain-Forensics Case Study.
International Journal of Cybersecurity Intelligence & Cybercrime, 9(2), - .
DOI: https://doi.org/10.52306/2578-3289.1249
Available at:
https://vc.bridgew.edu/ijcic/vol9/iss2/2
Copyright © 2026 Matthew Stern and Kyung-shick Choi
Included in
Criminology Commons, Criminology and Criminal Justice Commons, Forensic Science and Technology Commons, Information Security Commons