LIBRA wasn’t just another memecoin. It came wrapped in the flag of Argentina, sprinkled with government-flavored hype, and promoted by none other than the country’s President himself. But within 24 hours, it turned into one of the biggest crypto rug pulls of the decade — wiping out billions, implicating high-level politicians, and triggering a national crisis.

LIBRA was supposed to be a meme — a playful nod to Argentina’s complex financial situation. But when President Javier Milei publicly promoted it, things changed fast. Investors mistook meme for mandate. With one tweet, the market cap soared past $4.4 billion.

But it wasn’t just hype. It was intentional misdirection.

The insiders knew. They always do.

Behind the scenes, developers and influencers had preloaded wallets, waiting to dump as soon as retail poured in. And dump they did.

In a rare move, Circle froze nearly $58 million in USDC across two wallets tied to the LIBRA team. This came after a U.S. federal court issued a temporary restraining order, signaling the scale of the fraud.

The U.S. Treasury Department on Thursday sanctioned Funnull Technology Inc., a Philippines-based firm allegedly at the center of a vast cyber fraud network enabling cryptocurrency scams. 

Funnull is accused of providing technical infrastructure for hundreds of thousands of websites linked to so-called “pig butchering” scams — complex social engineering schemes where fraudsters pose as romantic or financial partners to coax victims into fake crypto investments.

U.S. victims have reported more than $200 million in losses associated with Funnull-linked sites, with an average individual loss of over $150,000. Its administrator, Chinese national Liu Lizhi, was also sanctioned, according to the Treasury Department.

The sanctions, issued by the Treasury’s Office of Foreign Assets Control under Executive Orders 13694 and 14144, were coordinated with the FBI. The bureau is releasing a cybersecurity advisory to help private-sector partners identify and take down sites tied to Funnull’s infrastructure.

“These actions reflect our commitment to disrupting the networks that power cybercrime and target Americans,” Deputy Treasury Secretary Michael Faulkender said.

Crypto scamming and phishing 

According to Treasury officials, Funnull purchased IP addresses in bulk from cloud service providers and resold them to scammers hosting fake investment platforms and phishing sites. It also used domain generation algorithms to mass-produce web addresses and provided design templates, helping cybercriminals impersonate legitimate financial services.

In 2024, Funnull reportedly tampered with a code repository used by developers to secretly reroute web traffic from legitimate sites to scams and gambling platforms, some linked to Chinese money laundering operations.

Liu Lizhi allegedly managed operations at Funnull, including overseeing staff who assigned domains to scammers and maintained infrastructure supporting fraud, phishing, and illicit gambling.

The Treasury’s action follows a September 2023 alert by its Financial Crimes Enforcement Network warning of pig butchering scams and their ties to Southeast Asian crime groups exploiting victims of labor trafficking to carry out fraud.