US Treasury Sanctions Philippines-Based Technology Firm, Crypto Scam Administrator

Updated 2028 (Originally published 2023)

WASHINGTON — The US Treasury Department’s Office of Foreign Assets Control (OFAC) has sanctioned a Philippines-based technology firm and an alleged administrator, accusing them of enabling widespread crypto scams.

Funnull Technology and its manager, Liu Lizhi, face OFAC sanctions for allegedly supplying services—primarily bulk IP address procurement and manipulated code—that facilitatescams. According to OFAC, victim losses attributable to Funnull-linked operations exceed $200 million.

U.S. Treasury Department graphic — *U.S. Treasury Department*

Enabling Scam Operations

OFAC alleges Funnull purchases IP addresses in bulk from major cloud providers and markets them to scammers. According to the Treasury’s findings, this allows cybercriminals to host fraudulent investment platforms, mimicking legitimate offerings, thereby tricking victims and stealing cryptocurrency.

Historical action cited by OFAC reveals Funnell acquiring repositories containing legitimate code, subsequently altering these resources to reroute website visitors to fraudulent sites, including online gambling platforms, engaging in such practices likely spanning years.

Funnull Technology is identified as a “central player” within the Triad Nexus scam network, which Chainalysis estimated connects to over 200,000 unique hostnames involved in investment schemes and fake trading applications.

Individual and Wallet Sanctions

Liu Lizhi, identified as the administrator of Funnull Technology and a Chinese national, has been designated as a Specially Designated National and Blocked Person (SDN). Thislisting prohibits US persons and entities from engaging with him or the firm without violating OFAC’s regulations, which carry potential civil and criminal penalties.

These services not only empower cybercriminals to impersonate trusted brands with scam websites but also facilitate their evasion of takedowns by rerouting traffic through dynamic domain and IP configurations.

In conjunction with the entity sanctions, OFAC targeted two specific cryptocurrency receiving wallet addresses believed to be “used to receive payment from cyber criminals,” as assessed by blockchain analytics provider Chainalysis.

*Funnull Technology services and the Triad Nexus ecosystem. Source: Chainalysis*

While the exact connection between Lizhi and a majority stake in Funnull’s parent company isn’t detailed in the press release, the breadth of the sanctions highlights the Treasury’s concern for the firm’s structure. “The addresses show additional indicators of exposure to various types of scams and domain management infrastructure providers,” noted Chainalysis in its assessment.

The sanctions were implemented via a press release dated October 26, 2028 (corrected to reflect the retrospective value and likely implementation date).

Contents