Government-designated addresses and entities, synced live from the OFAC SDN crypto lists. Attribution ties addresses to networks; the T0 graph layers on top.
| ENTITY | ADDRESS / SCOPE | CHAIN | VALUE | AUTHORITY | YEAR | STATUS |
|---|
The organized networks behind the wallets. Named rows are government-designated entities only, every one cited. The internal codename graph is T0 and is not shown here.
| NETWORK | MODEL | FOOTPRINT | AUTHORITY · YEAR | KNOWN SCALE | STATUS |
|---|
A bounded infrastructure syndicate: corporate identity, domains, named operator, designated wallet, victim-loss estimate, and enforcement action in one cited record.
OFAC designated the company, Liu Lizhi, and the listed ETH address. The $200M+ figure is an authority estimate of U.S. victim losses linked to scams enabled by Funnull infrastructure. Adjacent domains or wallets do not inherit designation.
Enterprise-scale criminal network record spanning corporate holdings, forced-labor compounds, laundering infrastructure, and the largest U.S. crypto forfeiture action.
The figures and allegations are bound to the 2025 DOJ and OFAC actions. A corporate relationship, transaction, or shared service does not independently establish participation in criminal conduct.
Active, bounded operator record connecting a named business group, physical compounds, forced-labor allegations, and sanctions evidence.
OFAC's designation is the attribution source. Nexus does not infer that every employee, tenant, customer, property transaction, or adjacent wallet participates in the conduct described.
Compounds and call centers where forced-labor fraud runs at industrial scale. Named sites are publicly documented by UN, UNODC, OFAC, and press reporting.
| REGION | SITE | TYPE | SOURCE | PRIMARY SCHEME | STATUS |
|---|
The infrastructure layer: phishing fleets, drainer deployments, laundering rails. Blocklist counts sync live from upstream corpora.
| OPERATION | VECTOR | INFRA | KNOWN SCALE | SOURCE | STATUS |
|---|
The vendor economy that industrializes fraud: marketplaces, kits, and services sold to operators. Track the suppliers, collapse the market.
| VENDOR | CATEGORY | OFFERING | KNOWN SCALE | SOURCE | STATUS |
|---|
Contribution buys access. Members feed the graph and get actionable views back: attribution, freeze targets, program rails.
| TIER | WHO | CONTRIBUTES | RECEIVES |
|---|---|---|---|
| Internal | Kinetic products | Every case, scan, and matter | FULL GRAPH |
| Coalition | Investigators, firms, exchanges | Case data, indicators, wallets | ACTIONABLE VIEWS |
| Program | Government, institutional | Mandates, jurisdiction | IDENTIFY · FREEZE · SEIZE |
The graph is never sold raw. Products and applications are collection mechanisms. Programs are the monetization: a Dragonfly-shaped program is the SKU.
The shape of the problem, in six frames. Figures are real and cited; graph-native versions follow the data seam.
The academic layer. Every claim in the graph traces to a citable source. Corpus lives on GitHub; searchable retrieval layer follows.
| SOURCE | PUBLISHER | TYPE | YEAR | FEEDS |
|---|---|---|---|---|
| Transnational Organized Crime and Casinos, Cyberfraud in SE Asia | UNODC | Report | 2024 | PHYSICAL OPS |
| Crypto Crime Report | Chainalysis | Annual report | 2025 | WALLETS · DIGITAL |
| Alert on Pig Butchering Schemes (FIN-2023-Alert005) | FinCEN | Advisory | 2023 | SYNDICATES |
| Transnational Crime in Southeast Asia: A Growing Threat | USIP | Study | 2024 | PHYSICAL OPS |
| Global State of Scams | GASA | Survey | 2025 | DIGITAL OPS |
| Typologies: Drainers & Scam-as-a-Service | Elliptic | Research | 2024 | SAAS TRACKER |
| IC3 Annual Report | FBI | Annual report | 2024 | GLOBE · DIGITAL |
| Internet Organised Crime Threat Assessment (IOCTA) | Europol | Assessment | 2024 | SYNDICATES |
| SDN Designations: Mixers & Fraud Syndicates | OFAC | Designations | Rolling | WALLETS |
| The Illicit Crypto Economy | TRM Labs | Report | 2025 | WALLETS · DIGITAL |
| Wallet Drainer Reports | ScamSniffer | Telemetry · LIVE | Rolling | SAAS · FEED |
| SDN Crypto Address Lists (0xB10C) | OFAC via GitHub | Machine-readable · LIVE | Rolling | WALLETS · GLOBE |
| eth-phishing-detect Blocklist | MetaMask | Blocklist · LIVE | Rolling | DIGITAL · GLOBE |
| US v. Chen Zhi (Prince Group) · $15B Forfeiture | DOJ EDNY | Indictment | 2025 | SYNDICATES |
| Section 311 Finding: Huione Group | FinCEN | Finding | 2025 | SYNDICATES · SAAS |
| Online Scam Operations & Trafficking (SE Asia) | UN OHCHR | Report | 2023 | PHYSICAL OPS |
| Crypto Judgment Dockets · LODESTAR | INTERNAL · T0 | Primary | Rolling | ALL MODULES |
| REPO | ROLE | STATUS |
|---|---|---|
| northpoint-nexus | Corpus of record: sources, notes, module data (private) | TO CREATE |
| blockchain-etl/ethereum-etl | Chain extraction pipeline | TRACKED |
| graphsense/graphsense-lib | Cluster and attribution tooling | TRACKED |
| opensanctions/opensanctions | Sanctions and entity screening data | LIVE · FEED |
| scamsniffer/scam-database | Drainer and scam domain telemetry | LIVE · FEED |
| MetaMask/eth-phishing-detect | Live phishing domain blocklist | LIVE · WIRED |
| 0xB10C/ofac-sanctioned-digital-currency-addresses | Machine-readable OFAC wallet list | LIVE · WIRED |
| graphsense/graphsense-tagpacks | Open attribution tag packs | TRACKED |
| cryptoscamdb/blacklist | Scam domain corpus | TRACKED |
Every record tiered: T0 INTERNAL (never leaves) · T1 PARTNER (coalition only) · T2 LICENSED · T3 PUBLIC (corroboration only, cited). Lineage immutable. Valuation = T0+T1 edges. Outbound views computed, never raw.
1. Corpus repo on GitHub, sources as structured files, PR-based additions. 2. Site reads corpus at build. 3. Searchable retrieval layer over the full corpus.