On May 29, 2025, the U.S. Treasury Department announced sanctions against Philippines-based Funnull Technology Inc. and its administrator, Liu Lizhi, over their alleged role in enabling cryptocurrency investment scams. Treasury said U.S. victims reported losing more than $200 million to scam websites linked to Funnull. That figure describes reported losses associated with those websites; Treasury did not say Funnull personally received or stole $200 million.
Who Treasury sanctioned—and what the $200 million means
The Treasury Department said its Office of Foreign Assets Control (OFAC) designated Funnull Technology Inc. and Liu Lizhi on May 29, 2025. Treasury described Funnull as a Philippines-based provider of computer infrastructure used by hundreds of thousands of websites involved in virtual-currency investment scams. It identified Liu, a Chinese national, as Funnull’s administrator.
Treasury reported more than $200 million in losses reported by U.S.-based victims of scam websites it linked to Funnull, and an average reported loss of more than $150,000 per individual. Treasury warned that the figures likely understate the harm because many victims do not report scams. They are agency-reported victim-loss figures, not an audited total, a court finding, recovered money, or proof of proceeds received by Funnull.
OFAC’s notice records that Funnull and Liu were added to the Specially Designated Nationals (SDN) List on May 29, 2025. That historical notice does not establish their live list status on October 8, 2026; consult OFAC’s Sanctions List Search for current results and aliases.
How Treasury says Funnull enabled scam websites
Treasury said Funnull bought IP addresses in bulk from major cloud-services companies and resold them to cybercriminals to host scam platforms and other malicious content. It also said Funnull generated domains using domain-generation algorithms and supplied website templates. Together, those services could help scam operators imitate trusted brands and move websites to new domains or IP addresses after providers took down existing ones.
Treasury further alleged that, in 2024, Funnull acquired a code repository used by web developers and maliciously altered code to redirect visitors from legitimate websites to scam and online-gambling sites. These are Treasury’s allegations and findings about infrastructure; they are not a court determination that Funnull was guilty of a crime.
How the crypto investment scam works
Treasury describes these schemes, often called “pig-butchering” scams, as a process of building trust before soliciting an investment. Scammers may use fictitious identities and personal or romantic stories to create a relationship, then steer the target to a fake cryptocurrency investment platform. The platform can display fabricated returns to make the investment appear successful and encourage further deposits.
- Establish contact and build trust. A scammer uses a false identity and a sustained personal story or relationship.
- Introduce an investment opportunity. The target is directed to a platform designed to resemble a legitimate investment service.
- Show false gains and seek more funds. Fabricated account balances or returns can encourage additional deposits.
- Cut off contact. When the target cannot or will not send more money, the scammer may disappear and keep the funds.
Treasury says these scams are largely perpetrated by criminal organizations based in Southeast Asia and notes that people subjected to labor trafficking may be used to conduct outreach. That context does not mean every operation or every person making contact has the same role.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the FBI’s infrastructure figures show
In a May 29, 2025 advisory, the FBI said it had identified 548 unique Funnull CNAMEs linked to more than 332,000 unique domains since January 2025. The advisory covers relevant infrastructure activity observed through April 2025. These are technical infrastructure counts—not counts of victims, confirmed fraud events, or financial losses.
The FBI advisory is aimed at cybersecurity professionals and system administrators investigating related infrastructure. Its title describes the activity as occurring between October 2023 and April 2025; its indicators and reporting guidance are available in the FBI advisory.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What an OFAC sanction generally does
Under Treasury’s explanation, property and interests in property belonging to designated or otherwise blocked persons are blocked when they are in the United States or in the possession or control of U.S. persons, and must be reported to OFAC. An entity owned directly or indirectly 50 percent or more by one or more blocked persons is also blocked.
Unless a general or specific license authorizes the activity, or an exemption applies, U.S.-person transactions—and transactions within or transiting the United States—involving blocked persons are generally prohibited. Sanctions violations may result in civil or criminal penalties; OFAC may impose civil penalties on a strict-liability basis. These are general rules, not advice about any individual transaction. Treasury’s announcement is available in its May 29, 2025 release.
Free tools Windows power users keep installed
One-click scans. No signup required.
Where to report suspected crypto investment fraud
Treasury directs people to report online scams and illegal activity to the FBI’s Internet Crime Complaint Center (IC3). The FBI advisory also provides guidance for cybersecurity professionals and system administrators. Reporting can provide information to authorities, but it does not guarantee that funds will be recovered.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
