You’ve got scams: Scammers exploit the fact that so many people are still fairly unfamiliar with cryptocurrency aside from its supposed “get rich quick” potential, according to Chainalysis. The various types of scams include fake token sales, blackmail scams, and fake services that promise to “mix” a user’s coins with those of others in order to make transactions harder to trace—only to run off with the money instead.

Predation by Ponzi: But according to the new report, Ponzi schemes are the elephant in the room. These scams, which entice unwitting people to invest in a phony enterprise and then dole out profits to earlier investors using the money that more recent investors have contributed, accounted for 92% of the stolen funds. Millions of people were defrauded.

The PlusToken fiasco: Chainalysis reports that a single Ponzi scheme based in China by itself brought in at least $2 billion last year, which would make it one of the biggest ever. PlusToken was a supposed cryptocurrency wallet service that promised users high returns if they used Bitcoin or Ethereum to buy the fake company’s own token, called Plus. An elaborate marketing campaign convinced more than three million people—the majority of whom were in China, Korea, and Japan—to invest by reaching them through the popular messaging platform WeChat, holding in-person meetups, and posting ads in supermarkets.

In June, Chinese authorities arrested six people alleged to have been behind the scam, but it appears that at least one still hasn’t been caught, since someone has continued to launder the funds and even cash some of them out.

Dirty laundry: Chainalysis says the PlusToken scammers have managed to cash out at least $185 million of stolen Bitcoin, but first they tried to cover their tracks by making 24,000 transfers and using 71,000 different Bitcoin addresses. Many of those transactions were executed via a special kind of wallet that uses a Bitcoin-compatible privacy technology called CoinJoin to combine the user’s transactions with others in a way that makes it difficult to tell who sent which payment to which recipient. Much of this money eventually found its way to so-called over-the-counter (OTC) brokers, independent entities that facilitate trades between individuals who don’t want to interact with a regulated exchange.

The PlusToken scammers weren’t the only criminals who took this route. Chainalysis concludes that the activity of a small subset of “rogue” OTC brokers providing crypto-money-laundering services “skyrocketed” in 2019. The authors warn: “Regulators need to be aware of how these scams function and how players like OTC brokers fit in so that they can craft more effective consumer protection laws.” In the meantime, keep your guard up.