Chinese Officials Hoped CoinJoin Would Hide Bitcoin Bribes

Two Chinese intelligence officers have been charged with obstructing a US federal investigation by paying bitcoin bribes worth $61,000


Source: Shutterstock


key takeaways

  • Guochun He and Zheng Wang sought bitcoin wallet Wasabi to hide bribe payments, Elliptic said
  • The pair allegedly hoped to gather confidential documents related to a federal investigation into Huawei

Two Chinese officials tried to hide bitcoin bribes paid to a US double agent with crypto mixing technology, once again thrusting privacy-preserving protocols into public discourse.

In 2019, authorities say Guochun He and Zheng Wang directed a US government employee to steal information about an ongoing criminal investigation into a global telecom company based in the People’s Republic of China (PRC), according to the Department of Justice (DOJ). 

The DOJ doesn’t name the company, but the Wall Street Journal and CNBC both reported the firm as Huawei. 

The officials, said to be conducting foreign intelligence operations in the interest of Huawei, believed the US government employee was recruited to work for Beijing. He was in fact working with the US Federal Bureau of Investigation (FBI), the complaint alleges.

In Sept. 2021, the Chinese officials assigned the double agent with detailing their meetings with prosecutors at the US Attorney’s office in Brooklyn.

They were especially interested in understanding which Huawei employees had been interviewed by the government, seeking a description of the prosecutors’ evidence, witness list and trial strategy.

Guochun He, one of the Chinese officials who paid the bitcoin bribes, allegedly told the agent that the company in question was “obviously interested” in the information. He first handed over $41,000 in bitcoin in Oct. 2021 for stealing a document and another lot worth $20,000 in September.

Huawei didn’t return Blockworks’ request for comment by press time.

Analytics unit traced bitcoin bribes despite Wasabi Wallet

In private messages, He allegedly asked the agent to accept bitcoin as he believed it would be “private and safe” from the eyes of the government.

Crypto has long been considered a means of engaging in discrete transactions, but mostly the opposite is true. Blockchain data, at its core, is almost always public and transactions are traceable, albeit pseudonymous. 

Crypto mixers were designed to provide privacy for this open financial system. There are many different kinds but they generally work by commingling funds with other users.

Mixers have increasingly come under the spotlight after usage by North Korean hackers and other bad actors in laundering illicit crypto gathered from exploits across the crypto ecosystem alongside ransomware attacks.

Excerpt from DOJ indictment.

The US recently banned citizens from using Ethereum-powered crypto mixing service Tornado Cash for this reason. 

Blockchain analytics firm Elliptic found that the two officials used bitcoin wallet Wasabi Wallet to conceal their transactions. Wasabi describes itself as an open-source, non-custodial bitcoin wallet created to provide privacy by default.

The wallet makes use of tech known as “CoinJoin,” which combines bitcoin of multiple transacting parties to render identifying fund provenance more difficult.

“All of the bribe payments can be traced back to Wasabi,” Elliptic said in a statement. Tom Robinson, co-founder and chief scientist at Elliptic, told Blockworks the firm was able to identify the bitcoin transactions based on details disclosed in the criminal complaint.

Elliptic was then able to use its blockchain analytics tools to trace the source of the payments and identify the use of Wasabi. Wasabi Wallet didn’t immediately return Blockworks’ request for comment.

Image source: Elliptic

Both officials are charged with attempting to obstruct a criminal prosecution of Huawei in the federal district court in the Eastern District of New York. He is additionally charged with two counts of money laundering based on bribe payments. 

They currently remain at large. If convicted, He faces up to 60 in prison and Wang faces up to 20 years.

In any case, the matter once more highlights the difficulty of hiding crypto activity — whether illicit or benign — even after funds are sent through crypto mixing technology such CoinJoin. 

Elliptic’s Robinson told Blockworks the firm has “special techniques for identifying bitcoin addresses associated with Wasabi use.”

Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the On the Margin newsletter.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.


Upcoming Events

Salt Lake City, UT

MON - TUES, OCT. 7 - 8, 2024

Blockworks and Bankless in collaboration with buidlbox are excited to announce the second installment of the Permissionless Hackathon – taking place October 7-8 in Salt Lake City, Utah. We’ve partnered with buidlbox to bring together the brightest minds in crypto for […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

Research Report Templates.png


ZKPs enable efficient offchain transaction processing and validation, resulting in increased throughput and reduced fees. Solana's ZK Compression leverages ZKPs to minimize onchain storage costs, while Sui's zkLogin streamlines user onboarding by replacing complex key management with familiar OAuth credentials.


The crypto asset manager lowered its planned fee from 0.25% to 0.15%, undercutting its competitors


Plus, a look at planned ETH ETF fees and how they differ from their BTC counterparts


North Korea suspected in breach of Indian exchange’s multisig wallet


Plus, Sanctum’s CLOUD token has officially launched — but not without problems


It’s not yet clear whether Donald Trump is pumping bitcoin. But an unofficial memecoin is still seeing benefit.