CHAPTER 18
THE TEST
OneCoin’s new blockchain made no sense to the regulars at BehindMLM either. The contributors to Oz’s site were hardly the most conventional armchair detectives. Some were cryptocurrency specialists who felt that OneCoin was damaging the industry; others were reformed believers who’d lost money to other MLM companies. But most had no obvious connection to the case other than curiosity. “We were all mostly just a bunch of nobodies tied together with a common interest,” Oz would say later. “Fellow travellers.” What united them all was a desire—although it was more like a hobby or even, over time, an addiction—to find out as much as they possibly could about OneCoin using publicly available information and share it with the world. Each had his or her own unique skills to bring to the table. Tim Tayshun, a Bitcoin specialist from California who attended a OneCoin seminar in 2015 and concluded the whole thing was a scam, would rail against the technical weaknesses of the OneCoin blockchain. “Semjon” excelled at finding obscure company, web-domain and personnel connections. Inspired by the big-hitting investigations by the open-source journalists at Bellingcat, he’d sometimes spend all night watching YouTube videos of OneCoin events, analyzing IP registries or reading through corporate filings, and carefully saved and documented everything he found in a virtual war chest. In another life, he might have been a top-notch private investigator—but like the rest of the BehindMLM contributors, it was a hobby rather than a profession.
Like most of the BehindMLM sleuths, Ari Widell’s lack of expertise was compensated by a stubborn fascination with the whole affair. Some days, Ari—a film fanatic in his late thirties—would get home from his day job in advertising, put the children to bed, then stay up until 3 AM in the morning investigating OneCoin. “I would just follow the rabbit hole,” he said later. “And then force myself to bed because I had to get up at 7 AM to go to work.” He often spent hours contacting banks who’d opened accounts for OneCoin and send them all the evidence he could muster that OneCoin was a Ponzi scheme. But the company always just seemed to brush it off.
As he sat reading Bjørn’s LinkedIn post, Ari realized “instantly” this was the proof everyone at BehindMLM had been waiting for. “You need to go public with what you know,” Ari told Bjørn when they spoke later that day. “This might be big.” Bjørn agreed to let Ari interview him about what had happened with Nigel Chinnock and Ruja’s missing blockchain. The next day, Ari posted the interview on his own blog site. It spread like wildfire and, within hours, Oz had posted it on BehindMLM too.1 As Bjørn read through the responses, he realized that his part in the OneCoin story wasn’t finished. He knew OneCoin didn’t have a real blockchain. But now he needed to prove it.
There is a famous saying in science: “Absence of evidence is not evidence of absence.” In other words, proving that something doesn’t exist is more difficult than proving that it does. That was the task facing Bjørn, who decided he needed to show the world that OneCoin’s blockchain was a fraud. It was made harder by OneCoin’s secretive design. Bitcoin had a public and open blockchain, which listed every transaction all the way back to the genesis block and anyone could check it. Ruja, by contrast, kept OneCoin’s blockchain private and guarded it like the Coca-Cola recipe. But she did concede one tiny morsel of transparency. Although no one was ever allowed to see the complete blockchain, the OneCoin website had something called a “blockchain display,” which showed live transactions between OneCoin wallets as they happened. That small window of openness gave Bjørn an idea. Investors could see their OneCoin balance by logging into their personal account, and those balances were supposed to mirror what was recorded on the blockchain. That meant that if Bjørn could transfer coins between OneCoin wallets, he could check if the same transactions appeared on the blockchain display.
Over the next few days, Bjørn acquired dozens of OneCoin wallets and passwords from disgruntled former investors and online critics, including several from Ari and other BehindMLM sleuths. One evening, he sat down at his desk and nervously opened three browser windows. Outside it was already pitch dark—one of those Norwegian winter nights that lasts forever. As usual he poured himself hot chai tea with honey and milk in a tall glass.
In the first two windows, he fired up the OneCoin website and logged into two OneCoin accounts he’d been given.
In the third he opened the blockchain display.
Bjørn then sent three OneCoin between his two accounts. Within seconds a message appeared on his screen: “Your request was successfully processed.” The coins had left one account and appeared in the other without any problem—just as he expected. If Ruja was telling the truth, if OneCoin really did have a functioning blockchain, that identical transaction should simultaneously appear on the blockchain display too, tucked in among all the other coins that were being sent and received across the network. But if Ruja was lying…
Bjørn sat and stared at the blockchain display, watching and noting every transaction that appeared: 0.580 coins moved. 1.121 coins moved. 1.681 coins moved. But no transaction appeared showing his three coins. So Bjørn did it again, this time with a different amount. And then again. And again. Wherever possible he used unusual number combinations that he would easily spot on the blockchain display. He moved 1.234 OneCoin. He moved 11.2233 OneCoin. Sometimes he waited a few hours between his tests, just in case someone from Sofia HQ was watching him. Other times he used his Rubik’s cube as a randomizer: in-between transactions he would solve and scramble one, three or seven times so Sofia wouldn’t spot his timing patterns. Over the course of several weeks, Bjørn made around 200 transactions on the “front end” account and watched the “back end” blockchain display, waiting for a match. But it was always the same result. Money moved between the accounts but never on the blockchain. Not even once.
There was only one, awful, conclusion. OneCoin’s blockchain display looked like the real thing, but it was some kind of pre-programmed “script,” an off-the-shelf piece of kit that was running phoney and meaningless transactions between imaginary wallets. Maybe it was built using “real” blockchain technology, but what mattered was this: the entries bore no relation to the balance investors held in their wallets.i
The display was just a clever ruse to fool investors into thinking their coins were held on a brand-new mathematically secure state-of-the-art blockchain. But all they owned were meaningless entries on a database. A million people had bought Ponzi tokens. Monopoly money that was controlled not by computer code, but by Ruja.
Suddenly everything else made sense.
No wonder Ruja could double everyone’s coins in Bangkok. She could conjure up as many coins as she wanted, simply by manually changing entries on her database. The absence of a genuine, decentralized blockchain also meant the “price” of OneCoin (which had gone from €0.5 in January 2015 to €6.95 by the time of the Bangkok event) wasn’t based on anything. It wasn’t driven by supply and demand, like Ruja had said in the beginning, because she didn’t have a real coin to sell. Nor was it based on the “mining difficulty,” like she sometimes claimed, since there was no real mining taking place. The price of OneCoin was just a number invented by Ruja—a number she would periodically increase to keep investors happy.
Her new blockchain was a giant simulation that used the ideas, language and success of Bitcoin to blind people to the truth.
The exchange site xcoinx, which Igor and others had used to exchange OneCoin into Euros, wasn’t a “boutique independent exchange.” It was secretly controlled and run from the Sofia HQ to process periodic Ponzi payouts so people believed in the coin. When Igor sold his coins, it wasn’t excited traders on the other side of the deal. It was Ruja’s finance team paying him with money from newer investors.
The “education” packages that people had been snapping up to acquire the tokens to mine the coins were another simulation, like the blockchain. They were pseudo-compliance, designed to confuse regulators into thinking the company was selling education rather than unregulated security investments. Huge chunks of the packages were directly plagiarized: for example, here of education level 3 was lifted word-for-word from the book Technical Analysis for Dummies.2 (That plagiarized “education” came with the “Pro Trader” package, which cost investors €1,100.)
And those audit reports OneCoin had published each month since June 2015, which claimed the blockchain was legit? The auditor, a Bulgarian man called Deyan Dimitrov, vanished after a couple of months and, ever since, the audits were written by a company called S-Systems, another firm secretly created and controlled by Ruja herself.3
Maybe she’d started with a real blockchain of sorts. Maybe her new 120 billion coin blockchain existed on a server somewhere. But the balances people held in their accounts didn’t correspond to it. The price was fake, the auditing company was fake, the exchange was fake and the education packages were fake. Everything was a lie.
Slowly the scale of the scam dawned on Bjørn. By the time he ran his tests in early 2017, OneCoin investors had spent approximately €3 billion purchasing as many as nine billion OneCoin, each of which was now priced at €7.95. That meant up to €70 billion worth of coins were owned by investors from Palestine to New York to Hong Kong to Kampala. Close to a million people thought they’d bought the next Bitcoin, but it was just an old-fashioned pyramid scam.
Footnote
i Bjørn also noticed that OneCoin’s blockchain display contained a serious timing error too. Blockchains contain a chronologically perfect record of every transaction, sometimes down to the nano-second. But a handful of users logged into their OneCoin accounts at 00.01 BST on October 1, 2016, and found that their coins had already been doubled even though Ruja only “switched on” the new blockchain in Bangkok approximately 16 hours later.