WASHINGTON, D.C. — The U.S. Treasury Department on Thursday sanctioned Philippines-based Funnull Technology and its administrator Liu Lizhi for allegedly enabling massive cryptocurrency scams, known as “pig butchering,” that have defrauded Americans of more than $200 million.
According to a Treasury news release, Funnull provided internet infrastructure that supported the majority of crypto scam websites reported to the FBI. These sites lured victims through romance or friendship-based schemes, convincing them to invest in fake virtual currency platforms. On average, victims lost over $150,000 each.
The FBI’s cybersecurity advisory, also released Thursday, details how Funnull’s services—including IP addresses, hosting, domain generation algorithms, and web design templates—enabled cybercriminals to rapidly scale and shift operations. The FBI identified 548 Funnull CNAME records linked to more than 332,000 unique scam domains since January 2025.
“It’s kind of impressive they did that at this scale in less than two years,” said Aidan Holland, a security researcher at Censys, noting the sheer volume of domains far exceeds those used in other widespread scams.
Funnull’s tactics included altering legitimate developer code to redirect users to scam and gambling sites, some allegedly tied to Chinese money laundering networks, the Treasury said.
Between October 2023 and April 2025, Funnull’s infrastructure showed signs of large-scale domain migration activity, helping scammers evade detection and sustain operations.
“Today’s action underscores our focus on disrupting criminal enterprises like Funnull that enable these cyber scams and deprive Americans of their hard-earned savings,” said Michael Faulkender, U.S. Deputy Secretary of the Treasury.
Liu Lizhi, a Chinese national, was sanctioned for operating on behalf of Funnull. Authorities found spreadsheets and documents linking Liu to task management and domain assignments tied to crypto fraud, phishing, and illegal gambling sites.
Cybersecurity analyst Allan Liska of Recorded Future praised the move, saying:
“You’re cutting off one of the arms of the scam ecosystem… call centers can’t operate without the infrastructure to process victims.”
The sanctions were issued by the Office of Foreign Assets Control (OFAC) and aim to freeze U.S.-connected assets and prohibit transactions with the sanctioned entities.
