Case Study

From Sanctioned Entity to Crime Network: Investigating Prince Group with AnChain Data MCP

January 29, 2026

How Model Context Protocol (MCP) tools on AnChain.AI platform can transform a complex blockchain investigation from weeks of manual work into a comprehensive analysis completed in minutes

The Case: Chen Zhi and the Prince Group

In late 2024, Chen Zhi (also known as Vincent Chen), the head of Prince Group, was arrested and charged with operating one of the largest pig butchering operations in history, a criminal enterprise estimated to have defrauded victims of over $15 billion. Read our Prince Group empire blog for details.

Pig butchering scams are sophisticated romance fraud schemes where criminals build trust with victims over weeks or months, then convince them to invest in fake cryptocurrency platforms. The victims' funds are stolen, and the criminals disappear. Chen Zhi's operation was particularly brazen, operating across multiple jurisdictions and using a complex network of shell companies and cryptocurrency addresses to launder the proceeds.

The Prince Group, based in Cambodia with operations spanning Hong Kong, the British Virgin Islands, and other jurisdictions, was designated as a Transnational Criminal Organization (TCO) by the US Treasury's Office of Foreign Assets Control (OFAC). Chen Zhi himself was added to sanctions lists by both the United States and United Kingdom.

Read our Prince Group empire blog for details.

But here's the critical question: How do you investigate and map a criminal cryptocurrency network when you only have a name and a company?

This is where blockchain intelligence and modern investigation tools become essential, and where AnChain.AI's MCP servers demonstrate their power.

The Challenge: From Name to Network

Traditional financial investigations rely on bank records, wire transfers, and paper trails. Cryptocurrency investigations are fundamentally different. When you're dealing with blockchain transactions, you need to:

  1. Identify cryptocurrency addresses associated with sanctioned entities
  2. Screen those addresses for risk factors and sanctions compliance
  3. Analyze transaction patterns to understand money flows
  4. Map network connections between addresses
  5. Trace funds through complex laundering schemes
  6. Identify new addresses that may be connected but not yet sanctioned

For the Chen Zhi investigation, we started with just a name and a company. The challenge was to find his cryptocurrency addresses, understand how they were being used, and map the entire criminal network.

The Solution: AnChain MCPs in Action

AnChain.AI provides a suite of MCP servers that enable AI assistants and automated systems to perform comprehensive blockchain investigations. These tools integrate directly into investigation workflows, allowing analysts to query blockchain data, screen addresses, and trace transactions programmatically.

Let’s dive into how our sanctions screening agent was able to leverage AnChain Data MCP to build a complete picture of Chen Zhi's cryptocurrency operations:

Step 1: Sanctions Screening

The agent  started by screening Chen Zhi's name against global sanctions databases. This immediately revealed:

  • OFAC Designation: Chen Zhi is listed as a Specially Designated National (SDN) under the Transnational Criminal Organization program
  • UK HMT Designation: Also sanctioned under the UK's Human Rights program
  • Multiple Identities: The screening revealed aliases (Vincent Chen), multiple passport numbers, and citizenship in three countries (Cambodia, Cyprus, Vanuatu)
  • Associated Entities: The search also identified multiple Prince Group entities, all sanctioned

Key Finding: The sanctions screening returned 10 Bitcoin addresses directly associated with Chen Zhi in the OFAC SDN listing. This is critical intelligence because these addresses are now legally blocked for all US persons and entities.

  1. bc1q9kja7t2zxz0ze4lcgxf0l07pygpc69ws528lj9
  2. bc1qw75cxmxz4e2v265mue9wmqgq2m0qdyr25l2ufl
  3. 386sPhHBbLidzPnoxUH74jiiYkHYtobefQ
  4. bc1qw0pswznckx7s6tjmd2f5hrx4q6kc5nyrdxku50
  5. 374RguZDMNW5Zh5ouW3KhKDcrerKusmsuk
  6. bc1qnq3pzsw3elkecrw8pqrz70r7zuse6cwyxa6dhc 
  7. bc1qeth6n6ryxexvkx34wnx3nuynun4474h3j0gkhw 
  8. 35irs2AU6pVgenYbWvMRz22avDBLC9XMkd
  9. bc1qu4p4eynzu8vwwcv0yxq74gth00exjyech05uf0
  10. bc1q2we5eqjj8je6lz9xwjattpc3pn4jejc5h0s70f

Why This Matters: AnChain's sanctions screening doesn't just check names, it returns the actual cryptocurrency addresses associated with sanctioned entities. This is data that's often buried in PDFs or spreadsheets, but AnChain makes it immediately queryable and actionable.

Step 2: Activity Analysis

This is where AnChain's unique intelligence capabilities really shine. The agent used the activity screening MCP to reveal detailed transaction patterns for each address:

Address #4: The Central Hub

One address stood out immediately: bc1qw0pswznckx7s6tjmd2f5hrx4q6kc5nyrdxku50

Activity Profile:

  • Received from unaffiliated wallets: 517 transactions
  • Total inbound volume: ~$1.52 billion USD
  • Sent to sanctioned wallets: 9 transactions totaling ~$1.03 billion USD
  • Sent to unaffiliated wallets: 10 transactions totaling ~$497.12 million USD

What This Tells Us:

  1. This is the primary collection point for the operation
  2. Funds are being received from hundreds of different sources
  3. The address then distributes funds to other sanctioned addresses and to unaffiliated wallets (likely for cashing out)
  4. Trace analysis links upstream funding to a CoinJoin mixing service, consistent with deliberate source obfuscation.

Address #1: The Distribution Network

Another address, bc1q9kja7t2zxz0ze4lcgxf0l07pygpc69ws528lj9, showed a different pattern:

  • Received from unaffiliated wallets: 120 transactions
  • Primary source: A single address (1GX28yLjVWux7ws4UQ9FB4MnLH4UKTPK2z) sending regular transfers of 25-34 BTC
  • Sent to unaffiliated wallets: 10 transactions, including multiple 400-500 BTC transfers

Pattern Recognition: The consistent source address and regular transfer amounts suggest an automated collection system, possibly a fake exchange or investment platform collecting funds from victims.

Step 3: Network Mapping

The attribution screening revealed the transaction flow patterns, showing how funds move through the network:

Key Network Structure Identified:

  1. Tier 1 (Collection): Addresses receiving from unaffiliated sources
    • Address #1: Receives regular deposits from 1GX28yLjVWux7ws4UQ9FB4MnLH4UKTPK2z
    • Address #4 (Primary Hub): Receives from 517 unaffiliated sources and funnels activity through the same recurring deposit pattern
  2. Tier 2 (Distribution Nodes): Addresses receiving from other sanctioned addresses and redistributing
    • Address #7: Receives from Address #4 and sends large transfers to unaffiliated wallets
    • Address #10: Receives from Address #4 and sends large transfers to unaffiliated wallets
  3. Tier 3 (Final Distribution): Large transfers to unaffiliated wallets consistent with cash-out activity
    • Multiple unaffiliated addresses receiving large BTC transfers (including 4,999 BTC transfers)

Inter-Address Connections:

  • Multiple addresses show transfers to/from 3FoD1f6Tfnq3s8MYHgJqFPWv9cUrtUdBSv (another OFAC-sanctioned address also linked to Chen Zhi)
  • Multiple addresses send to bc1q66y45cq78ke25kz7rpe94l84avt7zetglzeeqg (another OFAC-sanctioned address also linked to Chen Zhi)

AnChain's Analytical Advantage

1. Real-Time Sanctions Data Integration

What Makes This Unique: AnChain's sanctions screening doesn't just query a static database, it integrates with official OFAC and UK HMT sanctions lists and returns structured data including cryptocurrency addresses. When we searched for "Chen Zhi," we didn't just get a "yes, he's sanctioned" response, we got:

  • Full biographical data (aliases, passport numbers, addresses)
  • Associated entities (all the Prince Group companies)
  • The actual Bitcoin addresses (10 addresses ready for blockchain analysis)
  • Risk scores and categorization

This integration saves investigators hours of manual work parsing PDFs and spreadsheets.

2. Mixer and High-Risk Infrastructure Attribution

Unique Capability: Beyond simple sanctions hits, AnChain's trace and attribution tooling can identify high-risk infrastructure tied to laundering. In this case, tracing activity upstream from Chen Zhi's wallet network links funding back to CoinJoin (a Bitcoin mixer). This is a strong indicator of intentional source obfuscation and layering before funds reach the sanctioned wallet cluster.

Why This Matters: It helps investigators and compliance teams:

  • Prioritize cases where obfuscation is intentional (not just noisy activity)
  • Separate operational wallets from upstream laundering infrastructure
  • Generate defensible narratives for SARs, investigations, and asset recovery workflows

3. Pattern Recognition at Scale

The Power of Automation: AnChain's activity screening identified patterns that would be difficult to spot manually:

  • 517 incoming transactions to Address #4 from unaffiliated wallets
  • Regular transfer amounts (25-34 BTC) suggesting automated systems
  • Coordinated transfers between sanctioned addresses on the same dates
  • Large final distributions (4,999 BTC transfers) suggesting cash-out operations

The system automatically categorizes transactions by risk type (sanction, high-risk, unaffiliated) and aggregates volumes, making it easy to spot patterns across thousands of transactions.

4. Network Topology Mapping

Beyond Single Address Analysis: The attribution screening revealed the full network structure:

CoinJoin Mixing Service (Source)

    ↓

Recurring Deposit Address (1GX28y...)

    ↓

[Address #4] ← Primary Hub (~$1.52B received from unaffiliated)

    ↓

    ├─→ [Address #7] (sanctioned) → Unaffiliated (~$434.10M sent)

    ├─→ [Address #10] (sanctioned) → Unaffiliated (~$434.10M sent)

    └─→ [Other Sanctioned Addresses]

This network mapping is critical for:

  • Asset recovery: Understanding where funds ultimately go
  • Network disruption: Identifying all nodes in the operation
  • Future prevention: Recognizing similar patterns in other investigations

AnChain.AI platform viewable link for Prince Group sanctioned entity:  https://ciso.anchainai.com/s/5qpg73lXsxU

The Future of Blockchain Investigations

The Chen Zhi investigation demonstrates what's possible when powerful blockchain intelligence tools are made accessible through modern protocols like MCP. What used to require:

  • Specialized blockchain analysis software
  • Manual data collection and correlation
  • Days or weeks of investigation time
  • Deep technical expertise

Can now be accomplished by:

  • Querying MCP servers from any environment
  • Automated data collection and analysis
  • Minutes of investigation time
  • Natural language or simple API calls

As cryptocurrency adoption continues to grow, so does the need for effective investigation tools. AnChain MCPs provide a scalable, accessible solution that makes comprehensive blockchain investigations possible for teams of all sizes.

Conclusion

The investigation into Chen Zhi and the Prince Group's $15 billion pig butchering operation revealed:

  • 10 sanctioned Bitcoin addresses with confirmed OFAC listings
  • Transaction volumes totaling $2.5+ billion USD across the identified addresses
  • A sophisticated money laundering network with clear operational structure
  • Connections to high-risk infrastructure (including a CoinJoin mixing service)

All of this intelligence was gathered in minutes using AnChain's MCP tools, demonstrating the power of modern blockchain intelligence platforms when integrated into investigation workflows.

For compliance teams, this means faster, more accurate sanctions screening. For investigators, it means comprehensive network mapping in minutes instead of weeks. For financial institutions, it means better risk management and regulatory compliance.

Ready to Start Building?

Sign up for AnChain.ai Data →

What you get:

  • Access to all blockchain intelligence tools via MCP
  • Real-time sanctions screening
  • Risk scoring and attribution analysis
  • Transaction tracing capabilities
  • API documentation and examples

Build Your First Agent Today

  1. Signup for an API key at anchain.ai/data
  2. Install AnChain Data MCP from Github
  3. Configure your preferred agentic platform (Claude, Cursor, etc)
  4. Investigate!

About AnChain.AI

AnChain.AI provides comprehensive blockchain intelligence and compliance solutions. Our MCP servers enable seamless integration of blockchain analytics into any investigation or AML compliance workflow.

Key Capabilities:

  • Real-time sanctions screening
  • Comprehensive risk assessment
  • Transaction pattern analysis
  • Network topology mapping
  • Mixer and high-risk infrastructure attribution

Learn More:

This investigation was conducted using publicly available blockchain data and official sanctions lists. All addresses and transaction hashes are documented in the full investigation report available upon request.