A Chinese criminal organization linked to fentanyl precursor trafficking issued a fraudulent cryptocurrency token impersonating the legitimate ZKsync brand, operating through a shell company in Japan to defraud victims worldwide of at least hundreds of millions of yen, a figure The Block, summarizing the Nikkei reporting, described as exceeding $1 million, according to a Nikkei Asia investigation. The scheme connected a Wuhan-based chemical manufacturer, a Japan-registered front company, and a network of darknet drug proceeds laundered through on-chain transfers to sanctioned entities.

The Fake Token and the Shell Company

The fraudulent token, labeled "zksync.jp," was created in 2023 by a Chinese national based in Hong Kong. It was designed to mimic ZKsync, a widely used Ethereum Layer 2 network built by Matter Labs that uses zero-knowledge proof technology to process transactions faster and at lower cost than the Ethereum mainnet. ZKsync's global profile rose sharply after the network conducted a major token airdrop in June 2024 to 695,232 wallets, generating extensive media coverage and making the brand a prominent target for impersonation. The ".jp" suffix in the token name corresponds to Japan's country-code internet domain, which requires a registered Japanese address to obtain. That requirement gave the scam an air of geographic credibility, and Japan's global reputation for regulatory compliance likely made the branding more convincing to international buyers.

The operation ran through Firsky Co. Ltd., a shell company incorporated in Naha, Okinawa in June 2021 and later relocated to Nagoya in September 2022. Both Nikkei's investigation and Bellingcat's independent reporting confirmed that Firsky and Hubei Amarvel Biotech, a Wuhan manufacturer charged by the U.S. Drug Enforcement Administration in June 2023 for exporting fentanyl precursor chemicals, were effectively the same organization. The two entities shared salespeople, phone numbers, websites, and business certifications. Firsky was liquidated in July 2024.

On-Chain Trail and Sanctions Links

Nikkei built a custom blockchain analytics program to trace wallet activity tied to the Firsky and Amarvel network. That analysis documented more than 120 suspicious transactions between linked wallets and entities sanctioned by the U.S. Office of Foreign Assets Control (OFAC), beginning in October 2022. In some of the wallets examined, roughly 40 percent of incoming funds originated from vendors selling dangerous drugs through darknet markets. U.S. authorities seized approximately $900,000 in cryptocurrency from accounts connected to the network.

The case also intersects with the Wuhan Yuancheng Group, a separate OFAC-sanctioned Chinese chemical company, though the precise nature of that intersection has not been fully established and does not represent a confirmed direct operational link between the two networks. The U.S. government is offering a $5 million reward for information leading to the arrest of that group's top executive.

Xia Fengzhi, described in U.S. court documents as "the boss in Japan," is accused of directing logistics, approving large transactions, and receiving cryptocurrency payments from drug sellers while living in Japan. His current location is unknown. Two Amarvel executives convicted in February 2025, Qingzhou (Bruce) Wang and Yiyi (Chiron) Chen, were sentenced in September 2025 to 25 and 15 years in prison, respectively.

In a statement quoted by Nikkei Asia, the DEA said: "The DEA is looking into the creation and activities of the base, as well as pursuing the leader of these illegal transactions." Jurisdictional limits remain a complication: U.S. investigators depend on cooperation from Japan's National Police Agency, which has not yet officially confirmed that fentanyl flows passed through Japanese territory.

Regional Exposure

The scheme's victim list spanned multiple countries, and its structure highlights specific vulnerabilities in several markets. In India, where roughly 34 million people hold an estimated $3 billion in digital assets, crypto fraud reports surged 773 percent over just eight months, according to blockchain.news. Indian retail investors are active participants in ZKsync's ecosystem and may rely on brand recognition and domain cues rather than on-chain verification to assess a token's legitimacy, though it has not been confirmed that Indian users were among the victims of this specific scheme. Notably, 76 percent of India's crypto fraud volume involves USDT stablecoins moved through informal networks, a pattern consistent with the laundering methods documented in this case.

In Africa, the crypto fraud rate rose 112 percent year-over-year in 2025, the fastest increase of any region globally. Nigeria alone lost roughly $1 billion to the CBEX Ponzi scheme that year. While no African victims have been confirmed in this specific scheme, across markets where blockchain literacy is still developing, brand-mimicry scams carry outsized risk.

Japan itself faces a dual problem. Its compliance reputation made it attractive as an operational base for the network, while its domestic crypto market, with more than 13 million registered user accounts, remains a target. Japan's Financial Services Agency updated its anti-money laundering guidelines as of March 2026 and is working to move crypto oversight from the Payment Services Act to the stricter Financial Instruments and Exchange Act, which would impose tighter token disclosure and insider trading rules.

What Comes Next

The zksync.jp case fits a broader documented pattern. The Chainalysis 2026 Crypto Crime Report identifies Chinese money laundering networks as a dominant force in illicit on-chain activity, offering laundering services for drug trafficking proceeds, fraud, and sanctions evasion. Global crypto scam losses reached a record $17 billion in 2025, with impersonation scams rising approximately 1,400 percent year over year.

ZKsync has faced sustained attacks on its brand: a compromised admin account led to the theft of roughly $5 million in ZK tokens in April 2025, and its official account on X (formerly Twitter) was hacked a month later to promote fake SEC probe claims and facilitate malicious airdrops. Matter Labs has not issued a public statement specifically addressing the "zksync.jp" token. Verse Press has sought comment and will update this article upon response. Readers should note that no independent token contract address for the fake token has been confirmed through public blockchain explorers at time of publication.