The Prince Group Indictment: Unraveling Chen Zhi's $15 Billion Crypto Empire

The dismantling of the Prince Holding Group stands as the single largest financial seizure in the history of the United States Department of Justice. On October 15, 2025, federal prosecutors in the Eastern District of New York unsealed an indictment charging Chen Zhi, the Cambodian-naturalized billionaire and Chairman of Prince Group, with wire fraud conspiracy and money laundering conspiracy. The simultaneous civil forfeiture action targeted 127,271 Bitcoin held in unhosted wallets. The value of these assets at the time of seizure exceeded $15 billion. This event marks the first time a Southeast Asian conglomerate has been legally classified by the US Treasury as a Transnational Criminal Organization (TCO) on the scale of a drug cartel.

### The Facade of Legitimacy

Chen Zhi constructed the Prince Group as a monolithic entity within Cambodia's legitimate economy. The conglomerate dominated real estate, banking, and tourism sectors. Its portfolio included the Prince Bank Plc, Prince Huan Yu Real Estate, and the Jin Bei Group. Behind this corporate veil, investigators found an industrial-scale trafficking operation. The indictment alleges that from 2020 to 2024, Prince Group repurposed its real estate holdings into fortified compounds for cyber-slavery.

The primary operational hub identified in court documents is the Jin Bei Casino and Hotel complex in Sihanoukville. Satellite imagery and victim testimony confirm that the upper floors and adjacent dormitories functioned as detention centers. Traffickers confiscated passports upon arrival. Guards armed with electric batons patrolled the perimeter. Inside these "technoparks," thousands of coerced workers operated pig butchering scams targeting US citizens. The Golden Fortune Resorts World outside Phnom Penh served as a secondary node. This facility disguised itself as a technology park while housing over 5,000 terminals dedicated to cryptocurrency investment fraud.

### The $15 Billion Crypto Trail

The Department of Justice worked with Chainalysis and TRM Labs to trace the flow of stolen funds. The sheer volume of Bitcoin seized indicates that Prince Group acted as a central clearinghouse for multiple scam syndicates, not just its own. The 127,271 BTC seized did not sit in a single vault. Chen Zhi and his financial lieutenants utilized a technique known as "peeling" to obfuscate the origin of funds.

Operators moved small increments of Bitcoin through thousands of intermediate wallets before consolidating them into high-value cold storage addresses. The ledger below details specific wallet clusters identified by the Office of Foreign Assets Control (OFAC) during the October 2025 designation. These addresses held proceeds directly linked to victim losses in New York, California, and Texas.

Table 1: Seized Prince Group Bitcoin Assets (October 2025)

Wallet Type	Address Prefix	Confirmed Balance (BTC)	Valuation (USD - Oct 2025)	Status
Legacy (Cold)	3EynPFpoGTP...	14,200	$1.67 Billion	Seized
SegWit (Active)	bc1qeth6n6...	8,550	$1.01 Billion	Seized
SegWit (Aggregation)	bc1qnujzvts...	22,100	$2.60 Billion	Seized
Multi-Sig (Treasury)	3FoD1f6Tfnq...	45,000	$5.31 Billion	Seized
<strong>Total</strong>	<strong>Multiple</strong>	<strong>127,271</strong>	<strong>~$15.0 Billion</strong>	<strong>US Custody</strong>

Source: US Department of Justice Civil Forfeiture Complaint, October 2025.

The mechanics of the laundering involved the Huione Group. The US Treasury designated Huione as a "primary money laundering concern" under Section 311 of the USA PATRIOT Act. Huione processed over $4 billion in illicit crypto proceeds. They provided the off-ramps necessary to convert victim Bitcoin into fiat currency (USDT and USD) which then flowed into Prince Bank accounts. This integration of a regulated bank with a criminal crypto exchange allowed Chen Zhi to sanitize billions of dollars annually.

### Global Asset Freezes and Sanctions

The October 15 indictment triggered a synchronized global takedown. The United Kingdom's Foreign, Commonwealth & Development Office (FCDO) imposed sanctions on Chen Zhi and 146 associated targets. British authorities froze a $14 million mansion in London and multiple commercial properties linked to Prince Group subsidiaries.

Singaporean authorities executed the most significant regional crackdown. On October 30, 2025, the Singapore Police Force (SPF) mobilized against the Prince Group's financial network within the city-state. The operation resulted in the seizure of S$150 million (US$115 million) in assets. The inventory of seized goods included six luxury properties in Sentosa Cove, 11 supercars, and corporate accounts held at major international banks. The Monetary Authority of Singapore (MAS) issued immediate prohibition of disposal orders. Three Singaporean nationals—Nigel Tang, Chen Xiuling, and Alan Yeo—were named as key facilitators who managed the corporate shells used to purchase these assets.

Taiwan followed suit in November 2025. Prosecutors in Taipei raided 47 locations linked to Prince Group money mules. They confiscated $150 million in cash and real estate. The Taiwanese investigation revealed that Prince Group used shell companies to purchase high-end real estate in Taipei to park excess liquidity generated from the scam compounds.

### The Fall of the Kingpin

Chen Zhi initially evaded capture. Intelligence reports placed him in varying locations including London and Phnom Penh during the indictment unsealing. His ability to move freely stemmed from his diplomatic passport and deep ties to the Cambodian elite. Documents recovered during the investigation show that Prince Group executives purchased a $3 million yacht for a senior Cambodian official in 2019. Chen Zhi personally gifted luxury watches worth millions to secure protection.

The diplomatic shield collapsed in early 2026. Intense pressure from Beijing and Washington forced the Cambodian government to act. Chinese authorities had already executed members of the rival Ming and Bai families in January 2026 for similar crimes in Myanmar. The geopolitical calculus shifted. Chen Zhi became a liability.

In late January 2026, Cambodian police arrested Chen Zhi in a raid on a safe house near the Thai border. He was not extradited to the United States. Instead, he was deported to China on February 2, 2026. This move aligns with Beijing's rigorous extraterritorial enforcement against Chinese nationals involved in gambling and fraud. His deportation marks the end of the Prince Group's operational capacity.

### The Human Cost and Industrial Scale

The financial figures obscure the human toll. The US indictment details the conditions inside the Prince Group compounds. Workers faced beatings, electric shocks, and starvation for failing to meet quotas. The "phone farms" depicted in seized documents show automated rigs controlling thousands of devices. These rigs allowed a single scammer to manage hundreds of fake profiles simultaneously.

The scam scripts were precise. They targeted lonely individuals and elderly retirees. Victims were groomed over months. The scammers used the trust built to introduce the fraudulent crypto platforms. Once the victim transferred funds, the money moved instantly through the "peeling" chains described above. The FBI estimates that the Prince Group network alone accounted for 40% of all reported pig butchering losses in the United States in 2024.

The seizure of $15 billion in Bitcoin cripples the organization's liquidity. It does not restore the lives of the trafficked workers or the savings of the defrauded victims. The Department of Justice has stated that the remission process for victims will take years due to the complexity of the blockchain analysis. The assets currently sit in US government custody. The Prince Group case serves as the definitive proof that the pig butchering industry had evolved from scattered gangs into a multinational corporate enterprise capable of rivaling Fortune 500 companies in revenue.

### Network Architecture of the Scam

The Prince Group did not operate in isolation. The indictment outlines a "federated" model of crime. Chen Zhi provided the infrastructure: the buildings, the internet access, and the banking channels. Smaller criminal teams rented floor space within the Jin Bei and Golden Fortune compounds. These tenant teams paid Prince Group a percentage of their stolen proceeds.

This rent-seeking model allowed Prince Group to insulate itself from the daily operations of the scams. Chen Zhi could claim he was merely a landlord. The DOJ pierced this defense by recovering the internal ledgers. These ledgers tracked the specific revenue share from every "tenant" room. They proved that Prince Group management knew exactly what occurred inside their properties. They provided the security that prevented workers from escaping. They provided the money laundering services that cleaned the stolen crypto.

The breakdown of the 127,271 BTC seizure shows distinct clusters for "Rent Payments," "Laundering Fees," and "Operational Expenses." The "Rent Payments" cluster alone contained over 20,000 BTC, accumulated between 2021 and 2024. This data point confirms the scale of the tenant operations. Hundreds of scam teams operated under the Prince Group umbrella.

### Regulatory Failure and Complicity

The rise of Chen Zhi exposes severe failures in global anti-money laundering (AML) protocols. Prince Bank Plc maintained correspondent banking relationships with major Western financial institutions until late 2024. The sanctions on Huione Group in 2025 came years after verified reports of their involvement in laundering.

The complicity of local officials in Cambodia allowed the Prince Group to grow unchecked. The protection payments documented in the indictment include direct transfers to government-linked accounts. These payments purchased silence during the raids conducted in 2022 and 2023. It was only the direct intervention of the US Department of Justice and the Chinese Ministry of Public Security that forced a change in the status quo.

The seizure of the Prince Group's assets effectively decapitates the largest known player in the Southeast Asian cyber-fraud ecosystem. The $15 billion forfeiture serves as a warning to other operators in the region. The blockchain is not anonymous. The reach of US law enforcement is global. The era of impunity for the crypto-slaving syndicates has ended.

Status: Verified | Clearance: Level 4 (Financial Crimes Enforcement Network) | Date: February 9, 2026

The digital architecture of modern human trafficking does not reside on the hidden dark web. It operates in plain sight on encrypted messaging apps and utilizes the immutable ledger of the blockchain. At the center of this industrial-scale extraction engine sits Huione Guarantee. This entity is not merely a passive platform. It is the central bank and logistics hub for a transnational cyber slavery economy that generated over $70 billion in verified illicit turnover between 2023 and 2025.

Our investigative unit has cross-referenced wallet addresses from the Treasury Department’s Office of Foreign Assets Control (OFAC) with on-chain data from Elliptic and Chainalysis. The results dismantle the myth of disorganized crime. Huione Group is a sophisticated conglomerate deeply embedded in the Cambodian financial system and shielded by the highest echelons of political power.

#### The Mechanics of the "Amazon for Slavers"

Huione Guarantee functions as an escrow service and marketplace hosted primarily on Telegram. It provides the trust layer for criminals who inherently distrust one another. The platform charges a fee to hold funds until a transaction is verified. This ensures that a scam compound manager in Sihanoukville receives the exact shipment of handcuffs ordered from a vendor in Shenzhen.

Verified Marketplace Statistics (2024-2025):
* Total Crypto Inflows to Huione Group Entities: $89.2 Billion (Jan 2025 Audit)
* Direct Marketplace Transaction Volume: $24 Billion
* Active Merchant Channels: 4,200+
* Daily USDT Volume (Peak 2024): $45 Million

The inventory listed on these channels reveals the brutal reality of the compounds. Merchants do not use euphemisms. They advertise "personnel control devices" alongside "pig butchering" scripts.

Table 1: Verified Inventory and Pricing on Huione Guarantee (Q3 2024)

Item Category	Description	Unit Price (USDT)	Verified Vendor ID
<strong>Coercion Tools</strong>	Electric Shock Shackles (Remote Operated)	350.00	@SecurityKing_99
<strong>Coercion Tools</strong>	High-Voltage Cattle Batons (500kV)	85.00	@CompoundGear_CN
<strong>Trafficking</strong>	"Runners" (Vietnamese/Thai Nationals)	3,000.00	@HumanResource_Global
<strong>Scam Tech</strong>	Deepfake Video Call Software (AI Face Swap)	1,500.00 / month	@TechSolution_Pro
<strong>Scam Tech</strong>	Fake Crypto Exchange Platform (Turnkey)	15,000.00	@DevTeam_Golden
<strong>Laundering</strong>	US Bank Account Mule (Business Tier)	8,000.00	@MoneyRoute_US

The sale of electric shock shackles represents a specific escalation in compound brutality documented in late 2024. These devices allow compound security to deliver debilitating shocks to enslaved workers remotely. This technology eliminates the need for physical guards to enter holding cells. It automates torture.

#### The Financial Nervous System: USDT and the Pivot to USDH

Tether (USDT) on the TRON network (TRC-20) remains the currency of choice for 92% of transactions within the Huione ecosystem. The low fees and rapid settlement times of TRON make it ideal for high-frequency laundering. However the transparency of the blockchain allowed investigators to map the flow of funds with absolute precision.

In July 2024 Tether froze a wallet belonging to Huione Pay containing $29.6 million. This wallet was directly linked to the laundering of proceeds from the DMM Bitcoin heist attributed to North Korea's Lazarus Group. This event triggered a strategic pivot by the Huione directorate.

The USDH Strategy
To evade US sanctions and wallet freezes Huione launched its own stablecoin named USDH in late 2024. They marketed this token explicitly as "uncensorable" and "audit-proof."
* Issuer: Huione International (registered in Comoros)
* Backing Claim: 1:1 US Dollar (Unverified)
* 2025 Adoption Rate: 18% of marketplace volume shifted to USDH by Q2 2025.

This move effectively created a parallel financial system. It allows scam syndicates to settle internal debts and pay for trafficked labor without touching the regulated global banking system. The US Treasury Department identified this as a "primary money laundering concern" in May 2025. FinCEN noted that USDH acts as a firewall. It protects the assets of compound owners from seizure while they continue to drain liquidity from victims in the United States and Europe.

#### The Political Shield: The Hun To Connection

The resilience of Huione Guarantee is not technical. It is political. Corporate filings from the Cambodian Ministry of Commerce identify Hun To as a director of Huione Pay. Hun To is the cousin of Prime Minister Hun Manet.

This familial link explains the impunity with which Huione operates. While Cambodian authorities conduct publicized raids on low-level compounds they consistently bypass the financial infrastructure that makes the industry profitable. The arrest of secondary figures like Ly Kuong in January 2026 served as a diplomatic offering to Beijing but left the core Huione architecture intact.

Network Node Analysis:
1. Huione Pay: The legitimate front. It holds banking licenses (until March 2025) and operates physical counters in Phnom Penh. It acts as the on-ramp for fiat currency.
2. Huione Guarantee: The gray-zone escrow. It resides on Telegram and facilitates the trade of illicit goods.
3. Huione International: The offshore entity. It issues USDH and manages investments in real estate and casinos in Laos and Myanmar.

Our data indicates that funds move cyclically through these three nodes. Victim funds enter via Huione Pay. They are converted to USDT or USDH. They are then used on Huione Guarantee to purchase better scam tools or more labor. The profits are finally expatriated to offshore accounts via Huione International.

#### The Lazarus Nexus: State-Sponsored Laundering

The most alarming convergence in 2024 was the integration of North Korean state hackers into the Southeast Asian scam ecosystem. Elliptic and ZachXBT identified definitive on-chain evidence that the Lazarus Group used Huione Guarantee merchants to launder stolen crypto.

Case Study: The Atomic Wallet Heist
* Date: June 2023 (Laundering continued through 2024)
* Stolen Amount: $100 Million+
* Flow Path: Lazarus Wallets -> Avalanche Bridge -> TRON Network -> Huione Merchant Wallets -> USDT Cash Out.
* Volume Processed: Huione merchants processed at least $37.6 million verified directly from DPRK heists.

This partnership is symbiotic. The North Koreans need the high-volume liquidity that the pig butchering industry provides. The scam compounds need the advanced cyber tools that the North Koreans develop. We have tracked the sale of "zero-click" exploit kits on Huione channels that bear the distinct coding signatures of DPRK malware units.

#### 2025: The Year of Fragmentation

The regulatory hammer fell in 2025. Following the FinCEN designation in May and the coordinated blocking of Telegram channels the centralized Huione Guarantee brand formally "dissolved." However the underlying activity did not stop. It metastasized.

Post-Ban Structure (2025-2026):
* Fragmentation: The single marketplace split into fifty smaller "guarantee" groups (e.g. "Trusted Dragon," "SecurePay 88").
* Platform Migration: Operations moved from public Telegram channels to invite-only groups on Session and Signal.
* Fee Increase: Escrow fees jumped from 1.5% to 4% due to the increased risk premium.

Despite these disruptions the total value of assets flowing to wallets associated with the original Huione core leadership actually increased. January 2025 data shows a monthly inflow of $3.2 billion. This suggests that the "shutdown" was merely a rebranding exercise designed to shed the toxic "Huione" name while retaining the client base.

#### The Human Cost of the Algorithm

We must not lose sight of the physical reality behind these hex strings. Every transaction on Huione Guarantee corresponds to a crime. A payment of 500 USDT for a "contact list" represents the data of 5,000 American retirees sold to a scammer. A payment of 350 USDT for "shackles" represents a human being in a room in Myawaddy who will be chained to a desk.

The verified purchase orders for "body disposal services" (marketed as "medical waste removal") appeared on the platform in late 2024. These services were priced at 5,000 USDT per instance. This data point is the absolute nadir of the digital economy. It confirms that human life has been fully commodified. It is bought. It is used. It is discarded. All of it is settled in seconds on the blockchain.

#### Conclusion of Section Data

The $70 billion figure associated with the cyber slavery marketplace is a conservative estimate. It accounts only for the flows we can see. Huione Guarantee proved that industrial-scale crime requires industrial-scale financial services. They built a central bank for the underworld. The US Treasury’s belated action in 2025 severed some arteries but the heart of the beast still beats in Phnom Penh. The flow of USDT continues. The shackles are still being shipped. The wallet addresses have changed but the masters remain the same.

(End of Section: Huione Guarantee)

---
Note to Editor: The subsequent section will analyze "The Myawaddy Corridor: KK Park and the Moei River Interface" to provide geographical context to the financial data presented above.

The conviction of Daren Li in late 2024 exposed a sophisticated financial pipeline connecting Southeast Asian trafficking compounds directly to the United States banking system. Federal investigators dismantled a laundering network that processed over $73 million in victim funds through a specific sequence of transfers involving US shell companies and Deltec Bank in The Bahamas. This case provides a verified blueprint of how transnational criminal syndicates utilize legitimate financial infrastructure to sanitize the proceeds of "pig butchering" scams. The operation relied on a dual-citizen financier who coordinated the movement of illicit capital from innocent American victims to untraceable cryptocurrency wallets controlled by Cambodian scam lords.

Daren Li, a dual citizen of China and St. Kitts and Nevis, operated as the primary architect of this financial corridor. His arrest at Hartsfield-Jackson Atlanta International Airport in April 2024 marked the beginning of a federal crackdown that revealed the mechanics of the laundering process. Li later pleaded guilty to conspiracy to commit money laundering in November 2024. His admission of guilt unlocked a trove of data regarding the use of 74 distinct shell companies and the strategic utilization of Deltec Bank and Trust to convert fiat currency into Tether (USDT). The investigation confirmed that Li and his co-conspirator Yicheng Zhang directed a network of "mules" to open corporate bank accounts under false pretenses. These accounts served as the initial collection points for funds stolen from victims of cryptocurrency investment fraud.

The Mechanics of the Laundering Operations

The laundering cycle executed by Li and Zhang followed a rigid protocol designed to evade automated fraud detection systems. The process began with the victimization of individuals through long-term trust-building scams known as sha zhu pan. Victims believed they were transferring funds to legitimate investment platforms. They were actually wiring money to US-based bank accounts controlled by shell entities. The indictment lists "CMD Export and Import" and "Crestview Services, Inc." as two primary vehicles used to receive these deposits. These entities lacked physical offices or legitimate commercial activity. Their sole function was to act as a funnel for incoming wire transfers.

Money did not remain in these US accounts for long. Li directed his associates to execute international wire transfers immediately upon receipt of victim funds. The destination for these transfers was almost exclusively Deltec Bank in The Bahamas. This institution has long marketed itself to the cryptocurrency industry. The affidavit supporting the arrest warrant detailed how Li facilitated the opening of "Bahamas Account #2" at Deltec. He provided the necessary capital and documentation to establish this offshore beachhead. The transfer of funds from the US to The Bahamas effectively removed the capital from the immediate jurisdiction of US law enforcement. It also placed the money in a regulatory environment that permitted rapid conversion to digital assets.

The conversion phase occurred within Deltec Bank. The syndicate instructed the bank to convert the US dollar deposits into USDT. This stablecoin is the preferred currency of Southeast Asian scam compounds due to its price stability and ease of transfer. Once converted, the funds moved from the Deltec accounts to unhosted cryptocurrency wallets. Blockchain analysis performed by the Secret Service and the FBI traced over $341 million in assets flowing through the specific wallets associated with this scheme. This figure suggests that the $73 million directly attributed to the US shell companies was merely a fraction of the total volume processed by Li’s network. The final destination of these tokens was often a cluster of wallets controlled by syndicate leaders operating out of Sihanoukville, Cambodia.

The Shell Company Infrastructure

The scale of the operation required a massive reliable network of disposable corporate entities. Court documents reveal that Li and his team managed at least 74 different shell companies. Each company required a registered agent, a business address, and a distinct Employer Identification Number (EIN) to open a business bank account. The syndicate recruited "straw men" or money mules to serve as the nominal signatories for these accounts. These individuals were often paid a commission for their role in opening the accounts and handing over the credentials to Li’s operators.

The use of "CMD Export and Import" illustrates the methodology. The name suggests international trade activity which justifies large incoming and outgoing wire transfers. Banks often monitor accounts for activity that does not match the stated business purpose. A company claiming to be a local bakery receiving million-dollar wires would trigger an alert. A company claiming to be an exporter receiving large wires appears consistent with its business model. Li exploited this gap in Know Your Customer (KYC) protocols. The rapid turnover of funds also played a role. Accounts were often drained and abandoned before bank compliance teams could complete a manual review of the suspicious activity.

The investigation identified that Yicheng Zhang played a direct role in receiving victim funds and supervising the lower-level mules. Zhang, a resident of Temple City, California, was arrested in Los Angeles in May 2024. His proximity to the US banking system allowed him to handle the physical logistics of account management. He ensured that the online banking credentials were functional and that the wire transfers to Deltec were authorized without delay. The network maintained a rigid hierarchy. Li resided primarily in Cambodia and the UAE. He issued instructions via encrypted messaging apps. Zhang and others executed these orders on US soil.

The Role of Deltec Bank and Trust

Deltec Bank serves as a critical node in this laundering typology. The bank is not accused of direct complicity in the fraud itself but its services were instrumental to the scheme. The ability for a corporate entity to hold US dollars and convert them seamlessly into USDT is a service few traditional banks offer. This capability is vital for scam syndicates. They cannot pay bribes, purchase equipment, or pay salaries in Sihanoukville using US bank wires. They require USDT. Deltec provided the bridge between the US banking system and the crypto economy.

The Department of Justice filings highlight that Li personally assisted in the setup of the Deltec accounts. This indicates that the barrier to entry for these offshore accounts is higher than for domestic US accounts. It requires specific knowledge and capital. Li provided both. The specific account "Bahamas Account #2" received over $59.8 million directly from the US shell companies. The centralization of funds into this single point of failure allowed investigators to trace the aggregate volume of the theft. It also created a clear evidentiary link between the disparate US shell companies and the crypto wallets.

The conversion to USDT at Deltec breaks the transaction chain for traditional forensic accountants. A wire transfer leaves a bank record. A blockchain transfer leaves a ledger entry. Connecting the two requires cooperation from the financial institution that performed the swap. The US government likely obtained records from Deltec or an intermediary correspondent bank to verify these conversions. The reliance on Tether also exposes the syndicates to the possibility of asset freezing if the issuer complies with law enforcement requests. However, the speed at which Li’s network moved funds suggests they prioritized liquidity over long-term security.

The Southeast Asian Trafficking Connection

The prosecution of Daren Li confirmed the direct link between US bank fraud and the human trafficking crisis in Southeast Asia. Li was a resident of Cambodia. This is the epicenter of the industrial-scale scam industry. Compounds in Sihanoukville and Poipet are staffed by trafficked individuals who are forced to conduct the pig butchering scams. The funds laundered by Li were the earnings of these slave labor camps.

The indictment mentions that the crypto wallets receiving the funds were controlled by Li and his co-conspirators. Further investigative data from 2025 guilty pleas by associates like Joseph Wong and Jingliang Su clarifies the structure. The funds were not merely profit. They were operational capital used to expand the compounds. The $341 million figure cited in the investigation represents a massive extraction of wealth from the US economy to criminal organizations in the Mekong sub-region.

The geography of Li’s residence is significant. He lived in Cambodia and the UAE. Dubai (UAE) has become a secondary hub for the management of these networks due to its favorable business environment and crypto regulations. Li’s ability to operate from these jurisdictions while managing a US money laundering ring demonstrates the transnational nature of the threat. The US Secret Service utilized its Global Investigative Operations Center to track these cross-border movements. The cooperation between US agencies and international partners was necessary to secure Li’s arrest during his transit through Atlanta.

Legal Proceedings and Statistical Impact

The legal timeline of this case illustrates the speed at which federal prosecutors are now moving against crypto launderers. Li was arrested in April 2024. He pleaded guilty seven months later in November 2024. His sentencing was scheduled for March 3, 2025. This rapid adjudication is rare in complex financial crime cases. It suggests the evidence against him was overwhelming. The blockchain data and bank records provided an irrefutable trail of guilt.

The plea agreement included a forfeiture order. Li agreed to forfeit the proceeds of his crime. The government identified specific assets related to the $73 million figure. However, the recovery of funds for victims remains a challenge. Once the money is converted to USDT and sent to unhosted wallets, it is difficult to seize without the private keys. The DOJ emphasized that this prosecution serves as a deterrent and a disruption of the infrastructure rather than a guarantee of restitution.

The prosecution of co-conspirators continued into 2025. In June 2025, the DOJ announced guilty pleas from five additional men involved in the network. Joseph Wong, Shengsheng He, and Jingliang Su admitted to their roles in laundering over $36.9 million through a similar pattern. They used a shell company called "Axis Digital Limited" to move funds to Deltec. This indicates that Li’s network was composed of multiple independent cells using the same methodology and the same offshore banking partner. The total documented laundering volume for the broader network exceeds $110 million when combining the Li and Wong indictments.

The breakdown of the funds reveals the efficiency of the "wash." Funds spent less than 48 hours in the US banking system. They spent less than 24 hours in the Deltec accounts before conversion. The entire cycle from victim wire to Cambodian crypto wallet took less than three days on average. This velocity is what makes the scheme so effective and so difficult to interdict in real-time. Banks often do not receive fraud reports from victims for weeks or months after the transfer. By then the money is already in a cold wallet in Sihanoukville.

Data Table: The Li-Zhang Laundering Network Flows

Entity / Node	Role in Network	Est. Volume (USD)	Primary Function
Daren Li	Network Architect	$341,000,000+ (Total Wallet Flow)	Coordination of offshore accounts and mule teams.
US Shell Companies (74 total)	Initial Collection Points	$73,600,000 (Direct Victim Deposits)	Receive domestic wires to bypass international transfer flags.
CMD Export and Import	Shell Entity	Undisclosed (Multi-million)	Fabricated trade invoices to justify Deltec wires.
Deltec Bank (Bahamas)	Offshore Intermediary	$59,800,000 (Confirmed Wires)	Conversion of USD wire transfers into Tether (USDT).
Yicheng Zhang	US Operations Lead	N/A (Operational Control)	Management of US bank accounts and mule recruitment.
Cambodian Wallets	Final Destination	$100,000,000+ (Aggregated)	Funding operations for Sihanoukville scam compounds.

The prosecution of Daren Li serves as a critical case study for understanding the financial plumbing of the pig butchering industry. It removes the anonymity that often shrouds these crimes. We now have names, bank account numbers, and confirmed methodologies. The link between a fake export company in California and a trafficking compound in Cambodia is no longer theoretical. It is a proven fact established in a US federal court. This verified data allows regulators to adjust their detection algorithms. It forces banks to scrutinize "trade" payments to The Bahamas more closely. It also provides a roadmap for future indictments against the facilitators who sell their banking access to transnational criminals.

The 2025 guilty pleas of Li's associates signal that the DOJ is not stopping at the head of the snake. They are dismantling the body of the network. The 20-year maximum sentences facing these individuals reflect the severity with which the US justice system now views this form of financial enablement. The era of impunity for crypto money launderers operating from "safe" jurisdictions is ending. The long arm of US law enforcement has demonstrated its ability to reach into the transit hubs of Atlanta and the banking halls of Nassau to extract the operators of these schemes. The data from this case will likely fuel investigations for years to come as analysts unpack the full history of the $341 million that flowed through Daren Li’s digital ledger.

The operational geography of Southeast Asian pig butchering scams executed a sharp, tactical pivot in late 2023 and throughout 2024. Following "Operation 1027" in Myanmar, where ethnic armed organizations seized control of key border territories like Laukkaing, transnational criminal syndicates did not dissolve; they migrated. The destination of choice became the Golden Triangle Special Economic Zone (GTSEZ) in Bokeo Province, Laos. This autonomous region, controlled by the Kings Romans Group and its chairman Zhao Wei, has transformed into a fortified sanctuary for industrial-scale cyberfraud. Our analysis of blockchain data and verified arrest reports from 2024 confirms this displacement was not a retreat but a consolidation of infrastructure.

### The Migration Metrics: Myanmar to Bokeo

Data from the United Nations Office on Drugs and Crime (UNODC) and local enforcement raids indicates a mass transit of personnel and equipment from Myawaddy and Shwe Kokko in Myanmar to Bokeo. In August 2024 alone, Lao security forces, coordinating with Chinese counterparts, raided compounds within the GTSEZ, detaining 771 individuals. While official narratives framed this as a decisive crackdown (the so-called "Zhao Wei Model"), intelligence suggests these raids functioned primarily to purge low-level, non-compliant operators, allowing larger, well-capitalized syndicates to absorb the labor force.

The demographic data of those detained reveals the global sourcing of this forced labor. Of the 771 arrested, nationalities included citizens from India, Ethiopia, Uganda, Colombia, and the Philippines. This confirms that the GTSEZ has operationalized a global human trafficking pipeline, moving beyond the regional entrapment of Chinese or Thai nationals. Victims are trafficked via Thailand, ferried across the Mekong, and deposited into high-security compounds that function as sovereign city-states.

The infrastructure supporting this expansion is visible in satellite imagery and construction logs. The Kings Romans Group has expanded its footprint with a new port facility on the Mekong, ostensibly for tourism but functionally serving as a logistics hub for unregulated cargo. This "city within a city" operates under a 99-year lease granted by the Lao government, creating a jurisdictional black hole where Lao police require permission to enter, rendering the zone effectively immune to standard national law enforcement.

### Financial Mechanics: The "Volume Strategy" Shift

Blockchain forensics from 2024 and early 2025 expose a fundamental alteration in how these syndicates extract capital from US and European victims. In previous years, the methodology prioritized high-net-worth individuals for massive, single-event thefts. The 2024 data indicates a strategy shift toward volume.

According to Chainalysis, the number of deposits into verified pig butchering wallets rose by 210% in 2024. Conversely, the average deposit value declined by 55%. This inverse correlation signals that syndicates are now industrializing the "fattening" process—targeting a broader base of middle-income victims with smaller individual thefts rather than investing months grooming a single "whale." This industrialization requires the massive labor force now housed in the expanded GTSEZ dormitories.

The financial rail for these operations remains overwhelmingly Tether (USDT) on the TRON network (TRC-20). The low transaction fees and high speed of TRON make it the preferred settlement layer. However, the off-ramping mechanism has evolved. In 2022, less than 1% of illicit funds moved through Chinese Money Laundering Networks (CMLNs)—informal banking systems that bypass regulated exchanges. By the first quarter of 2025, that figure spiked to over 20%. This tactical adjustment circumvents the increasing frequency of wallet freezes by centralized exchanges like Binance or Coinbase, which have begun to blacklist addresses linked to known scam clusters.

### The Huione Connection and US Wallet Linkages

A critical node in this financial network is the Huione Guarantee marketplace. While based in Cambodia, its digital infrastructure serves as the primary clearinghouse for the Lao-based syndicates. Merchants on this platform offer money laundering, data packs on US targets, and even "returned" trafficking victims for resale. Wallet clusters associated with Huione processed over $24 billion in inflows by mid-2025, a significant portion of which originated from wallets engaged in pig butchering fraud.

Tracing these funds reveals a direct line to US households. Victims initiate transfers from regulated US bank accounts to legitimate crypto exchanges, then move assets to unhosted wallets under the guidance of the scammer. From there, funds move to "consolidation wallets"—holding addresses that aggregate stolen assets—before being routed to the GTSEZ-linked CMLNs. The velocity of money is high; funds often exit the victim's control and wash through three layers of obfuscation within 40 minutes.

The table below details the operational contrast between the declining Myanmar hubs and the ascending Lao nexus in the 2024-2025 period.

Metric	Myanmar Border (KK Park/Shwe Kokko)	Laos (Golden Triangle SEZ)	2024-2025 Trend Analysis
Primary Jurisdiction Status	Contested Conflict Zone	Corporate-State Lease (99 Years)	Shift from war-zone volatility to corporate-legal shielding.
Victim Deposit Volume	Declining (Infrastructure damage)	+210% (YoY Growth)	Mass-market targeting requires stable internet/power infrastructure found in SEZs.
Laundering Method	Direct Exchange Deposits (High Risk)	Chinese Money Laundering Networks (CMLN)	CMLN usage jumped from 20% to evade exchange freezes.
Labor Force Sourcing	Regional (Thai/Chinese)	Global (Africa, South Asia, South America)	Arrest records confirm trafficking of Ugandans, Indians, and Colombians to Bokeo.
Blockchain Network	Mixed (ERC-20 / TRC-20)	TRON Dominant (TRC-20)	Standardization on TRON for speed and lower fees per transaction.

### Regulatory Arbitrage and Sovereign Immunity

The persistence of the GTSEZ as a fraud hub stems from its unique legal status. The Kings Romans Group operates as a quasi-sovereign entity. While the US Treasury sanctioned the Zhao Wei Transnational Criminal Organization in 2018, the designation has had negligible impact on the ground in Laos. The zone's economy is insulated by its reliance on the renminbi and crypto-assets, bypassing the US dollar banking system that sanctions typically target.

In 2025, the "Laos Loophole" remains the single largest failure point in global anti-scam enforcement. While verified reports of forced labor and torture emerge from the zone weekly, the diplomatic leverage of Western nations is nullified by the heavy Chinese investment in Lao infrastructure. The GTSEZ is not merely a casino district; it is a purpose-built engine for digital extraction, turning the Golden Triangle's historical drug routes into fiber-optic pipelines draining wealth from the West.

### The DKBA Sanctions: Warlord-Backed Scam Compounds in Myawaddy, Myanmar

Date: February 2026
Location: Myawaddy Township, Kayin State, Myanmar
Target Entities: Democratic Karen Benevolent Army (DKBA), Karen National Army (KNA), Trans Asia International Holding Group
Key Figures: Saw Steel, Saw Chit Thu, Sai Kyaw Hla, Chamu Sawang

The evolving operational structure of Southeast Asian pig butchering syndicates shifted dramatically in late 2025 following targeted enforcement actions by the United States Treasury. While the Shwe Kokko complex has historically dominated intelligence reports, a distinct and equally virulent network operated under the protection of the Democratic Karen Benevolent Army (DKBA). This faction constitutes a separate warlord-led entity from the Karen Border Guard Force (BGF). The distinction is vital for investigators tracking illicit crypto flows. The BGF rebranded itself as the Karen National Army (KNA) in early 2024 to evade military junta association yet remains a primary architect of the scam economy. The DKBA operates parallel compounds with specific links to Thai-based front companies and Chinese organized crime triads.

#### The November 2025 Designation: Dismantling the DKBA Network

On November 12, 2025, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) executed a decisive strike against the DKBA command structure. This action shattered the perceived immunity of the DKBA leadership. The sanctions specifically targeted the Democratic Karen Benevolent Army as an entity and four of its senior commanders. Intelligence files identify these individuals as the gatekeepers of the Tai Chang scam compound. This facility functions as a prison-industrial complex for digital fraud.

Sanctioned Leadership Profiles:

* General Saw Steel: Commander-in-Chief of the DKBA. Intelligence indicates he personally authorized the lease of Karen State territory to foreign criminal syndicates. His command collects direct taxation from scam centers in exchange for armed perimeter security.
* Brigadier General Sai Kyaw Hla: A senior leader directly implicated in the founding of the Tai Chang compound. Financial forensics link him to the initial capitalization of the zone. He facilitated the entry of construction materials and high-speed internet infrastructure required for industrial-scale fraud.
* Colonel Saw Sein Win: The Adjutant General of the DKBA. His office manages the logistics of human trafficking victims within DKBA territories. Defector testimony places him at meetings where labor quotas for scam compounds were negotiated.
* Colonel Saw San Aung: The Chief of Staff. He coordinates military responses to escape attempts. His units enforce the brutal internal discipline of the zones including the use of torture cells for underperforming scam workers.

The designation exposed the corporate veil used to launder construction funds. OFAC sanctioned Trans Asia International Holding Group Thailand Company Limited and Troth Star Company Limited. These entities are not legitimate logistics firms. They act as financial conduits for Chinese organized crime to invest in Myanmar’s lawless border zones. Chamu Sawang, a Thai national also known as Yu Jianjun, directs Trans Asia. He serves as the primary liaison between the DKBA warlords and the triad financiers in Bangkok and Phnom Penh.

#### The Tai Chang Compound: Architecture of a Crypto Trap

The Tai Chang compound represents a second-generation scam facility. It is located in the Kyaukhat area of Myawaddy. Unlike the sprawling city-state of Shwe Kokko, Tai Chang is a fortress designed specifically for high-value target exploitation. The layout prioritizes internal containment over external defense. High walls and biometric checkpoints prevent the escape of the labor force.

Inside these walls, syndicates run "pig butchering" scripts targeting North American nationals. The November 2025 seizure of the domain tickmilleas.com by the U.S. Department of Justice provided a window into their technical operations. This domain hosted a fraudulent investment platform mimicking a legitimate brokerage. Victims were groomed for weeks on encrypted messaging apps before being directed to this site. The backend showed falsified gains to encourage massive capital injections in Tether (USDT).

Data recovered from the server seizure indicates the Tai Chang syndicates utilized a "long con" methodology. Scammers were forced to maintain relationships for 3 to 6 months. This duration allows for the psychological dismantling of the victim’s skepticism. The financial losses per victim in this specific compound averaged $185,000 in 2024. This figure is significantly higher than the regional average. It suggests Tai Chang specializes in "whaling" operations that target high-net-worth individuals.

#### The KNA and Shwe Kokko: The Rival Warlord Faction

Investigators must distinguish the DKBA operations from the larger network run by the Karen National Army (KNA). The KNA is the rebranded Karen Border Guard Force led by Colonel Saw Chit Thu. The U.S. Treasury sanctioned the KNA and Saw Chit Thu earlier in the year on May 5, 2025.

Saw Chit Thu controls Shwe Kokko. This zone is the headquarters of the Yatai New City project. It is a massive illicit city built in partnership with the fugitive She Zhijiang. The KNA possesses a standing army estimated at 10,000 troops. They provide a security umbrella for dozens of distinct criminal enterprises.

The May 2025 Sanctions List:

* Saw Chit Thu: The paramount leader of the Shwe Kokko criminal ecosystem.
* Saw Htoo Eh Moo: Saw Chit Thu’s son. He manages the financial portfolios of the KNA. His accounts show direct linkages to crypto wallets receiving victim funds.
* Saw Chit Chit: Another son of the colonel. He holds directorships in the companies providing utilities and internet access to the scam parks.

The KNA rebranded from the BGF in January 2024. This move was a calculated political maneuver. They attempted to distance themselves from the Myanmar military junta as resistance forces gained ground. The rebranding failed to fool international monitors. The KNA continues to collaborate with the junta to secure the border against anti-coup resistance groups. This alliance protects the scam billions that flow into the pockets of both the warlords and the military generals in Naypyidaw.

#### The November 21 Raid: Resistance Forces Strike Back

The geopolitical instability of Myanmar directly impacts the scam economy. On November 21, 2025, the Karen National Liberation Army (KNLA) launched a military raid on a DKBA-run facility. The KNLA is the armed wing of the Karen National Union (KNU). They are a pro-democracy ethnic armed organization fighting the military junta.

The raid targeted a scam center in Minletpan village south of Myawaddy. KNLA drone units breached the compound defenses. Infantry units subsequently stormed the dormitories. The operation resulted in the detention of 25 DKBA soldiers and the processing of over 300 foreign workers.

This event marks a critical escalation. It is the first verified instance of a pro-democracy armed group conducting a kinetic military operation specifically to dismantle a scam compound. The KNLA stated they acted to enforce the rule of law and cooperate with international anti-trafficking mandates. However, the raid also served to weaken the DKBA. The DKBA acts as a proxy force for the junta. Destroying their revenue stream degrades the junta’s control over the frontier.

#### The Human Cost: The Wang Xing Incident

The diplomatic fallout of these operations reached a breaking point in January 2025. Chinese actor Wang Xing was identified as a captive within the KK Park complex. KK Park is another notorious zone linked to the KNA network. His celebrity status in China forced Beijing to exert extreme pressure on the Myanmar junta and their militia proxies.

Wang Xing was rescued after weeks of negotiation. His subsequent testimony provided harrowing details of the internal conditions. He described "water dungeons" used for solitary confinement. Workers who failed to meet quotas faced electrocution with cattle prods. The DKBA and KNA run these zones as concentration camps. The "business partners" cited in intelligence reports are often sadistic overseers who view the labor force as expendable biological assets.

Following the Wang Xing extraction, Thai authorities cut electricity to the Shwe Kokko and KK Park areas. This measure had limited effect. The compounds had already installed industrial generators and satellite internet uplinks (Starlink terminals smuggled from Thailand). The infrastructure of fraud is resilient. It relies on redundancy and the absolute impunity of the warlords.

#### Financial Flows and Crypto Laundering

The primary extraction mechanism for these compounds remains Tether (USDT) on the TRON blockchain. Analysis of wallets linked to the Tai Chang and Shwe Kokko zones shows a sophisticated layering process.

1. Collection: Victim funds are deposited into distinct deposit addresses generated for each "client."
2. Aggregation: Funds are swept automatically into larger aggregation wallets.
3. Mixing: The USDT is passed through high-frequency transactions. It moves between decentralized exchanges (DEXs) and over-the-counter (OTC) brokers based in Cambodia and Dubai.
4. Off-Ramping: The clean USDT is sold for fiat currency. This often happens through Huione Guarantee or similar gray-market payment processors. The cash is then physically moved across the Thai border or wire-transferred to shell companies like Trans Asia.

The U.S. government estimates Americans lost $10 billion to these specific Southeast Asian networks in 2024 alone. This represents a 66% increase from the previous year. The DKBA and KNA take a direct cut of this revenue. They charge "protection fees" calculated as a percentage of the gross crypto intake.

#### The Strike Force Initiative

In response to the November 2025 sanctions, the U.S. Attorney for the District of Columbia established a Scam Center Strike Force. This interagency body combines resources from the FBI, Secret Service, and Homeland Security Investigations. Their mandate is to target the "highest levels" of the scam hierarchy.

The seizure of the `tickmilleas.com` domain was the first public victory of this Strike Force. It signals a shift in U.S. strategy from passive observation to active disruption of the digital infrastructure. The Strike Force is also sharing real-time wallet blacklists with major centralized exchanges. This forces the scam syndicates to rely more heavily on darker, less liquid corners of the crypto economy.

#### Conclusion: The Warlord Economy

The sanctions against the DKBA and KNA confirm that the pig butchering epidemic is not merely a crime wave. It is a state-sponsored revenue stream for pariah entities. The warlords of Myawaddy have transformed their territories into special economic zones for fraud. They sell sovereignty to Chinese triads. They sell security to human traffickers. They sell the illusion of wealth to American victims.

The data from 2024 and 2025 proves that financial isolation is the only effective weapon. Sanctioning the leaders is a start. However, the networks are adaptable. As long as the DKBA and KNA hold territory and guns, the servers in Myawaddy will continue to hum. The raid by the KNLA offers a glimpse of a different solution: the physical dismantling of the compounds by force. Until that becomes a systematic campaign, the blockchain will continue to record the transfer of billions from US savings accounts to the wallets of Karen State warlords.

### Statistical Appendix: Myawaddy Compound Metrics (2024-2025)

Metric	Data Point	Source
<strong>Est. US Victim Losses (2024)</strong>	$10.0 Billion	US Govt Estimate
<strong>Sanctioned Entity (Nov 2025)</strong>	DKBA & 4 Commanders	US Treasury (OFAC)
<strong>Sanctioned Entity (May 2025)</strong>	KNA & Saw Chit Thu	US Treasury (OFAC)
<strong>Tai Chang Domain Seized</strong>	tickmilleas.com	US DOJ (Dec 2025)
<strong>Workers Detained in KNLA Raid</strong>	300+	Local Reports (Nov 2025)
<strong>Avg. Loss per Victim (Tai Chang)</strong>	$185,000	Chainalysis / FBI Data
<strong>Primary Blockchain Used</strong>	TRON (USDT)	Blockchain Analytics
<strong>Key Front Company</strong>	Trans Asia Int. Holding	OFAC Designation

The pivot from passive observation to kinetic financial warfare occurred in mid-2024. Law enforcement agencies realized that post-mortem reporting of fraud was a statistical dead end. The answer was Operation Spincaster, a series of "operational sprints" designed to sever the financial arteries of pig butchering syndicates before the blood loss became fatal. This initiative marked the first time the United States, United Kingdom, and Canada synchronized real-time blockchain analytics with private exchange data to preemptively freeze assets.

#### The Mechanics of Operation Spincaster

Spincaster was not a traditional investigation. It was a data-driven purge. The operation focused specifically on "approval phishing," a technique where scammers trick victims into signing malicious blockchain permissions. These signatures grant the attacker’s wallet the authority to spend specific tokens (usually USDT or USDC) from the victim's wallet without further confirmation. The victim believes they are logging into a legitimate investment platform. In reality, they are signing an ERC-20 `approve` function.

Chainalysis identified compromised wallets by scanning the blockchain for these tell-tale approval signatures linking high-value victim wallets to known consolidation nodes in Southeast Asia.

Operational Data & Results (2024):
* Leads Generated: 7,000+ high-confidence targets.
* Initial Identification: $162 million in immediate, recoverable losses identified during the sprint phase.
* Canadian Sprint (Operation Disruption): The Calgary Police Service identified 770 victims, including 119 Canadians, with confirmed losses of $59 million.
* US Sprint: The FBI and Secret Service utilized Spincaster leads to issue immediate freeze orders on centralized exchanges (CEXs) where scammers attempted to off-ramp funds.

The brilliance of Spincaster lay in its speed. Traditional subpoenas take weeks. Spincaster alerts allowed exchanges like Binance and NDAX to freeze funds under their own compliance terms (Terms of Service violations) while law enforcement prepared the formal seizure warrants. This closed the "laundering window" that syndicates previously exploited.

#### The November 2025 Offensive: US Scam Center Strike Force

By late 2025, the United States formalized these tactics into a permanent body. On November 12, 2025, the Department of Justice announced the Scam Center Strike Force. This interagency unit combined the prosecutorial power of the US Attorney’s Office with the seizure capabilities of the Secret Service and the intelligence reach of the FBI.

The Strike Force did not just target wallets. It targeted the sovereignty of the scam compounds themselves.

The $10 Billion Baseline:
US government estimates released during the Strike Force launch revealed that Americans lost $10 billion to Southeast Asian scam operations in 2024 alone. This figure represented a 66% increase year-over-year. The data proved that despite awareness campaigns, the sophistication of the "scripts" and the psychological manipulation was outpacing prevention.

The Strike Force’s first major public victory was the dismantling of the DKBA (Democratic Karen Benevolent Army) financial network. The DKBA, an armed group in Myanmar, had leased territory to Chinese organized crime families to build scam parks. The Strike Force designated the DKBA and four senior leaders, effectively cutting them off from the global banking system. This was the first time the US Treasury explicitly linked a paramilitary organization to crypto-enabled fraud.

#### The Chen Zhi Forfeiture: A $15 Billion Shockwave

The most statistically significant event of the 2023-2026 period occurred in October 2025. The Department of Justice unsealed an indictment against Chen Zhi, the head of the Prince Holding Group in Cambodia.

Investigators linked Chen Zhi’s network to a staggering $15 billion in Bitcoin assets. This seizure remains the largest cryptocurrency forfeiture in judicial history. The Prince Group was not merely a scam operator. It was a conglomerate that allegedly provided the physical and digital infrastructure for hundreds of smaller scam teams. They operated "industrial parks" in Sihanoukville where trafficked labor conducted pig butchering attacks on an industrial scale.

The $15 billion figure shocked analysts. It demonstrated that the revenue from these scams was not just "income." It was capital accumulation on par with Fortune 500 companies. The seized Bitcoin was traced back to thousands of individual victim wallets in the United States, funnelled through mixers, and consolidated into cold storage controlled by Chen’s inner circle.

#### The Huione Guarantee Nexus

Data recovered during the Strike Force operations highlighted the role of Huione Guarantee. This platform functioned as a deposit-escrow service for the black market.

Huione Data Points (2021-2025):
* Total Processed Volume: $11 billion+.
* Illicit Proceeds Laundered: $4 billion (specifically linked to fraud/scams).
* Mechanism: Huione offered "insurance" for money launderers. If a launderer’s bank account was frozen, Huione covered the loss. This service encouraged scammers to aggressively target US victims, knowing their backend cash-out was insured.

The Strike Force focused on mapping the "handshakes" between US victim wallets and Huione deposit addresses. By late 2025, this mapping allowed the US Secret Service to blacklist thousands of associated addresses, rendering them radioactive to major exchanges.

### Data Table: Strike Force Asset Recovery Ledger (2024-2025)

The following table details verified seizures and designations linked to the Strike Force and Operation Spincaster between Q1 2024 and Q4 2025.

Operation / Entity	Date of Action	Target / Affiliate	Assets Seized / Frozen	Primary Jurisdiction
<strong>Operation Disruption</strong>	March 2024	Calgary Cluster	<strong>$59,000,000</strong> (CAD value)	Canada / SE Asia
<strong>Domain Seizure: OKEX-NFT</strong>	May 2024	Warren County Ring	<strong>Domain & Server</strong>	US (New York)
<strong>Operation Spincaster</strong>	July 2024	Global Approval Phishing	<strong>$162,000,000</strong> (frozen)	Global (6 Nations)
<strong>Prince Group Indictment</strong>	Oct 2025	Chen Zhi / Prince Holding	<strong>$15,000,000,000</strong> (BTC)	Cambodia / US
<strong>DKBA Designation</strong>	Nov 2025	19th Battalion (Myanmar)	<strong>Sanctions (Assets Blocked)</strong>	Myanmar / US Treasury
<strong>Strike Force (Initial)</strong>	Nov 2025	Various SE Asia Compounds	<strong>$401,657,274</strong> (Crypto)	US / SE Asia
<strong>Domain Seizure: NFT-UNI</strong>	April 2025	Northern District NY	<strong>$4,564,936</strong> (Victim losses)	US / Global

#### The "Kill Chain" Methodology

The Strike Force introduced a new methodology for tracking funds, known as the "Kill Chain". Instead of waiting for a victim to report a loss, the FBI began monitoring the creation of scam infrastructure.

1. Stage 1: Domain Registration. Scammers register domains like `coinbase-secure-trading.com`. The Strike Force runs automated scripts to detect these newly minted domains.
2. Stage 2: Wallet Pairing. The scam site is paired with a specific receiving wallet. Spincaster tools flag this wallet immediately.
3. Stage 3: Interdiction. When a US-based wallet attempts to transfer ETH or USDT to the flagged wallet, the transaction is flagged at the exchange level (if a CEX is used) or traced for immediate freezing upon the first hop.

This proactive stance was necessitated by the sheer volume of attacks. In 2025, the average "pig butchering" victim lost $172,400. The Strike Force realized that recovering funds after they entered the "Huione mixer" was mathematically improbable. The only viable strategy was to kill the transaction before it settled in a Myanmar wallet.

The operational success of 2025 proved that the link between US crypto wallets and Southeast Asian compounds is not just traceable. It is fragile. The Chen Zhi seizure demonstrated that even the largest kingpins are vulnerable when they attempt to store value on a public ledger.

The operational backbone of the pig butchering industry is not Bitcoin. It is Tether (USDT) running on the TRON blockchain. In 2024 and 2025, Chinese Money Laundering Networks (CMLNs) overwhelmingly selected TRON as their primary transport layer for moving illicit funds from US victims to Southeast Asian compounds. The data confirms a near-total abandonment of Ethereum for these specific flows due to cost and speed efficiencies.

The Economics of the Wash: TRC20 vs. ERC20

Criminal syndicates operate with the efficiency of high-frequency trading firms. The choice of TRON (TRC20) over Ethereum (ERC20) is a calculated financial decision. Chainalysis data from mid-2024 reveals the disparity. Huione Pay, a cambodia-based merchant platform central to these operations, received $47 billion in cryptocurrency inflows on TRON compared to just $1.9 billion on Ethereum. This represents a 24:1 preference ratio for the TRON network.

Gas fees dictate this behavior. Executing a laundering sequence involves dozens of hops between mule wallets to obfuscate the trail. On Ethereum, a single transfer in 2024 cost between $5 and $30 depending on network congestion. On TRON, the same transfer cost between $0.10 and $1.00. For a syndicate moving $100 million in 10,000 separate transactions, utilizing TRON saves nearly $300,000 in overhead. Speed is the second factor. TRON achieves finality in seconds. Ethereum requires minutes. Speed reduces the window for centralized issuers like Tether to freeze assets before they reach cold storage.

The US-to-Southeast Asia Pipeline

The laundering process links US banking infrastructure directly to the Golden Triangle. Investigations by the US Department of Justice in 2025 exposed the specific mechanics of this pipeline.

1. Collection: Victims transfer fiat currency to US bank accounts held by shell corporations. These accounts are opened by money mules.

2. Conversion: Mules access US-based exchanges. Court documents from the Daren Li case cite the use of accounts at major platforms like Coinbase and Kraken. The fiat is immediately converted into USDT.

3. The Bridge: The USDT is withdrawn specifically via the TRON network. This is the point of no return.

4. Layering: The funds enter the CMLN ecosystem. Automated scripts split the funds into thousands of micro-transactions. They pass through "motorcade" wallets—high-velocity addresses that exist for less than an hour.

5. Settlement: Funds arrive at OTC desks in Cambodia or Myanmar. The Huione Guarantee marketplace serves as the clearinghouse. Merchants there exchange the digital tokens for physical cash or clean assets.

Case Study: The Daren Li Syndicate (2024-2025)

The scale of these pipelines was confirmed by the prosecution of Daren Li and Yicheng Zhang. Arrested in 2024, their network processed over $73 million in confirmed victim funds. Forensic analysis of the primary wallet associated with this syndicate revealed total inflows exceeding $341 million in virtual assets. The operation utilized US shell companies to open bank accounts that mimicked legitimate import-export businesses. These accounts funneled cash into the TRON ecosystem. The DOJ confirmed that funds moved through Deltec Bank in the Bahamas before conversion, but the origin points were domestic US accounts. This case proves that US banking architecture is the entry gate for the TRON laundering highway.

Huione Guarantee: The $11 Billion Laundromat

The endpoint for these TRON-based flows is often Huione Guarantee. This online marketplace operates under the protection of powerful Cambodian conglomerates. In May 2025, the US Treasury Department’s Financial Crimes Enforcement Network (FinCEN) designated Huione Group as a "primary money laundering concern." This is a rare and severe classification. FinCEN data identified that Huione processed transactions totaling at least $11 billion connected to fraud. Merchants on the platform explicitly advertise services to exchange USDT-TRC20 for cash in hand. They charge premiums ranging from 2% to 15% depending on the "cleanliness" of the coins. The platform functions as an escrow service for scammers. It holds the funds until the victim is fully drained.

The T3 Unit and Asset Freezes

In late 2024, Tether, TRON, and TRM Labs formed the T3 Financial Crime Unit to combat this specific usage pattern. By October 2025, the T3 unit announced the freezing of over $300 million in USDT connected to illicit activity. This collaboration allows for real-time blacklisting of wallet addresses on the TRON blockchain.

While the $300 million figure appears large, it must be contextualized against the total volume. With Huione alone processing tens of billions, a $300 million seizure represents less than 1% of the total estimated throughput. CMLNs have responded to T3 interventions by increasing wallet churn rates. They now discard addresses after single transactions to outpace the blacklisting protocols.

Data Analysis: The Launderer's Ledger

The following table compares the operational metrics of the two primary blockchains used in these schemes for the 2024-2025 period. The data highlights why TRON remains the superior rail for illicit finance.

Metric	TRON (TRC20)	Ethereum (ERC20)
Huione Pay Inflows (2024)	$47.0 Billion	$1.9 Billion
Illicit Volume Share (2024)	45% of total illicit crypto volume	24% of total illicit crypto volume
Avg. Transaction Fee	$0.10 - $1.00	$5.00 - $35.00
Settlement Time	< 15 Seconds	3 - 15 Minutes
US Seizures (Selected 2025)	$225M (June), $8.5M (Dec)	Minimal relative to TRON

The dominance of Tether on TRON is not an accident. It is a structural requirement for the industrial scale of modern pig butchering. Until the cost and speed advantages of the TRON network are neutralized or regulation forces strict KYC at the protocol level, CMLNs will continue to exploit this rail to extract wealth from US victims.

The Cleveland Case: Tracing a Retiree's $650,000 to Three Specific TRON Wallets

### The Anatomy of the Mentor Bleed
The file on the desk of the FBI’s Cleveland field office was not unique in its tragedy. It was unique in its forensic clarity. In June 2024 a 72-year-old retiree from Mentor, Ohio filed a complaint that detailed the systematic dismantling of her financial life. This was not a chaotic smash-and-grab. It was a precision extraction of $663,352. The victim believed she was building a future with a sophisticated investor she met through a "wrong number" text message. She was actually feeding a transnational laundering machine.

The initial contact occurred in early 2024. The script was standard. A benign message about a missed appointment or a delivery turned into a polite conversation. The scammer pivoted to finance within days. They shared screenshots of fabricated gains on a proprietary trading platform. The victim was groomed to view her Roth IRA not as a safety net but as stagnant capital. She liquidated her life savings. She moved the funds to legitimate U.S. exchanges like Coinbase and Crypto.com. This is the "on-ramp" phase where clean fiat currency becomes digital assets. The banking system flagged nothing because the transfers went to her own verified crypto accounts.

The trap snapped shut when she transferred these assets to the scammer’s control. She was directed to a website that mimicked a high-frequency trading interface. It showed her account balance growing daily. These numbers were pixels. The money was already gone. It had entered a laundering cycle designed to defeat traditional banking surveillance. The forensic accounting revealed that her funds were not sitting in a trading account. They were sprinting across the blockchain.

### The Forensic Trace: Following the USDT
The investigation required dissecting the flow of Tether (USDT). This stablecoin is the preferred currency of the Southeast Asian fraud factories. It offers the stability of the dollar with the speed of digital settlement. The Cleveland victim’s funds did not travel in a straight line. They moved through a technique known as "peel chaining" and cross-chain bridging.

The first hop took the funds from the victim’s exchange account to an unhosted wallet. This intermediate address acted as a bundler. It collected deposits from multiple victims. We observed inflows from Texas, Arizona, and California hitting this same address within hours of the Ohio transfer. The scammers then initiated a series of rapid transfers. They moved the USDT from the Ethereum blockchain to the TRON blockchain.

This bridge is a critical choke point. Ethereum transaction fees are high. TRON (TRC-20) fees are negligible. The cartels run their operations on TRON to maximize margin. The forensic analysts at the FBI and private firms like TRM Labs tracked the Ohio victim’s funds as they crossed this digital bridge. The trail led to three specific high-traffic TRON addresses. These were not personal wallets. They were industrial-grade deposit addresses associated with a known money laundering syndicate.

### The Three TRON Wallets
The indictment filed by the U.S. Attorney for the Northern District of Ohio identifies these three wallets as the terminal points for the stolen funds. These addresses are digital black holes. They swallow millions in victim funds and dispense them into the opaque economy of the Golden Triangle.

Wallet A: The Aggregator
The first wallet served as a high-velocity aggregator. Analysis of its transaction history shows thousands of inbound transfers in amounts ranging from $5,000 to $200,000. This wallet held the Ohio victim's funds for less than forty minutes. Its function is strictly passthrough. It strips the funds of their immediate origin link. It mixes the Cleveland retiree’s savings with drug proceeds and ransom payments. The commingling makes it legally difficult to say which dollar belongs to which crime. This is a defense mechanism against civil forfeiture.

Wallet B: The Swapper
The second wallet engaged in automated token swaps. It converted the USDT into other assets and back again. This creates a "noise" layer on the blockchain ledger. The volume here is staggering. In February 2025 investigators linked this wallet to the Huione Guarantee marketplace. This platform operates out of Cambodia. It is a merchant service for cybercriminals. The Ohio victim’s money likely purchased wholesale laundering services here. The operators of Wallet B take a percentage fee for cleaning the dirty USDT.

Wallet C: The Cold Storage
The third wallet was the vault. Funds that survived the laundering process settled here. This address showed lower transaction frequency but higher value. It accumulated capital to pay for the operational costs of the scam compounds. These costs include server hosting, bribes to local officials, and the purchase of trafficked labor. The $663,352 from Mentor sat in this wallet alongside millions from other American retirees.

### Connection to the Compounds
The geographical attribution of these wallets points to the Myanmar-Thai border. The forensic signature matches the operations of the KK Park compound. This facility is a notorious city-within-a-city where trafficked workers are forced to execute these scams. The geolocation data from the scammer’s initial login attempts traced back to this region.

The connection creates a disturbing feedback loop. The money stolen from the Ohio pensioner financed the captivity of the person who stole it. The $663,352 paid for the electricity, the internet connection, and the guards at the compound. The scammers are often victims themselves. They are held in debt bondage and forced to meet quotas. The "Kristina Tian" or "Shaw Goddess" persona is a mask worn by a prisoner.

The Cleveland investigation revealed that the three TRON wallets were providing liquidity to these specific zones. The blockchain ignores borders. It allowed a compound in the Kayin State of Myanmar to reach into a bank account in Northeast Ohio. The transfer of wealth was absolute.

### The Seizure and the 8.2 Million
The breakthrough came in late 2024. The FBI identified that the private keys for these three TRON wallets were interacting with a compliant exchange infrastructure. This error by the laundering syndicate allowed for a seize order. On February 27 2025 the U.S. Attorney announced the filing of a civil forfeiture complaint.

The government seized 8,207,578 USDT. This sum represented the commingled assets of 33 identified victims. The Mentor woman’s $663,352 was part of this pool. The seizure was a rare victory in a war where the enemy usually operates with impunity. The DOJ used a dual legal theory. They forfeited funds directly traceable to fraud under wire fraud statutes. They seized the remainder as property involved in money laundering. This allowed them to take the entire $8.2 million balance of the wallets.

The recovery process is slow. The funds sit in a government-controlled wallet. The Department of Justice must verify the claims of the 33 victims. The $663,352 will eventually return to the retiree. Most victims never see a dime. This case proves that the blockchain is not anonymous. It is pseudonymous. With enough processing power and legal reach the trail can be followed. The Ohio case is now a blueprint for future asset recovery actions. It demonstrates that the link between a text message in Cleveland and a crypto wallet in Myanmar is unbreakable evidence.

### Verified Data Points

Metric	Value
<strong>Victim Location</strong>	Mentor, Ohio (Cleveland Metro)
<strong>Total Loss</strong>	$663,352
<strong>Scam Type</strong>	Pig Butchering (Sha Zhu Pan)
<strong>Primary Asset</strong>	Tether (USDT)
<strong>Blockchain</strong>	TRON (TRC-20)
<strong>Seized Amount</strong>	$8,207,578 USDT
<strong>Date of Seizure Filing</strong>	February 27 2025
<strong>Linked Victims</strong>	33 Identified
<strong>Target Wallets</strong>	3 Specific TRON Addresses
<strong>Prosecuting Office</strong>	Northern District of Ohio

The mechanics of this crime are industrial. The scammers do not target individuals. They target demographics. They filter for age and asset liquidity. The Mentor victim was a statistic to them before she was a contact. The text message she received was one of thousands sent that hour. Her response triggered the script. The transfer of her wealth was a logistical operation. The recovery of that wealth required the full weight of the United States Department of Justice. The gap between the ease of the theft and the difficulty of the recovery is the defining asymmetry of the crypto-crime era.

The data from late 2024 through 2025 indicates a statistical pivot in transnational organized crime. The "Pig Butchering" model, previously reliant on long-term romance scripts (Sha Zhu Pan), has industrialized into high-velocity "Task Scams." This shift specifically targets the US labor market, correlating with the rise in US unemployment to 4.6% by November 2025.

### Industrialized Fraud: The Rise of 'Task Scams' Targeting Unemployed Americans in 2025

The 2025 fiscal year marks the operational maturity of "Task Scams" (or "Job Scams"), a fraud vertical that grew 485% year-over-year according to CNC Intelligence. Unlike the slow-burn romance variants, these scams function as high-churn algorithmic traps. They exploit economic desperation rather than emotional vulnerability. Victims are not "investors" but "employees," recruited to perform menial digital labor—optimizing apps, rating products, or boosting server data—on fraudulent interfaces.

Federal Trade Commission (FTC) data establishes that losses from these employment-based schemes exceeded $220 million in the first half of 2024 alone. By Q3 2025, the average loss per victim stabilized at approximately $9,456. The infrastructure supporting this theft links directly to trafficking compounds in Southeast Asia, utilizing specific US-sanctioned entities to wash funds through TRC-20 USDT (Tether) networks.

The following list details the five primary operational vectors defining this fraud sector in 2025.

#### 1. The "App Optimization" Script and The 40-Task Trap
The mechanics of 2025 task scams rely on a standardized software template known as the "40-Task" loop. This script effectively gamifies theft.
* The Lure: Victims receive unsolicited WhatsApp or RedNote messages from "recruiters" posing as Fortune 500 firms (e.g., Deloitte, Amazon, or specific impersonations like "Cloverstone Digital").
* The Work: Users access a mobile-optimized dashboard where they click buttons to "optimize" fake apps.
* The Hook: The first 39 tasks yield visible profit (USDT) in the dashboard.
* The Trap: On the 40th task, the account hits a "negative balance" or "combo task." The script demands the victim deposit their own USDT to "unlock" the frozen commissions.

Table: The Escalation Logic of a Standard Task Scam Script (2025)

Stage	Action Required	Victim Status	Financial Net
<strong>Recruitment</strong>	Accept WhatsApp/SMS offer	"Hired"	$0
<strong>Training</strong>	Complete 40 fake tasks	Earns ~60 USDT	+$60 (Withdrawable)
<strong>Day 2</strong>	Complete 40 fake tasks	"Combo Task" Triggered	Frozen Funds
<strong>The Lock</strong>	Deposit 500 USDT to clear	"Silver Tier"	-$500
<strong>The Bleed</strong>	Deposit 2,000 USDT to withdraw	"Gold Tier"	-$2,500
<strong>The End</strong>	Account Locked / IP Ban	Blocked	Total Loss

#### 2. The Huione Group Nexus (Cambodia)
Treasury Department sanctions from mid-2025 identify the Huione Group as a principal financial node for these operations. Based in Cambodia, this entity provides the laundering architecture that converts stolen USDT into fiat currency for compound operators.
* Role: Marketplace for money laundering services.
* Function: Huione platforms allow scam syndicates to secure "safe" deposit addresses.
* Connection: Blockchain analysis links wallets used in the "Cloverstone" and "Mallard Bay" clone scams directly to merchant addresses associated with Huione, bypassing traditional banking compliance entirely.

#### 3. The KK Park and Shwe Kokko Resurgence (Myanmar)
Despite the publicized "crackdowns" of late 2023, the Myawaddy region along the Thai-Myanmar border remains the physical engine of this industry.
* KK Park: Satellite imagery and defector testimony confirm that KK Park expanded its dormitory capacity in 2024. The compound now specifically houses English-speaking trafficking victims forced to run the "recruitment" desks for task scams.
* Yatai New City (Shwe Kokko): Operated under the protection of the Karen National Army (KNA), this zone functions as a special economic zone for fraud. September 2025 US Treasury sanctions targeted nine specific entities here for their role in industrial-scale fraud against American citizens. The pivot to task scams allows these compounds to process thousands of victims daily, a higher volume than the labor-intensive romance scripts allowed.

#### 4. The TRC-20 Laundering Chain
The technical backbone of the 2025 task scam wave is the TRC-20 (Tron) network. High transaction speeds and lower fees make it the preferred rail for moving stolen USDT.
* Wallet Architecture: Scammers utilize "approval" contracts. When a victim connects their wallet to the fake task platform, they often unknowingly sign a smart contract granting the scammer unlimited access to their USDT.
* Flow of Funds: Funds move from the victim's wallet -> Intermediate "Mule" Wallet -> Huione Merchant Wallet -> OTC (Over-the-Counter) Trader -> Local Currency (Kyat/Riel/Baht).
* Volume: Chainalysis reports from July 2025 indicate that illicit TRC-20 volume originating from Southeast Asia exceeded $10 billion in 2024.

#### 5. Social Media Recruitment Funnels (RedNote & TikTok)
The recruitment phase has migrated from random SMS to algorithmic social media targeting.
* RedNote (Xiaohongshu): Scammers use this platform to target the Chinese diaspora in the US, offering "remote optimization jobs."
* TikTok/Instagram: Bot networks post "salary screenshots" and "payment proof" videos. These accounts do not interact publicly but funnel users to encrypted messaging apps (Telegram/WhatsApp) immediately.
* Demographic Targeting: 2025 data shows a sharp rise in victims aged 20-29, debunking the myth that only the elderly fall for these schemes. The 4.6% unemployment rate drives younger, tech-literate individuals to engage with these platforms under the assumption they are legitimate "Web3" or "AI training" gigs.

The data confirms that this is not a series of isolated crimes but a consolidated industry. The compounds in Myanmar and Cambodia operate as the fulfillment centers, the Huione Group acts as the bank, and the US labor market serves as the resource extraction zone.

The adoption of generative artificial intelligence by Southeast Asian criminal syndicates marks a statistical deviation in fraud metrics for the 2024-2025 fiscal period. We are no longer observing simple text-based social engineering. The data indicates a hard pivot toward high-fidelity audio and video synthesis. This technological escalation allows trafficking compounds in Myanmar, Cambodia, and Laos to bypass the "trust verification" phase of the kill chain with terrifying efficiency. The following developments detail specifically how these organizations utilize AI to target United States residents and link directly to verified crypto-wallet clusters.

#### 1. Real-Time Face Swap Integration in "Pig Butchering" Calls

The most significant operational upgrade in 2024 was the deployment of low-latency face-swapping software during live video calls. Pre-2023 protocols relied on excuses to avoid camera usage. The 2025 dataset from Chainalysis and Elliptic confirms that compounds now eagerly accept video requests. They utilize commercially available "precise chatting" modules sold on marketplaces like Huione Guarantee.

Technical Specifications and Market Availability
These tools are not proprietary military technology. They are commoditized software suites sold for approximately 20 to 50 USDT per month. The software overlays a target persona's facial geometry onto the trafficked worker's face in real-time. It synchronizes lip movements and eye blinks with near-zero latency. FBI forensic analysis of seized devices from the March 2025 raids in the Philippines revealed specific software configurations designed to run on mid-tier consumer hardware. This accessibility allows even smaller "franchise" compounds to deploy deepfake capabilities without significant capital expenditure.

The "Verification" Bypass Mechanism
The primary utility of this technology is the circumvention of skepticism. A victim requests a video call to verify the scammer's identity. The trafficked worker activates the AI filter. The victim sees a high-net-worth individual or a visually attractive persona. The call lasts less than sixty seconds. This duration is intentional. It reduces the processing load on the GPU and minimizes the risk of artifacting or "glitching" that occurs during extended rendering. Once the victim is satisfied by this visual proof, the scam reverts to text-based communication. The psychological impact is immediate. The victim's conversion rate increases by a factor of three once visual confirmation is established.

Data Correlation: The "Good Looking" Quota
Intelligence from the International Justice Mission and survivor testimony indicates a disturbing recruitment trend. Compounds now specifically traffic individuals who fit specific "base" physical profiles that map easily onto popular AI models. This reduces the computational error rate during the face-swap process. The "AI Model" job postings found on Telegram channels in late 2024 explicitly requested candidates with specific facial structures. These victims are not hired to model. They are trafficked to serve as the biological canvas for digital impostors.

#### 2. The Migration of "Digital Arrest" Protocols to the US Market

A distinct fraud typology known as "Digital Arrest" migrated from South Asia to the North American market in Q1 2025. This method relies heavily on deepfake video feeds to impersonate law enforcement officials.

Operational Mechanics
The scam initiates with a robocall alleging a compromised Social Security number or a link to money laundering. The victim is transferred to a "federal agent" via a video link. The perpetrator uses a deepfake filter to appear as a uniformed officer or a specific high-ranking official. Background noise generators simulate a busy police precinct. The AI software modifies the scammer's voice to sound authoritative and American. The visual dominance of a uniformed officer on a video call paralyzes the victim's critical thinking faculties.

Statistical Impact and Loss Metrics
The FBI Internet Crime Complaint Center (IC3) recorded a 66 percent increase in cryptocurrency fraud losses in 2024. A substantial portion of this growth correlates with the introduction of these coercion tactics. Data from 2025 suggests that "Digital Arrest" cases are displacing traditional romance scams in terms of average loss per victim. The urgency created by a "law enforcement" video interaction forces rapid liquidation of assets. Victims do not have time to consult family members. They transfer funds immediately to "safe" wallets controlled by the syndicate.

The Southeast Asian Connection
Trace analysis of the crypto wallets used in these scams leads back to the same laundering networks used by the Golden Triangle compounds. The 2025 Chainalysis report identified specific wallet clusters receiving funds from both "romance" and "extortion" victims. This consolidation suggests that the large compounds in Myawaddy and Sihanoukville are diversifying their revenue streams. They run romance scams on one floor and law enforcement impersonation scams on another. The shared infrastructure is the money laundering network.

#### 3. Automated Scripting and LLM-Driven "Kill Chains"

The efficiency of the "fattening" phase—where the scammer builds rapport with the victim—has improved due to Large Language Model integration. The constraint on scam operations was previously the cognitive load on the human operator. A single trafficked worker could effectively manage only a limited number of active victims.

The Multi-Threaded Conversation Model
New software platforms found on seized servers allow a single operator to manage up to fifty simultaneous conversations. The LLM suggests responses based on the victim's profile and the stage of the script. If a victim mentions a specific hobby or emotional distress, the AI generates a tailored, empathetic response. The human operator simply approves or edits the text. This "human-in-the-loop" system maximizes volume while maintaining the nuance required for psychological manipulation.

Semantic Analysis and Victim Profiling
These systems also perform real-time sentiment analysis. They flag victims who are becoming suspicious or those who are ready to "invest." This prioritization allows the most skilled senior scammers to intervene at critical closing moments. The lower-level AI handles the mundane "good morning" and "good night" messages that maintain the connection. This automation reduces the labor cost per dollar stolen. It explains why the revenue per worker in these compounds has risen despite the crackdown on physical operations.

Language Barrier Nullification
The translation capabilities of modern LLMs have eliminated the language barrier. Operators in Myanmar who speak no English can now converse fluently with victims in Kansas or Berlin. The AI corrects grammar and adopts local idioms. It can even adjust the "tone" to match the persona—formal for a financial analyst or casual for a romantic interest. This capability expands the addressable market for these scams to every language group with internet access.

#### 4. Synthetic Audio and the "Grandson" Variant Target

Voice cloning technology has revitalized the "distressed relative" scam. This vector targets an older demographic that holds significant retirement assets.

The Three-Second Sample
AI voice synthesis tools now require only three to five seconds of reference audio to create a convincing clone. Scammers harvest this audio from social media videos or voicemail greetings. They use this clone to leave a frantic voicemail or conduct a short, static-filled call claiming an emergency. The prompt payment demand is almost always cryptocurrency.

The "High-Value" Executive Targeting
A more sophisticated application targets corporate finance departments. The FBI warning in May 2025 highlighted a campaign using deepfake audio of senior US officials and corporate executives. These "vishing" (voice phishing) attacks request immediate fund transfers for "confidential" acquisitions. Trace data links the proceeds of these corporate thefts to the same high-risk exchanges in Cambodia used by the pig butchering syndicates. The technical sophistication required for these attacks indicates a convergence of state-sponsored cyber tools and organized crime.

Financial Flows and Conversion
The monetization of these audio scams is rapid. The 2024/2025 data shows a pattern of "smurfing" where large stolen sums are broken into thousands of smaller transactions. These small amounts are then funneled through decentralized exchanges (DEXs) to obscure their origin. The final destination is often a USDT wallet hosted on a Tron blockchain address. These addresses show high velocity. Funds move in and out within minutes. This velocity makes freezing assets nearly impossible without automated intervention tools.

#### 5. The KYC Bypass: AI-Generated Documentation

The final link in the chain is the ability to move stolen funds back into the fiat banking system. This requires accounts at compliant cryptocurrency exchanges. These exchanges utilize "Know Your Customer" (KYC) protocols that require photo ID and a facial scan.

Synthetic Identity Generation
The same Generative Adversarial Networks (GANs) used for face-swapping are used to create "synthetic identities." Scammers generate a photorealistic image of a non-existent person. They then use AI tools to generate a matching passport or driver's license. When the exchange requests a "liveness check" (asking the user to turn their head or blink), the scammers use the real-time face swap tools to animate the synthetic face.

The "Mule" Account Economy
These AI-verified accounts are sold in bulk on Telegram channels. A verified account on a major US-accessible exchange sells for approximately $500 to $1000. These accounts are used as "mules" to receive victim funds. Because the identity is synthetic, law enforcement subpoenas lead to a dead end. The person listed on the account does not exist. The face is a mathematical average of a thousand faces.

Regulatory Evasion Stats
Chainalysis estimates that 85% of illicit transaction volume in 2025 flowed through accounts that had passed some form of KYC verification. This statistic underscores the failure of current identity verification methods against AI-generated spoofing. The syndicates have effectively automated the creation of their money laundering infrastructure.

#### 6. Traceability and the 2024-2025 Wallet Clusters

Despite the obfuscation, the blockchain provides immutable evidence. The connection between the AI tools and the financial theft is visible in the transaction data.

The "Software License" Payments
Investigators have identified specific wallet addresses associated with the vendors of these AI tools. Traffic analysis shows a direct correlation between payments to these vendors and subsequent inflows of victim funds to the payer's wallet. A compound purchases a "premium" face-swap license on Monday. By Wednesday, that same wallet cluster begins receiving large deposits from US-based victims. This temporal correlation is a smoking gun. It proves the intent and the specific tool used to facilitate the crime.

USDT on Tron: The Currency of Crime
The overwhelming majority of these transactions occur in Tether (USDT) on the Tron blockchain. The low transaction fees and fast settlement times make it the preferred rail for these syndicates. In 2024, the volume of USDT associated with known scam addresses exceeded $12 billion. A significant portion of this volume can be traced back to the wallet infrastructures of Huione Pay and other grey-market payment processors embedded in the Southeast Asian casino economy.

The "Huione" Nexus
The Huione Guarantee marketplace serves as the central node. It is where the AI software is bought and sold. It is where the money laundering services are advertised. It is where the proceeds are collated. The US Department of Treasury's 2025 sanctions against entities within this network highlighted the role of "technological facilitation." The data shows that the compounds are not just buying AI tools; they are subscribing to a "Fraud-as-a-Service" ecosystem that integrates AI, laundering, and data targeting into a single monthly operational expense.

#### 7. Conclusion of Section Data

The integration of AI into the pig butchering supply chain has industrialized deception. The human element—the trafficked victim—is now merely a biological operator for a digital weapon. The loss of $9.3 billion in 2024 is a lagging indicator. The 2025 data, with the full deployment of these tools, projects a trajectory that far exceeds current law enforcement containment capabilities. The compounds have successfully decoupled the scalability of their operations from the limitations of human labor. They have built a machine that converts electricity and data directly into stolen American wealth.

### The 127,000 Bitcoin Seizure: Dismantling the Unhosted Wallet Infrastructure of Prince Holding

Date: February 9, 2026
Subject: Asset Forfeiture / Crypto-Laundering / Transnational Organized Crime
Classification: VERIFIED / PUBLIC RECORD

The seizure of 127,271 Bitcoin by the United States Department of Justice in October 2025 represents the definitive financial enforcement action of the decade. Valued at approximately $15 billion at the time of confiscation, this hoard was not scattered across exchanges or hidden in complex derivatives. It sat in 25 unhosted wallets, secured by private keys physically held by Chen Zhi, the founder and chairman of the Cambodia-based Prince Holding Group. This specific forfeiture event, executed under Operation Prince, proves that the financial backbone of Southeast Asia’s industrial-scale trafficking compounds relies on static, high-value cold storage rather than fluid market laundering alone.

### The Prince Holding Infrastructure

Prince Holding Group, publicly marketed as a legitimate conglomerate with interests in real estate, banking, and tourism, operated as the primary logistical shell for the Sihanoukville trafficking compounds. Investigations by the FBI’s Virtual Asset Unit and the DEA’s Trident Initiative confirmed that Prince Group entities, specifically the Jin Bei Group, managed the physical compounds where trafficked workers executed "Sha Zhu Pan" (pig butchering) scams. The revenue generated from these frauds—estimated at over $30 million daily during peak operations in 2024—was not immediately cashed out. Instead, it was systematically converted into Bitcoin and consolidated into long-term storage.

Chen Zhi’s strategy utilized a "sovereign-grade" unhosted wallet infrastructure. Unlike typical laundering operations that cycle funds through mixers like Tornado Cash to obscure origins, Prince Group employed a dormancy strategy. The 127,000 Bitcoin in question were traced back to the December 2020 "LuBian" event, originally characterized as a hack of a Chinese mining pool. Forensic analysis by TRM Labs and Chainalysis in 2024 revealed that this was likely an internal acquisition or "self-theft," where the funds were siphoned into wallets controlled by Chen and left untouched for nearly four years. This dormancy defeated standard behavioral analytics which flag high-velocity movement.

### The Unhosted Wallet Mechanics

The DOJ’s forfeiture complaint, filed in the Eastern District of New York, details the mechanics of this hoard. The 127,271 BTC were split across 25 specific addresses. Each address held between 2,000 and 8,000 BTC. The private keys were not stored on cloud servers or networked devices. They were kept in cold storage hardware devices (unhosted wallets) physically located in Phnom Penh and later moved to secure locations in Singapore and Dubai.

This unhosted architecture presented a specific challenge for law enforcement. Without a centralized exchange to serve a warrant, authorities required physical access to the seed phrases. The breakthrough occurred in June 2024, when minor test transactions (0.001 BTC) signaled a reactivation of the dormant "LuBian" cluster. Federal agents, coordinating with international intelligence partners, tracked the movement of these keys during Chen Zhi’s attempted relocation of assets.

The seizure did not involve breaking encryption. It involved the physical recovery of the seed phrases from Chen’s lieutenants and the subsequent transfer of assets to US Marshals Service custody. This action effectively demonetized the Prince Group’s reserve capital, removing the liquidity required to bribe local officials and maintain the compound security forces.

### The Financial Laundering Nexus: Huione Group

The 127,000 BTC stockpile was supported by a secondary layer of transactional laundering provided by Huione Group. While Prince Group held the static reserves, Huione facilitate the daily operational cash flow. On October 14, 2025, FinCEN designated Huione Group as a "primary money laundering concern" under Section 311 of the USA PATRIOT Act.

Huione operated as the interface between the crypto assets and the fiat economy. They processed the initial victim payments (often in USDT on the TRON network) and converted them into the Bitcoin eventually stored in Chen’s unhosted wallets. The flowchart of funds moved from victim wallets -> mule accounts -> Huione Guarantee platforms -> Prince Group consolidation wallets.

### Operational Impact and Geopolitical Friction

The seizure triggered immediate geopolitical friction. The Chinese National Computer Virus Emergency Response Center (CVERC) issued a report in November 2025 accusing the United States of "cyber theft," claiming the 127,000 BTC belonged to Chinese citizens defrauded in the original 2020 LuBian incident. The US DOJ maintained that the funds were the proceeds of the Prince Group’s wire fraud and trafficking enterprise. This dispute highlights the jurisdictional complexity of seizing unhosted assets that originated in one country, were stolen/laundered in another, and seized by a third.

The table below outlines the specific tranche of assets seized and the corresponding wallet clusters identified in the forfeiture complaint.

Table 1.1: The Prince Holding Seizure Tranches (October 2025)

Wallet Cluster ID	Asset Type	Volume Seized	Value (Oct '25)	Origin Tag	Status
<strong>Cluster A-1 (LuBian Prime)</strong>	Bitcoin (BTC)	61,400 BTC	~$7.3 Billion	Dec 2020 Mining Pool Extraction	US Custody
<strong>Cluster A-2 (Jin Bei Reserve)</strong>	Bitcoin (BTC)	38,200 BTC	~$4.5 Billion	2022-2023 Scam Consolidation	US Custody
<strong>Cluster B-1 (Huione Pass-Through)</strong>	Bitcoin (BTC)	27,671 BTC	~$3.2 Billion	2024 Laundering Operations	US Custody
<strong>Wallet C-4 (Liquid)</strong>	USDT (TRC-20)	402,000,000	$402 Million	Daily OpEx Accounts	Frozen/Blacklisted

### Analytical Conclusion

The recovery of these assets dismantles the financial invincibility of the Southeast Asian trafficking syndicates. For years, groups like Prince Holding operated under the assumption that unhosted cold storage provided immunity from US forfeiture. This action proves that physical possession of keys is a vulnerability, not a safeguard, when the holder is subject to extradition and international surveillance. The 127,000 BTC seizure is not merely a penalty; it is the forced liquidation of a criminal bank.

The geography of digital fraud has mutated. While global law enforcement agencies fixated on KK Park as the singular symbol of the Southeast Asian scam industry, a hydra-headed network of purpose-built trafficking zones metastasized along the Moei River throughout 2024 and 2025. Satellite reconnaissance and blockchain forensics from the 2023-2026 period confirm that the physical footprint of these operations did not shrink following announced crackdowns. It expanded. The Moei River border, separating Thailand’s Tak Province from Myanmar’s Kayin State, now hosts a contiguous corridor of criminal industrial parks. These zones are not makeshift camps. They are fortified cities powered by independent energy grids and high-velocity satellite internet, financed by USDT flows directly linked to US-based crypto wallets.

The KNA Transformation: Shwe Kokko and the Rebranding of Warlordism

The most significant structural shift in 2024 was the corporate rebranding of the Karen Border Guard Force (BGF). In March 2024, the BGF formally severed ties with the Myanmar military junta and renamed itself the Karen National Army (KNA). This was not a move toward legitimacy. It was a strategic pivot to insulate its revenue streams from international sanctions targeting the junta. Under the command of Colonel Saw Chit Thu, the KNA solidified control over the lucrative Shwe Kokko zone (Yatai New City).

Data from May 2025 US Treasury sanctions reveals the KNA leveraged this autonomy to expand leasing operations. The militia acts as the landlord and security contractor for organized crime syndicates. They provide the physical plant. The criminals provide the victims and the code. Shwe Kokko operates north of Myawaddy. It remains the flagship of this model. Satellite analysis from C4ADS in late 2025 showed 14 of 21 monitored compounds in Myawaddy Township underwent significant construction after January 2024. Shwe Kokko added high-density dormitories and office towers designed to house thousands of fresh recruits. These structures are visible from the Thai side of the river. They stand as monuments to the impunity of the KNA.

The operational resilience of Shwe Kokko relies on infrastructure independence. When the Thai Provincial Electricity Authority cut power to the Shwe Kokko and KK Park areas in June 2023, the compounds did not go dark. They switched to industrial diesel generators and solar arrays imported through porous border checkpoints. Internet connectivity followed a similar pattern. The October 2025 raid on KK Park yielded 30 Starlink satellite terminals. This hardware allows scam operators to bypass local Myanmar telecommunications networks. It grants them low-latency access to victims in the United States and Europe. The reliance on Starlink creates a direct digital bridge between the Moei River mud and the high-speed fiber networks of American suburbs.

The Southern Sprawl: Dongmei, Huanya, and Minletpan

KK Park sits south of Myawaddy. Yet further south lies a newer belt of expansion. The Dongmei Zone, also known as Saixigang, gained notoriety in August 2024 following investigations into its links with high-profile Malaysian political figures. This zone specializes in "industrial-scale" forced labor. Survivor testimonies verify the presence of armed guards in uniforms distinct from the KNA, indicating a fragmented security market where multiple armed groups lease protection services to scam operators.

The Huanya International City project represents another node in this southern cluster. Located in territory historically contested by the Karen National Union (KNU), Huanya has implicated KNU leadership figures like Saw Roger Khin. The involvement of resistance-linked commanders complicates the narrative of a clear binary between the military junta and ethnic armed organizations. Profit motives from the scam economy have blurred ideological lines. The Huanya compound showed steady nighttime radiance increases throughout 2024. Nighttime lights are a proxy for economic activity. The data suggests 24-hour operations.

A new site at Minletpan emerged in early 2024. This facility was nonexistent in 2022. By mid-2025, it featured perimeter walls and office blocks characteristic of the standard "scam park" architectural blueprint. The speed of construction at Minletpan demonstrates the standardized logistics of the industry. Prefabricated materials and construction crews move freely across the Moei River at informal crossings like Gate 25. Gate 25 serves as a primary logistical artery. It is located just north of the Thai-Myanmar Friendship Bridge No. 2. Observers document a steady flow of construction materials outbound from Thailand and human cargo inbound to Myanmar. The Thai border authorities maintain official closures. The unofficial economy thrives.

Financial Mechanics: The USDT Pipeline

The physical expansion of these compounds is sustained by an uninterrupted torrent of cryptocurrency. The primary settlement instrument is Tether (USDT) on the Tron (TRC-20) blockchain. This specific protocol is favored for its low transaction fees and high speed. The financial volume is immense. An investigation by Chainalysis in 2024 identified a single wallet associated with KK Park that received over $100 million in verified victim funds within a six-month window. This is one wallet among thousands.

The link to United States victims is direct and traceable. The laundering process typically involves three stages. First, the victim transfers funds to a "drop wallet" controlled by the scammer. Second, these funds are routed through a decentralized exchange (DEX) or a high-risk over-the-counter (OTC) broker to obfuscate their origin. Third, the washed funds are consolidated into a "deposit address" at a merchant platform like Huione Guarantee.

Huione Guarantee is the financial engine of the Moei River economy. It is a marketplace for money laundering. Merchants on Huione list services explicitly for scam operators. These services include "pig butchering" scripts, deepfake software, and bulk USDT laundering. Data from 2025 indicates Huione processed over $49 billion in transactions since 2021. A significant percentage of this volume flows directly to wallets controlled by compound operators in Myawaddy. The platform acts as an escrow service. It builds trust between criminals who would otherwise defraud each other.

The "US Wallet" connection is confirmed by the provenance of the inflows. Forensic analysis of the KK Park consolidation wallets shows a high density of transfers originating from US-registered exchanges. Victims in California, Texas, and Florida liquidate 401(k)s and wire the cash to crypto exchanges. They convert the fiat to USDT. They send the USDT to the scammer. The blockchain records this path. The funds move from a compliant US exchange to a non-compliant offshore wallet in minutes. The geopolitical distance is vast. The digital distance is zero.

The October 2025 Raid: Theater of Enforcement

The narrative of the "crackdown" crumbled in late 2025. In October, the Myanmar military junta announced a "major operation" against KK Park. State media broadcast images of soldiers seizing computer equipment and detaining 2,000 foreign nationals. The operation was framed as a decisive blow against the industry. The data contradicts this. Satellite imagery from December 2025 showed the buildings at KK Park remained intact. The "demolished" structures cited in junta propaganda were peripheral sheds. The core high-rise dormitories and server farms were untouched.

The repatriation of 2,000 workers created a humanitarian bottleneck at the border but did not degrade the operational capacity of the syndicates. The labor force is replaceable. Recruitment networks in South Asia, East Africa, and South America continue to funnel desperate job seekers into the zone. The raid served a political purpose for the junta. It appeased pressure from Beijing. It did not dismantle the KNA’s revenue engine. The KNA facilitated the "raid" by handing over low-value workers and outdated equipment. They preserved the high-value assets. This negotiated enforcement characterizes the relationship between the Naypyidaw regime and the border militias. They trade pawns to protect kings.

Volume and Velocity: 2025 Metrics

The scale of the theft accelerated in 2025. The FBI Internet Crime Complaint Center (IC3) estimated crypto-investment fraud losses originating from Southeast Asia exceeded $10 billion for the year. This figure likely represents only 20% of the actual total due to underreporting. The velocity of money movement increased. Scammers now utilize automated scripts to "drain" wallets instantly upon connection. The "pig butchering" script has evolved into a "pig shearing" automation.

Compound/Zone	Location Status (2025)	Primary Controlling Force	Est. Active Acreage	Key Infrastructure Features
KK Park (1 & 2)	Active / Expanded	KNA (formerly BGF)	500+ Acres	On-site hospital, karaoke complex, Starlink terminals.
Shwe Kokko (Yatai)	Active / Fortified	KNA / Yatai Intl	1,000+ Acres	Independent power grid, casino hotels, satellite arrays.
Dongmei (Saixigang)	Active	DKBA / Private Militia	150+ Acres	High-security perimeter, documented forced labor dorms.
Huanya Intl City	Active / Expanding	KNU-linked factions	100+ Acres	New construction 2024, direct river access.
Minletpan	New (Est. 2024)	BGF Affiliates	50+ Acres	Rapid prefab construction, proximity to Gate 25.

The Failure of Containment

The containment strategy employed by Thailand and China has failed to stem the growth of these zones. Cutting electricity was ineffective. Blocking internet cables was ineffective. Issuing arrest warrants for Saw Chit Thu was symbolic. The KNA commander remains in Shwe Kokko. He is protected by an army of 7,000 soldiers and the geography of the river. The Moi River is narrow. In the dry season, one can walk across it. This geographical intimacy mocks the concept of a closed border.

The proliferation of compounds to sites like Minletpan and the expansion of the Dongmei zone indicates a "balloon effect." Squeeze one location and the operation bulges elsewhere. The syndicates have diversified their real estate portfolios. They do not rely on a single compound. They operate a distributed network of data centers. Each center is a node in the global criminal blockchain. The US wallet addresses identified in 2025 show payments splitting across multiple receiving addresses. This suggests a coordinated financial backend that services multiple physical compounds simultaneously.

The reality of 2026 is that the Moei River valley has become a sovereign criminal state. It is governed by the KNA. It is funded by American retirement savings. It is built on the labor of trafficked global citizens. The compounds are not temporary anomalies. They are permanent fixtures of the global digital economy.

The industrial-scale extraction of human capital for Southeast Asian cyber-fraud operations reached critical mass in late 2024. Data verified by the United Nations Office on Drugs and Crime (UNODC) and the FBI Internet Crime Complaint Center (IC3) indicates a shift from opportunistic kidnapping to streamlined logistical supply chains. Criminal syndicates now operate recruitment pipelines with the efficiency of multinational HR departments. These networks move victims from India, China, Africa, and the United States into Cambodian detention compounds with impunity. The destination for this human cargo is a network of fortified "parks" in Sihanoukville, Poipet, and O'Smach. These facilities function as sovereign enclaves where debt bondage enforces cyber-slavery.

#### The Digital Dragnet: Algorithms of Ensnarement

Recruitment begins on open web platforms. Syndicates utilize algorithmic targeting on Facebook, LinkedIn, and Telegram to identify vulnerable job seekers. The "bait" is consistently high-paying technical or data entry roles in Thailand or Dubai. Verified case files from the Indian Ministry of External Affairs reveal a specific pattern for 2024. Agents based in Uttar Pradesh and Bihar post advertisements for "Digital Marketing Executives" with salaries ranging from $1,200 to $2,000 USD. This figure is strategically chosen. It is high enough to entice but low enough to avoid immediate skepticism.

Victims undergo rigorous interview processes. These interviews are theater. They exist to establish a veneer of legitimacy. Applicants share passport details, educational certificates, and family contacts. This data is not for background checks. It is collateral. Traffickers use this information later to blackmail victims or threaten families if the worker attempts escape. Once "hired," the victim receives a visa and flight ticket. The destination is rarely Cambodia initially. Bangkok remains the primary transit hub due to its status as a regional tourism center.

Table 1: Recruitment Origin and Transit Metrics (2024-2025)

Origin Region	Primary Bait Role	Transit Hub	Entry Point to Cambodia	Est. Trafficked (2024)
<strong>South India</strong>	Data Entry / IT Support	Bangkok (BKK)	Poipet Land Border	5,000+
<strong>China</strong>	Crypto Customer Service	Phnom Penh (PNH)	Sihanoukville Highway	12,000+
<strong>East Africa</strong>	Construction / Admin	Dubai (DXB)	O'Smach Border	2,500+
<strong>Malaysia</strong>	Casino Management	Bangkok (BKK)	Koh Kong Border	1,800+

#### The Logistics of Human Cargo: Bangkok to the Border

The transfer from Thailand to Cambodia constitutes the second phase of the pipeline. Victims land at Suvarnabhumi Airport and are met by "company drivers." These drivers are traffickers. They confiscate passports immediately under the guise of visa processing. The transport then moves by road to the Thai-Cambodia border. The Aranyaprathet-Poipet crossing is the most documented artery. However, 2025 data shows a tactical shift to the remote O'Smach border crossing in Oddar Meanchey province.

O'Smach is significant. It is the fiefdom of sanctioned tycoon Ly Yong Phat. The US Treasury Department designated Ly and his L.Y.P. Group in September 2024 for serious human rights abuses. His control over the O'Smach Resort allows traffickers to move victims across the border without immigration scrutiny. Survivors report being driven directly through checkpoints into the resort compound. There is no stamp in their passport. Legally, they have vanished.

The "selling" of victims occurs upon arrival. Recruitment agents receive a commission ranging from $3,000 to $5,000 per head. This fee becomes the victim's initial "debt." The syndicate adds travel costs, visa bribes, and "training fees" to this total. A new arrival typically starts day one with a debt of $10,000 to $30,000. This debt is the legal fiction used to justify detention. The victim cannot leave until it is paid. The only way to pay is to defraud others.

#### Inside the Parks: Architecture of Detention

The term "park" is a euphemism for high-security prison complexes disguised as commercial real estate. Sihanoukville hosts the highest density of these facilities. Compounds like Jinshui Park and the White Sand Palace operate with military-grade security. High walls topped with razor wire verify the perimeter. Guard towers with armed sentries monitor all movement.

Inside the walls, the environment is designed for psychological breakdown. Workers sleep in dormitories housing 8 to 12 people. Personal phones are seized. Access to the outside world is restricted to company-monitored devices. The work floor mimics a legitimate call center. Rows of computers run multiple script-generating applications. The "Lazy Protocol" and other laundering scripts are pre-loaded.

Discipline is brutal. 2025 reports from rescued Nepali and Pakistani workers detail the use of electric cattle prods, water dungeons, and starvation as standard punishment. A specific marketplace for torture equipment was identified on the Huione Guarantee platform. This platform acts as an eBay for cyber-slavery. Listings in 2024 included electrified shackles and heavy-duty batons. The existence of a commercial market for these tools confirms that torture is not incidental. It is systemic.

The hierarchy within the parks is rigid.
* The Head: usually a Chinese national with links to triad networks.
* The Supervisor: enforces quotas. They are often previous victims who bought their way up.
* The Soldier: armed guards, often local mercenaries or uniformed police working off-duty.
* The Dog: the lowest tier victim. They must generate $30,000 in revenue per month to avoid physical punishment.

#### The Financial Arteries: Linking Slaves to US Wallets

The purpose of this pipeline is financial extraction. The victims in these camps are the engine for "Pig Butchering" scams (Sha Zhu Pan). In 2024, the revenue from these operations exceeded $12 billion. A substantial portion of these funds originated from US victims. The flow of money links the detention cells in Cambodia directly to crypto wallets in the United States.

The method is precise. Victims in the US are groomed via WhatsApp or LinkedIn. They are convinced to invest in fake crypto exchanges. When the victim transfers funds, the money enters a "mule" wallet. These wallets are often registered on US-compliant exchanges using stolen identities. From there, the funds are converted to Tether (USDT) on the TRON blockchain.

Chainalysis and TRM Labs verified a massive surge in USDT volume moving from US-based wallets to addresses clustered around Huione Pay in 2024. Huione Pay is the payment arm of the Huione Group. This conglomerate processes billions of dollars. In July 2024, researchers linked a specific wallet receiving North Korean Lazarus Group funds to Huione. The same nexus processes scam revenue.

Table 2: Financial Extraction & Laundering Velocity (2025 Estimates)

Metric	Value / Description
<strong>Avg. Victim Loss (US)</strong>	$185,000
<strong>Scammer Quota (Monthly)</strong>	$30,000 USD
<strong>Laundering Fee (Huione)</strong>	10% - 12% of transaction
<strong>Primary Asset</strong>	Tether (USDT) on TRON (TRC-20)
<strong>Destination Wallets</strong>	Huione Guarantee, L.Y.P. Group Affiliates

The DOJ seizure of $15 billion in cryptocurrency in October 2025 provided the smoking gun. The indictment named specific Cambodian compounds as the beneficiaries of these funds. The money trail proved that the "parks" are not just criminal hideouts. They are integrated nodes in the global financial system. The profits from a victim in Ohio pay for the electric shackles used on a victim from Mumbai.

#### Sanctions and the illusion of Enforcement

The US Treasury sanctions against Ly Yong Phat in September 2024 marked a diplomatic escalation. The designation cited the O'Smach Resort explicitly. However, enforcement on the ground remains porous. The Cambodian government's response has been mixed. While raids occur, they often target low-level operators. The owners remain untouched.

In January 2025, a raid on O'Smach resulted in the rescue of 57 foreign workers. They were found locked in a dormitory. The resort management claimed no knowledge of their presence. This deniability is the standard defense. The compounds operate as sublet real estate. The owner leases the floor to a "tech company." The tech company vanishes during a raid. The infrastructure remains ready for the next tenant.

The pipeline is resilient because it is profitable. The cost of a human life in this system is approximately $5,000. The potential revenue from that life is millions. As long as this asymmetry exists, the recruitment networks will continue to operate. They will continue to route victims through Bangkok and Dubai. They will continue to feed the parks.

### DeFi Mixing Services: The New Layer of Obfuscation for Stolen 'Pig Butchering' Assets

Date: February 9, 2026
Analyst: Chief Statistician, Ekalavya Hansaj News Network
Subject: Laundering Methodologies (2023–2026)

The mechanism of laundering stolen assets from Southeast Asian "pig butchering" (Sha Zhu Pan) compounds underwent a radical architectural shift between Q4 2023 and Q1 2026. As centralized exchanges (CEXs) implemented stricter KYC protocols under pressure from the U.S. Department of Justice (DOJ) and the Financial Action Task Force (FATF), criminal syndicates migrated their laundering infrastructure to Decentralized Finance (DeFi) protocols.

By January 2025, on-chain data confirmed a 210% increase year-over-year in the use of high-risk, no-KYC decentralized services for processing illicit flows. This section dissects the technical "smurfing" and "chain-hopping" methodologies now linking the Golden Triangle’s trafficking compounds directly to U.S.-hosted crypto wallets.

#### 1. The Statistical Pivot: DeFi vs. CEX (2024–2025)

The era of direct deposits to Binance or Coinbase is effectively over for high-level syndicates. In 2024, blockchain forensics firm Chainalysis and TRM Labs reported that while overall scam revenue fluctuated, the velocity of laundering through DeFi mixers surged.

* Total Scam Revenue (2024): $9.9 billion to $12.4 billion (Verified).
* Pig Butchering Share: 33.2% of total crypto scam revenue.
* DeFi Utilization: illicit flows to decentralized bridges and mixers rose by 200% between 2024 and 2025.
* Victim Pool Expansion: Deposits to scam addresses increased by 210% in 2024, while the average deposit size dropped by 55%. This indicates a strategic shift: industrial-scale targeting of middle-income victims rather than solely hunting "whales," necessitating automated, high-volume laundering solutions.

Table 1.1: Laundering Channel Volume Shift (Est. Billions USD)

Channel Type	2023 Vol. (Est)	2024 Vol. (Verified)	2025 Vol. (Proj)	YoY Change (24-25)
<strong>Centralized Exchanges (CEX)</strong>	$4.8B	$3.1B	$1.9B	-38%
<strong>DeFi Bridges & Mixers</strong>	$1.2B	$3.6B	$7.2B	+100%
<strong>High-Risk Exchanges (No KYC)</strong>	$2.5B	$4.1B	$5.5B	+34%
<strong>USDT (TRON) Direct Wallet</strong>	$5.1B	$8.7B	$11.4B	+31%

Data Source: Aggregated forensics from TRM Labs, Chainalysis, and FBI IC3 reports (2024–2025).

#### 2. The Huione Guarantee: The $100 Billion Engine

At the epicenter of this laundering network sits the Huione Group (rebranded as "Haowang" in late 2024 following exposure). Operating out of Cambodia, Huione Guarantee functions not merely as a marketplace but as a sovereign clearinghouse for cybercrime.

Verified Metrics (2024–2025):
* Total Transaction Volume: Surpassed $100 billion in USDT (Tether) transactions between January 2024 and June 2025.
* Illicit Service Escrow: $24 billion confirmed directly linked to scam equipment, human trafficking tools (e.g., electrified shackles), and money laundering services.
* The "Motorcade" Service: Vendors on Huione offer "Motorcades"—specialized laundering teams that guarantee the conversion of "black" crypto (stolen funds) into "white" cash (RMB or USD) for a fee ranging from 12% to 18%.

The platform operates primarily on Telegram, utilizing the TRON blockchain due to its low transaction fees and high USDT liquidity. In July 2024, on-chain evidence linked the North Korean Lazarus Group to Huione, utilizing the platform to launder $35 million. This marks a critical convergence: state-sponsored hackers providing technical laundering infrastructure to private criminal syndicates in Myanmar and Cambodia.

#### 3. The TRON-USDT Superhighway

The TRON blockchain (TRC-20 standard) is the logistical backbone of the pig butchering economy. In 2024, 58% of all illicit crypto volume occurred on TRON.

Why TRON?
1. Speed & Cost: Transactions cost cents, allowing scammers to "peel" large sums into thousands of micro-transactions (smurfing) without eroding profits.
2. USDT Dominance: 90%+ of pig butchering proceeds are collected in USDT.
3. Lack of Enforcement: While Tether (the issuer) freezes addresses occasionally, the sheer volume of wallet creation on TRON outpaces blacklist implementations.

The "Peel Chain" Technique:
Funds are not moved in bulk. A $1 million theft is split into 100 transactions of $10,000. These are further split into 1,000 transactions of $1,000. These "peels" move through hundreds of intermediary wallets on TRON before re-aggregating at a high-risk exchange or entering a cross-chain bridge.

#### 4. Cross-Chain Bridging: The "Hop" to Obfuscation

To break the chain of custody, syndicates in 2024 began aggressively using Cross-Chain Bridges. A bridge allows a user to lock an asset on one blockchain (e.g., TRON) and mint a wrapped version on another (e.g., Ethereum or Avalanche).

The 2024 Laundering Pattern (The "Avalanche Hop"):
1. Collection: Victim sends USDT (ERC-20 or TRC-20) to the scammer's wallet.
2. Aggregation: Funds are pooled into a "aggregator wallet" on TRON.
3. The Bridge: Funds are sent to a decentralized bridge (e.g., removing the need for a central authority). The assets are swapped for AVAX (Avalanche chain) or XMR (Monero).
4. The Exit: The clean assets are bridged back to Ethereum or sold on a P2P market for fiat.

This "chain hopping" breaks the heuristic analysis used by law enforcement. A warrant for a TRON wallet does not automatically grant visibility into the Avalanche blockchain. By the time investigators trace the hop, the funds have moved again.

#### 5. Case Study: The Prince Group & The $15 Billion Seizure

In October 2025, the U.S. Department of Justice unsealed an indictment against Chen Zhi, Chairman of the Prince Holding Group (Cambodia). This case represents the largest cryptocurrency forfeiture action in history.

Key Data Points:
* Seized Assets: 127,271 Bitcoin (valued at approx. $15 billion at time of filing).
* Charge: Operation of forced-labor scam compounds and wire fraud conspiracy.
* Methodology: The indictment revealed that Prince Group compounds utilized "cold storage" wallets (offline hardware) to hoard Bitcoin converted from victim funds. The private keys were held physically by Chen Zhi, bypassing the need for third-party launderers for the reserve capital.

This case verified that top-tier syndicates are not just "cashing out" but are functioning as sovereign investment funds, holding billions in crypto-assets derived from global fraud.

#### 6. The U.S. Mule Network: Daren Li & Geoffrey Auyeung

The final link in the chain is the "cash-out" in the United States. While the compounds are in Southeast Asia, the banking infrastructure used to layer the funds is often American.

The Daren Li Network (Indicted May 2024):
* Operator: Daren Li (Dual citizen, China/St. Kitts).
* Volume: $73 million laundered.
* Mechanism: Li managed a network of shell companies in the U.S. (registered in Delaware and Wyoming). These companies opened business bank accounts at legitimate U.S. institutions.
* The Flow: Victim funds -> U.S. Shell Company Bank Account -> Conversion to USDT (via U.S. Exchanges like Gemini/Coinbase) -> Transfer to Huione-linked wallets in Cambodia.

The Geoffrey Auyeung Network (Indicted Aug 2024):
* Location: Seattle, WA.
* Volume: $64 million traced.
* Entities: 74 different bank accounts under names like "Sea Forest International LLC" and "Apex Oil and Gas Trading."
* Pretext: Fake oil and gas investment platforms.
* Conversion: Funds were quickly moved from U.S. banks to crypto exchanges (BitStamp, Coinbase), converted to USDT, and sent to offshore wallets.

These cases prove that the USDT used to pay the traffickers in Myanmar often originates from U.S. bank accounts controlled by mules, creating a closed loop of financial destruction.

#### 7. Conclusion: The Industrialization of Laundering

The data from 2024–2025 illustrates a "Money Laundering-as-a-Service" (MLaaS) economy. The scam compounds (KK Park, Shwe Kokko) no longer handle their own laundering. They outsource it to specialized syndicates (Huione, Lazarus, US Mule Networks) who charge a premium for the risk.

Critical Metric for 2026:
Watch the Tether (USDT) freeze rate. In late 2024, Tether began freezing wallets at a higher rate, but the syndicates are already pivoting to DAI and USDC on decentralized exchanges to mitigate this risk. The cat-and-mouse game has moved entirely on-chain.

The operational logic of U.S. federal prosecutors shifted in late 2023. Realizing that extradition of syndicate leaders from Cambodia or Myanmar is geopolitically improbable, the Department of Justice (DOJ) and Secret Service (USSS) weaponized in rem civil forfeiture. This legal mechanism targets the property itself rather than the criminal defendant. The objective is immediate financial disruption. By establishing that specific crypto assets are proceeds of wire fraud, authorities can seize, liquidate, or "burn" tokens without requiring a criminal conviction of the foreign operators. Between Q3 2023 and Q1 2025, this strategy resulted in the freezing of over $400 million in US-linked stablecoin assets.

The Northern District of Ohio: Anatomy of a Token Burn

The Northern District of Ohio (NDOH) established a critical legal precedent in October 2024 regarding the technical destruction of illicit Tether (USDT). In United States of America v. 100,000 Tether (USDT) Cryptocurrency (Case No. 1:24-cv-01714-BMB), prosecutors detailed the precise laundering path of a single victim, identified as "L.D." from Ashtabula.

On February 22, 2024, L.D. attempted to transfer Bitcoin from a Trezor hardware wallet to a decentralized exchange aggregator. Scammers intercepted the transaction via a compromised "approval" signature, draining the wallet. The stolen Bitcoin was immediately swapped for USDT and routed through a chaotic web of intermediate addresses to obfuscate the trail. USSS agents, utilizing blockchain analytics, traced the funds to two specific Ethereum addresses ending in 700f10e and 35345a3.

Unlike traditional seizures where marshals take custody of physical cash, this action utilized the centralized control of the Tether smart contract. Upon issuance of the seizure warrant, Tether Limited blacklisted the illicit addresses and "burned" (destroyed) the 100,000 USDT tokens on-chain. Tether then minted an equivalent amount of fresh USDT to a government-controlled wallet. This "Burn and Mint" protocol circumvents the need for private keys, rendering the syndicate’s possession of the wallet useless. The timeline was ruthless; the assets were frozen, litigated, and forfeited in under eight months, a fraction of the time required for criminal proceedings.

California’s $112 Million Dragnet

While Ohio focused on surgical strikes against unhosted wallets, the Central District of California (CDCA) executed a mass-scale disruption of custodial accounts. In April 2023, the DOJ announced the seizure of $112 million linked to pig butchering investment schemes. The bulk of this haul—$66.4 million—was confiscated from a single account in Los Angeles following a magistrate judge's warrant.

Affidavits from the investigation reveal that the seized account acted as a "concentration wallet" for multiple Southeast Asian syndicates. Funds from victims across the United States were funneled into this account before being converted into fiat currency or moved to cold storage. The investigation utilized clustering analysis to link ostensibly unrelated victim reports to this single node. By proving that the account received deposits solely from known victim addresses, prosecutors established probable cause to seize the entire balance under 18 U.S.C. § 981(a)(1)(C).

This action coincided with the "Section 311" designation of the Huione Guarantee marketplace. Data from blockchain intelligence firm Elliptic confirmed in July 2024 that Huione, a Cambodian conglomerate, processed over $11 billion in transactions primarily linked to pig butchering and money laundering. The California seizures represent one of the few successful penetrations of this specific financial network, intercepting funds before they could be fully integrated into the Huione ecosystem.

Verified Asset Forfeiture Filings (2023-2025)

The following table aggregates verified civil forfeiture actions directly linking US victim funds to Southeast Asian trafficking compounds. Data is sourced from PACER filings and DOJ press releases.

Jurisdiction & Date	Case / Action Reference	Assets Seized	Operational Nexus
C.D. California Apr 2023	Seizure Warrant (sealed) Ref: DOJ Release 23-362	$112 Million (Various Crypto)	Concentration wallet for multi-syndicate laundering.
N.D. Ohio Oct 2024	USA v. 100,000 Tether Case No. 1:24-cv-01714	$200,000 USDT (Burned & Reissued)	Tracing victim "L.D." funds to unhosted wallets.
Global / USSS Nov 2023	Tether Freeze Action Collab with OKX	$225 Million (Frozen USDT)	Linked to "Prince Group" trafficking syndicates in Cambodia.
E.D. North Carolina Aug 2024	USA v. Approx. $5M Tether Seizure Warrant	$4.97 Million USDT	Funds traced to "investment" scams targeting elderly victims.