TL;DR
- In a massive coordinated interagency effort, the Department of Justice (DOJ), the Department of the Treasury’s Office of Foreign Assets Control (OFAC), and the Department of State announced sweeping actions against transnational criminal organizations operating cryptocurrency scam centers in Southeast Asia.
- DOJ Actions: The Scam Center Strike Force charged two Chinese nationals for managing the Shunda scam compound in Burma; seized a Telegram channel used to recruit trafficking victims; took down 503 fake cryptocurrency investment websites; and restrained over $700 million in cryptocurrency tied to scam money laundering. Restraining refers to a court-ordered block that prevents criminals from transferring the crypto, preserving the funds so they can ultimately be seized and potentially returned to victims.
- OFAC Sanctions: OFAC designated Cambodian Senator Kok An, his business empire, and 28 other individuals and entities — including casinos, front companies, and a Cambodian bank — for their roles in housing and facilitating human trafficking and cyber-enabled fraud.
- State Department Rewards: A reward of up to $10 million was announced for information leading to the seizure of proceeds related to the Tai Chang scam center in Burma.
- These actions mark a significant escalation in the U.S. government’s “whole-of-government” strategy to disrupt the infrastructure of “pig butchering” and other cyber-enabled fraud schemes that have drained billions of dollars from American citizens.
In one of the most comprehensive crackdowns on the global shadow economy of cyber-enabled fraud to date, U.S. authorities announced on April 23, 2026 a multi-pronged strike against Southeast Asian scam centers. Led by the DOJ’s Scam Center Strike Force, alongside OFAC and the Department of State, the coordinated actions target the entire lifecycle of transnational scam operations: from the compounds where human trafficking victims are held captive, to the digital infrastructure used to defraud victims, to the financial networks used to launder the stolen cryptocurrency.
Cryptocurrency investment fraud — often referred to by scammers as “pig butchering” — is currently one of the most financially devastating forms of cybercrime. According to the FBI’s Internet Crime Complaint Center (IC3), reported losses from these scams reached an estimated $7.2 billion in 2025. These operations are largely run out of industrial-scale compounds in countries like Burma (Myanmar) and Cambodia, where criminal syndicates use forced labor and violence to execute massive fraud campaigns against global victims.
DOJ strike force: arrests, seizures, and $700 million restrained
Criminal charges for scam bosses
Authorities unsealed criminal complaints against two Chinese nationals, Huang Xingshan and Jiang Wen Jie, who served as managers at the Shunda compound in Min Let Pan, Burma. Before the compound was seized by local forces late last year, Huang and Jiang oversaw operations where trafficked workers were subjected to physical punishment and forced to defraud American victims using fake cryptocurrency investment platforms. The two men were arrested in Thailand earlier this year while attempting to transit between scam compounds in Cambodia and Burma.
Disrupting recruitment
The Strike Force also executed a first-of-its-kind seizure of a Telegram channel containing over 6,000 followers. The channel was used to lure English-speaking individuals to Cambodia under the guise of high-paying jobs. Once there, they were forced into operating a sophisticated law enforcement and bank impersonation scheme targeting U.S. citizens.
Additionally, through its “Operation Level Up” initiative, the FBI and U.S. Secret Service seized 503 web domains designed to look like legitimate cryptocurrency investment platforms. These sites successfully tricked victims into depositing crypto funds into wallets controlled by the scammers.
Restraining over $700 million in crypto
Perhaps most notably for the broader crypto ecosystem, the Strike Force announced that it has successfully restrained over $701.9 million in cryptocurrency tied to the laundering of stolen victim funds. This was achieved through a combination of U.S. legal process and voluntary actions by cryptocurrency service providers.
OFAC designations: targeting the Cambodian scam network
While the DOJ targeted the operators and digital footprint, OFAC struck at the political and financial elite enabling these compounds. OFAC designated 29 targets in Cambodia, effectively cutting them off from the global U.S. financial system.
At the center of the sanctions is Kok An, a Cambodian senator and businessman. According to OFAC, Kok An’s sprawling business empire — including Crown Resorts and Anco Brothers Co Ltd — owns and manages casinos and properties in cities like Poipet and Sihanoukville that have been explicitly retrofitted to serve as scam compounds. Kok An allegedly provides security and infrastructure to these criminal syndicates while collecting rental income and using casino operations to launder the proceeds.
OFAC also sanctioned several of Kok An’s close associates and their associated businesses, which form a complex web of casinos, real estate, and financial institutions used to facilitate these crimes:
- Rithy Raksmei and his K99 Group, a casino operator managing multiple Sihanoukville properties linked to romance scams, Ponzi schemes, and human rights abuses.
- Luo Hong and his company Bolai (Brilliancy Sihanoukville Investment and Development Co Ltd), which operates social media channels and gambling websites used to launder millions of dollars of scam-derived funds, routing them from U.S. victims to bank accounts in Cambodia.
- Heng Feng Cambodia Bank plc, a financial institution controlled by sanctioned associate Sai Aung Linn, demonstrating the overlap between these illicit operations and regional banking infrastructure.
Among these designations, the K99 Group and Bolai illustrate how Southeast Asian criminal networks operationalize their schemes. More recently, Infoblox’s research connected malware deployment to scam compounds and their operations, among them K99. This probably signifies a shift in the tactics, techniques, and procedures (TTPs) commonly observed in pig butchering scams, as scam operators continue to adapt and expand their toolkit beyond social engineering.
Meanwhile, Bolai operates along a distinct financial track, relying on third-party payment processors to funnel deposits and creating an unregulated financial pathway for laundering money. As shown in the Chainalysis Reactor graph below, the payment processor used by Bolai has receiving exposure from other questionable entities, including a Black U service, a pig butchering scam, and a fraud shop selling social media profiles. These connections indicate a close interconnectedness of these actors within the wider and sprawling illicit ecosystem.
Implications for sanctions compliance and monitoring
The U.S. government’s sweeping actions highlight a crucial reality: the infrastructure of transnational cyber fraud relies heavily on the blockchain to move and launder stolen wealth. However, the inherent transparency of cryptocurrency provides law enforcement and compliance teams with the tools needed to follow the money, restrain funds, and identify the physical entities — like Southeast Asian casinos and real estate conglomerates — cashing out the proceeds.
For cryptocurrency exchanges, financial institutions, and compliance professionals, these OFAC designations introduce significant new risks associated with Southeast Asian casino networks, regional banks like Heng Feng Cambodia Bank, and the web of holding companies identified.
With Chainalysis’s solutions, organizations can monitor and detect exposure to high-risk activity associated with the sanctioned entities. We have labeled the relevant cryptocurrency addresses associated with these scam networks in our product suite to ensure our customers can proactively identify exposure, prevent the laundering of victim funds, and maintain global compliance standards.
Chainalysis will continue to monitor the on-chain fallout from today’s designations.
FAQs
What is the Scam Center Strike Force?
The Scam Center Strike Force is an interagency U.S. government initiative officially launched in November 2025 by the Department of Justice. Its mission is to address the growing threat posed by transnational organized crime syndicates — primarily operating out of Southeast Asia — that execute cryptocurrency investment fraud, cyber-enabled fraud, human trafficking, and money laundering operations targeting Americans.
What is “pig butchering” or cryptocurrency investment fraud?
“Pig butchering” is a financially devastating form of cybercrime where fraudsters cultivate a relationship with a victim over time — often posing as a romantic interest or friend — before deceiving them into depositing money into fake cryptocurrency investment platforms. The platforms display fabricated, high-yield returns to encourage further deposits, but the funds actually flow directly into the scammers’ wallets.
Who did OFAC sanction in connection with these scam operations?
OFAC designated 29 targets in Cambodia, centering on Cambodian Senator Kok An, his business associate Rithy Raksmei, and their sprawling network of casinos, hotels, and holding companies. These entities, which include Crown Resorts, K99 Group, and Heng Feng Cambodia Bank plc, are alleged to provide the physical infrastructure for scam compounds, facilitate human trafficking, and launder the stolen cryptocurrency proceeds.
How much stolen cryptocurrency has been intercepted?
According to the DOJ, law enforcement agencies working under the Scam Center Strike Force have successfully restrained over $700 million in cryptocurrency. These funds, which were tied to the laundering of victim deposits, were secured through a combination of U.S. legal process and the voluntary cooperation of cryptocurrency service providers.
What should individuals do if they believe they are victims of this type of fraud?
Victims of Southeast Asian scam centers or cryptocurrency investment fraud are strongly encouraged to report the incident to the FBI’s Internet Crime Complaint Center at ic3.gov. Timely reporting can assist law enforcement in tracking stolen funds and potentially identifying the perpetrators.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
