US-Led Seizure of $15 Billion in Cryptocurrency from Southeast Asian Scam Empire
US authorities, in collaboration with their UK counterparts, executed a historic seizure of nearly 130,000 bitcoins, valued at approximately $15 billion, from a criminal organization operating out of Cambodia. This operation marks the largest financial seizure of any kind in US history. The criminal network, known as the Prince Group and led by CEO Chen Zhi (aka Vincent), ran massive scam compounds across Cambodia, Myanmar, and Laos. These compounds were notorious for using forced labor to perpetrate large-scale cryptocurrency investment fraud, commonly referred to as 'pig butchering' scams. Victims were lured into online relationships and convinced to invest in fraudulent crypto schemes, resulting in billions of dollars in losses worldwide. The scam operations were characterized by the use of violence and coercion, with trafficked workers held against their will and forced to conduct online fraud on an industrial scale. The US Department of Justice unsealed an indictment against Chen Zhi and the Prince Group, detailing the extent of the operation and the methods used to launder and store the illicit proceeds. The seized cryptocurrency represents the largest amount ever confiscated in a US law enforcement action, underscoring the global reach and financial impact of the scam. The operation also highlights the growing intersection of human trafficking and cyber-enabled financial crime, as the scam compounds relied on both physical and digital means to exploit victims and evade detection. The investigation revealed that the criminal group targeted victims in the United States and around the world, using sophisticated social engineering tactics to build trust before defrauding them. The seizure was the result of extensive international cooperation and intelligence sharing, reflecting the complexity of dismantling transnational cybercrime networks. Authorities emphasized the importance of disrupting the financial infrastructure of such organizations to deter future operations. The case has drawn attention to the need for increased vigilance and regulatory oversight in the cryptocurrency sector, as digital assets continue to be exploited by organized crime. The Prince Group's operations have been linked to a broader pattern of cyber-enabled fraud and human rights abuses in Southeast Asia. The US government has called for continued international collaboration to combat similar scam networks and to provide support for victims of both financial fraud and human trafficking. The indictment and asset seizure serve as a warning to other criminal enterprises leveraging technology and coercion for illicit gain. The operation is expected to have a significant impact on the global cybercrime landscape, disrupting one of the most prolific scam networks to date. Law enforcement agencies are continuing to pursue leads related to the whereabouts of Chen Zhi and other key figures in the organization. The case underscores the evolving nature of cybercrime, where traditional criminal methods are increasingly intertwined with advanced digital tactics and cross-border operations.

Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
6 events from the most recent confirmed update back to the earliest known activity.
Researchers claim satellites leak unencrypted communications data
Security research highlighted claims that satellites were leaking unencrypted communications data, exposing sensitive transmissions to interception. The report underscored risks from insecure legacy or poorly protected space-based communications systems.
Senator Wyden alleges federal agencies accessed Flock Safety data
Senator Ron Wyden sent a letter alleging that ICE, the Secret Service, and Navy investigators had access to Flock Safety's AI-powered license-plate recognition data. The allegation raised concerns about potential misuse of surveillance data by federal agencies.
Report reveals covert FBI 'Group 78' anti-Black Basta effort
European media outlets reported that the FBI had operated a secret 'Group 78' task force focused on disruptive actions against the Black Basta ransomware gang. The reported effort included discussions of operations inside Russia and attempts to encourage Russian prosecutions of gang members.
Hackers leak personal data of U.S. federal law-enforcement officials
A member of 'the Com' posted spreadsheets on Telegram containing personal information for hundreds of DHS, FBI, DOJ, and ICE officials, including some home addresses. The doxxing incident exposed sensitive details of U.S. federal law-enforcement personnel.
Researchers report North Korean EtherHiding malware delivery technique
Google researchers disclosed that North Korean hackers used an 'EtherHiding' technique, embedding malware-hosting logic in an Ethereum smart contract to deliver cryptocurrency-stealing payloads. The finding added new technical detail on how blockchain infrastructure is being abused for malware delivery.
U.S. seizes $15 billion in cryptocurrency from scam networks
U.S. authorities carried out a major cryptocurrency seizure valued at about $15 billion tied to Southeast Asian, including alleged Cambodian, scam and laundering networks. The action was highlighted as a significant law-enforcement disruption of large-scale fraud infrastructure.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.


