Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to intelligence
enforcement-actioncryptocurrency-platform-riskidentity-impersonation-fraud

Arrest and Extradition of Chen Zhi for Multi-Billion Dollar Crypto Scam Operations

Updated 3mo agoFirst seen Jan 8, 20263 sources

Chen Zhi, the founder and chairman of the Prince Group conglomerate, was arrested in Cambodia and extradited to China following a joint investigation by Cambodian and Chinese authorities. U.S. prosecutors allege that Chen orchestrated a massive crypto fraud network involving forced-labor scam compounds in Cambodia, which generated billions of dollars through cryptocurrency investment and romance scams. The U.S. Department of Justice previously filed its largest-ever forfeiture action, seizing billions in bitcoin allegedly linked to Chen's operations, while the U.K. and other jurisdictions have confiscated properties associated with the Prince Group.

The arrest and extradition of Chen Zhi, along with two associates, marks a significant law enforcement action against Southeast Asia’s extensive cyber scam industry. In October, Chen and 128 entities linked to him were sanctioned by the U.S. and U.K., and authorities in Taiwan, Singapore, and Hong Kong have also seized assets connected to the group. The Prince Group’s operations, which spanned real estate, banking, entertainment, and airlines, are now under intense international scrutiny for their alleged role in orchestrating large-scale online fraud and human trafficking for scam operations.

Share:
Arrest and Extradition of Chen Zhi for Multi-Billion Dollar Crypto Scam Operations
Stay ahead

Get ahead of threats like this

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.

EVENT TIMELINE

How this story unfolded

5 events from the most recent confirmed update back to the earliest known activity.

5 EVENTS
Jan 7, 20266mo ago

Prince Group denies allegations and criticizes asset seizures

After the enforcement actions, the Prince Group publicly denied the accusations against it and criticized the seizure of assets tied to the case.

Cambodia extradites Chen Zhi to China

Following his arrest, Chen Zhi was extradited or deported from Cambodia to China. The move was described as a major law enforcement action against Southeast Asia's scam industry and was reported during the first week of January 2026.

Cambodia arrests Chen Zhi and two associates

Cambodian authorities apprehended Chen Zhi, described as head of the Prince Group, along with two associates as part of action against an alleged multi-billion-dollar cyber scam empire.

Authorities seize Prince Group-linked bitcoin and properties

Authorities seized about $15 billion in bitcoin and numerous properties linked to Chen Zhi and the Prince Group. Other jurisdictions including Taiwan, Singapore, and Hong Kong also reportedly seized Prince Group-connected assets.

U.S. and U.K. sanction Chen Zhi, Prince Group, and related entities

Before the arrest, U.S. and U.K. authorities imposed sanctions on Chen Zhi, the Prince Group conglomerate, and 128 related entities over alleged involvement in cyber-enabled fraud, illegal online gambling, sextortion, money laundering, and trafficking tied to scam compounds.

LINKED ENTITIES

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

88 LINKEDOpen in app
Affected products
13 linked
CoolifyVeeamOwncloudWindowsWhatsappCloudflareRoundcubeDiscordN8nOfficeChatgptTrust WalletCisco
Organizations
44 linked
Prince GroupBitfinexGlobal-eLedgerCheck Point Software TechnologiesBarracuda NetworksCisco SystemsRapid7DiscordPalo Alto NetworksRadwareSamsung ElectronicsKnownsecJaguar Land RoverLastPassCloudflareEmsisoftRecorded FutureStack OverflowMeta PlatformsReversingLabsNetskopeResecurityXMicrosoft CorporationCYFIRMAGroup-IBObjective-SeeTrust WalletTRM LabsUnleash ProtocolSedgwickWhiteDateManage My HealthUL SolutionsSgnlFlow FoundationKontigoFlowtyProsuraCanary MissionDesjardinsVroomVroomVroomTop10VPN
The operational view lives in Mallory

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t — which of your assets are affected, which threat actors are using it right now, which detections to deploy, and what to do next.
Exposure mapping

Map indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidence

Every observed campaign, victim, and pivot linked to actors named in this story.

Associated malware

Malware, exploits, and IOCs connected to the activity described here.

Detection signatures

YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alerts

Get matching new stories delivered to your team as they break — not the next morning.

AI threads

Ask questions about this story and take action on the answers.