In October 2025, the U.S. Department of Justice unsealed an indictment against Chen Zhi, chairman of Cambodia's Prince Holding Group, and filed a civil forfeiture claim against approximately 127,271 Bitcoin — worth around $15 billion at the time, and the largest forfeiture action in DOJ history. Three months later, Cambodian authorities arrested Chen and extradited him to China. In March 2026, Singapore police arrested three Singaporeans in a related money laundering investigation.
A conglomerate that operated hotels, banks, and real estate developments across Southeast Asia was, according to U.S. prosecutors, simultaneously running forced-labor scam compounds that stole billions from victims worldwide. The case file describes dormitories ringed by high walls and barbed wire, profit ledgers maintained per compound, and "phone farms" — automated call centers running thousands of devices and millions of mobile numbers.
The Prince Group case is the most visible data point in a much larger picture. The United Nations Office on Drugs and Crime estimates that industrial-scale scam centers in Southeast Asia generate on the order of $40 billion in annual profits. The FBI's Internet Crime Complaint Center recorded $9.3 billion in cryptocurrency-related losses reported by Americans in 2024 alone — a 66 percent jump year over year — with $5.8 billion attributed to the "pig butchering" investment fraud that these compounds industrialized. And that is one country's reported losses, for one year.
This is no longer a fraud problem. It is a transnational criminal economy with its own labor force, real estate, payment rails, and political protection. Understanding how the money moves through it is the key to dismantling it.
The Compound as a Business Model
The scam compound is best understood as a vertically integrated fraud factory. The inputs are trafficked workers, telecom infrastructure, and target data. The output is stolen cryptocurrency and wire transfers. Everything in between is process engineering.
The workforce is the most disturbing input. UN and U.S. government sources estimate that between 100,000 and 150,000 people are exploited in scam compounds in Cambodia alone; Amnesty International identified at least 53 active compounds across the country in a June 2025 report. Many workers are lured by fake job advertisements — posted on the same social platforms the scams themselves run on — then held against their will, their passports confiscated, their quotas enforced with violence. Investigations into Myanmar's KK Park complex documented 17-hour workdays and torture of workers who attempted to flee.
The infrastructure is equally deliberate. Compounds cluster in special economic zones and loosely governed border areas — Myanmar's Myawaddy district, Cambodian provincial towns, the Golden Triangle. When Myanmar's military raided KK Park in October 2025, it detained more than 2,000 people and seized over 30 Starlink terminals: satellite connectivity had kept the operation online independent of any national telecom the authorities could pressure.
The fraud itself is scripted, multilingual, and increasingly AI-assisted. Pig-butchering teams work leads through weeks of relationship-building before steering victims to fake investment platforms. Translation tools and generative AI have removed the language barriers that once confined each compound to a handful of target countries. A single compound now runs concurrent campaigns against victims in a dozen languages.
The Laundering Stack
Stealing the money is half the operation. Moving roughly $40 billion a year from victims' wallets into usable assets requires laundering infrastructure at matching scale — and Southeast Asia's syndicates built it.
The centerpiece is the guarantee marketplace: Telegram-based platforms where vetted vendors sell the services a scam operation needs — laundering, mule accounts, stolen data, SIM farms, even the electrified shackles used in compounds — with the marketplace operator holding deposits as escrow. The largest of these was operated by Cambodia's Huione Group, whose ecosystem spanned a payments company, a cryptocurrency exchange, and the Haowang Guarantee marketplace. In May 2025, the U.S. Treasury's Financial Crimes Enforcement Network found that Huione Group had laundered at least $4 billion in illicit proceeds between August 2021 and January 2025 — including at least $37 million connected to North Korean cyber-heist operations — and in October 2025 FinCEN issued a final rule severing the group from the U.S. financial system entirely.
Beneath the marketplaces sits a familiar chain: victim funds move into the syndicate's wallets, hop through mixers and cross-chain bridges, consolidate into stablecoins — overwhelmingly dollar-pegged tokens, which offer the syndicates the stability of the dollar without the oversight of a correspondent bank — and then exit through over-the-counter brokers, underground banking networks, casinos, and real estate. The endpoint of the chain is the part that looks legitimate: hotels, development projects, and holding companies of exactly the kind Prince Group operated in plain sight for years.
Why Raids Alone Have Not Worked
The enforcement wave of 2025 and 2026 is real. The Chen Zhi indictment and record forfeiture. Coordinated U.S.-U.K. sanctions against Southeast Asian cybercrime networks — the largest action of its kind. The FinCEN rule against Huione. The KK Park raid. Thousands of workers released from Myanmar compounds under Chinese and Thai pressure.
And yet the UNODC assessed in 2025 that the industry had reached an inflection point — not of collapse, but of expansion. Crackdowns disrupt individual compounds, and the operations reappear in newly built business parks elsewhere in the region, or further afield. KK Park was one of roughly 30 compounds along Myanmar's border with Thailand. Earlier waves of releases — more than 7,000 workers freed in the February 2025 purge — did not measurably slow the fraud output. The syndicates treat raids as a cost of doing business: the compound is expendable, the network is not.
The network survives because each of its layers is usually investigated by a different institution, in a different country, with a different mandate. Anti-trafficking units see the labor pipeline. Financial intelligence units see the suspicious transaction reports. Blockchain analysts see the wallet clusters. Cybercrime teams see the phishing domains and fake trading apps. Diplomats see the sanctioned facilitators. Each sees a slice; the syndicate operates across all of them simultaneously.
What the Successful Cases Have in Common
Look closely at the actions that actually hurt the networks, and a pattern emerges: every one of them fused multiple intelligence disciplines around a single target network.
The Prince Group case connected blockchain tracing (127,271 Bitcoin attributed to fraud proceeds and mapped to the defendant), corporate records (the conglomerate's legitimate-facing structure across multiple jurisdictions), human-source and documentary evidence from inside the compounds (the ledgers, the phone farms), and international cooperation spanning Washington, London, Phnom Penh, Beijing, and Singapore. The Huione action fused years of transaction analysis across both crypto rails and the licensed payments business with monitoring of the Telegram marketplace where the services were openly advertised.
None of these cases was built from a single data source. That is the operational lesson for every agency and financial intelligence unit now confronting this economy.
The Fusion Problem, Concretely
For an investigator or FIU analyst, a scam-compound network presents as fragments scattered across incompatible systems:
- Open-web and platform signals. Recruitment ads for "customer service" jobs in Cambodia or Myawaddy. Guarantee-market vendor listings on Telegram. Fake trading platforms and their domain registration patterns. Victim complaints surfacing on social media. This is where web intelligence collection operates — and the channels are multilingual by design: Chinese-language marketplaces, Burmese and Khmer recruitment posts, victim-facing content in English, Japanese, or Bahasa.
- Financial signals. Suspicious transaction reports from banks and payment providers. Stablecoin flows through identifiable wallet clusters. Mule account networks whose cash-out patterns repeat across victims. Cross-border remittances that map to underground banking. This is financial intelligence terrain — STR analysis, cryptocurrency tracing across chains and mixers, and sanctions screening against the growing list of designated facilitators.
- Human signals. Trafficking reports from NGOs and embassies. Repatriated workers' debriefs describing compound layouts, management hierarchies, and quota systems. Border-crossing records that reveal the labor pipeline.
- Corporate and property signals. The holding companies, casino licenses, and real estate developments where the proceeds finally surface — often in the investigator's own jurisdiction.
Any one of these threads, pulled alone, ends at a jurisdiction boundary or an anonymous wallet. Fused, they resolve into a network: the same phone number bridging a Telegram vendor and a mule account application; the same wallet cluster paying a compound's Starlink reseller and receiving a victim's "investment"; the same corporate director appearing in a trafficking debrief and a land registry. This entity-resolution work — across languages, data formats, and source types — is precisely what intelligence fusion platforms exist to do, and it is the difference between prosecuting a compound and dismantling a syndicate.
What Agencies in the Region Should Take From 2025-2026
Treat scam networks as organized crime, not consumer fraud. The unit of analysis is the syndicate — its ownership, its laundering rails, its protection — not the individual scam report. Victim complaints are collection opportunities that, aggregated, map the network's infrastructure.
Put the guarantee marketplaces under permanent monitoring. The syndicates' service economy advertises in the open, on platforms that are far more collectable than the Tor-era underground. Vendor listings, escrow disputes, and channel-to-channel forwarding networks are a standing map of who provides what to whom.
Follow the stablecoins. Dollar-pegged tokens are the settlement layer of this economy. Wallet clustering, bridge monitoring, and exchange off-ramp analysis convert the blockchain's transparency from a talking point into case evidence — the Prince forfeiture proved the model at $15 billion scale.
Build for cross-border evidence from day one. Every significant case in this space has ended in a multi-jurisdiction action. Intelligence that cannot be packaged, sourced, and shared under legal frameworks — across ASEAN partners and beyond — stalls at exactly the border the syndicate planned around.
The compounds were built on the assumption that fragmented jurisdictions and fragmented data would protect them. The 2025-2026 enforcement wave showed what happens when investigators fuse the fragments. The task now is making that fusion routine instead of exceptional.