OAK — OnChain Attack Knowledge

Worked example · 2024-01

KK Park compound-operated investment-fraud takedown — Myanmar/Thailand border — 2024

Loss
estimated hundreds of millions of USD-equivalent in victim deposits processed through the KK Park compound's fake-CEX and fake-investment-platform operations, distributed across thousands of individual victims worldwide. The compound housed approximately 6,000–7,000 trafficked workers operating romance-scam and friendship-scam feeder narratives at industrial throughput.
OAK Techniques observed
OAK-T11.005.003 (Compound-Operated Investment-Fraud Platforms) — primary; KK Park was a forced-labour scam compound on the Myanmar-Thailand border operating fake-CEX platforms (T11.005.001) and fake-custodian/asset-manager frauds (T11.005.002) at industrial scale. The compound's operational model — trafficked workers, multi-layer fraud stacking, jurisdictional arbitrage — is the canonical T11.005.003 signature.
Attribution
confirmed at the entity/compound level through investigative journalism (BBC, Reuters, UNODC reporting), satellite imagery, and survivor testimony. Individual operator attribution (compound leadership) is inferred-strong; no named-individual DOJ indictment at v0.1.
Key teaching point
KK Park is the canonical compound-level T11.005.003 worked example demonstrating that the industrial-scale scam-compound model is not a single-operator phenomenon — multiple independent compounds (KK Park, Shwe Kokko, O-Smach Resort, Huione Group affiliates) replicate the same T11.005.003 operational template across Southeast Asia, exploiting jurisdictional arbitrage and trafficked labour as the industrial substrate.

Summary

KK Park was a forced-labour scam compound located on the Myanmar side of the Myanmar-Thailand border, operating from approximately 2021 through its partial disruption in 2024. The compound housed an estimated 6,000–7,000 trafficked workers, predominantly from China, Taiwan, Vietnam, Thailand, Malaysia, and other Southeast Asian countries, who were forced to operate romance-scam and friendship-scam feeder narratives targeting victims worldwide.

The compound's operational model was the canonical T11.005.003 template:

  1. Labour-force scale: Thousands of trafficked workers operated feeder narratives across dating apps, social media, and messaging platforms in multiple languages, at industrial throughput.
  2. Multi-layer fraud stacking: The compound operated fake-CEX platforms (T11.005.001), fake-custodian / asset-manager frauds (T11.005.002), and fake-recovery services targeting previous victims of the compound's own platforms — a closed-loop fraud ecosystem.
  3. Jurisdictional arbitrage: The compound exploited the contested jurisdiction of the Myanmar-Thailand border region, where law-enforcement cooperation was limited and extradition channels with victim-residence jurisdictions (U.S., EU, OECD) were functionally absent.
  4. Integrated laundering: Victim deposits in BTC, ETH, and USDT (predominantly on Tron) were funnelled through laundering infrastructure adjacent to the compound's operators.

The compound was the subject of extensive investigative journalism (BBC, Reuters) and UNODC/OHCHR reporting. Satellite imagery documented the compound's physical expansion from 2021 through 2024. Partial disruption occurred in 2024 through coordinated Thai-Myanmar law-enforcement action, but the operational model replicated elsewhere (Shwe Kokko in Myanmar, O-Smach Resort in Cambodia) as operators relocated in response to enforcement pressure.

KK Park is the canonical per-compound T11.005.003 anchor, complementing the Huione/Prince Group federal-enforcement anchor at examples/2025-10-huione-compound-fraud-cohort.md. Together they establish that the compound-operated fraud model is a recurring structural phenomenon across independent Southeast Asian compounds, not a single-entity aberration.

Timeline (UTC)

When Event OAK ref
2021 KK Park compound established on Myanmar-Thailand border; trafficked-worker recruitment begins T11.005.003 surface (compound formation)
2021–2023 Compound scales to ~6,000–7,000 trafficked workers; romance-scam feeder narratives operate in dozens of languages T11.005.003 (industrial operationalisation)
2022–2024 BBC, Reuters, UNODC, OHCHR publish investigative reports documenting the compound's forced-labour model, multi-layer fraud stacking, and victim-deposit flows (public-record establishment)
2023–2024 Multi-layer fraud stacking: fake-CEX platforms, fake-custodian frauds, and fake-recovery services operated from the same compound T11.005.001 + T11.005.002 + T11.005.003
2024 Coordinated Thai-Myanmar law-enforcement action partially disrupts KK Park operations; hundreds of trafficked workers repatriated (partial disruption)
2024–2025 Compound operators relocate to other jurisdictions (Shwe Kokko, Laos, Philippines); operational model replicates T11.005.003 (operator-mobility pattern)

Realised extraction

Estimated hundreds of millions of USD-equivalent in aggregate victim deposits. Individual victims number in the thousands across multiple jurisdictions. Recovery is structurally foreclosed — deposited funds have been laundered through compound-adjacent infrastructure.

Public references

  • Cross-reference: T11.005.003 at techniques/T11.005.003-compound-operated-investment-fraud-platforms.md.
  • Cross-reference: 2025-10-huione-compound-fraud-cohort at examples/2025-10-huione-compound-fraud-cohort.md (Huione/Prince Group compound fraud cohort, canonical federal-enforcement anchor).
  • Cross-reference: 2023-09-jpex-hong-kong at examples/2023-09-jpex-hong-kong.md (JPEX Hong Kong, single-platform T11.005.001 anchor).

Public References

See citations in corresponding technique file.

Techniques demonstrated (1)