OAK — OnChain Attack Knowledge

Worked example · 2024-01

KK Park compound-operated investment-fraud takedown — Myanmar/Thailand border — 2024

Corrected 2026-10-11
the claimed 2024 Thai-Myanmar disruption is removed (documented crackdowns are Feb 2025 and the Oct 2025 junta raid, 2,198 detained), worker count corrected from 6,000–7,000 to roughly 2,000+, and the unsupported loss estimate is marked unverified.
Loss
not quantified by any source reviewed; aggregate victim deposits processed through the KK Park compound are unverified. Victims were spread worldwide. The compound housed on the order of 2,000 or more workers (Pulitzer Center reporting; the junta's October 2025 raid detained 2,198 people), many described as trafficked or coerced, operating romance-scam and friendship-scam feeder narratives at industrial throughput.
OAK Techniques observed
OAK-T11.005.003 (Compound-Operated Investment-Fraud Platforms) — primary; KK Park was a forced-labour scam compound on the Myanmar-Thailand border operating fake-CEX platforms (T11.005.001) and fake-custodian/asset-manager frauds (T11.005.002) at industrial scale. The compound's operational model — trafficked workers, multi-layer fraud stacking, jurisdictional arbitrage — is the canonical T11.005.003 signature.
Attribution
confirmed at the entity/compound level through investigative journalism (BBC, Reuters, UNODC reporting), satellite imagery, and survivor testimony. Individual operator attribution (compound leadership) is inferred-strong; no named-individual DOJ indictment at v0.1.
Key teaching point
KK Park is the canonical compound-level T11.005.003 worked example demonstrating that the industrial-scale scam-compound model is not a single-operator phenomenon — multiple independent compounds (KK Park, Shwe Kokko, O-Smach Resort, Huione Group affiliates) replicate the same T11.005.003 operational template across Southeast Asia, exploiting jurisdictional arbitrage and trafficked labour as the industrial substrate.

Summary

KK Park was a forced-labour scam compound located on the Myanmar side of the Myanmar-Thailand border, operating from approximately 2021 and still active into 2025. The compound housed on the order of 2,000 or more workers (the October 2025 raid detained 2,198 people), predominantly from China, Taiwan, Vietnam, Thailand, Malaysia, and other Southeast Asian countries, who were forced to operate romance-scam and friendship-scam feeder narratives targeting victims worldwide.

The compound's operational model was the canonical T11.005.003 template:

  1. Labour-force scale: Thousands of trafficked workers operated feeder narratives across dating apps, social media, and messaging platforms in multiple languages, at industrial throughput.
  2. Multi-layer fraud stacking: The compound operated fake-CEX platforms (T11.005.001), fake-custodian / asset-manager frauds (T11.005.002), and fake-recovery services targeting previous victims of the compound's own platforms — a closed-loop fraud ecosystem.
  3. Jurisdictional arbitrage: The compound exploited the contested jurisdiction of the Myanmar-Thailand border region, where law-enforcement cooperation was limited and extradition channels with victim-residence jurisdictions (U.S., EU, OECD) were functionally absent.
  4. Integrated laundering: Victim deposits in BTC, ETH, and USDT (predominantly on Tron) were funnelled through laundering infrastructure adjacent to the compound's operators.

The compound was the subject of extensive investigative journalism (BBC, Reuters) and UNODC/OHCHR reporting. Satellite imagery documented the compound's physical expansion from 2021 through 2024. No 2024 disruption of KK Park was found in the sources reviewed. The documented enforcement events are the 2025 crackdowns: a February 2025 Thai-led pressure campaign (cross-border internet and power cuts; an AFP report cites roughly 7,000 workers repatriated across the border region, not KK Park alone) and the Myanmar military's October 2025 raid, which detained 2,198 people at KK Park and was described by locals and experts as a staged public-relations exercise. The operational model is reported to persist and replicate elsewhere (Shwe Kokko in Myanmar, O-Smach Resort in Cambodia).

KK Park is the canonical per-compound T11.005.003 anchor, complementing the Huione/Prince Group federal-enforcement anchor at examples/2025-10-huione-compound-fraud-cohort.md. Together they establish that the compound-operated fraud model is a recurring structural phenomenon across independent Southeast Asian compounds, not a single-entity aberration.

Timeline (UTC)

When Event OAK ref
2021 KK Park compound established on Myanmar-Thailand border; trafficked-worker recruitment begins T11.005.003 surface (compound formation)
2021–2023 Compound scales to a workforce in the thousands (order of 2,000+ per Pulitzer Center); romance-scam feeder narratives operate in dozens of languages T11.005.003 (industrial operationalisation)
2022–2024 BBC, Reuters, UNODC, OHCHR publish investigative reports documenting the compound's forced-labour model, multi-layer fraud stacking, and victim-deposit flows (public-record establishment)
2023–2024 Multi-layer fraud stacking: fake-CEX platforms, fake-custodian frauds, and fake-recovery services operated from the same compound T11.005.001 + T11.005.002 + T11.005.003
2025-02 Thai-led cross-border pressure campaign and repatriations across the Myanmar border region (AFP: ~7,000 repatriated regionally); construction at compounds reported to continue (regional crackdown; not KK Park-specific)
2025-10-20 Myanmar military raids KK Park, detains 2,198 people; hundreds flee into Thailand; locals and experts call it a PR stunt (partial disruption)
2025 Operational model reported to persist and replicate at other compounds T11.005.003 (operator-mobility pattern)

Realised extraction

No source reviewed quantifies aggregate victim deposits for KK Park; any total is unverified. Recovery is generally difficult for compound-operated fraud because funds move through compound-adjacent laundering infrastructure.

Public references

Public References

See citations in corresponding technique file.

Techniques demonstrated (1)