Worked example · 2025-10
Huione Group / Prince Group Southeast Asia compound-operated investment-fraud cohort — multi-chain (BTC / ETH / USDT on Tron dominant) — 2020–2025
Summary
The Southeast Asian scam-compound ecosystem emerged circa 2020 and expanded through 2025 into the single largest retail-aggregate-loss class in crypto. The defining operational innovation is the compound model: forced-labour compounds in Cambodia, Burma (Myanmar), Laos, and the Philippines house thousands of trafficked workers who operate romance-scam and friendship-scam feeder narratives at industrial throughput, targeting victims globally in dozens of languages.
The compound structure layers three fraud products against the same victim cohort:
- Fake-CEX / pig-butchering platform (T11.005.001) — the victim is directed to deposit into a fake exchange whose balance display, trade history, and P&L dashboard are database fictions. The platform displays fictitious profits to induce escalating deposits; withdrawal is blocked or gated behind perpetual "tax" / "verification" preconditions.
- Fake-custodian / fake-asset-manager (T11.005.002) — the victim is sold an "AI-trading" yield product or "professional managed account" whose returns are fictional. The product does not trade; deposits are aggregated into the compound's laundering infrastructure.
- Fake-recovery service — previous victims of (1) or (2) are re-contacted by the same compound through a different feeder channel, claiming to be a "recovery service" or "law firm" that can recover the lost funds for an upfront fee. The recovery service is a secondary fraud operated by the same compound.
The laundering infrastructure (Huione Group) processes victim deposits through a multi-hop chain involving OTC desks, shell-company bank accounts, real-estate purchases, and casino-chip conversion. The industrial throughput — tens of billions of dollars across 2020–2025 per FinCEN — makes the compound model the dominant retail crypto-fraud laundering surface globally.
Timeline
| When | Event | OAK ref |
|---|---|---|
| 2020 | Industrial-scale scam compounds emerge in Cambodia (Sihanoukville); forced-labour trafficking model documented by UNODC and OHCHR | T11.005.003 surface created |
| 2020–2023 | Compound model expands to Myanmar (Shwe Kokko / KK Park), Laos (Golden Triangle Special Economic Zone), and the Philippines | (geographic expansion) |
| 2022–2024 | Huione Group emerges as the primary laundering infrastructure for compound-operated fraud; victim-deposit flows concentrate through Huione-associated wallets and OTC desks | T7 laundering infrastructure |
| 2024-09 | OFAC designates Ly Yong Phat and O-Smach Resort for human-trafficking-linked scam-compound operation under Executive Order 13818 | (OFAC designation) |
| 2024–2025 | FBI Operation Level Up notifies 5,831+ victims with $359M+ in prevented losses through retail-bank-side debit-card monitoring of known compound-operated platform deposit destinations | (retail-bank-side prevention) |
| 2025-06 | DOJ seizes $225M USDT from Philippines compound operation — the largest USDT seizure tied to Southeast Asian scam compounds | (DOJ enforcement) |
| 2025-10 | DOJ files civil forfeiture of $15B in Bitcoin against Chen Zhi / Prince Group (Cambodia) — largest single Bitcoin forfeiture in U.S. history | (DOJ forfeiture) |
| 2025-10 | FinCEN issues section 311 final rule designating Huione Group as a primary money-laundering concern tied to Southeast Asian compound-operated fraud | (FinCEN section 311) |
| 2025–2026 | Compound operators relocate in response to enforcement pressure; Cambodia → Myanmar → Laos → Philippines pattern documented by UNODC | T8 operator mobility |
What defenders observed
- The compound structure converts individual fraud into industrial-scale extraction. The compound model's defining features — forced labour for victim-acquisition throughput, multi-layer fraud stacking, integrated laundering infrastructure, and jurisdictional arbitrage — produce aggregate extraction that exceeds all other crypto-attack classes combined in retail-victim-count terms. The FBI IC3 reported $5.8B in pig-butchering-class losses in the U.S. alone in 2024. The compound model is the operational substrate behind that aggregate.
- The Huione Group laundering infrastructure is the binding constraint on compound operations. FinCEN's section 311 final rule (October 2025) identifies Huione Group as the primary laundering substrate for Southeast Asian compound-operated fraud — victim deposits across multiple compounds and multiple fake platforms concentrate through Huione-associated wallets, OTC desks, and shell-company banking infrastructure. Disrupting the laundering substrate (FinCEN section 311, OFAC designations, DOJ civil forfeiture) is the highest-leverage federal-action surface.
- Jurisdictional arbitrage is the compound model's primary defence. Compounds operate in jurisdictions with weak or compromised law-enforcement cooperation (Myanmar's KK Park, the Laos Golden Triangle Special Economic Zone, contested areas of Cambodia) and relocate across jurisdictions in response to enforcement pressure. The cross-border mobility pattern is the T8.001 operator-continuity signal applied at the compound-organisational layer.
- Retail-bank-side debit-card monitoring is the highest-cadence operational prevention surface. The FBI's Operation Level Up model — notifying retail banks when their debit cards are being used to deposit to known compound-operated platform addresses — prevented $359M+ in losses across 5,831+ victims by April 2025. The model operates at the retail-bank/payment-rail layer, which is upstream of the on-chain deposit and therefore the highest-cadence prevention surface for the compound-operated class.
What this example tells contributors writing future Technique pages
- T11.005.003 is the primary classification for the compound-organisational shape. The compound model is structurally distinct from per-platform T11.005.001: it is the organisational infrastructure that produces T11.005.001 at scale, not a per-platform fraud. The multi-layer fraud stacking (fake-CEX + fake-custodian + fake-recovery), the forced-labour victim-acquisition throughput, and the integrated laundering infrastructure are the defining T11.005.003 signals.
- The federal-record surface is the canonical detection layer for T11.005.003. OFAC SDN designations, DOJ civil-forfeiture filings, and FinCEN section 311 actions are the primary public-record anchors. On-chain victim-deposit-wallet cluster overlap with OFAC-designated entities is the on-chain signal, but the signal is downstream of the compound's organisational structure and requires off-chain attribution context to interpret.
- The T11.005.003 / T7 / T8 co-occurrence is structural. Every compound-operated fraud case involves laundering infrastructure (T7 — Huione Group) and operator-continuity signals (T8 — cross-jurisdiction mobility, cross-platform wallet-address overlap). Contributors should map all three when documenting compound-operated cases.
Public references
- United States Department of Justice. "United States Files Civil Forfeiture Action to Recover Cryptocurrency Traceable to Pig Butchering Scheme — Largest Single Forfeiture of Bitcoin in U.S. History." October 2025. $15B Bitcoin forfeiture against Chen Zhi / Prince Group.
- OFAC. "Treasury Designates Cambodian Businessperson Ly Yong Phat and His Businesses for Human Rights Abuse." 12 September 2024. O-Smach Resort scam-compound designation.
- FinCEN. "FinCEN Issues Final Rule Under Section 311 Against Huione Group." October 2025. Huione Group designated as a primary money-laundering concern tied to Southeast Asian compound-operated fraud.
- United States Department of Justice. "U.S. Attorney's Office Announces Seizure of $225 Million in Cryptocurrency from Philippines Pig Butchering Operation." June 2025.
- FBI. "Operation Level Up: FBI Notifies Over 5,800 Victims of Cryptocurrency Investment Fraud." April 2025. Retail-bank-side debit-card monitoring model.
- UNODC. "Transnational Organized Crime Threat Assessment — Southeast Asia." 2023–2025 editions. Compound-model operational description.
- Chainalysis. "2025 Crypto Crime Report — Pig Butchering Revenue +40% YoY 2024."
- Cross-reference: T11.005.003 (Compound-Operated Investment-Fraud Platforms) at
techniques/T11.005.003-compound-operated-investment-fraud-platforms.md. - Cross-reference: T11.005 (Operator-side Fake-Platform Fraud) at
techniques/T11.005-operator-side-fake-platform-fraud.md.
Proposed new BibTeX entries
@misc{dojoctober2025chenzhi,
author = {{United States Department of Justice}},
title = {United States Files Civil Forfeiture Action Against Cryptocurrency Traceable to Pig Butchering Scheme — Chen Zhi / Prince Group},
year = {2025},
month = oct,
note = {Largest single Bitcoin forfeiture in U.S. history: $15B; Cambodia compound-operated case}
}
@misc{ofacseptember2024lyyongphat,
author = {{Office of Foreign Assets Control (OFAC)}},
title = {Treasury Designates Cambodian Businessperson Ly Yong Phat and His Businesses for Human Rights Abuse — O-Smach Resort Scam-Compound Operation},
year = {2024},
month = sep,
day = {12}
}
@misc{fincenoctober2025huione,
author = {{Financial Crimes Enforcement Network (FinCEN)}},
title = {FinCEN Issues Final Rule Under Section 311 Against Huione Group — Primary Money-Laundering Concern Tied to Southeast Asian Compound-Operated Fraud},
year = {2025},
month = oct
}
@misc{dojjune2025philippinescompound,
author = {{United States Department of Justice}},
title = {U.S. Attorney's Office Announces Seizure of $225 Million in Cryptocurrency from Philippines Pig Butchering Operation},
year = {2025},
month = jun
}