OAK — OnChain Attack Knowledge

Worked example · 2025-10

Huione Group / Prince Group Southeast Asia compound-operated investment-fraud cohort — multi-chain (BTC / ETH / USDT on Tron dominant) — 2020–2025

Loss
$15B Bitcoin forfeiture (Chen Zhi / Prince Group — DOJ October 2025, the largest single Bitcoin forfeiture in U.S. history); Ly Yong Phat / O-Smach Resort OFAC-designated September 2024; DOJ civil-forfeiture complaint (filed 2025-06-18) against ~$225M USDT laundered through 144 OKX accounts and tied by prosecutors to a Philippines scam compound; FinCEN found Huione Group laundered at least $4B of illicit proceeds between August 2021 and January 2025 (section 311 action; final rule October 2025). Pig-butchering-class losses are among the largest retail-victim loss classes in crypto; the claim that they exceed all other attack classes combined has no cited source and is not asserted here.
OAK Techniques observed
OAK-T11.005.003 (Compound-Operated Investment-Fraud Platforms — primary; the industrial-scale distribution of T11.005.001 through forced-labour scam compounds in Southeast Asia). OAK-T11.005 (Operator-side Fake-Platform Fraud — parent class; the compound structure co-locates multiple T11.005.001 fake-CEX platforms, T11.005.002 fake-custodian/"AI-trading" products, and fake-recovery-service operations under a single compound's operational control). OAK-T7 (Laundering — the Huione Group laundering infrastructure is identified by FinCEN as the primary laundering substrate for Southeast Asian compound-operated fraud, processing victim deposits at industrial throughput). OAK-T8 (Operational Continuity / Attribution Signals — the compound operators' mobility across jurisdictions and cross-platform wallet-address overlap constitute the T8.001 cluster-reuse signal at the compound-organisational layer). OAK-T15 (Off-chain Entry-Vector / Pre-Positioning — the romance-scam and friendship-scam feeder narratives, operated at industrial scale by trafficked workers, are the defining victim-acquisition surface).
Attribution
confirmed via OFAC designation (Ly Yong Phat / O-Smach Resort, September 2024), DOJ forfeiture filing (Chen Zhi / Prince Group, October 2025), and FinCEN section 311 final rule (Huione Group, October 2025). Individual platform operators within each compound are pseudonymous at the named-individual level; the compound-level operators (Ly Yong Phat, Chen Zhi) are confirmed at the federal-record level.
Key teaching point
The Southeast Asian scam-compound model is the industrial-organisational shape that produces T11.005.001 (Fake-CEX) at scale. The compound structure — forced labour, multi-platform fraud stacking, integrated laundering infrastructure, and jurisdictional arbitrage — converts the per-platform fake-exchange fraud into an industrial operation whose aggregate extraction is among the largest retail-victim loss classes in crypto. The detection surface is at the federal-record / OSINT layer (OFAC, FinCEN, DOJ, UNODC) rather than at the on-chain forensics layer; the on-chain signals are downstream of the compound's operational structure and require off-chain attribution context to interpret.
Corrected 2026-10-11
FinCEN's Huione finding is at least $4B (Aug 2021–Jan 2025), not "tens of billions"; the $225M USDT item is a 2025-06-18 DOJ civil-forfeiture complaint (144 OKX accounts, Philippines-linked) rather than a compound seizure, with the Tether/OKX freeze dated 2023-11; the unsourced "exceeds all hacks combined" claim was removed.

Summary

The Southeast Asian scam-compound ecosystem emerged circa 2020 and expanded through 2025 into the single largest retail-aggregate-loss class in crypto. The defining operational innovation is the compound model: forced-labour compounds in Cambodia, Burma (Myanmar), Laos, and the Philippines house thousands of trafficked workers who operate romance-scam and friendship-scam feeder narratives at industrial throughput, targeting victims globally in dozens of languages.

The compound structure layers three fraud products against the same victim cohort:

  1. Fake-CEX / pig-butchering platform (T11.005.001) — the victim is directed to deposit into a fake exchange whose balance display, trade history, and P&L dashboard are database fictions. The platform displays fictitious profits to induce escalating deposits; withdrawal is blocked or gated behind perpetual "tax" / "verification" preconditions.
  2. Fake-custodian / fake-asset-manager (T11.005.002) — the victim is sold an "AI-trading" yield product or "professional managed account" whose returns are fictional. The product does not trade; deposits are aggregated into the compound's laundering infrastructure.
  3. Fake-recovery service — previous victims of (1) or (2) are re-contacted by the same compound through a different feeder channel, claiming to be a "recovery service" or "law firm" that can recover the lost funds for an upfront fee. The recovery service is a secondary fraud operated by the same compound.

The laundering infrastructure (Huione Group) processes victim deposits through a multi-hop chain involving OTC desks, shell-company bank accounts, real-estate purchases, and casino-chip conversion. FinCEN's finding of at least $4B laundered between August 2021 and January 2025 marks Huione as a major laundering surface for the compound model.

Timeline

When Event OAK ref
2020 Industrial-scale scam compounds emerge in Cambodia (Sihanoukville); forced-labour trafficking model documented by UNODC and OHCHR T11.005.003 surface created
2020–2023 Compound model expands to Myanmar (Shwe Kokko / KK Park), Laos (Golden Triangle Special Economic Zone), and the Philippines (geographic expansion)
2022–2024 Huione Group emerges as the primary laundering infrastructure for compound-operated fraud; victim-deposit flows concentrate through Huione-associated wallets and OTC desks T7 laundering infrastructure
2024-09 OFAC designates Ly Yong Phat and O-Smach Resort for human-trafficking-linked scam-compound operation under Executive Order 13818 (OFAC designation)
2024–2025 FBI Operation Level Up notifies 5,831+ victims with $359M+ in prevented losses through retail-bank-side debit-card monitoring of known compound-operated platform deposit destinations (retail-bank-side prevention)
2023-11 Tether freezes ~$225M USDT after a DOJ investigation with OKX participation (the 2025 complaint is reported to concern funds linked to this freeze; coverage does not state it explicitly) (stablecoin-issuer freeze)
2025-06-18 DOJ files civil-forfeiture complaint (D.D.C.) against ~$225M USDT laundered through 144 OKX accounts; prosecutors tied the funds to a Philippines scam compound; 430+ victims identified. A complaint, not a completed seizure (DOJ enforcement)
2025-10 DOJ files civil forfeiture of $15B in Bitcoin against Chen Zhi / Prince Group (Cambodia) — largest single Bitcoin forfeiture in U.S. history (DOJ forfeiture)
2025-10 FinCEN issues section 311 final rule designating Huione Group as a primary money-laundering concern tied to Southeast Asian compound-operated fraud (FinCEN section 311)
2025–2026 Compound operators relocate in response to enforcement pressure; Cambodia → Myanmar → Laos → Philippines pattern documented by UNODC T8 operator mobility

What defenders observed

  • The compound structure converts individual fraud into industrial-scale extraction. The compound model's defining features — forced labour for victim-acquisition throughput, multi-layer fraud stacking, integrated laundering infrastructure, and jurisdictional arbitrage — produce aggregate extraction that is among the largest retail-victim loss classes in crypto. The FBI IC3 reported $5.8B in pig-butchering-class losses in the U.S. alone in 2024. The compound model is the operational substrate behind that aggregate.
  • The Huione Group laundering infrastructure is the binding constraint on compound operations. FinCEN's section 311 action (final rule October 2025; underlying finding at least $4B laundered, August 2021–January 2025) identifies Huione Group as a major laundering substrate for Southeast Asian compound-operated fraud — victim deposits across multiple compounds and multiple fake platforms concentrate through Huione-associated wallets, OTC desks, and shell-company banking infrastructure. Disrupting the laundering substrate (FinCEN section 311, OFAC designations, DOJ civil forfeiture) is the highest-leverage federal-action surface.
  • Jurisdictional arbitrage is the compound model's primary defence. Compounds operate in jurisdictions with weak or compromised law-enforcement cooperation (Myanmar's KK Park, the Laos Golden Triangle Special Economic Zone, contested areas of Cambodia) and relocate across jurisdictions in response to enforcement pressure. The cross-border mobility pattern is the T8.001 operator-continuity signal applied at the compound-organisational layer.
  • Retail-bank-side debit-card monitoring is the highest-cadence operational prevention surface. The FBI's Operation Level Up model — notifying retail banks when their debit cards are being used to deposit to known compound-operated platform addresses — prevented $359M+ in losses across 5,831+ victims by April 2025. The model operates at the retail-bank/payment-rail layer, which is upstream of the on-chain deposit and therefore the highest-cadence prevention surface for the compound-operated class.

What this example tells contributors writing future Technique pages

  • T11.005.003 is the primary classification for the compound-organisational shape. The compound model is structurally distinct from per-platform T11.005.001: it is the organisational infrastructure that produces T11.005.001 at scale, not a per-platform fraud. The multi-layer fraud stacking (fake-CEX + fake-custodian + fake-recovery), the forced-labour victim-acquisition throughput, and the integrated laundering infrastructure are the defining T11.005.003 signals.
  • The federal-record surface is the canonical detection layer for T11.005.003. OFAC SDN designations, DOJ civil-forfeiture filings, and FinCEN section 311 actions are the primary public-record anchors. On-chain victim-deposit-wallet cluster overlap with OFAC-designated entities is the on-chain signal, but the signal is downstream of the compound's organisational structure and requires off-chain attribution context to interpret.
  • The T11.005.003 / T7 / T8 co-occurrence is structural. Every compound-operated fraud case involves laundering infrastructure (T7 — Huione Group) and operator-continuity signals (T8 — cross-jurisdiction mobility, cross-platform wallet-address overlap). Contributors should map all three when documenting compound-operated cases.

Public references

  • United States Department of Justice. "United States Files Civil Forfeiture Action to Recover Cryptocurrency Traceable to Pig Butchering Scheme — Largest Single Forfeiture of Bitcoin in U.S. History." October 2025. $15B Bitcoin forfeiture against Chen Zhi / Prince Group.
  • OFAC. "Treasury Designates Cambodian Businessperson Ly Yong Phat and His Businesses for Human Rights Abuse." 12 September 2024. O-Smach Resort scam-compound designation.
  • FinCEN. "FinCEN Issues Final Rule Under Section 311 Against Huione Group." October 2025. Huione Group designated as a primary money-laundering concern tied to Southeast Asian compound-operated fraud.
  • United States Department of Justice. "U.S. Attorney's Office Announces Seizure of $225 Million in Cryptocurrency from Philippines Pig Butchering Operation." June 2025. (The filing is a civil-forfeiture complaint; see [fortune225m2025].)
  • FBI. "Operation Level Up: FBI Notifies Over 5,800 Victims of Cryptocurrency Investment Fraud." April 2025. Retail-bank-side debit-card monitoring model.
  • UNODC. "Transnational Organized Crime Threat Assessment — Southeast Asia." 2023–2025 editions. Compound-model operational description.
  • Chainalysis. "2025 Crypto Crime Report — Pig Butchering Revenue +40% YoY 2024."
  • Cross-reference: T11.005.003 (Compound-Operated Investment-Fraud Platforms) at techniques/T11.005.003-compound-operated-investment-fraud-platforms.md.
  • Cross-reference: T11.005 (Operator-side Fake-Platform Fraud) at techniques/T11.005-operator-side-fake-platform-fraud.md.

Proposed new BibTeX entries

@misc{dojoctober2025chenzhi,
  author = {{United States Department of Justice}},
  title = {United States Files Civil Forfeiture Action Against Cryptocurrency Traceable to Pig Butchering Scheme — Chen Zhi / Prince Group},
  year = {2025},
  month = oct,
  note = {Largest single Bitcoin forfeiture in U.S. history: $15B; Cambodia compound-operated case}
}

@misc{ofacseptember2024lyyongphat,
  author = {{Office of Foreign Assets Control (OFAC)}},
  title = {Treasury Designates Cambodian Businessperson Ly Yong Phat and His Businesses for Human Rights Abuse — O-Smach Resort Scam-Compound Operation},
  year = {2024},
  month = sep,
  day = {12}
}

@misc{fincenoctober2025huione,
  author = {{Financial Crimes Enforcement Network (FinCEN)}},
  title = {FinCEN Issues Final Rule Under Section 311 Against Huione Group — Primary Money-Laundering Concern Tied to Southeast Asian Compound-Operated Fraud},
  year = {2025},
  month = oct
}

@misc{dojjune2025philippinescompound,
  author = {{United States Department of Justice}},
  title = {U.S. Attorney's Office Announces Seizure of $225 Million in Cryptocurrency from Philippines Pig Butchering Operation},
  year = {2025},
  month = jun
}

Techniques demonstrated (5)