Thai-Southeast Asia $520M Cross-Chain Crypto Scam Network

August 2021

Huione Group begins accumulating what FinCEN later identifies as at least $4 billion in illicit proceeds through its payments and crypto services, linked to pig-butchering scam laundering and DPRK heist proceeds.

2022

Start of the victim complaint window analyzed in the Elliptic/HTCD investigation; Royal Thai Police begin receiving crypto-related victim reports that would eventually feed the joint dataset.

25 January 2025

Bybit suffers a $1.5 billion Ethereum theft attributed by the FBI to North Korea's Lazarus Group cluster TraderTraitor, the largest single crypto theft in history. North Korean cross-chain crime tactics are put under global scrutiny.

May 2025

FinCEN identifies Cambodia-based Huione Group as a primary money laundering concern under Section 311 of the USA PATRIOT Act, citing $4 billion in alleged illicit proceeds and its role as infrastructure for DPRK heist laundering and pig-butchering scam proceeds.

5 May 2025

U.S. Treasury OFAC sanctions the Karen National Army (KNA), its leader Saw Chit Thu, and his two sons for facilitating cyber scam compounds on the Thai-Burmese border, human trafficking, and cross-border smuggling.

16 July 2025

Elliptic publishes its State of Cross-Chain Crime 2025 report, estimating $21.8 billion in cumulative cross-chain criminal activity since 2022 — a threefold increase from 2023 — with North Korea accounting for approximately 12% of the total.

October 2025

End of the victim complaint window analyzed in the Elliptic/HTCD investigation; over 500 suspicious wallets linked to approximately $14 million in documented individual victim losses have been reported to the Royal Thai Police.

November 2025

U.S. Attorney Pirro officially launches the DOJ Scam Center Strike Force to target Chinese organized crime syndicates operating Southeast Asian scam centers, crypto investment fraud, and human trafficking operations.

February 2026

U.S. Secret Service reports the Scam Center Strike Force has seized more than $580 million in cryptocurrency from Chinese transnational criminal networks since the Strike Force's inception.

April 2026

Drift Protocol, the largest decentralized perpetual futures exchange on Solana, is exploited for approximately $285-286 million in what Elliptic attributes to a DPRK-linked operation following a six-month social engineering campaign — further establishing North Korean operatives as active in the Asia-Pacific threat landscape.

23 April 2026

DOJ Scam Center Strike Force announces major coordinated actions: criminal charges against managers of a Burma scam compound, seizure of a Telegram recruitment channel, takedown of 503 fraudulent investment websites, and restraint of over $700 million in cryptocurrency. OFAC simultaneously sanctions Cambodian Senator Kok An and businessman Rithy Raksmei.

18 June 2026

Elliptic publishes its joint report with the Royal Thai Police's High-Tech Crime Division, authored by Dr. Arda Akartuna, exposing $520 million in suspicious crypto transactions across 32 blockchains linked to a cross-chain scam and money-laundering network operating from January 2022 to October 2025.

24 June 2026

Wider media coverage of the Elliptic/HTCD report published, including The Daily Hodl and Crypto Briefing, bringing the $520 million figure and cross-chain network details to broader public attention.