Global Crackdown Arrests 276 in Major Crypto Scam Operation, Seizes $701 Million
A significant international law enforcement operation has led to the arrest of at least 276 individuals and the dismantling of nine scam centers involved in cryptocurrency investment fraud schemes targeting American citizens. This coordinated effort, spearheaded by Dubai Police in collaboration with the U.S. Federal Bureau of Investigation (FBI) and the Chinese Ministry of Public Security, has resulted in substantial financial losses for victims, amounting to millions of dollars.
International Collaboration and Arrests
The operation was initiated by the UAE’s Ministry of Interior, which facilitated the arrests of suspects from various countries, including Burma and Indonesia. Among those apprehended are Thet Min Nyi, 27, Wiliang Awang, 23, Andreas Chandra, 29, and Lisa Mariam, 29, who face federal charges of fraud and money laundering in the United States. Two additional co-conspirators remain at large.
Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division emphasized the global nature of fraud, stating, “Fraudsters who target Americans from overseas cannot operate with impunity, no matter where in the world they reside.” He reiterated the commitment of law enforcement to pursue justice for victims, regardless of geographical boundaries.
The Mechanics of the Scams
The indictment reveals that the defendants managed and recruited individuals for three companies—Ko Thet Company, Sanduo Group, and Giant Company—allegedly operating multiple scam centers. The scams typically involved building trust with victims over time, often through friendly or romantic relationships, a method known as “pig butchering” or romance baiting. This approach is closely linked to human trafficking, where foreign nationals are coerced into running scams under dire conditions, often after being lured by false promises of lucrative employment.
The Department of Justice (DoJ) noted that scammers would promote fake cryptocurrency investments, guiding victims to set up accounts and transfer funds to platforms that were, unbeknownst to them, fraudulent. Victims were often encouraged to invest more money, even borrowing from friends and family to do so. Once the funds were transferred, they were quickly laundered to various cryptocurrency accounts controlled by the fraudsters.
Victim Outreach and Financial Recovery
As part of its ongoing efforts, the FBI has notified nearly 9,000 victims and has reportedly saved them an estimated $562 million since the launch of “Operation Level Up” in January 2024. This initiative aims to proactively identify and alert victims of cryptocurrency investment fraud schemes.
Recent Developments in the Crypto Scam Landscape
In a related development, the DoJ has charged two Chinese nationals, Jiang Wen Jie (aka Jiang Nan) and Huang Xingshan (aka Ah Zhe), for their involvement in a major cryptocurrency investment fraud operation. They allegedly operated the Shunda scam compound in Myanmar and were planning to establish a second center in Cambodia after the first was seized by authorities.
Huang is reported to have played a significant role in the physical punishment of trafficked workers within the compound, while Jiang led a team that specifically targeted American victims. Both were arrested by Thai authorities in early 2026.
Human Trafficking and Cybercrime
The DoJ highlighted that the scam compounds utilized websites and mobile applications disguised as legitimate investment platforms to defraud victims. Workers within these compounds were often trafficked individuals, coerced into committing fraud under threats of violence. The crackdown has also led to the seizure of a Telegram channel used for recruiting victims and a cluster of 503 fake investment websites aimed at defrauding U.S. citizens.
Sanctions and Legislative Responses
In conjunction with these arrests, the U.S. Treasury Department has sanctioned Cambodian Senator Kok An, who is linked to a network of cyber scam operations. The sanctions also target businessman Rithy Raksmei and their associates, including companies like K99 Group. The U.S. government has offered rewards of up to $10 million for information leading to the seizure of proceeds related to the Tai Chang scam center in Burma.
The Cambodian parliament has responded to the rising tide of cybercrime by passing a new law aimed at preventing the re-emergence of scam centers. This legislation imposes severe penalties, including prison sentences of five to ten years and fines up to $250,000 for those convicted of operating scams.
Emerging Threats: Malware and Cyber Operations
In addition to the crackdown on scams, an Android banking trojan has been identified, likely operating from multiple locations, including the K99 Triumph City compound. This malware facilitates real-time surveillance, credential theft, and financial fraud. The trojan has been active since at least 2023 and is part of a broader malware-as-a-service (MaaS) platform.
Researchers have reported that the operation registers approximately 35 new domains monthly, utilizing both registered domain generation algorithms and lookalike domains to impersonate legitimate organizations. The scope of these scams has expanded geographically, targeting victims in regions such as Africa and Latin America.
Operation Atlantic: A Broader Context
These developments are set against the backdrop of Operation Atlantic, which has successfully frozen approximately $12 million from cybercrime operations targeting cryptocurrency scams. This operation employs a technique known as “approval phishing,” where victims are tricked into signing blockchain transactions that grant scammers control over their wallets.
The U.S. Secret Service has identified over 20,000 victims across 30 countries, including Canada and the U.K., and has confiscated more than 120 domains used for phishing. The Treasury Department’s Office of Cybersecurity and Critical Infrastructure Protection has also launched an initiative to enhance cybersecurity within the digital asset industry, providing actionable information to eligible firms.
For more details on the ongoing situation, refer to the original reporting source: thehackernews.com.
Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.
