Intl. sting arrests 276, freezes $701M in crypto fraud

International law enforcement detained 276 suspects, closed nine scam centers and restrained more than $701 million in cryptocurrency tied to investment fraud that targeted U.S. residents, authorities reported. The operation was led by Dubai Police under the UAE Ministry of Interior in coordination with the U.S. FBI and China’s Ministry of Public Security. Investigators also seized domains, recruitment channels and digital evidence linking the networks to human trafficking and malware campaigns.

U.S. prosecutors have charged several defendants in connection with the rings, naming operations that allegedly ran under the Ko Thet Company, Sanduo Group and Giant Company brands. Federal indictments identify individuals including Thet Min Nyi, Wiliang Awang, Andreas Chandra and Lisa Mariam, along with two co-conspirators who remain at large. Some arrests of Burmese and Indonesian nationals were executed by Dubai and Thai officials.

Officials described the fraud as long-running schemes commonly known as “pig butchering” or romance baiting. Scammers first build trust through friendly or romantic contact, then persuade victims to move money into fraudulent cryptocurrency investment platforms. Investigators say victims were urged to borrow or take loans to increase investments, after which funds were laundered to accounts controlled by the fraud networks.

The Justice Department and the FBI reported links between the scam operations and human trafficking. Foreign nationals were recruited with false job offers and then forced to staff scam compounds under coercive conditions. Two Chinese nationals, Jiang Wen Jie and Huang Xingshan, were charged for running the Shunda compound in Myanmar and were arrested in Thailand. U.S. prosecutors allege workers at that compound were held against their will and forced to defraud victims under threats of violence.

The FBI’s Operation Level Up, launched in January 2024 to identify and alert potential victims of cryptocurrency investment fraud, notified nearly 9,000 people and is credited with saving an estimated $562 million as of April 2026. Law enforcement also seized a Telegram recruitment channel with more than 6,500 followers and a cluster of 503 fake investment websites used to target U.S. victims.

Alongside arrests, authorities restrained over $701 million in cryptocurrency alleged to be proceeds of these scam networks. The U.S. Treasury has sanctioned Cambodian Senator Kok An, business associates and companies including K99 Group, accusing them of operating scam compounds. The State Department announced rewards up to $10 million for information that leads to seizure or recovery of proceeds tied to the Tai Chang scam center in Myanmar.

Cyber tools were used to carry out and scale the schemes. Security researchers identified an Android banking trojan offered as malware-as-a-service that has been active since at least 2023 and is linked to activity at Cambodia’s K99 Triumph City compound. The malware was spread by SMS and email lures that directed victims to fake Google Play listings or spoofed government sites. Once installed, the app escalated permissions, harvested data and injected fake overlay screens to capture banking credentials. Analysts found the infrastructure registered about 35 new domains per month and used roughly 400 lure domains in 2025 to impersonate banks, government agencies, airlines and e-commerce platforms.

A related enforcement action, Operation Atlantic, froze roughly $12 million tied to a campaign that used “approval phishing” to gain control of crypto wallets. Approval phishing tricks victims into signing blockchain transactions that grant scammers control over wallets, allowing funds to be drained. Investigators have identified more than 20,000 victims across 30 countries, confiscated over 120 domains and traced an additional $33 million believed linked to investment fraud globally.

A. Tysen Duva, Assistant Attorney General for the Justice Department’s Criminal Division, warned, “Fraudsters who target Americans from overseas cannot operate with impunity, no matter where in the world they reside. Scam center organizers and fraudsters who defraud Americans and others will face justice in American courts and in courts around the world.” The Treasury has also launched an information-sharing initiative to provide eligible U.S. digital asset firms with actionable cybersecurity information to help detect and respond to threats tied to these schemes.