On October 14, 2025, the United States Attorney’s Office in the Eastern District of New York announced the indictment of a corporate executive of a Cambodian-based company for wire fraud and money laundering arising out of a near decade-long “pig butchering” cybercrime scheme, alongside a corresponding civil forfeiture action seeking approximately 12,271 bitcoin—worth approximately $15 billion—that are alleged to be proceeds and instrumentalities of the scheme.  This is the largest forfeiture action in the Department of Justice’s history, and, together with the charges against the corporate executive, signals that the Department will continue to pursue corporate criminal enforcement, particularly where it involves cybercrime and cryptocurrency.

According to the government’s , since approximately 2015, the Cambodian-based company, known as the Prince Holding Group (“Prince Group”), under the direction of its Chairman, Chen Zhi (“Zhi”), was operating as one of the largest transnational criminal organizations in Asia.  Although Prince Group claimed to be involved in real estate development and other legitimate businesses, the government alleges that, in reality,  Prince Group used a sophisticated forced-labor scheme employing thousands of people to commit large-scale cryptocurrency fraud that enabled Zhi and his associates to steal and launder billions in fraudulent proceeds.

Specifically, the government alleges that Zhi and other Prince Group executives built and operated at least ten compounds in Cambodia, housing migrant workers who were then forced to execute cyber scams at high volumes.  Additional scams were operated with the assistance of local networks around the world.  One such network operated in Brooklyn, New York, between May 2021 and August 2022 and stole over $18 million from more than 250 victims, which was laundered through a series of accounts to Prince Group.  (Eleven individuals alleged to have been involved in the Brooklyn Network were indicted for various offenses in October 2022, ten of whom have pled guilty).

In these scams, perpetrators contact victims through messaging or social media apps—often under the pretense of a wrong number—then build relationships with the victims over time and convince the victims to invest cryptocurrency with promises that it will generate significant profits. Some showed victims false profiles or investment dashboards from trading platforms or false investment reports to maintain their trust.  But instead of investing the funds, the perpetrators misappropriated them and laundered them through Prince Group’s businesses.  The compounds created by Prince Group and Zhi are alleged to have been built specifically to provide the necessary infrastructure to run such a sprawling criminal scheme.  For example, Zhi maintained documents describing and depicting “phone farms,” which were used to facilitate the various fraudulent schemes.  A picture of one of those phone farms, taken from the indictment, is depicted below:

Zhi is alleged to have been directly involved in managing the scam compounds and maintaining records that tracked the profits from the scams, including ledgers that specifically referred to “pig butchering,” “Russian order fraud,” and other items explicitly identified as fraud or scams.  Zhi and his associates allegedly also used acts of violence, such as physical beatings, to ensure compliance among the workers at the compounds.

As the government’s press release on this matter notes, these schemes are an example of how transnational criminal organizations have leveraged cryptocurrency to better launder and conceal their criminal activities and increase their ill-gotten gains.  Many of the scam’s cryptocurrency proceeds were converted to conventional currency that was used to purchase “clean” cryptocurrency, while other portions of the scam proceeds were used to fund large-scale cryptocurrency mining operations that produced large sums of bitcoin dissociated from criminal activities.  Zhi and his associates also allegedly engaged in traditional money laundering techniques, such as mixing criminal cryptocurrency proceeds with “clean” cryptocurrency, or using “spraying” and “funneling” techniques in which large volumes of cryptocurrencies were disaggregated into a large number of wallets and then re-consolidated into fewer.

There are several lessons to take away from this significant indictment and forfeiture proceeding.

First, the charges indicate that the Department of Justice and U.S. Attorney’s Offices around the country are still pursuing corporate entities and their executives for serious crimes, particularly where they involve cybercrime and the fraudulent misuse of cryptocurrency.  Although there have been indicators of a slowdown in certain more traditional areas of corporate criminal enforcement, this case is evidence that the Department has and will continue to pursue egregious criminal activities of the sort alleged here.

Second, while Prince Group is alleged to be a wholly criminal organization, the case is still a reminder that companies should continue to develop and maintain internal controls to prevent misuse of corporate resources for criminal purposes.  Because, as this case illustrates, cybercriminals often mask unlawful operations behind seemingly legitimate business fronts, companies should implement robust internal whistleblower and compliance programs, regularly audit high-risk business units, and train employees to spot red flags to ensure that their resources are not being used to facilitate unlawful conduct.

Third, multinational businesses face heightened exposure to enforcement actions when operating in high-risk jurisdictions or sectors.  Transnational crime schemes often exploit regulatory gaps and weak enforcement in certain countries. U.S.-based companies or foreign entities with U.S. touchpoints should conduct enhanced due diligence when expanding internationally, especially in regions known for labor abuses, cybercrime, or lax oversight of financial flows.  Implement tailored risk assessments and consider engaging local counsel or third-party investigators to monitor for signs of illicit activity.

Fourth, law enforcement’s growing sophistication in tracing and seizing digital assets raises the stakes for cryptocurrency-related compliance.  The success of this record-breaking forfeiture demonstrates the government’s ability to track blockchain transactions and recover criminal proceeds—even across borders. Companies and investors must ensure they are not unwittingly facilitating or receiving tainted funds, which may put them at risk of civil and criminal enforcement actions.  Regularly screen counterparties and wallet addresses against sanctions watchlists and maintain detailed records of cryptocurrency transactions to demonstrate compliance if questioned by regulators or law enforcement.

Finally, this case highlights the ongoing risks to investors posed by fraud and other misconduct involving the use of digital or cryptocurrency.  The ease with which a bad actor can secure and quickly transmit cryptocurrency funds to jurisdictions outside the United States, and then mix or convert them in a way that helps erase the digital trail, creates a major risk that an investor caught up in such fraud will be unable to recoup much, if any, of their losses.  Individuals and businesses can avoid becoming victims of cryptocurrency scams using many of the same measures that they use to protect against fraud involving traditional currency, which include:

• Be cautious about responding to unsolicited messages in messaging or social media applications
• Verify the legitimacy and history of trading platforms or websites before using them
• Conduct due diligence into investment opportunities to be aware of potential risks
• Avoid deliberately sharing personal and financial information, including cryptocurrency wallet keys, with online contacts whom you have not met in person
• Use password protection and other security measures, such as two-factor authentication, to avoid inadvertently sharing personal and financial information
• Regularly monitor both cryptocurrency and traditional currency accounts for suspicious or unauthorized activities

While they cannot eliminate all risk, such measures can significantly reduce the likelihood of being victimized by cryptocurrency scams and other fraudulent schemes.

 

 

The material contained in this communication is informational, general in nature and does not constitute legal advice. The material contained in this communication should not be relied upon or used without consulting a lawyer to consider your specific circumstances. This communication was published on the date specified and may not include any changes in the topics, laws, rules or regulations covered. Receipt of this communication does not establish an attorney-client relationship. In some jurisdictions, this communication may be considered attorney advertising.