US seizes $15 billion in huge bust of cybercriminal group

Treasury Has Used Roughly 60% Of Its Debt-Cap Special Measures
Al Drago/Bloomberg
  • Key insight: The U.S. and U.K. took coordinated action against two vast criminal networks in Southeast Asia involved in human trafficking and financial fraud.
  • What's at stake: Billions of dollars have been lost globally to Prince Group's "pig butchering" scams, which relied on forced labor from trafficked victims.
  • Forward look: U.S. banks must now implement special due diligence measures to block any transactions involving the Cambodia-based Huione Group.

Overview bullets generated by AI with editorial review

The U.S. and U.K. today executed a coordinated action this week targeting cybercriminal networks in Southeast Asia responsible for so-called pig butchering scams and money laundering.

These actions include sanctions against Prince Group and its leader, Chen Zhi, who faces federal indictment. The U.S. has also seized an historically large sum of money from Zhi — $15 billion in the form of bitcoin.

Separately, the Treasury Department's Financial Crimes Enforcement Network, or Fincen, issued a final rule that severs the Cambodia-based Huione Group from the U.S. financial system due to extensive money laundering tied to North Korean cyber heists and global cyber scams.

The actions require immediate diligence and compliance updates from U.S. banks and credit unions in response to new requirements from Fincen and Treasury's Office of Foreign Assets Control, or OFAC.

Fincen seeks to ban Huione Group from US financial system

Fincen's final rule issued this week subjects the Cambodia-based financial services conglomerate Huione Group to special measures enabled by the USA Patriot Act against money laundering groups.

The rule prohibits banks, securities brokers-dealers, mutual funds and futures commission merchants from opening or maintaining accounts for or on behalf of Huione Group.

Under the rule, effective Nov. 17, banks and credit unions must take reasonable steps to ensure they do not process any transaction that involves Huione Group.

The rule requires banks to apply special due diligence measures to their foreign correspondent accounts, reasonably designed to guard against the use of these accounts to process transactions involving Huione Group. At a minimum, banks and credit unions must adhere to these specific requirements:

  1. Notification: Banks must notify account holders who they know or have reason to believe provide services to Huione Group that those account holders may not provide Huione Group with access to the account.
  2. Screening: Institutions must implement risk-based procedures designed to identify any use of accounts to process transactions involving Huione Group. This can be the same OFAC screening process the bank already uses.
  3. Investigation and prevention: If a bank knows or has reason to believe that an account has processed transactions involving Huione Group, it must investigate and prevent access, which includes notifying the account holder and, where necessary, terminating the account.
  4. Documentation: Banks must document their compliance with the notification requirement.

Fincen determined that willful violations of this final rule face civil and criminal penalties. Furthermore, Fincen believes the prohibition is warranted given Huione Group's "ongoing and egregious conduct."

OFAC sanctions block Prince Group

Accompanying the Fincen rule, OFAC imposed sweeping sanctions, effective immediately, on 146 targets within Prince Group, requiring banks to report and block all property and interests in property of these targets.

Banks generally cannot engage in any transactions within or transiting the U.S. that involve these targets unless specifically authorized.

OFAC has designated 117 affiliated businesses as part of the Prince Group, emphasizing that many are offshore shell companies engaged in "no apparent real commercial or business activity."

Richard Graham, director of know your customer and financial crime at Moody's, commenting on the actions, said, "Shell companies often serve as the getaway vehicle for illicit actors, obscuring beneficial ownership, enabling cross-border fund movement, and shielding the true controllers behind scam operations."

Disturbing criminal conduct exposed

The coordinated actions expose two vast criminal networks built on human exploitation and sophisticated financial fraud.

Chen Zhi, a 37-year-old Cambodian national and Chinese emigré, is the founder and chairman of Prince Holding Group.

Zhi allegedly directed an international criminal network fueled by illegal online gambling and human trafficking for forced labor in scam compounds ultimately owned by him and his close associates, according to an indictment by the U.S. Attorney's Office for the Eastern District of New York.

Chen Zhi was the "mastermind behind a sprawling cyber-fraud empire operating under the Prince Group umbrella, a criminal enterprise built on human suffering," said John A. Eisenberg, assistant attorney general for national security.

Investigators allege that Prince Group operated at least ten forced-labor scam compounds throughout Cambodia, including the so-called Jinbei Compound and Golden Fortune Science and Technology Park.

These facilities housed "vast dormitories surrounded by high walls and barbed wire," functioning as forced labor camps, according to a press release from the Department of Justice.

Criminals working for Prince Group lured hundreds of workers with fake job offers, then held them against their will and forced them to execute cyberfraud schemes, notably so-called pig butchering scams.

Pig butchering involves developing trusting relationships with victims, often over months, and convincing them to invest (supposedly) in fraudulent platforms controlled by the scammers.

"The cruelty of this criminal activity is twofold," Treasury said in a press release. "The scammers are — not always, but often — victims themselves of human trafficking for forced labor."

These methods included physical abuse, isolation, restrictions on movement, arbitrary fines and threats of sexual exploitation.

Zhi was "directly involved" in managing the scam compounds and possessed images depicting beatings and "other methods of torture," according to the Department of Justice.

Zhi personally approved of violence, directing subordinates about beating individuals who "caused trouble," cautioning them not to be "beaten to death," the department alleged.

Prince Group's investment scams have caused billions of dollars in losses globally. One New York-based network facilitated the fraudulent transfer and laundering of more than $18 million from over 250 U.S. victims on behalf of Prince Group scammers working at the Jinbei Compound, according to the Department of Justice.

Zhi and his co-conspirators laundered the illicit profits through professional operations and through Prince Group's own network of supposedly legal enterprises, including cryptocurrency mining operations.

Zhi used the proceeds to fund large-scale cryptocurrency mining operations, including a Laos-based company called Warp Data.

Zhi "boasted to others of Prince Group's mining businesses that 'the profit is considerable because there is no cost' – that is, the operating capital for the businesses comprised money stolen from Prince Group's many victims," according to the Department of Justice.

To protect their criminal enterprise, Prince Group executives used political influence and paid bribes to foreign public officials.

Zhi maintained ledgers that tracked hundreds of millions of dollars in reimbursements for bribes, including a yacht purchased for a senior foreign official valued at over $3 million, according to the federal indictment against Zhi. The indictment does not name the foreign official.

Zhi used the vast proceeds to fund travel and make extravagant purchases, including a Picasso painting purchased through a New York City auction house, private jets, yachts and high-end collectibles. The indictment does not name the auction house.

The U.S. Attorney's Office unsealed an indictment charging Chen Zhi with wire fraud conspiracy and money laundering conspiracy.

The Department of Justice also issued the largest forfeiture action in its history against Zhi.

The U.S. is currently in custody of approximately 127,271 bitcoin — the equivalent of roughly $15 billion — associated with Zhi.

In a parallel action, the U.K. froze assets tied to the network, including a £12 million mansion in North London.

Huione Group's role in DPRK and scam laundering

Fincen said in its announcement this week it found Huione Group serves as a "critical node" for laundering illicit funds.

The conglomerate laundered proceeds from cyber heists carried out by North Korea, or DPRK, and from Southeast Asia-based criminal organizations perpetrating pig butchering scams.

Fincen's analysis identified that Huione Group received at least $37.6 million worth of virtual currency from North Korean cyber actors linked to DPRK-attributed heists.

The group also received proceeds from cyber scams, including at least $36 million in virtual currency investment scam proceeds, since August 2021. In total, Huione Group laundered at least $4 billion worth of illicit proceeds between August 2021 and January 2025, according to Fincen.

Huione Group expanded its money laundering enterprise by offering services that accepted both fiat currencies and virtual currencies. Its marketplace, Haowang Guarantee, sold equipment that could detain people, including "tear gas, electric batons, and electronic shackles."

The conglomerate even created its own stablecoin, U.S. Dollar Huione, or USDH, which it advertised as a stablecoin that "cannot be frozen," promising clients a "virtually risk-free ecosystem" to move or store virtual currency without the possibility of interception by law enforcement.

Huione Group also operates with no meaningful anti-money-laundering or know-your-customer program, Fincen alleged.

For reprint and licensing requests for this article, click here.
Cyber security Money laundering FinCEN Cryptocurrency Technology
MORE FROM AMERICAN BANKER