Connect with us

Crypto

Crypto and Human Trafficking: 2026 Crypto Crime Report

Published

on

Crypto and Human Trafficking: 2026 Crypto Crime Report

TL;DR

  • Cryptocurrency flows to suspected human trafficking services, largely based in Southeast Asia, grew 85% in 2025, reaching a scale of hundreds of millions across identified services.
  • Telegram-based “international escort” services show sophisticated integration with Chinese-language money laundering networks (CMLNs) and guarantee platforms, with nearly half of transactions exceeding $10,000.
  • Analysis reveals global reach of Southeast Asian trafficking operations, with significant cryptocurrency flows from destinations across the Americas, Europe, and Australia.
  • CSAM networks have evolved to subscription-based models and show increasing overlap with sadistic online extremism (SOE) communities, while strategic use of U.S.-based infrastructure suggests sophisticated operational planning.
  • Unlike cash transactions, cryptocurrency’s inherent transparency creates unprecedented opportunities for law enforcement and compliance teams to detect, track, and disrupt trafficking operations.

The intersection of cryptocurrency and suspected human trafficking intensified in 2025, with total transaction volume reaching hundreds of millions of dollars across identified services, an 85% year-over-year (YoY) increase. The dollar amounts significantly understate the human toll of these crimes, where the true cost is measured in lives impacted rather than money transferred.

This surge in cryptocurrency flows to suspected human trafficking services is not happening in isolation, but is closely aligned with the growth of Southeast Asia–based scam compounds, online casinos and gambling sites, and Chinese-language money laundering (CMLN) and guarantee networks operating largely via Telegram, all of which form a rapidly expanding local illicit ecosystem with global reach and impact. Unlike cash transactions that leave no trace, the transparency of blockchain technology provides unprecedented visibility into these operations, creating unique opportunities for detection and disruption that would be impossible with traditional payment methods.

Our analysis tracks four primary categories of suspected cryptocurrency-facilitated human trafficking:

  1. “International escort” services: Telegram-based services that are suspected to traffic in people
  2. “Labor placement” agents: Telegram-based services that facilitate kidnapping and forced labor for scam compounds
  3. Prostitution networks: suspected exploitative sexual service networks
  4. Child sexual abuse material (CSAM) vendors: networks of individuals engaged in the production and dissemination of CSAM

Payment methods vary significantly across these categories. While “international escort” services and prostitution networks operate almost exclusively using stablecoins, CSAM vendors have traditionally relied more heavily on bitcoin. However, even within CSAM operations, bitcoin’s dominance has decreased with the emergence of alternative Layer 1 networks. Broadly, the predominant use of stablecoins by “international escort” services and prostitution networks suggests that these entities prioritize payment stability and ease of conversion over the risks that these assets might be frozen by centralized issuers.

As we detail below, the “international escort” services are tightly integrated with Chinese-language money laundering networks. These networks rapidly facilitate the conversion of USD stablecoins into local currencies, potentially blunting concerns that assets held in stablecoins might be frozen.

Advertisement

Nearly half of Telegram-based “international escort” service transactions exceed $10,000, demonstrating professionalized operations

The distribution of transaction sizes reveals distinct operational models across different types of suspected trafficking services. “International escort” services show the highest concentration of large transactions, with 48.8% of transfers exceeding $10,000, suggesting organized criminal enterprises operating at scale. In contrast, prostitution networks cluster in the mid-range, with approximately 62% of transactions between $1,000-$10,000, indicating potential agency-level operations.

These “international escort” services operate with sophisticated business models, complete with customer service protocols and structured pricing. For example, one prominent operation advertises across major East Asian cities with a tiered pricing system ranging from 3,000 RMB ($420) for hourly services to 8,000 RMB ($1,120) for extended arrangements, including international transport. These standardized pricing models create identifiable transaction patterns that investigators and compliance teams can use to detect suspicious activity at scale.

Screenshot showing an advertisement from an escort service provider, which include the locations that the provider serves and pricing for escort services

 

CSAM vendors and marketplaces

CSAM operations demonstrate different but equally concerning patterns. While approximately half of CSAM-related transactions are under $100 – unfortunately, there’s more CSAM on the internet than ever before, and it’s never been cheaper to produce – these operations have evolved sophisticated financial and distribution strategies. In 2025, we observed that, while these networks still collect payments in mainstream cryptocurrencies, they increasingly use Monero for laundering proceeds. Instant exchangers, which provide rapid and anonymous cryptocurrency swapping without KYC requirements, play a crucial role in this process.

The business model for CSAM operations has largely consolidated around subscription-based services rather than pay-per-content transactions, generating more predictable revenue streams while simplifying administration. These subscriptions typically cost less than $100 per month, creating a lower barrier to entry while establishing regular revenue for operators.

A disturbing trend emerged in 2025 with increasing overlap between CSAM networks and sadistic online extremism (SOE) communities. Following law enforcement actions against groups like “764” and “cvlt,” we observed SOE content appearing within CSAM subscription services, commonly advertised as “hurtcore.” These SOE groups specifically target and manipulate minors through sophisticated sextortion schemes, with the resulting content being monetized through cryptocurrency payments, perpetuating cycles of abuse.

Advertisement

The scale of these operations became particularly evident in July 2025, when Chainalysis identified one of the largest CSAM websites operating on the darkweb following a UK law enforcement lead. This single operation utilized over 5,800 cryptocurrency addresses and generated more than $530,000 in revenue since July 2022, surpassing the notorious “Welcome to Video” case from 2019.

Geographic analysis of clearnet CSAM operations reveals strategic use of U.S. infrastructure [1]. While U.S.-based IP addresses account for a large portion of CSAM activity associated with surface websites, IPs from other countries like South Korea, Spain, and Russia show smaller flows. This suggests that these operations leverage U.S.-based infrastructure for scale, reliability, and an initial appearance of legitimacy that helps the activity blend into normal traffic and delays detection. Further, if the operators are outside the U.S., it reduces their personal exposure.

Chris Hughes, Internet Watch Foundation Hotline Director, told us, “In 2025, the Internet Watch Foundation identified 312,030 reports containing child sexual abuse images and videos. This is more than ever before, with an increase of 7% from the previous year. Early analysis of IWF data indicates that most clearweb sites offering virtual currency as a payment for child sexual abuse are hosted in the US, while darkweb sites were the second highest. Any payment information that we identify on commercial websites is captured and shared with global law enforcement and organisations like Chainalysis to disrupt further distribution of criminal imagery and to help in the investigation of those who create, share and profit from the sale of child sexual abuse material.”

Despite these concerning trends, 2025 saw significant law enforcement successes, including the takedown of “KidFlix” by German authorities and increased arrests of CSAM consumers across the United States. These cases demonstrate how blockchain analysis can provide critical evidence for identifying, investigating, and prosecuting both operators and consumers of CSAM networks.

Telegram-based services show deep integration with Chinese-language money laundering networks (CMLNs) and guarantee platforms

“International escort” services

The cryptocurrency footprint of escort services reveals sophisticated integration with established financial infrastructure, particularly CMLNs and guarantee platforms. While some escort services operate legally, cryptocurrency transaction patterns help identify potential trafficking operations through their distinct financial behaviors.

Advertisement

The majority of cryptocurrency movements flow through a combination of mainstream exchanges, institutional platforms, and guarantee services like Tudou and Xinbi. This creates both vulnerabilities and opportunities: while these platforms provide easier access to the financial system, they also serve as critical chokepoints where compliance teams can detect and investigate suspicious patterns.

“Labor placement” agents

It’s been widely reported that scam operations — pig butchering schemes in particular — are deeply intertwined with human trafficking. Victims are often lured by fake job offers before being forced to work in Southeast Asian scam compounds, where they face brutal conditions and are coerced into operating romance/investment scams under threat of violence.

These operations utilize guarantee services’ “human resource” vendors to facilitate recruitment. Channel participants inquire about methods to transport workers who have been detained at immigration checkpoints, while compound administrators provide updates concerning regional developments that might affect their operations, such as the ongoing border tensions between Thailand and Cambodia.

Screenshot of advertisement on Telegram, detailing compensation terms and personnel requirements, including differentiated pricing for workers

Blockchain analysis shows that recruitment payments typically range from $1,000 to $10,000, aligning with advertised pricing tiers. This provides another opportunity to leverage identifiable transaction patterns to detect suspicious activity at scale. These agents maintain presence across multiple guarantee platforms to maximize their reach, with some operating through mainstream cryptocurrency exchanges.

The involvement of established criminal organizations became evident through our analysis of trafficking-related channels. For example, we identified an administrator account linked to the “Fully Light Group,” a Kokang-based organization previously flagged by the United Nations Office on Drugs and Crime (UNODC) for illegal gambling and money laundering. Their presence in channels facilitating transactions between scam compounds and “labor placement” agents suggests how established criminal networks provide critical financial infrastructure for trafficking operations.

Screenshot of administrators in a recruitment channel, with an account linked to Fully Light designated as an “admin” account

Southeast Asian organizations facilitating potential trafficking show global reach through cryptocurrency

Geographic analysis of “international escort” services in 2025 reveals how Southeast Asian services, particularly Chinese-language operations, have expanded their reach globally through cryptocurrency adoption [2]. The transparency of the blockchain provides valuable insight into broader trafficking patterns and financial flows of these types of operations.

Based on our data, Chinese-language services operating through networks spanning mainland China, Hong Kong, Taiwan, and various Southeast Asian countries demonstrate sophisticated payment processing capabilities and extensive international reach. Their large-scale cryptocurrency transactions show significant flows from countries including Brazil, the United States, the United Kingdom, Spain, and Australia, indicating the truly global scope of these operations.

Advertisement

While traditional trafficking routes and patterns persist, these Southeast Asian services exemplify how cryptocurrency technology enables trafficking operations to facilitate payments and obscure money flows across borders more efficiently than ever before. The diversity of destination countries suggests these networks have developed sophisticated infrastructure for global operations.

Key risk indicators and monitoring strategies

While the sophistication of cryptocurrency-facilitated trafficking operations continues to grow, the transparent nature of blockchain technology provides powerful tools for detection and prevention. Our analysis has identified several key indicators that compliance teams and law enforcement can monitor:

  • Large, regular payments to labor placement services paired with cross-border transactions
  • High-volume transactions through guarantee platforms
  • Wallet clusters showing activity across multiple categories of illicit services
  • Regular stablecoin conversion patterns
  • Concentrated fund flows to regions known for trafficking operations
  • Connections to Telegram-based recruitment channels

The increasing sophistication of these operations, particularly their growing intersection with legitimate businesses and professional money laundering networks, requires a comprehensive monitoring approach that leverages blockchain analysis alongside traditional anti-trafficking efforts and public education. As these networks continue to evolve, the transparency of blockchain technology provides unprecedented opportunities for detection, disruption, and enforcement that would be impossible with traditional payment methods.

[1] This analysis is limited to the clearweb portion of the CSAM industry. A significant portion of CSAM transactions are conducted peer-to-peer through encrypted messaging apps or the darkweb, where reliable IP addresses can not be obtained for this analysis.

[2] This analysis involved a combination of signals to estimate the country of origin, including web traffic data and the use of regional crypto exchanges.

 

Advertisement

This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein. 

This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.

Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.

Advertisement

Crypto

Wood County Sheriff’s Department pushes for cryptocurrency kiosk protections

Published

on

Wood County Sheriff’s Department pushes for cryptocurrency kiosk protections

WOOD COUNTY, Wis. (WSAW) – The Wood County Sheriff’s Department is hoping a bill that would protect victims from scams involving cryptocurrency kiosks will soon be signed into law. It passed with bipartisan support on Tuesday.

Sheriff Shawn Becker says they have seen many people lose thousands of dollars to scammers when using the machines

Scammers have used kiosks to take thousands of dollars from victims in north central Wisconsin. Scammers convince people to first deposit cash. It’s then turned into bitcoin and sent to scammers.

The Wood County Sheriff’s Department first received complaints about scams involving cryptocurrency kiosks three years ago. Since then, they’ve been investigating reports and testifying for change.

Sheriff Shawn Becker has been sounding the alarm.

“We did push, we did communicate, communicate with our law enforcement agencies, communicate with other legislators, anybody that would be willing to listen,” Becker said.

Advertisement

Legislation passes with bipartisan support

Lawmakers have been working to impose regulations on these kiosks. One element would require operators to reimburse victims.

“I’m hoping that we can go retroactively to the investigations that we’ve been handling and where we’ve kept the money at the sheriff’s department, and we can give it right back to that victim. And that’s going to be a great day, quite honestly,” Becker said.

The department has thousands of dollars in evidence they seized that they’ll be able to return to victims if the bill is signed into law.

The legislation also includes daily $1,000 transaction limits.

“That limitation is really going to be effective, because somebody can’t walk in there with $20,000 or even more and put it into the machine,” Becker said.

Advertisement

It also requires operators to add warning labels to kiosks. It also requires kiosks to be more than five feet away from ATMs.

“It took many, many people to be involved in this and understand it’s a process to create legislation and we’re there. And we’re really happy with the end result,” Becker said.

Becker also gave an update about a lawsuit from last year. A crypto vendor sued the department for seizing cash from their bitcoin machines. They’ve now settled. Becker said he didn’t agree with that, but it showed they needed to continue pushing for change.

AARP Wisconsin supporting legislation

Raj Shukla is the Wisconsin state director for AARP. He said this legislation does a lot to stop scammers in their tracks and protect victims, especially since it puts $1,000 daily transaction limits on kiosks.

“That means that people won’t be losing a lifetime’s worth of life savings in just a day. It provides for receipts for every transaction so that law enforcement can track transactions and find scammers faster,” Shukla said.

Advertisement

Shukla said the consumer protections that exist on ATMs don’t exist on cryptocurrency machines. He said this legislation levels the playing field.

Shukla is hoping the bill is signed into law this week. He said scams involving cryptocurrency are rampant right now.

Click here to download the WSAW news app or WSAW First Alert weather app.

Click here to submit a news tip or story idea.

Advertisement
Continue Reading

Crypto

Crypto Asset Recovery in 2026: How MiCA Regulation and Global Crypto Laws Are Changing Cross‑Border Cryptocurrency Fraud Investigations – FinTech Weekly

Published

on

Crypto Asset Recovery in 2026: How MiCA Regulation and Global Crypto Laws Are Changing Cross‑Border Cryptocurrency Fraud Investigations – FinTech Weekly

Explore how MiCA regulation and global crypto laws are improving cross-border cryptocurrency fraud investigations and asset recovery through stronger compliance and blockchain forensics.

By Manuel Dueñas, Senior Fraud Lawyer at Crypto Legal

 


 

FinTech moves fast. News is everywhere, clarity isn’t.

Advertisement

FinTech Weekly delivers the key stories and events in one place.

Click Here to Subscribe to FinTech Weekly’s Newsletter

Read by executives at JP Morgan, Coinbase, BlackRock, Klarna and more.

 


 

Advertisement

Cryptocurrency fraud has evolved alongside the rapid growth of digital assets. As cryptocurrencies have become a mainstream component of global finance, fraudsters have increasingly exploited the borderless nature of blockchain technology to move stolen assets across multiple jurisdictions. For several years, victims faced a difficult reality: once digital assets were transferred through international exchanges and wallet networks, legal recovery options were often uncertain.

The legal and regulatory environment in 2026 looks markedly different. Regulatory frameworks, particularly the European Union’s Markets in Crypto‑Assets Regulation (MiCA), together with stronger compliance obligations for cryptocurrency exchanges and the development of blockchain forensic investigation techniques, have begun to reshape how digital asset fraud is investigated and addressed across borders. While challenges remain, the infrastructure supporting cryptocurrency fraud investigations and asset tracing has improved significantly.

Legal Recognition of Cryptoassets and the Foundations of Recovery

One of the most important developments in recent years has been the increasing recognition of cryptoassets as property within several legal systems. Courts in multiple jurisdictions have clarified that cryptocurrencies may constitute property capable of ownership, transfer and legal protection.

This recognition has important consequences for victims of cryptocurrency fraud. Once digital assets are legally recognised as property, traditional legal doctrines such as tracing, misappropriation claims and asset preservation measures can be applied to blockchain‑based transactions. Lawyers are therefore able to rely on established legal principles while adapting them to the technological realities of decentralised networks.

Courts have also become more comfortable accepting blockchain transaction records as evidential material. Public blockchains provide immutable transaction histories that can be analysed by forensic specialists to demonstrate the movement of assets between wallets, exchanges and service providers. This transparency has significantly strengthened the evidential basis for digital asset investigations.

Advertisement

Blockchain Forensics and Cryptocurrency Asset Tracing

The growth of specialised blockchain forensic analysis has been another critical factor in improving the investigation of cryptocurrency fraud. Advanced analytics platforms allow investigators to map transaction flows across thousands of wallet addresses and identify patterns that reveal how funds move through the blockchain ecosystem.

Even when assets are transferred through numerous intermediary wallets, forensic techniques frequently allow investigators to identify clusters of addresses controlled by the same entity. In many cases, funds eventually interact with centralised exchanges or custodial services where compliance obligations require the collection of customer identification information.

This intersection between blockchain transparency and regulatory compliance has become one of the most effective mechanisms for identifying individuals behind fraudulent activity. When assets interact with regulated platforms, lawyers and investigators may be able to engage with those institutions or relevant authorities in order to pursue investigative actions.

MiCA Regulation and the Transformation of the European Crypto Landscape

The implementation of the European Union’s Markets in Crypto‑Assets Regulation represents one of the most significant regulatory milestones in the history of digital assets. MiCA establishes a harmonised framework governing cryptocurrency exchanges, custodial wallet providers and other cryptoasset service providers operating within the European Union.

Under MiCA, regulated firms must obtain authorisation, maintain governance and risk management systems and implement robust anti‑money laundering controls. These requirements include customer due diligence procedures, transaction monitoring systems and reporting obligations designed to detect suspicious activity.

Advertisement

From the perspective of fraud investigations, these regulatory requirements are highly consequential. Exchanges operating under MiCA are expected to maintain compliance infrastructures capable of responding to legitimate investigative requests and cooperating with authorities when financial crime is suspected. This has gradually strengthened the ecosystem in which digital asset investigations occur.

Global Regulation and Cross‑Border Cooperation in Crypto Fraud Cases

Regulatory developments are not limited to the European Union. Several major financial centres, including the United Kingdom, the United States, Singapore and the United Arab Emirates, have introduced licensing regimes and compliance frameworks for virtual asset service providers.

International bodies such as the Financial Action Task Force have also contributed to regulatory convergence by establishing global standards for anti‑money laundering compliance within the digital asset sector. As more jurisdictions adopt these standards, cooperation between regulators, exchanges and investigators has improved.

Many exchanges now maintain specialised compliance teams capable of responding to inquiries relating to fraud investigations and suspicious transactions. This growing cooperation between institutions has strengthened the ability to follow digital assets across jurisdictions.

Challenges That Still Exist in Cross‑Border Crypto Asset Recovery

Despite regulatory progress, recovering cryptocurrency from foreign jurisdictions remains legally and technically complex. Digital assets can still move rapidly through decentralised platforms that operate outside traditional regulatory structures. Certain privacy technologies may also complicate transaction analysis.

Advertisement

Jurisdictional boundaries continue to present practical limitations. Legal authority to compel disclosure or freeze assets is typically confined to specific jurisdictions, which means investigators may need to coordinate responses across several countries simultaneously.

Nevertheless, blockchain transparency remains a powerful investigative tool. Even when immediate recovery is not possible, transaction analysis frequently reveals the path taken by misappropriated funds and identifies platforms involved in the movement of assets.

What Victims of Cryptocurrency Fraud Should Know

Individuals affected by cryptocurrency scams often assume that digital assets cannot be traced. In practice, blockchain transactions create permanent records that frequently allow investigators to reconstruct the movement of funds.

Timing is often critical. The earlier a forensic investigation begins, the greater the likelihood of identifying exchange interactions or service providers involved in the transaction flow.

Cryptocurrency investigations require a combination of legal expertise and technical blockchain analysis. Lawyers working in this field typically collaborate with forensic investigators to analyse transaction data, identify responsible parties and assess potential legal strategies.

Advertisement

The Future of Crypto Fraud Prevention and Investor Protection

As the digital asset sector continues to mature, regulatory frameworks are expected to evolve further. Policymakers increasingly recognise that cryptocurrencies are likely to remain a permanent component of global financial infrastructure.

Future regulatory developments may involve deeper cooperation between exchanges, regulators and blockchain analytics providers in order to detect suspicious activity more rapidly. Improvements in transaction monitoring technologies may also allow platforms to identify fraudulent behaviour earlier.

Although digital asset fraud cannot be eliminated entirely, the regulatory and investigative environment surrounding cryptocurrencies is becoming progressively more sophisticated. Stronger compliance frameworks and improved forensic capabilities are gradually enhancing protections for investors and market participants.

About the Author

Manuel Dueñas is a Senior Fraud Lawyer at Crypto Legal, specialising in complex cryptocurrency and blockchain related disputes. He advises clients on fraud, misappropriation of digital assets, investment scams and cross border recovery strategies.

Manuel has extensive experience in fraud investigations, asset tracing, KYC and AML compliance, and works closely with forensic experts to build comprehensive recovery plans. His practice focuses on providing clear legal strategies to individuals, businesses and financial institutions facing fraud or regulatory challenges in the digital asset sector.

Advertisement

 

Continue Reading

Crypto

Questions swirl around US plans for record $15B Prince Group crypto seizure – ICIJ

Published

on

Questions swirl around US plans for record B Prince Group crypto seizure – ICIJ

The U.S. Justice Department last October announced the largest asset seizure in American history: a cache of bitcoin then valued at $15 billion tied to the Cambodia-based Prince Group that prosecutors alleged oversaw an empire of human trafficking and industrial-scale scamming.

The news offered a rare glimmer of hope for victims of sophisticated cryptocurrency scams. In part due to the ease of laundering cryptocurrencies, these victims have had a notoriously difficult time recovering their lost life savings or even getting law enforcement to begin tracing such funds.

“By dismantling a criminal empire built on forced labor and deception, we are sending a clear message that the United States will use every tool at its disposal to defend victims, recover stolen assets, and bring to justice those who exploit the vulnerable for profit,” U.S. Attorney General Pam Bondi said in a joint statement.

But in the five months since the announcement, questions and frustrations have begun to swirl around the Justice Department’s handling of the historic cache of seized funds. The Justice Department has given little indication of what it plans to do with the 127,271 seized bitcoins, currently worth around $9 billion, as it has swiftly rejected claims on the funds made by attorneys representing hundreds of alleged victims.

Daniel Thornburgh and other attorneys representing hundreds of alleged victims of crypto scams say the government is not providing a viable path for returning seized funds to rightful owners.

Advertisement

Victims’ advocates and attorneys fear the agency may use the funds to capitalize President Trump’s national Strategic Bitcoin Reserve, a government crypto stockpile advocated by the cryptocurrency industry.

“This would lead to victims being revictimized by their own government,” said Thornburgh.

He is part of a growing number of attorneys and victim advocates who are calling for a special victim fund to take over responsibility for the historic sum of seized assets. They argue that this alternative offers a clearer path to victims receiving restitution.

The Department of Justice declined to comment on the case.

In November, the International Consortium of Investigative Journalists and 36 partner publications released The Coin Laundry investigation that showed how cryptocurrency scam victims face immense difficulty recovering funds due to the rapidly expanding illicit crypto economy. In interviews, dozens of victims told ICIJ and its media partners that they faced financial ruin as criminals rapidly laundered their stolen funds through secretive crypto wallets. In many cases, reports to law enforcement yielded no response at all.

Advertisement

The U.S. seizure of billions in bitcoin from the Prince Group’s founder Chen Zhi stemmed from allegations that he operated a transnational criminal organization that used forced labor in scam compounds to defraud victims worldwide. After the group was hit with U.S. and U.K. sanctions, Chen was taken into custody in Cambodia and sent to China in January 2026.

Even as victim attorneys strategize how to get their clients’ money back, fundamental questions hang over the case, including how and when U.S. authorities obtained the funds in the first place. Attorneys say that more information could help victims make stronger claims on the assets, while the Prince Group argues the lack of detail points to a flimsy case for the government holding the crypto at all. Although the Justice Department declined to comment on how it obtained the Bitcoin, the Chinese government recently accused the U.S. of stealing it through sophisticated hacking.

The government’s indictment of Chen contains apparent irregularities that are especially striking given the case’s significance. Prosecutors’ evidence against Chen relied in part on photographs alleged to illustrate the Prince Group’s violent methods.

ICIJ confirmed that one disturbing photo included in the indictment showing a man bound to an overturned chair appears to have nothing to do with the Prince Group. The exact photo was part of a light-hearted post published on a Mongolian-language website in April of 2020, describing an unusual medical incident. In another case, a man portrayed in the indictment as a victim of the Prince Group told ICIJ in an interview he had never been the victim of organized crime.

Victim claims have been swiftly rejected

When government authorities seize assets, they can keep those assets for public sector use, distribute the assets to victims who lost money to the crime in question, or do a combination of both. The process of determining if and how assets should be returned to victims is complicated and can take years.

Advertisement

In the wake of the Prince Group seizure, one U.S. senator said the assets could be used in part to strengthen Donald Trump’s national strategic bitcoin reserve, a U.S. government stockpile of cryptocurrency that industry proponents say will help boost the prominence of bitcoin. At the same time an array of alleged scam victims and their lawyers flooded the Justice Department with claims on the seized assets.

The department rapidly rejected many of them, asserting a wide variety of reasons why the victims had no legitimate claims, including that victims had not put forth specific evidence linking their cases to the seized funds and that they had no legal basis to credibly claim the funds in the first place.

Victims and their attorneys told ICIJ that a troubling picture is emerging of a Justice Department that appears set on rejecting claims.

Without more information about the seizure, scam victims are at a disadvantage because the alleged laundering was highly complex, making it difficult to directly link any specific scam to the cache of digital currency, according to lawyers.

“What’s happening here is not normal at all,” said Marc Fitapelli, a New York-based attorney who represents victims of cryptocurrency scams. “There should be an independent person appointed by the court to have control over these assets.”

Advertisement
The Phnom Penh headquarters of Prince Holding Group in Cambodia, with the Prince Group logo missing from the building’s facade. Image: Patrick Chengzhi Wang/SOPA Images/LightRocket via Getty Images

Thornburgh told ICIJ that recent conversations with Justice Department lawyers convinced him that the government was committed to denying victim claims, so he booked a trip to Cambodia on a long-shot mission to collect additional evidence linking his cases to the Prince Group. Thornburg said he spent a grueling week in early March interviewing dozens of former workers at the country’s notorious scam compounds, but had little luck finding the documentation to connect his client’s cases to the DOJ’s seized funds.

“It was an incredible amount of work to demonstrate what I probably already knew, which was: this was going to be impossible,” Thornburgh said. “Even if I was successful, victims or their lawyers should not have to travel all the way across the world to recover their assets.”

Thornburgh expressed concern about the Justice Department’s tactics in a separate high-profile crypto forfeiture action announced in June. Last month, government attorneys argued that victims did not deserve to recover funds from this seizure because the victims had freely given it away to scammers. “Although their voluntary transfers may have been induced through misrepresentations, those transfers were made voluntarily nonetheless,” the Justice Department said in a filing.

Several experts pointed to legislation as the most promising path to recovering victim funds. Erin West, the founder of Operation Shamrock, an advocacy group for victims of cyber scams, told ICIJ the organization would be working with partners to push for legislation that allocates the seized funds to victims. “We have an amazing opportunity to put found assets back into the hands of those who deserve it most,” West said.

Fitapelli said that a call with Justice Department lawyers last month yielded little in direct answers. “I was told that victims will be contacted by the government if/when the DOJ determines it is appropriate,” he said. “So victims should hope that some lawyer at the Justice department stumbles on their file and contacts them? This is so unfair.”

Advertisement

Deeper questions about the money

Scam victims aren’t the only ones seeking more information from the Justice Department about the case.

Almost immediately after the government’s announcement of the historic seizure, cryptocurrency experts began to ask basic questions about the origin of the enormous pile of bitcoin. According to the U.S. officials, the Prince Group’s alleged laundering methods diverted proceeds of fraud to fund a bitcoin mining company called LuBian that created new, “clean” bitcoins. Attorneys representing thousands of alleged victims of Iranian terrorism say that this bitcoin mining operation had extensive ties to Iran and are also making claims on the seized bitcoin.

But there is a twist in the history of these coins: On the blockchain, the publicly available ledger of most cryptocurrency transactions, experts could see that the huge sum of seized bitcoin, which was reportedly stolen by an unknown hacker in 2020 and then sat dormant in crypto wallets of unknown ownership for years. This crypto remained untouched between late 2020 and mid-2024, when the cache of bitcoin moved to a new set of wallets where it has remained since, crypto analyst Yury Serov told ICIJ.






The U.S. government filings that ICIJ reviewed do not provide details on how it came into possession of the bitcoin. This lack of an official explanation has created an opening for speculation among experts, interested parties and a rival superpower. A Chinese cybercrimes agency recently suggested that the U.S. government originally stole the bitcoin through sophisticated hacking in 2020.

Advertisement

Last week, lawyers representing Chen demanded that the Justice Department explain how it seized the funds.

The Justice Department’s asset forfeiture filing, which describes the government’s rationale for taking the $15 billion, has also created some confusion about which victims may be entitled to the funds.

After the government announced its seizure in 2025, analysts quickly pointed out that the $15 billion in bitcoin had sat dormant in crypto wallets for years after their reported theft in 2020. Chen’s defense attorneys have argued these dormant assets have had no opportunity to commingle with any money taken from scam victims after 2020. But, in its asset forfeiture filing, some of the government’s most specific descriptions of the Prince Group’s alleged scams involve frauds that took place in 2021 and 2022 — after the seized bitcoin went dormant.

Attorneys for Chen last week criticized the asset forfeiture complaint’s use of these alleged crimes to justify seizing money that had been out of circulation since 2020.

The Prince Group argues that the U.S. government somehow took the coins and then created a story to justify keeping them. “This indictment is simply air cover for a giant cash grab — one that both does a disservice to the victims of these crypto scams and injustice to an innocent man,” a spokesperson for the Prince Group told ICIJ in a statement.

Advertisement

“Prosecutors used exaggerations, deceit, and outright impossibilities to convince a court to retroactively approve their theft of Bitcoin and to convince a grand jury of everyday Americans to indict an innocent man, Chen Zhi,” the spokesperson said. “Not only did prosecutors use salacious rumors and innuendo to make wild accusations completely unconnected to Chen, they made serious errors, generated falsehoods out of whole cloth, and acted with egregious negligence all in an effort to justify their desperate, unfounded allegations.”

In court filings last week, Prince Group lawyers highlighted another possibly problematic part of U.S. authorities’ case against Chen. Several photos that the indictment claimed as evidence of wrongdoing appear to have no ostensible relationship to the Prince Group or its alleged crimes.

One of these photos, offered up by U.S. prosecutors as an example of the Prince Group’s violence, shows a man bound to an overturned plastic lawnchair. But ICIJ was able to confirm that the same photo was featured on a Mongolian-language website six years ago in a post about a man whose testicles became stuck in a lawn chair and had to be extricated from the chair by medical workers. This article contains no mention of the Prince Group or any wrongdoing.

Side-by-side screenshots showing identical photos of a man attached to a lawn chair in a hospital bed, one from the US prosecutor's indictment, the other from a Mongolian website.
Left, a photo included in the U.S. indictment against Chen Zhi shows a man attached to a lawn chair in a hospital bed; Right, the same image was published in an unrelated article on a Mongolian-language website in 2020.

Another photo in the indictment shows a purported victim of the Prince Group with blood flowing from a head wound. However, on a Zoom call arranged by representatives for the Prince Group, the man, who requested anonymity, told ICIJ that the photo depicted injuries he sustained in a drunken fight in 2015, and that he has never been the victim of violence by an organized crime group.

Hany Farid, a visual forensics expert at the University of California at Berkeley, confirmed that the man ICIJ spoke with via Zoom is the same person pictured in the indictment.

The Department of Justice declined to comment on the photographs.

Advertisement
Continue Reading

Trending