Global Crackdown Arrests 276, Shuts 9 Crypto Scam Centers, Seizes $701M

A coordinated international operation involving authorities from the United Arab Emirates, United States, China, Thailand, and other nations has successfully dismantled a global cryptocurrency fraud network, resulting in 276 arrests, the shutdown of nine scam centers, and the seizure of $701 million in cryptocurrency assets.

The crackdown, led by Dubai Police under the UAE Ministry of Interior in partnership with the FBI and Chinese Ministry of Public Security, targeted sophisticated criminal organizations operating across multiple countries. Among those arrested are individuals from Burma and Indonesia, with several key figures now facing federal fraud and money laundering charges in the United States.

The Scam Operation Exposed

According to the U.S. Department of Justice, the defendants allegedly managed three companies—Ko Thet Company, Sanduo Group, and Giant Company—that operated scam centers targeting American victims through investment fraud schemes. These scams, commonly known as "pig butchering" or "romance baiting," involved building trust with victims over time through friendly or romantic relationships before tricking them into transferring funds to fraudulent cryptocurrency investment platforms.

"Fraudsters who target Americans from overseas cannot operate with impunity, no matter where in the world they reside," stated Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division. "Scam center organizers and fraudsters who defraud Americans and others will face justice in American courts and in courts around the world."

The operation revealed a disturbing connection to human trafficking, where foreign nationals were coerced into running the scams under slave-like conditions after being recruited with false promises of high-paying jobs. The DoJ noted that once victims transferred funds to the fake platforms, the assets were immediately laundered to other cryptocurrency accounts controlled by the fraudsters.

Technical Infrastructure and Malware

The investigation uncovered a sophisticated Android banking trojan operating from multiple locations, including the K99 Triumph City compound in Cambodia. This malware-as-a-service (MaaS) platform, believed to have been active since at least 2023, facilitates real-time surveillance, credential theft, data exfiltration, and financial fraud.

According to a joint report from Infoblox and Vietnamese non-profit Chong Lua Dao, the malware infrastructure shares characteristics with threat actors tracked as Vigorish Viper and Vault Viper. The operation registers approximately 35 new domains monthly, using domain generation algorithms (RDGA) and lookalike domains that impersonate legitimate organizations and government services.

The attack chain typically begins with malicious URLs distributed via SMS or email appearing to come from government officials. Victims are directed to fake Google Play Store listings or government service websites, where they install malicious APK files. Once installed, the malware escalates permissions, connects to external servers, and enables operators to remotely monitor devices and harvest data. Attackers then inject bogus overlay screens on banking applications to capture credentials and transfer funds to accounts under their control.

Operation Atlantic and Additional Actions

Simultaneously, Operation Atlantic has frozen approximately $12 million from a cybercrime operation targeting cryptocurrency investors through "approval phishing"—a technique where victims are deceived into signing blockchain transactions that grant scammers complete control over their wallets.

"This tactic is often used in online investment fraud, often referred to as pig butchering, to lure victims into handing over ever-increasing amounts to scammers," noted the U.S. Secret Service. The operation has identified over 20,000 victims across 30 countries and confiscated more than 120 phishing domains.

In a related development, the U.S. Treasury Department has sanctioned Cambodian Senator Kok An and businessman Rithy Raksmei for their alleged involvement in operating a network of cyber scam compounds. Cambodia has also passed its first law specifically targeting scam centers, with penalties including 5-10 year prison sentences and fines up to $250,000.

Victim Recovery and Prevention Efforts

The FBI has notified nearly 9,000 victims through Operation Level Up, an initiative launched in January 2024 to proactively identify and alert victims of cryptocurrency investment fraud. These efforts have saved victims an estimated $562 million as of April 2026.

To strengthen prevention, the Treasury Department's Office of Cybersecurity and Critical Infrastructure Protection (OCCIP) announced a new information-sharing initiative in early April. This program will provide actionable cybersecurity information to eligible U.S. digital asset firms and industry organizations at no cost, helping them better identify, prevent, and respond to cyber threats targeting their customers and networks.

Practical Advice for Protection

Security experts recommend several measures to protect against these types of scams:

1. Verify investment platforms: Always research and verify the legitimacy of investment platforms before transferring funds. Check for proper licensing, regulatory compliance, and reviews from trusted sources.

2. Be skeptical of unsolicited contacts: Exercise extreme caution with unexpected messages, especially those building personal relationships quickly or offering investment opportunities that seem too good to be true.

3. Enable two-factor authentication: Use 2FA on all financial and cryptocurrency accounts to add an extra layer of security.

4. Regularly monitor accounts: Frequently review financial statements and transaction histories for any unauthorized activity.

5. Educate yourself about common tactics: Stay informed about evolving scam techniques, particularly those involving cryptocurrency and investment fraud.

The global nature of these operations demonstrates the need for continued international cooperation and robust cybersecurity measures. As criminal organizations adapt their techniques, law enforcement and security professionals must remain vigilant in protecting potential victims and disrupting these illicit operations.