Feds sanction Cambodian conglomerate over cyber scams, seize $15 billion from chairman

The U.S. Justice Department seized about $15 billion worth of bitcoin from accounts allegedly linked to the chairman of a prominent Cambodian conglomerate, who was indicted on charges that his company is behind a sprawling scamming empire. 

The Treasury Department announced concurrent sanctions on Tuesday targeting the company, Prince Group, and 146 associated people and entities, among them 117 shell companies allegedly used for money laundering. 

The U.K.’s Foreign, Commonwealth & Development Office also imposed sanctions on the company and announced the seizure of properties in London allegedly connected to the group, including a £100 million office building, a £12 million mansion and 17 apartments.

Prince Group is one of Cambodia’s most prominent companies, working across the real estate, financial services and entertainment sectors. Previous media reports alleged the company was also participating in Cambodia’s lucrative scamming industry, in which people are tricked into working in industrial-scale compounds and forced to con people around the world. The U.S. government estimates Americans lost at least $10 billion to fraudsters operating out of Southeast Asia last year. 

According to an indictment filed on October 8 in the Eastern District of New York, company chairman Chen Zhi was directly involved in the operation of scam compounds that relied on trafficked forced labor to carry out pig butchering and other types of investment fraud. A citizen of China, Cambodia, Vanuatu, St. Lucia and Cyprus, Zhi allegedly oversaw the construction and operation of at least 10 compounds throughout the country, the DOJ said, including the notorious “Jinbei Compound” in the coastal city of Sihanoukville and “Mango Park” in Kampong Speu. 

Investigators accessed company documents appearing to show the inner workings of the operations, including records tracking profits from scams and a breakdown of which floors and buildings within a compound were focused on which types of scams. 

According to the indictment, documents show two facilities held 1,250 mobile phones that controlled 76,000 accounts on an unnamed social media platform.

“Additional internal Prince Group documents included instructions on building rapport with victims and guidance on how to register social media accounts in bulk, including a direction to use profile photos of women who were not ‘too beautiful,’ so that the accounts would appear genuine,” the indictment said. 

At one point, a co-conspirator allegedly bragged that the company was earning over $30 million per day from scams. 

Other documents allegedly show complicity between officials and Prince Group, which “used their political influence to protect the scam operations from law enforcement in multiple countries.” These authorities allegedly included the Chinese Ministry of Public Security and Ministry of State Security. 

The company’s executives bribed officials in order to get advance information about raids on compounds, prosecutors alleged. 

Prince Group allegedly laundered illicit proceeds by using them to fund legitimate cryptocurrency mining operations, like the Laos-based Warp Data and the Chinese company Lubian. 

The company did not immediately respond to a request for comment.

By approximately 2020, Zhi had amassed 127,271 bitcoin (about $15 billion) held in 25 unhosted cryptocurrency wallets, which have now been seized. The forfeiture action is the largest in the Justice Department’s history. 

“As alleged, the defendant directed one of the largest investment fraud operations in history, fueling an illicit industry that is reaching epidemic proportions,” said Joseph Nocella, U.S. attorney for the Eastern District of New York. “Prince Group’s investment scams have caused billions of dollars in losses and untold misery to victims around the world, including here in New York, on the backs of individuals who have been trafficked and forced to work against their will. 

The sanctions against Prince Group and associated entities demonstrate the scale of the scamming industry and how it has spread outside of Southeast Asia. They target 100 shell companies registered around the world and also single out Prince Group’s expansion into the Pacific island nation of Palau, where the company has worked with an alleged local “organized crime facilitator” to build a luxury resort on an island where it secured a 99-year lease. 

The Treasury said its action was “in support of Palau’s ongoing efforts to protect against predatory investments by transnational organized criminal groups originating from the People’s Republic of China.”   

The U.S. Financial Crimes Enforcement Network (FinCEN) also took action on Tuesday against the scamming industry, severing the Cambodia-based Huione Group from the U.S. financial system. FinCEN had previously identified the financial institution as a money laundering concern. 

The company is “a critical node” for laundering the proceeds of cybercrime by North Korea, as well as transnational criminal groups in Southeast Asia. Between August 2021 and January 2025, Huione Group laundered at least $4 billion worth of illicit proceeds, the agency said.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

James Reddick

James Reddick

has worked as a journalist around the world, including in Lebanon and in Cambodia, where he was Deputy Managing Editor of The Phnom Penh Post. He is also a radio and podcast producer for outlets like Snap Judgment.

 

Total
0
Shares
Previous Post

Indiana city confirms ransomware hackers behind September incident

Next Post

New SAP NetWeaver Bug Lets Attackers Take Over Servers Without Login

Related Posts

Trojanized ESET Installers Drop Kalambur Backdoor in Phishing Attacks on Ukraine

A previously unknown threat activity cluster has been observed impersonating Slovak cybersecurity company ESET as part of phishing attacks targeting Ukrainian entities. The campaign, detected in May 2025, is tracked by the security outfit under the moniker InedibleOchotense, describing it as Russia-aligned. "InedibleOchotense sent spear-phishing emails and Signal text messages, containing a link
Read More

New Browser Security Report Reveals Emerging Threats for Enterprises

According to the new Browser Security Report 2025, security leaders are discovering that most identity, SaaS, and AI-related risks converge in a single place, the user’s browser. Yet traditional controls like DLP, EDR, and SSE still operate one layer too low. What’s emerging isn’t just a blindspot. It’s a parallel threat surface: unmanaged extensions acting like supply chain implants, GenAI
Read More

New Fluent Bit Flaws Expose Cloud to RCE and Stealthy Infrastructure Intrusions

Cybersecurity researchers have discovered five vulnerabilities in Fluent Bit, an open-source and lightweight telemetry agent, that could be chained to compromise and take over cloud infrastructures. The security defects "allow attackers to bypass authentication, perform path traversal, achieve remote code execution, cause denial-of-service conditions, and manipulate tags," Oligo Security said in
Read More