The Outlier Lab

Case Study - Prince Group Pig Butchering Enforcement (2025)

In October 2025 the US and UK acted against Cambodia's Prince Group: Chen Zhi indicted, about 127,271 BTC (~$15B) put up for forfeiture, and 146 targets sanctioned.

What happened

  • The fraud. Prosecutors allege Prince Group's compounds held trafficked workers behind walls and barbed wire and forced them, under threat of violence, to run relationship-based investment scams. Victims were cultivated over weeks or months, steered to fake crypto trading platforms, shown small or fabricated early gains, and pushed to invest more until withdrawals were blocked. This is the standard Investment Scams (Pig Butchering) arc.
  • Industrial scale. DOJ alleges "phone farms" ran thousands of phones and very large pools of numbers for outreach. TRM Labs, citing the complaint, reports the group allegedly earned more than $30M per day from these schemes at one point in 2018.
  • The laundering layer. Proceeds were allegedly collected in BTC and stablecoins, converted through professional "money houses," and cycled through online gambling, crypto mining, front companies and property in several jurisdictions. A US-based network allegedly moved more than $18M from US victims to Prince-linked accounts in 2021–2022 (the money-mule layer: Money Mules).
  • The bitcoin. The forfeited coins sat in 25 unhosted wallets that Chen and top lieutenants allegedly controlled. The wallets were dormant from December 2020, the movement long called the "LuBian hack." The complaint suggests that movement may have been an insider theft within the laundering network rather than an outside breach.
  • Protection. The indictment alleges bribery and political influence were used to keep enforcement away.
Diagram: Trafficked workers in compounds, Relationship-building outreach, Victim funds fake platform (bank wire, crypto, P2P), Mule accounts and money houses, Gambling, mining, front companies, property

Timeline

DateEvent
2018Group allegedly earning more than $30M/day from investment scams
December 2020BTC moved into wallets later subject to forfeiture ("LuBian" movement), then dormant
2021–2022US-based network allegedly launders more than $18M from US victims to Prince-linked accounts
June–July 2024Renewed activity in the wallet cluster
October 14, 2025Chen indicted in EDNY (No. 25-CR-312). Verified civil forfeiture complaint in rem filed for ~127,271 BTC across 25 addresses (No. 1:25-cv-05745), citing wire fraud and money laundering proceeds. OFAC and the UK sanction 146 targets. FinCEN finalizes the Section 311 action against Huione Group. UK freezes Chen's assets, including London properties.
Late 2025Investigations and asset seizures follow in Singapore, Taiwan, Hong Kong and Thailand
January 6–8, 2026Cambodia says it arrested Chen, revoked his citizenship and sent him to China. Chinese state media confirm. Two days after the arrest, the National Bank of Cambodia orders Prince Bank into liquidation.
May 2026Cambodian authorities raid Phnom Penh sites linked to Chen and detain about 100 people
September 25, 2026In the EDNY forfeiture case, Judge Rachel P. Kovner strikes or refuses to allow claims from nine alleged scam victims for lack of standing, because they could not trace their losses to the seized wallets. She points to DOJ remission as the victims' route if the government wins.
October 2026Cambodia says courts have provisionally frozen nearly $1B in Prince Group assets, including $300M+ in cash, and attributes about 198 companies to the group

Mechanisms involved

Control gaps

The gaps sit across many institutions rather than in one firm:

GapWhy it mattered
Banks and brokerages releasing large, out-of-pattern outbound payments to crypto on-rampsVictim funds left the regulated system with little friction (Payee Confirmation and Payment Friction, Scam Victim Indicators)
Mule accounts receiving and forwarding victim fundsDomestic accounts gave the network a US entry point (Fast In Fast Out Patterns, Playbook - Money Mule Detection Members)
Payment intermediaries serving the networkHuione was cut off only after years of reporting (BSA-AML and SAR Filing)
Little intelligence sharing between victim institutionsEach bank saw one victim. The network only showed up in aggregate (Consortium and Data Sharing).

Detection and response

The case was built through blockchain tracing, the domestic laundering network, and coordination among DOJ, Treasury (OFAC, FinCEN), the UK Foreign Office and Asian authorities. For practitioners, the sanctions designations themselves are a detection input. Once 146 entities and individuals are listed, payments touching them become screening hits, and wallet attributions feed External Intelligence Feeds.

Outcome

  • Criminal (US): indictment pending. Chen is in Chinese custody, so a US trial is unlikely in the near term.
  • Criminal (China): press reports Chen faces fraud and illegal gambling charges in China. As of October 2026, no trial or verdict has been reported.
  • Forfeiture: the ~127,271 BTC are held by the US government. As of October 2026 no final forfeiture order has been entered. The September 2026 ruling cleared nine victim claims from the case but did not decide forfeiture.
  • Victims: individual victims generally can't contest the forfeiture unless they trace their money to the seized coins. Their realistic route is a remission petition after forfeiture (28 C.F.R. § 9.8): documented loss caused directly by the offense, no involvement or compensation already received, and a share capped at their portion of net proceeds, at DOJ's discretion.
  • Sanctions: 146 OFAC/UK designations. Huione Group cut off from US correspondent banking under the Section 311 action.
  • International: asset seizures in Singapore, Taiwan and Hong Kong. Cambodia revoked Chen's citizenship, liquidated Prince Bank and provisionally froze nearly $1B in assets.

Lessons for practitioners

  1. No single institution sees the whole network. One bank sees a customer wiring savings to a crypto exchange, and the network only becomes visible across institutions. Join or build information sharing, and map sanctions designations into payee screening quickly (Consortium and Data Sharing, Threat Intelligence and Horizon Scanning).
  2. Intervene at the payment, before the money leaves. Liquidating brokerage positions, first-time large transfers to crypto platforms, and a customer who is coached or secretive are the signals that matter (Scam Victim Indicators, Customer Contact Signals, Playbook - Scam Intervention Members). In brokerage, trusted-contact outreach and temporary holds are tools you can use under the regulations (Trusted Contact and Senior Investor Holds).
  3. Treat inbound mule flows as part of the same problem. The domestic collection layer was a weak point that enforcement could reach. Fast-in-fast-out patterns and new accounts receiving many unrelated senders deserve attention (Money Mules, Entity Link Analysis).
  4. Expect industrialization and displacement. The operation used phone farms, scripts and managed workforces. Action against one group pushes the activity to others. Watch for new jurisdictions and payment rails (Real-Time Payment Rail Fraud, Gift Card Fraud).
  5. Liability is moving toward institutions. Mandatory reimbursement for authorized scams in the UK (Case Study - UK APP Scam Reimbursement Rules (2024)) and US pressure on P2P networks (Case Study - Zelle Scam Liability Disputes (2024-2025)) mean scam losses increasingly land on the institution's books as well as the customer's.

Sources