How crypto investigators uncover scammers’ blockchain billions, scale of money laundering in Asia

“The scale of this problem is far, far greater than what is understood by any government or competent authority at this point in time,” Tan said of Chain Argos’ research.

As Southeast Asia’s online gambling and scam industries have grown larger and more sophisticated, cryptocurrency watchdogs are increasingly investigating the mechanics used to hide criminal proceeds.

The stakes are astonishingly high – and cybercrime experts are only just starting to unspool the true scope of the problem.

Massive laundering case reveals dark side of Singapore’s bid to lure super-rich

Last year, authorities in Singapore uncovered a money-laundering ring mostly comprising Chinese nationals from Fujian province with Cambodian citizenships, with over US$2 billion in assets seized from the 10 suspects.

Minimal regulation has made digital currencies – in particular the token Tether (USDT) on the Tron operating system – the avenue of choice for moving illicit revenues in high volumes, according to a revelatory UN report on money laundering published in January.

But such transactions can be traced via crypto wallets – despite them using unique, anonymised addresses made of strings of letters and numbers – due to there being a log of recent transactions that sometimes provides investigators with clues about criminals’ identities based on transaction patterns.

Tan’s company Chain Argos compiles data on crypto movements to advise clients ahead of crashes, such as the cataclysmic end of crypto exchange FTX, or more locally, the fall of Singapore-based crypto lender Hodlnaut.

While he still believes in the untapped potential of the crypto market, Tan is worried that regulators’ failure to detect and investigate suspicious activity weakens the investment environment.

“The curtains will come down on compliance theatre eventually,” he said.

“When is harder to say, but at least from what we’ve seen, there’s a growing recognition that continuing around this show is not going to fly because there is real harm being caused here.”

One regional security intelligence officer who requested anonymity claimed to have uncovered a money-laundering network linking Southeast Asia’s scam industry to a web of criminal activity including ransomware attacks by Lazarus Group, the hacking collective believed to be associated with North Korea.

“It is no exaggeration that they have supercharged the organised crime economy and are running a parallel financial system,” the security expert said.

“The fact Lazarus and Hamas financers use the same providers underscores their global reach and capacities, and that they get the job done.”

Blockchain bandits

Scam victims have been left to educate themselves as fast as they can and delve back into the crypto space that deceived them in the first place, trying to reclaim their investments.

In the weeks after US citizen Brian Bruce lost US$191,000 on a fake crypto investment platform disguised as a real exchange in 2021, he obsessed over the crypto wallets where he sent the money.

He eventually confronted a suspect, whom he believed was moving money for Myanmar-based scam farms, in a phone call.

So-called pig butchering scams, which have proliferated across the Mekong Delta in recent years but target the entire world, are characterised by a scammer building up a relationship, often a romantic one, with a victim before urging them to invest in a fraudulent platform.

The “kill” comes when the victim sends their money to the scammer’s cryptocurrency wallet.

‘We can kill you here’: inside the lawless Chinese-run scam hubs of Myanmar

After he started volunteering for the fraud-stopping Global Anti-Scam NGO, which has been instrumental in revealing Asia-based scam networks, Bruce used his memory of just such a wallet address as a jumping-off point to collect and trace transactions.

“I started seeing those same wallets pop up as we were getting more victims,” he said. “These [scammers] are connected to a lot of the same wallets I am, and that’s where I started drawing a lot of conclusions.”

Erin West, a California state prosecutor, said it was sometimes possible to reclaim victims’ losses by following this trail – depending on the exchanges that had been used and whether the criminals had moved the money before a warrant could be issued.

“We have to look away from what we would traditionally do, which is making arrests, because that’s just not going to be helpful in these cases,” she said.

West, who teaches her crypto knowledge to other state prosecutors, says companies and governments need to adopt more innovative approaches when investigating scams, including by preparing for the increased use of artificial intelligence.

Multinational criminal organisations like the 14K Triad and the Heavenly Way Alliance have already both been connected to extensive money laundering across Asia, using cryptocurrency and casinos to cover their financial tracks, according to a UN report.

Digital fingerprints

Blockchain transactions are feeding investigators like Tan and Bruce evidence of a global money-laundering process connecting seemingly disparate criminals.

This Week in Asia obtained the details of crypto wallets of two individuals who had been identified as recipients of fraudulent funds trafficked on the exchange Binance.

One, Wang Yicheng, a well-connected Chinese entrepreneur in Bangkok’s business scene, was the subject of a Reuters report on alleged links between cryptocurrency movements and the scam trade.

Wang did not reply to Reuters’ request for comment in November, and a Thai business association of which he was previously a board member distanced itself from Wang, adding that he was longer associated with it.

The other suspect owns a defunct remittance and foreign exchange business in Canada and operates a wallet on the Tron system.

5 Malaysians linked to ‘fake friend’ call scams extradited to Singapore

The regional intelligence officer explained that based on their transaction histories, the two individuals appeared to be playing slightly different roles in the same money-laundering network.

“Wang is basically part of a group fronting cyber-fraud operations,” the officer said, adding the other man was part of “a sophisticated transnational money-laundering organisation”.