Ari Redbord’s Post

On October 14, 2025, the U.S. Department of Justice (DOJ) announced a historic asset forfeiture, seizing approximately 127,271 Bitcoin (worth about $15 billion) from a Cambodian criminal network known as the "Prince Group". This action is part of a major international operation targeting a massive "pig butchering" scam empire. The table below summarizes the key details of this operation. Aspect Details Action Largest-ever forfeiture by the U.S. DOJ Bitcoin Seized 127,271 BTC Value ~$15 billion Target Prince Group Transnational Criminal Organization (TCO) Key Figure Chen Zhi (aka "Vincent"), founder and chairman (indicted and at large) Primary Crimes "Pig butchering" investment scams, money laundering, wire fraud, forced labor, and human trafficking 🚨 The Criminal Operation The U.S. authorities allege that Chen Zhi and his associates secretly grew the Prince Group into one of Asia's largest transnational criminal organizations. · "Pig Butchering" Scams: The network operated forced-labor scam compounds across Cambodia. Trafficked workers were forced to execute long-term investment scams, building fake online relationships with victims (the "fattening" stage) before convincing them to invest in fraudulent cryptocurrency platforms, leading to massive financial losses (the "slaughter"). · Money Laundering & Scale: The group used a complex web of over 100 shell companies and a dedicated Bitcoin mining operation in Laos to launder proceeds. Through Huione Group—a Cambodian financial services provider now severed from the U.S. financial system—over $4 billion in illicit crypto proceeds were laundered, with total transaction volume exceeding $98 billion. 🌍 A Coordinated International Strike The seizure was part of a sweeping, coordinated effort between the United States and the United Kingdom. · U.S. Actions: The DOJ unsealed an indictment and filed the civil forfeiture complaint. The Treasury Department's OFAC sanctioned 146 targets linked to the Prince Group, designating it a Transnational Criminal Organization. FinCEN also formally cut off Huione Group from the U.S. financial system. · U.K. Actions: The UK government imposed parallel sanctions and asset freezes on Chen Zhi and associated entities, freezing a £12 million mansion in London and other assets linked to the network. · Origin of the Bitcoin: Blockchain analytics firm Elliptic identified that the seized Bitcoin was previously held by Lubian, a Chinese cryptocurrency mining operation that shut down after the funds were reportedly stolen in 2020. The indictment describes Lubian as part of Chen Zhi's money laundering structure, though the exact circumstances of the "theft" and how the DOJ gained control of the funds remain unclear. This record-breaking seizure demonstrates law enforcement's growing capability to trace, target, and dismantle sophisticated crypto-enabled criminal operations on a global scale. #BTC

No. 1️⃣9️⃣ - Virtual Asset Snapshot: South Korea - What are the regulatory developments, current landscape and key money laundering vulnerabilities related to virtual assets and VASPs? 🏛️ 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸 In March 2021, Korea amended the Specified Financial Information Act to classify VASPs under AML obligations, requiring registration, KYC, STRs, and record-keeping. In March 2022, the Travel Rule was introduced: for VA transfers above KRW 1 million (≈ USD 740), VASPs must transmit originator and beneficiary identity data to counterparty VASPs or regulators. In June 2023, a new law was adopted to fill gaps in user protection and unfair-trade regulation, granting the FSC more direct powers to inspect and penalise VASPs. 👀 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗢𝘃𝗲𝗿𝘀𝗶𝗴𝗵𝘁 The FSC formulates crypto policy, disclosure rules, and unfair trade sanctions while Korea's FIU (KoFIU) enforces AML obligations. In 2024, KoFIU announced plans to strengthen its review of VASP registration, including scrutiny of major shareholders and social credibility, and to introduce preemptive suspension of suspicious transactions. ✅ 𝗟𝗶𝗰𝗲𝗻𝘀𝗶𝗻𝗴 & 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 To register with KoFIU, VASPs must: • Obtain ISMS certification (Information Security Management) • Operate real-name bank accounts (to ensure traceability) • Segregate customer VAs from their own assets, and maintain custodied holdings matching declared volumes • Keep records of VA transactions for 15 years, plus other logs for 5 years • Appoint an MLRO, implement transaction monitoring, sanctions screening, risk assessments, and internal controls  ⚠️ 𝗠𝗟/𝗖𝗙𝗧 𝗥𝗶𝘀𝗸𝘀 • Market manipulation & layering: VASPs may be used to disguise illicit flows via fake orders, wash trades, or splits across multiple accounts. • Use of “borrowed-name” accounts erodes BO transparency, despite real-name banking rules. • Emerging areas, DeFi protocols, non-custodial wallets, NFTs, are less regulated and thus more vulnerable pathways.  💰 𝗧𝗮𝘅𝗮𝘁𝗶𝗼𝗻 𝗨𝗻𝗰𝗲𝗿𝘁𝗮𝗶𝗻𝘁𝘆 As of 2022, the Adjustment of International Taxes Act treats foreign VA accounts as reportable - residents must report balances exceeding KRW 500 million (~USD 370,000). A capital gains tax (20%) is scheduled to apply to crypto profits exceeding KRW 50 million (~USD 37,000) from 2027. However, ambiguity remains around airdrops, forks, staking rewards, and utility tokens. 🔮 𝗙𝘂𝘁𝘂𝗿𝗲 𝗢𝘂𝘁𝗹𝗼𝗼𝗸 Korea is preparing to adopt the OECD Crypto-Asset Reporting Framework (CARF) timelines, aligning tax transparency globally. The Digital Assets Framework Act under discussion is expected to unify token, exchange, custody, and ICO rules. KoFIU’s 2024 plan aims to expand risk-based inspections, incorporate flow-analysis systems, and authorise preemptive transaction suspension. Access full reporting and scoring on all 245 jurisdictions via subscription. 👉 sales@knowyourcountry.com

Late last month, Brazil's Polícia Federal launched Operation Lusocoin, a sweeping investigation into a sophisticated criminal network accused of laundering billions of reais through cryptocurrency. TRM Labs is proud to have supported Brazilian law enforcement in this and other investigations. Coordinated by the Superintendence of the Federal Police in Rio Grande do Sul, the operation executed 13 search and seizure warrants, 11 temporary arrests, and issued court-ordered freezes on assets totaling more than 3 billion Brazilian reais (≈ USD 540 million). According to investigators, the network functioned as an international money-laundering and foreign-exchange evasion scheme, converting illicit profits from drug trafficking, smuggling, tax evasion, and terrorism financing into crypto assets to obscure their origin. The investigation was led by the Federal Police unit in Santana do Livramento, a frontier city sharing a porous border with Rivera, Uruguay. The region is a hub of commerce and informal exchange — where cash, goods, and people move fluidly across national lines. Those same conditions that power legitimate trade also enable financial crime, from trade-based laundering and bulk cash smuggling to shell companies masking illicit proceeds. Investigators believe the group moved more than 50 billion reais (≈ USD 9 billion) through a network of shell companies, exchanges, and wallets. The scheme even included a proprietary token — “Lusocoin” — designed both to lure investors and to function as a laundering vehicle for criminal proceeds. Using TRM, investigators traced connections among shell entities and addresses linked to organized crime. Authorities seized six luxury vehicles, six high-value properties, and froze assets tied to 65 individuals and companies, as well as 30 cryptocurrency wallets. Working with international exchanges and analytics providers, the team identified and froze 4.33 million USDT (≈ 22.5 million reais) belonging to the network’s principals. The case highlights Brazil’s growing sophistication in crypto investigations. Operation Lusocoin marks the sixth investigation in which Brazilian authorities have leveraged the T3 Financial Crime Unit — a global public-private partnership uniting TRM Labs, Tether, TRON, Binance and law enforcement agencies worldwide. Across T3-supported operations, Brazil has now frozen 13,399,699 USDT (≈ USD 13 million) in criminal assets — evidence of its expanding capacity to dismantle cross-border laundering networks. Operation Lusocoin once again demonstrates that even highly decentralized, cross-border laundering schemes leave trails — and that with blockchain intelligence, public-private collaboration, and rapid coordination across jurisdictions, those trails lead to enforcement success.

🙌🏼 Great work from Brazil’s Polícia Federal! 💡 This case shows that while crypto is being used extensively by money launderers, there is a lot of off-chain investigation that has to go into catching these criminals. 🤓While AI is being used extensively to help catch these criminals, the most successful money launderers still rely on off-chain value transfer methods to layer and integrate their ill gotten gains, meaning that AI may be replacing a lot of jobs in the fincrime industry, but money launderer is one role that’s unlikely to be replaced any time soon. 🫠

Impressive work by Brazil’s Polícia Federal and TRM Labs in Operation Lusocoin ! This investigation uncovered a massive international laundering scheme using crypto to obscure illicit proceeds from drug trafficking, smuggling, and more totaling over 50 billion reais (~USD 9 billion). The operation highlights the power of blockchain intelligence and public-private collaboration in dismantling sophisticated financial crime networks. Proud to see TRM Labs playing a key role in supporting law enforcement efforts across borders. 🔗 13 search warrants 🔗 11 arrests 🔗 65 individuals and companies targeted 🔗 30 crypto wallets frozen 🔗 4.33M USDT seized 🔗 6 luxury vehicles and 6 high-value properties confiscated Brazil is setting a global example in crypto investigations !

Hydra Market - The mind behind Dmitry Olegovich Pavlov What: Hydra was the largest Russian-language darknet marketplace (active 2015–April 2022) and functioned as a broad criminal ecosystem: large scale drug trafficking, exchange/tumbling services for crypto, sale of forged documents, hacking services, and financial-crime facilitation. It operated an integrated crypto-fiat exchange that helped convert illicit crypto to Russian rubles. Scale & impact: Authorities estimate Hydra facilitated billions in illicit transactions (estimates $4–$5+ billion lifetime) and accounted for a massive share of darknet crypto flows prior to takedown. It was subject to international sanctions and a coordinated takedown (servers seized, crypto assets frozen). Key stakeholders Platform administrators / owners ran the marketplace and its internal conversion/exchange services. Vendors / suppliers narcotics suppliers, vendors selling stolen data, illicit services (malware, money-mule recruitment), and forged documents. Customers largely Russian-language user base, international buyers for drugs and illegal services. Embedded financial rails / exchanges Hydra’s ecosystem included links to certain cryptocurrency exchanges and conversion services (some later sanctioned or investigated for weak AML controls, e.g., Bitzlato connections). Logistics networks physical parcel networks and mule networks used to move drugs and contraband. Forum/moderators and escrow operators governance and dispute resolution inside the marketplace. Law enforcement / sanctions authorities German authorities, U.S. DOJ, U.S. Treasury/OFAC, and others involved in seizure, sanction and prosecution actions. Products & services sold (typical listings) Illegal drugs: large selection of heroin, cocaine, synthetic opioids (fentanyl and precursors), stimulants often at industrial scale. Financial services / money-laundering tools: in-platform conversion between crypto and Russian rubles, mixing/tumbling-like services, and contacts to exchange operators able to convert illicit proceeds to fiat. Stolen data & fraud services: databases of PII, stolen credit-card dumps, identity documents, and forged credentials. Cybercrime services: malware, DDoS/ransomware support, hacking-as-a-service listings. How these offerings relate to money laundering, fincrime, trafficking, terrorism risk Integrated laundering pipeline: Hydra’s unique risk was its integrated model — facilitating illicit product sales and providing conversion paths to fiat inside the same ecosystem. That reduced friction for criminals to convert crypto revenues into spendable fiat, widening AML exposure for exchanges and on-ramps. Cross-crime facilitation: vendors selling stolen data and hacking tools fuel identity fraud and large-scale financial crime; proceeds from one crime can be laundered via the marketplace’s financial rails and then re-used to fund other illicit activities.

World of secrets the rise of layer-2 scaling solutions, particularly rollups.These networks attempt to increase throughput, lower fees, and improve scalability beyond what base chains can support. But as these layer-2 networks grow, they also present fresh risks and challenges for anti-money laundering (AML) compliance. Criminals and illicit actors are already adapting to exploit these new layers.

The U.S. Department of Justice has unsealed a sweeping indictment charging Chen Zhi (aka “Vincent”), founder and chairman of Prince Holding Group, with orchestrating a massive transnational fraud and labor-trafficking enterprise. (https://lnkd.in/dJrGmSfN) At the heart of the case: Cambodia-based forced-labor compounds where victims, held under duress, were coerced into executing “pig butchering” cryptocurrency investment scams. Billions of dollars were stolen from victims globally. In parallel, the DOJ filed the largest forfeiture action in its history: some 127,271 BTC (approx. USD 15 billion) tied to the fraud are now in U.S. custody. This case illustrates how human trafficking, cyber-fraud, and money laundering can be deeply intertwined - and how digital assets provide a powerful conduit for hiding, transferring, and layering illicit proceeds across borders. Daily updates of sanctions/whatch lists matter - especially in crypto & financial institutions. For crypto and financial institutions, even a short delay in recognizing a newly sanctioned entity or address can allow contagion across systems, illicit fund flows to persist, or risky counterparties to remain undetected. Daily updates (or real-time feeds) ensure that compliance systems, transaction monitoring, and risk assessments can block or flag suspicious actors as close to “live” as possible - closing windows of opportunity for money laundering, sanctions evasion, and fraud networks to exploit. At Covery AI, we ensure our clients always screen against the latest, daily refreshed sanctions data - so that no risky counterparties slip through.

FATF 2025: Digital Assets and the Stablecoin Paradox I was recently reviewing notes from the FATF Virtual Asset Contact Group (VACG) meeting held in Paris earlier this year (April 2025), and one theme stood out: the same features that make digital assets — especially stablecoins — efficient and attractive are also reshaping the financial crime landscape. Stablecoins are no longer just “digital dollars.” They’ve become a major channel for value transfer, and increasingly, for illicit finance. FATF discussions focused on how to close the regulatory and technical gaps that allow misuse to scale. Key takeaways from the FATF discussions: • Good design doesn’t mean good compliance – even if a stablecoin is well-built from a technical or economic standpoint, that doesn’t mean it meets AML or regulatory expectations. Centralized stablecoins like USDC or USDT are issued by identifiable entities that can freeze wallets, block transactions, and cooperate with law enforcement. In contrast, decentralized stablecoins such as DAI or USDH operate entirely through smart contracts with no central control — meaning there’s no one to enforce sanctions, monitor suspicious activity, or reverse illicit transactions. Strong technology and price stability don’t automatically equal compliance — and that gap is where financial crime risk grows. • The real risk sits in the code – controls need to be built directly into the smart contract, not just handled by the company that issues or trades the asset. • AI helps both sides – regulators and investigators are using AI to track illicit flows, but criminals are also using AI tools to create new types of scams and hacks. • Regulation needs to start earlier – FATF members are considering whether stablecoin code itself should be reviewed or approved before being released, similar to how financial audits work. For financial institutions, these discussions signal what’s coming next. As stablecoins and other digital assets move further into the mainstream, regulators are shifting their focus from who moves the money to how the technology itself operates. This means that compliance expectations will increasingly extend beyond customer due diligence and transaction monitoring — toward understanding the code, governance, and design of the assets being handled. For banks and service providers, staying ahead will require closer collaboration between compliance, technology, and risk teams — and a mindset that treats code as part of the control environment, not just infrastructure. It’s fascinating to see how the definition of compliance continues to evolve alongside technology — and how quickly our approach must evolve with it. https://lnkd.in/ganEAUCi

French authorities have expanded AML checks across more than 100 registered crypto providers to inform MiCA (Markets in Crypto-Assets Regulation) licensing decisions. Inspections include major exchanges such as Binance and Coinhouse.  https://lnkd.in/dXQTzAPm