2026-07-31 · Illicit Finance
Prosecutors in Brooklyn say the coins are the proceeds of forced-labour scam compounds in Cambodia. Blockchain analysts say the same coins were taken from a Chinese mining pool in December 2020 through a private key generation flaw, and then sat almost untouched for four years.
Case file
| Field | Value |
|---|---|
| Matter | United States v. Chen Zhi (criminal); civil forfeiture at No. 25-CV-5745 |
| Court | E.D.N.Y. (Brooklyn) |
| Unsealed | 14 October 2025. DOJ release 25-1,031, updated 17 October 2025 |
| Defendant | Chen Zhi, also known as “Vincent”, 37, a Cambodian national |
| Charges | Wire fraud conspiracy; money laundering conspiracy |
| Maximum exposure | 40 years |
| Amount forfeited | approx. 127,271 BTC, approx. $15 billion at the time of filing |
| Posture as of 31 July 2026 | Charged. Defendant at large. No conviction |
| Filed by | US Attorney’s Office, E.D.N.Y. and DOJ National Security Division |
| Investigating | DEA New York Division; FBI New York Joint Asian Criminal Enterprise Task Force; FBI Virtual Asset Unit |
| Foreign assistance | UK National Crime Agency; Isle of Man Constabulary Proactive International Money-Laundering Investigations Team |
| Related sanctions | OFAC and UK FCDO designations, 14 October 2025; OFAC expansion, June 2026 |
The DOJ release carries a correction notice: “This press release has been updated to accurately reflect the defendant’s nationality.” Some wire coverage from 14 October described Chen Zhi as a Chinese-born emigre aged 38. The corrected DOJ release says Cambodian national, 37. This article follows the DOJ release.
What the record shows
On 14 October 2025 an indictment was unsealed in the Eastern District of New York charging Chen Zhi, founder and chairman of the Cambodia-based conglomerate Prince Holding Group, with wire fraud conspiracy and money laundering conspiracy. The Department of Justice alleges he directed the operation of forced-labour scam compounds across Cambodia, where people held against their will ran cryptocurrency investment fraud of the type commonly called pig butchering. He faces up to 40 years if convicted. He has not been arrested and remains at large.
Alongside the indictment, the US Attorney’s Office for the Eastern District of New York and the Justice Department’s National Security Division filed a civil forfeiture complaint against approximately 127,271 bitcoin, described in the release as “currently worth approximately $15 billion”. The release states the coins are “proceeds and instrumentalities of the defendant’s fraud and money laundering schemes, and were previously stored in unhosted cryptocurrency wallets whose private keys the defendant had in his possession”, and that they are now in US government custody. The Department called it the largest forfeiture action in its history.
The release sets out where the government says the bitcoin came from. Prince Group is alleged to have laundered fraud proceeds through its own businesses, including online gambling and cryptocurrency mining. Prosecutors quote Chen Zhi describing the mining operation to others: “the profit is considerable because there is no cost.” The government’s reading of that remark is that the mining businesses were capitalised with money stolen from victims, which is what makes the mined output forfeitable proceeds rather than ordinary revenue.
The release also describes the laundering method, naming “spraying” and “funneling”: large volumes of cryptocurrency repeatedly split across scores of addresses and then re-consolidated into fewer addresses. Prosecutors say Chen Zhi kept diagrams recording how some of the forfeited cryptocurrency was laundered, and ledgers tracking which schemes ran out of which rooms in the compounds. A network operating in Brooklyn is alleged to have moved millions of dollars on Prince Group’s behalf from more than 250 victims in New York and elsewhere in the United States.
The DOJ release ends with the standard formulation, which governs everything above: “An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.”
The same day, Treasury’s Office of Foreign Assets Control, acting in coordination with the United Kingdom’s Foreign, Commonwealth and Development Office, designated Prince Group as a transnational criminal organisation. Elliptic’s analysis of the action counts 146 designated targets across the network. The UK’s parallel action reached entities including Byex Exchange, which Elliptic traced as having received at least $1.3 billion in cryptocurrency. Elliptic also identified four bitcoin addresses it attributes to Chen Zhi holding roughly $1.8 billion, and a fifth address holding a further $560 million that was not named in the designation.
OFAC expanded the Prince Group designations again in June 2026, reaching further into the network. Treasury’s release names Hu Xiaowei, described as the organisation’s second-in-command, and Chen Bo, a director of at least six Prince Group companies designated in the October 2025 action. Prosecutors say the operation generated as much as $30 million a day at its height, and that proceeds were placed into real estate, aviation and other businesses.
The provenance of the coins
The forfeited bitcoin has a history that predates the indictment by nearly five years.
On 28 or 29 December 2020, depending on the account, the LuBian mining pool lost the overwhelming majority of its bitcoin holdings in a single event. Arkham Intelligence, which published its analysis in August 2025, puts the figure at 127,426 BTC and says more than 90% of LuBian’s holdings were drained. A separate technical forensic report circulated in the Chinese-language press puts it at 127,272.06953176 BTC on 29 December. Arkham attributes the loss to a flaw in how LuBian generated private keys, which it says left the keys open to brute-force attack. At December 2020 prices the haul was worth somewhere around $3.5 billion.
Arkham’s account is that the coins then went largely dormant, with the last significant movement being a wallet consolidation in July 2024. Reporting on the incident notes that messages were written into the blockchain in early 2021 and again in July 2022, addressed to whoever held the coins, asking for their return and offering payment. Those messages went unanswered.
China’s National Computer Virus Emergency Response Center has publicly disputed the characterisation of the 2020 event as an ordinary hack, describing it instead as a state-level operation. The United States has rejected that account. Neither position has been tested in a court.
What I think happened
The most interesting question in this case is one the public record does not answer: who held these coins between December 2020 and October 2025.
The government’s theory is coherent and it is filed with a lot of on-chain work behind it: fraud money capitalised the mining businesses, the mining businesses produced the bitcoin, Chen Zhi held the keys, so the bitcoin is forfeitable proceeds. The “no cost” quote is doing real work in that chain, because it is the government’s evidence that the operating capital was stolen.
Here is what I keep returning to. The DOJ release does not mention LuBian at all.
That is a conspicuous absence, because the analytics firms put the same coins somewhere else entirely. Arkham’s August 2025 work says 127,426 BTC left the LuBian mining pool in a single event in late December 2020, through what it reads as a brute-forceable flaw in how LuBian generated private keys. Elliptic, writing about the sanctions the same month as the indictment, describes the seized coins as having been stolen from LuBian in 2020. The government instead describes coins that were mined by Prince Group’s own operation between roughly 2021 and 2022 and sat in wallets whose keys the defendant possessed.
Those two accounts can be reconciled, but only in ways that each raise a further question. If LuBian was itself a Prince Group operation, then the December 2020 event happened to them and the “proceeds of mining” framing survives, but somebody else held the coins for four years and the government does not say who or how they came back. If LuBian was a third party, the mining-proceeds theory has to account for coins that were mined by a different business. And the on-chain messages written in early 2021 and again in July 2022, addressed to whoever held the coins and offering payment for their return, sit awkwardly with any version where possession was continuous.
China’s National Computer Virus Emergency Response Center has publicly called the 2020 event a state-level operation. The US has rejected that. I have no basis to evaluate either claim and neither does anyone else working from open sources, which is precisely why it is worth saying plainly that the question is open rather than picking the account that reads best.
The timing is what I keep coming back to. Coins sit untouched from December 2020, get consolidated in July 2024, and are in US government custody by October 2025. That is a long, patient sequence, and it is the part of the story that the press releases skip.
Two things I would not read into this. First, the size of the number is a function of bitcoin’s appreciation, not of the scale of the underlying fraud in 2020 terms. A $3.5 billion event became a $15 billion headline because the asset moved. Second, a forfeiture is not a conviction. Chen Zhi has not been tried and is presumed innocent. A civil forfeiture proceeds against the property on a lower standard than a criminal case against the person, and the two can end differently.
What is genuinely new here is that a state has now demonstrated the operational capability to take custody of a six-figure bitcoin balance held in unhosted wallets. Whatever you believe about how that happened, serious holders should update on it.
What would have changed the outcome
There are two different readers of this case and they need different answers. Conflating them is how post-mortems on fraud turn into noise.
If you are worried about being the victim. Pig butchering works on the person, so the structure of your holdings is close to irrelevant to it. No entity or trust stops somebody from being talked into sending money over several months by a person they believe they have a relationship with. What works is process, and it is unglamorous: a standing rule that no outbound transfer above a set threshold happens same-day, and a second human who has to approve it. The delay is the control, because the whole model depends on emotional momentum. If you run family money, write that rule down and apply it to yourself, not only to staff.
If you are worried about the keys. This is the part of the case with a real lesson, and it is the LuBian side rather than the Prince Group side. Around $3.5 billion at the time, and $15 billion by the end, turned on how one operation generated its private keys. Arkham’s reading is that the entropy was weak enough to brute-force. That is not an exotic attack and it is not a market risk you can diversify away from. It is a single engineering decision made once, by whoever wrote the key generation code, and then inherited by every coin that landed in those addresses.
The structural question worth asking about your own holdings is: who generated your keys, on what hardware, and can anybody demonstrate how? If the answer is a script somebody wrote, or a wallet whose entropy source nobody has examined, you are carrying a risk that has nothing to do with the market and that you cannot see on a statement.
The alternative that most large holders land on is a third-party qualified custodian with audited key ceremonies and hardware security modules, where key generation is documented and independently examined rather than assumed. Holding assets with an independent qualified custodian in your own name also separates them from the balance sheet of any platform you trade through, which matters in an insolvency. DAG coordinates independent custody arrangements of that kind for digital-asset holders.
Being straight about the limits: that arrangement addresses key generation and platform insolvency. It does nothing about market risk, and it does nothing at all about the scenario in the first half of this section, where the holder authorises the transfer themselves. As DAG’s own disclosure puts it, custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them.
Sources
- US Department of Justice, Office of Public Affairs, “Chairman of Prince Group Indicted for Operating Cambodian Forced Labor Scam Compounds Engaged in Cryptocurrency Fraud Schemes”, press release 25-1,031, 14 October 2025, updated 17 October 2025. Prosecutors: AUSAs Alexander F. Mindlin, Andrew D. Reich, Benjamin Weintraub and Rebecca M. Schuman (E.D.N.Y.), with Deputy Chief Christopher B. Brown of the National Security Division’s NatSec Cyber Section; AUSA Tanisha Payne on forfeiture. US Attorney Joseph Nocella Jr. https://www.justice.gov/opa/pr/chairman-prince-group-indicted-operating-cambodian-forced-labor-scam-compounds-engaged
- Indictment, United States v. Chen Zhi, E.D.N.Y., unsealed 14 October 2025 (PDF). https://www.justice.gov/usao-edny/media/1416266/dl
- Civil forfeiture complaint, No. 25-CV-5745, E.D.N.Y.
- FBI Internet Crime Complaint Center, 2024 IC3 Annual Report: cryptocurrency investment fraud caused more than $5.8 billion in reported losses in 2024, cited in the DOJ release. https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
- US Department of the Treasury, “U.S. and U.K. Take Largest Action Ever Targeting Cybercriminal Networks in Southeast Asia”, OFAC designation of Prince Group as a transnational criminal organization, press release SB0278, 14 October 2025. https://home.treasury.gov/news/press-releases/sb0278
- US Department of the Treasury, “Treasury Further Dismantles Overseas Scam Operations Targeting Americans”, press release SB0538, June 2026. https://home.treasury.gov/news/press-releases/sb0538
- UK Foreign, Commonwealth and Development Office, parallel designations, 14 October 2025.
- Elliptic, “Prince Group targeted with crypto sanctions for global pig butchering operations”, October 2025.
- TRM Labs, “Operation Prince: Inside the Global Effort That Led to the Largest Forfeiture in US History”.
- Chainalysis, analysis of the Southeast Asia scam network, October 2025.
- Arkham Intelligence, LuBian mining pool analysis, August 2025.
- China National Computer Virus Emergency Response Center, statement on the LuBian event.
Related on this desk
- Tornado Cash: the sanctions arc, Blender to Van Loon to delisting — the sanctions instrument, applied to infrastructure rather than to a person.
- Mirror Trading International: 29,421 bitcoin and a bot that did not exist — the other case where the underlying business was the fraud.
Corrections
None. If you can show something here is wrong, the correction goes at the top of this section with the date it was made.
Disclosure. Max Avery is affiliated with Digital Ascension Group (DAG). Investment advisory services are offered through DAG Wealth, an SEC-registered investment adviser (CRD No. 328627). Registration does not imply a certain level of skill or training. DAG is not a law firm and does not provide legal or tax advice. Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. Nothing here is investment, legal, or tax advice, or a recommendation to buy or sell any asset. This article describes matters of public record; charges are allegations and defendants are presumed innocent unless and until proven guilty.