Author: 0xjs@Jinse Finance

The mantis stalks the cicada, unaware of the oriole behind.

The largest telecom fraud group in Southeast Asia has ultimately been "harvested" by the U.S. government.

On the evening of October 14, Beijing time, the U.S. Department of Justice charged Chen Zhi, the founder and chairman of the multinational fraud group "Prince Group" based in Cambodia, and other accomplices with telecom fraud and money laundering. If these two charges are established, the U.S. government will confiscate all property or proceeds obtained directly or indirectly from these crimes, including but not limited to 127,271 bitcoins (approximately $15 billion).

This approximately 127,000 BTC is the proceeds and tools of the Prince Group's fraud and money laundering scheme, previously stored in a non-custodial cryptocurrency wallet controlled by Chen Zhi, who held the private keys, and is now under the control of the U.S. government.

The crypto community is particularly concerned about whether the 127,000 bitcoins currently controlled by the U.S. government are related to the 127,000 BTC stolen from the Lubian mining pool, which was the sixth largest Bitcoin mining pool in 2020.

Jinse Finance reviewed the indictment from the U.S. Department of Justice and compiled key information as follows:

1. 25 Bitcoin Wallets with 127,000 BTC

Documents from the U.S. Department of Justice indicate that the 127,000 BTC was previously stored in 25 non-custodial wallet addresses controlled by Chen Zhi. Moreover, as early as around 2020, Chen Zhi had accumulated such a large amount of BTC through massive fraud and money laundering.

Chen Zhi personally kept records of each wallet address and the mnemonic phrases associated with the private keys. The specific 25 addresses are shown in the table below:

2. Two Key Dates

December 29, 2020, and June 22, 2024.

Tracking the addresses in the table above, for example, the first address 3Pja5FPK1wFB9LkWWJai8XYL1qjbqqT9Ye, on December 29, 2020, 20,452 bitcoins from this address were transferred in multiple batches.

They were transferred in amounts ranging from dozens to hundreds of BTC to multiple BTC addresses:

These addresses (taking the first address in the above image bc1qut988zlc9uhmczj4yz3d8c4xn8qdh2g7rymdzy as an example, with 105.7 BTC) were transferred again to a new address (34x7umj1KZRH94F1nvyF6MtXQoLgQ3swRd) on June 22, 2024, and have not been transferred since.

The last address 339khCuymVi4FKbW9hCHkH3CQwdopXiTvA follows the same pattern, with 1,500 BTC transferred to a new address in one go on December 29, 2020.

3. How Did the U.S. Government Control the 127,000 BTC "Stolen" from the Lubian Mining Pool?

The BTC addresses from the previous section are all marked as Lubian hacker on Arkham.

And December 29, 2020, is precisely the day when 127,000 BTC was stolen from the Lubian mining pool.

According to Arkham research, the LuBian mining pool was one of the largest Bitcoin mining pools in the world in 2020, at one point accounting for nearly 6% of the total Bitcoin network's hash rate in May 2020. It was attacked by hackers on December 29, 2020.

How do we determine that the Lubian mining pool was hacked? Arkham's research found that each hacker address received transactions with OP_RETURN messages, in which LuBian requested the hackers to return the stolen funds. To send these messages, LuBian initiated 1,516 transactions, consuming about 1.4 bitcoins.

Refer to Jinse Finance's previous report, "BTC Shocking Theft Case Exposed: 120,000 Bitcoins Worth $14.5 Billion, On-Chain Messages Reveal the Truth."

According to the U.S. government's announcement, the 127,000 bitcoins of the Prince Group are currently under the control of the U.S. government. This means that by June 22, 2024, the U.S. government had already controlled these 127,000 BTC.

On-chain intelligence agencies also mistakenly labeled the U.S. government as the Lubian hacker.

So, how did the 127,000 BTC once controlled by Prince Group founder Chen Zhi end up in the hands of the U.S. government?

We can boldly speculate that the possibilities include but are not limited to the following four:

1. Before December 29, 2020, the U.S. government obtained Chen Zhi's mnemonic phrases, transferred the Lubian mining pool's BTC on December 29, 2020, and organized the BTC on June 22, 2024;

2. Chen Zhi orchestrated the "Lubian mining pool theft" incident on December 29, 2020, and after the "theft," the mnemonic phrases for the new address were obtained by the U.S. government, and the BTC was transferred by the U.S. government on June 20, 2024. The new question is, how did the U.S. government obtain the mnemonic phrases?

3. An insider around Chen Zhi attacked the Lubian mining pool, and this person was subsequently captured by the U.S. government, leading to the control of the bitcoins by the U.S. government on June 22, 2024, and pulling the carrot and bringing up the mud;

4. A real hacker attacked the Lubian mining pool, and the hacker was captured by the U.S., similar to scenario 3.

More details of the case require further information disclosure from the U.S. government.

4. Individuals and Entities Related to the "Prince Group Case"

Organizational chart of Prince Group executives

According to the indictment from the U.S. Department of Justice, the relevant individuals and entities are as follows:

a. Chen Zhi: Holds citizenship in China, Cambodia, Vanuatu, Saint Lucia, and Cyprus, and has resided in Cambodia, Singapore, Taiwan, and the United Kingdom.
b. Accomplice 1: Holds citizenship in Cambodia, Vanuatu, Cyprus, and Saint Kitts, and has resided in Cambodia, Singapore, and the United Kingdom.
c. Accomplice 2: Holds citizenship in Cambodia and Cyprus, and has resided in Singapore and the United States.
d. Accomplice 3: Holds citizenship in China and Cambodia, and has resided in the United States and other regions.
e. Accomplice 4: Cambodian citizen and resident.
f. Accomplice 5: Hong Kong citizen and resident.
g. Accomplice 6: Hong Kong citizen and resident.
h. Accomplice 7: Singaporean citizen and resident.
i. Exchange 1: A cryptocurrency exchange platform headquartered in China.
j. Exchange 2: A cryptocurrency exchange platform headquartered in Seychelles.
k. Exchange 3: A cryptocurrency exchange platform headquartered in the United States.
l. Exchange 4: A cryptocurrency exchange platform headquartered in the United States.
m. Trading Platform 1: An online trading platform.
n. Financial Institution 1: A financial institution headquartered in the United States, with deposits insured by the Federal Deposit Insurance Corporation (FDIC).
o. Prince Group: A holding company registered in Cambodia, operating over 100 business entities in more than 30 countries worldwide, founded and chaired by Chen Zhi.
p. Yun Ki Estate Intermediary Co., Ltd.: A subsidiary of Prince Group, primarily engaged in real estate development. From around 2020 to present, Accomplice 1 has served as the chairman of this company.
q. Awesome Global Investment Group: A subsidiary of Prince Group, primarily engaged in entertainment, hospitality, and real estate development. From around 2017 to 2022, Accomplice 2 served as the chairman of this company.
r. Prince Real Estate Group and Prince Huan Yu Real Estate Group: Subsidiaries of Prince Group, both primarily engaged in real estate development. From around 2018 to at least 2024, Accomplice 3 served as the chairman of Prince Huan Yu Real Estate Group.
s. Prince Bank: A subsidiary of Prince Group, primarily engaged in financial services. From around 2015 to at least 2023, Accomplice 4 served as the vice chairman of this bank.
t. Warp Data Technology Lao Sole Co., Ltd.: An entity registered in Laos, operating Bitcoin mining facilities.
u. Lubian: A Bitcoin mining organization in China, with Bitcoin mining facilities in various locations across Asia, including China and Iran.
v. Future Technology Investment: An entity registered in the Cayman Islands, with Accomplice 6 serving as a director and bank account signatory for this company.
w. Amber Hill Ventures Limited: An entity registered in the British Virgin Islands, with Accomplice 6 serving as a director and bank account signatory for this company.
x. Lateral Bridge Global Limited: An entity registered in the British Virgin Islands, associated with FTI, with Accomplice 7 serving as a director for this company.
y. Hing Seng Limited: An entity registered in Hong Kong.

The Criminal Network of Prince Group

It is reported that the Southeast Asian fraud group lured unsuspecting job seekers from over 70 countries, forcing them to work alongside those actively participating in crimes, implementing large-scale and complex fraud schemes targeting almost all jurisdictions worldwide.

In Cambodia, Laos, and Myanmar alone, it is believed that the workforce engaged in cybercrime exceeds 350,000 people, with estimates indicating that the annual revenue of Southeast Asian fraud groups ranges between $50 billion and $75 billion. This makes transnational fraud potentially the most significant economic activity in the entire Mekong subregion of Southeast Asia—its scale is even comparable to nearly half of the GDP of the major host countries. Among them, the profit from Cambodia's fraud industry is particularly substantial, with estimates of its illegal annual revenue ranging between $12.5 billion and $19 billion.

Since around 2015, Chen Zhi and senior executives of Prince Group have implemented cryptocurrency investment fraud and other fraudulent schemes, defrauding victims globally and embezzling billions of dollars. To carry out these schemes, Chen Zhi and his accomplices directed Prince Group to establish and operate "forced labor fraud parks" throughout Cambodia, compelling personnel within these parks to engage in large-scale fraudulent activities. Chen Zhi and his accomplices utilized their political influence in multiple countries to protect their criminal activities and bribed foreign public officials to evade law enforcement crackdowns. Subsequently, they laundered the proceeds of fraud through professional money laundering organizations and Prince Group's own "seemingly legitimate" business network (including online gambling and cryptocurrency mining operations).

5. How the Fraud Group Implements Scams

The indictment from the U.S. Department of Justice contains a wealth of information, detailing how the Southeast Asian fraud group executes its scams.

Chen Zhi is the founder and chairman of Prince Group. According to the official website of the group, its "core business sectors" in Cambodia include "Prince Real Estate Group, Prince Huan Yu Real Estate Group, Prince Bank, and Awesome Global Investment Group." These sectors and other entities under Prince Group are involved in various publicly disclosed business areas such as "real estate development, banking, finance, tourism, logistics, technology, catering, and lifestyle."

The primary source of profit for Prince Group comes from illegal fraudulent activities led by Chen Zhi, with the assistance of his core executives and accomplices (including Accomplices 1 to 7), which mainly include:

1. Fraud Parks

Prince Group occupies a dominant position in the aforementioned online fraud industry. In this illegal industry, thousands of migrant workers travel to Cambodia and other locations seeking job opportunities, only to be sold into fraud parks, where they are coerced under threats of violence to engage in cryptocurrency investment fraud and other fraudulent activities. These fraud parks are equipped with large dormitories, surrounded by high walls and barbed wire, effectively functioning as "violent forced labor camps."

Under Chen Zhi's direction, Prince Group has established and operated at least 10 fraud parks across Cambodia, specifically for executing cryptocurrency investment fraud and other fraudulent schemes, including: (i) the "Jinbei Compound" associated with Prince Group's "Jinbei Hotel and Casino" located in Sihanoukville, Cambodia; (ii) the "Jinyun Compound" (also known as "Jinfu Technology Park") located in Chirethom, Cambodia; (iii) the "Jinhong Park" (also known as "Mango Park") located in Pursat Province, Cambodia.

Chen Zhi is directly involved in the management of the fraud parks and keeps records related to each park, including tracking records of fraud profits clearly marked as "pig butchering" schemes. A ledger preserved by Chen Zhi details various fraudulent schemes operated by the Jinhong Park of Prince Group, as well as the specific schemes responsible for each building and floor within the park, including "Vietnam order fraud," "Russia order fraud," "European and American chat scams" (referring to fraudulent conversations), "Vietnam chat scams," "China chat scams," "Taiwan chat scams," and "China brushing" (referring to online retail fraud).

Chen Zhi and his accomplices designed the fraud parks to maximize profits and personally ensured that the parks had the necessary infrastructure to "reach as many victims as possible." For example, around 2018, Accomplice 1 obtained millions of phone numbers and account passwords from illegal online markets; around 2019, Accomplice 3 assisted in supervising the construction of the Jinfu Park. Chen Zhi himself also kept documents describing and showcasing "phone farms"—automated call centers used for executing cryptocurrency investment fraud and other cybercrimes. The documents detailed the construction status of two "phone farm" facilities: each facility was equipped with 1,250 phones and could control 76,000 accounts on a popular social media platform.

Additionally, internal documents of Prince Group also contain guidelines on "how to build trust with victims" and operational manuals on "how to register social media accounts in bulk" (including explicit instructions to "use 'less attractive' female avatars to ensure accounts appear genuine").

In the summer of 2022, Accomplice 2 boasted that in 2018, Prince Group earned over $30 million per day through fraudulent pig butchering schemes and related illegal activities.

2. Advancing Criminal Schemes through Bribery and Violence

Chen Zhi and his accomplices utilized political influence to protect their fraudulent activities from law enforcement crackdowns in multiple countries. Among them, senior executives of Prince Group obtained advance warning information about "law enforcement raids on fraud parks" through bribery; additionally, Chen Zhi assigned Accomplice 2 to oversee the "risk control" function of Prince Group, monitoring the progress of related investigations and maintaining the interests of Prince Group through "corrupt dealings" with foreign law enforcement officials.

Chen Zhi kept records of bribes paid to public officials, including one ledger that documented "reimbursements for bribes and luxury goods purchases amounting to hundreds of millions of dollars to individuals associated with Prince Group." For example, the ledger shows that in 2019, Accomplice 2 purchased a yacht worth over $3 million for a senior official of a foreign government; Chen Zhi also bought luxury watches worth millions of dollars for another foreign government official. In 2020, this official assisted Chen Zhi in obtaining a diplomatic passport, which Chen Zhi used to travel to the United States in April 2023.

As part of the "risk control" responsibilities, Accomplice 2 served as the "executor" for Prince Group, maintaining the group's dominant position in the fraud industry through corruption and violence. For instance, around July 2024, Accomplice 3 communicated with Chen Zhi regarding "the theft of illegal profits from the group by individuals associated with Prince Group," stating that "a financial staff member absconded with funds and attempted to hide," and informed Chen Zhi that "measures are being taken to recover the stolen funds," promising that "we will investigate thoroughly, and I don't know if the boss (referring to Chen Zhi) and the group have any suggestions or methods to share… both the mafia and the government are ready to take action, to set an example. Boss, does the group have relevant experience or resources?" Chen Zhi subsequently replied, "You should first communicate with Accomplice 2 about this matter, gather all the information before deciding how to handle it, and ascertain the current location of this person."

Under Chen Zhi's direction, individuals associated with Prince Group frequently employed violence and coercion to achieve "business objectives" and advance criminal schemes. For example, an individual associated with Prince Group once discussed with Chen Zhi the "beating of individuals causing trouble in the park," and Chen Zhi approved the beating plan but instructed, "Do not kill them," adding, "We must keep an eye on them, don't let them escape." In another instance, Chen Zhi communicated with Accomplice 4 about "two missing persons being found by the police in the Jinfu Park," and Accomplice 4 assured Chen Zhi that he would handle the matter but suggested that Chen Zhi utilize his "connections with the police."

(3) Brooklyn Network

Prince Group's investment fraud schemes target victims globally (including victims in the United States) and are implemented through local networks working for them. One such network, known as the "Brooklyn Network," operates in the Eastern District of New York, assisting fraudsters from Prince Group's Jinbei Park in executing investment fraud: fraudsters (referred to as "Introducers") contact unsuspecting victims through various instant messaging applications, falsely claiming to "profit from investing in cryptocurrency, foreign exchange, and other markets," luring victims into investing and introducing them to so-called "Account Managers" to handle transactions. The Account Managers then provide victims with "bank account information to which investment funds should be transferred" and create fake investment accounts and portfolios for victims on mobile online trading platforms, including "Trading Platform 1."

However, the bank accounts provided to victims by the Account Managers are not investment accounts but accounts controlled by the Brooklyn Network, opened in the names of shell companies in Brooklyn and Queens, New York (with account-opening institutions located in Brooklyn, Queens, and other areas of New York). The victims' funds are not used for investment as promised but are embezzled and laundered through these accounts and others.

At the same time, the "investment accounts" created for victims by the Account Managers are artificially manipulated to appear as if "investment values are continuously increasing," when in fact, there is no growth. Initially, the "apparent value" of the victims' portfolios rises, leading victims to mistakenly believe they are profiting from their investments, which in turn lures them into continuing to invest; additionally, when victims first request to withdraw small amounts of their investment funds, the Account Managers cooperate. However, when victims request to withdraw large sums from the trading platform, they encounter numerous obstacles—for example, the Account Managers refuse to process withdrawals, citing "transaction fees, taxes, or legal fees" as reasons. Ultimately, the Account Managers and Introducers stop responding to victims' messages, leaving victims unable to withdraw most of the funds they transferred as directed by the Account Managers.

The Brooklyn Network ultimately transfers funds back to the fraudsters at Prince Group's Jinbei Park and other locations through a series of accounts, which are further laundered before flowing to Prince Group and its executives. Money laundering methods include: transferring the proceeds of fraud through shell company bank accounts, converting them into USDT and then transferring them into a complex network of non-custodial cryptocurrency addresses, or withdrawing cash to sever audit trails (the cash is then used to purchase cryptocurrency, which is subsequently transferred in the same manner).

From around May 2021 to August 2022, the Brooklyn Network assisted Prince Group in fraudulently transferring and laundering over $18 million from more than 250 victims in the Eastern District of New York and other areas of the United States.

Chen Zhi also personally monitored the virtual currency addresses receiving the proceeds of fraud (including funds from victims in the United States). For example, records kept by Chen Zhi show that in June 2021, 100,000 USDT were transferred to a virtual currency address starting with "0x77" (hereinafter referred to as the "0x77 Address"); during the summer of that year, this address also directly received funds traceable to a victim in California (referred to as "Victim 1"). Specifically, between July and August 2021, Victim 1 transferred over $400,000 in cryptocurrency from an account at a popular cryptocurrency exchange to an address starting with "0x1e" (hereinafter referred to as the "0x1e Address"); this amount was subsequently transferred from an address starting with "0x83" (hereinafter referred to as the "0x83 Address") to an address starting with "0x34" (hereinafter referred to as the "0x34 Address"); between July and September 2021, the 0x34 Address transferred over $350,000 in USDT to the 0x77 Address monitored by Chen Zhi.

6. How 127,000 BTC Were Laundered

Chen Zhi and his accomplices laundered the illegal profits of Prince Group (including cryptocurrency) through a complex money laundering network, employing methods such as: using professional money laundering organizations, utilizing Prince Group's own businesses (including online gambling and cryptocurrency mining) to launder funds; subsequently using the funds for luxury travel, entertainment expenses, and purchasing luxury watches, yachts, private jets, vacation villas, high-end collectibles, and rare artworks (including a Picasso painting purchased through an auction house in New York).

Professional Money Laundering Organizations: Sometimes referred to as "money laundering houses," "money shops," or "water houses," these organizations receive the proceeds of fraud siphoned from victims by Prince Group's fraudulent activities and then return the funds to Prince Group. A common operational method is to receive the proceeds of fraud in the form of Bitcoin or stablecoins like USDT or USDC, convert them into fiat currency, and then purchase "clean" Bitcoin or other cryptocurrencies with cash. Chen Zhi directly coordinated such money laundering activities and discussed with accomplices the use of "illegal money shops" and "underground banks"; Chen Zhi also kept documents explicitly mentioning "Bitcoin washing" (BTC washing) and "Bitcoin money laundering personnel" (BTC money laundering people).

Shell Company Money Laundering: Chen Zhi and his accomplices also laundered money through "shell companies" (whose sole purpose is money laundering), which are controlled by Chen Zhi, Accomplices 1, 5, 6, 7, and other individuals associated with Prince Group, including dozens of companies like FTI, Amber Hill, and LBG. Among them, FTI is used to launder illegal funds (including money laundering through the aforementioned Prince Group mining entity, Warp Data). In the account-opening records from Financial Institution 1 for FTI in January 2019, Accomplice 6 stated that FTI's business activities included "mining and trading digital assets with its own funds," but falsely declared FTI's source of income as "personal wealth"; at the same time, Accomplice 6 severely underestimated FTI's monthly trading volume in the same account-opening document, declaring "expected monthly deposits and withdrawals of approximately $2 million," while account statements showed that in February 2019, FTI had actual deposits of about $28 million and withdrawals of about $27 million at Financial Institution 1. Amber Hill served a similar purpose, also opening an account at Financial Institution 1: in the account-opening records from March 2019, Accomplice 6 stated that Amber Hill's business activities were "proprietary trading and investment," falsely declaring the source of income as "personal wealth," and similarly severely underestimating the monthly trading volume (declaring expected monthly deposits and withdrawals of approximately $2 million), while account statements showed that in February 2020, Amber Hill had actual deposits of about $22.5 million and withdrawals of about $21.8 million at Financial Institution 1.

Money Laundering through Prince Group's Business Departments: Chen Zhi and his accomplices also laundered money through the functional business departments of Prince Group, especially its large online gambling operations—even after Cambodia banned online gambling around 2020, this business continued to operate in multiple countries. To evade law enforcement crackdowns, Prince Group operated its gambling business through "mirror sites" (replicating website content on different domain names and servers). Chen Zhi directly supervised Prince Group's online gambling operations and discussed with others "how to launder cryptocurrency fraud proceeds through this business"; Accomplice 1 was responsible for managing payroll for the online gambling business, keeping payroll records for employees from 2018 to 2024, which explicitly noted "employee salaries—please pay with clean funds."

Bitcoin Mining Money Laundering: Additionally, Chen Zhi and his accomplices laundered money by "funding large-scale cryptocurrency mining operations with illegal proceeds," involving Warp Data in Laos and its subsidiary in Texas, USA, as well as Lubian in China, which produced a large amount of "clean Bitcoin" unrelated to criminal proceeds. The Lubian mining pool at one point became the sixth-largest Bitcoin mining organization in the world during its operation. Chen Zhi boasted to others that Prince Group's mining operations were "highly profitable because there are no costs," as the operating funds for these businesses all came from money stolen from victims. For example, from November 2022 to March 2023, Warp Data received over $60 million from the shell company Hing Seng Limited; Hing Seng Limited was also used to make payments to the spouse of a senior executive at Awesome Global and to purchase luxury items worth millions of dollars (including a Rolex watch and the aforementioned Picasso painting). Chen Zhi and his accomplices also systematically mixed "illegal funds" with "newly mined cryptocurrency" in wallets associated with the mining entities to obscure the source of the funds.

Layered Money Laundering: Chen Zhi and his accomplices often employed "layered money laundering techniques" to further obscure the illegal source of profits for Chen Zhi and Prince Group. Under Chen Zhi's direction, individuals associated with Prince Group (including Accomplice 5, who served as Chen Zhi's personal wealth manager, and Accomplice 6) used complex cryptocurrency laundering techniques (including "spraying" and "funneling"): large amounts of cryptocurrency were repeatedly split into dozens of wallets and then re-consolidated into a few wallets, with no commercial purpose, solely to obscure the source of the funds (specific processes are detailed in the examples below). Some funds ultimately ended up stored in wallets at cryptocurrency exchanges like Trading Platform 1 and Trading Platform 2, or were converted into fiat currency and deposited into traditional bank accounts; other funds (including those laundered through Prince Group's mining entities) were stored in non-custodial cryptocurrency wallets controlled by Chen Zhi.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。