Author: Lisa
Editor: Liz
Background
In April 2025, the United Nations Office on Drugs and Crime (UNODC) released a report titled (Global Impact of Southeast Asia's Scam Centers, Underground Banks, and Illegal Network Markets). This report systematically analyzes the emerging transnational organized crime forms in Southeast Asia, particularly focusing on the new digital crime ecology built around online scam centers, integrated with underground bank money laundering networks and illegal online market platforms.
Shortly after the report was released, the U.S. Treasury Department announced on May 5, 2025, sanctions against the Karen National Army (KNA) and its leaders and relatives, recognizing it as a significant transnational crime organization that leads and assists in conducting online scams, human trafficking, and cross-border money laundering activities. The KNA-controlled area along the Myanmar-Thai border has become a gathering place for multiple scam groups, and its collusion with the Myanmar military enables it to lease land on a large scale and provide electricity and security services in armed-controlled areas, supporting the daily operations of scam parks. On May 1, 2025, the Financial Crimes Enforcement Network also designated Huione Group as a primary money laundering concern, pointing out its role as a key channel for North Korean hacker groups and Southeast Asian scam groups to launder proceeds from virtual asset crimes, involving various virtual asset investment scams such as 'pig butchering'.
The report points out that as the synthetic drug market in Southeast Asia approaches saturation, criminal groups are rapidly transforming to use fraud, money laundering, data trafficking, and human trafficking as profit-making means, and constructing a cross-border, high-frequency, low-cost black market system through online gambling, virtual asset service providers, Telegram underground markets, and crypto payment networks. This trend initially erupted in the Mekong sub-region (Myanmar, Laos, Cambodia) and quickly spread to weak regulatory areas in South Asia, Africa, and Latin America, forming a clear 'gray export'.
UNODC warns that this type of criminal model has highly systematic, specialized, and global characteristics, and relies on emerging technologies for continuous evolution, becoming a significant blind spot in international security governance. In the face of an ever-expanding threat, the report calls on governments to immediately strengthen regulation of virtual assets and illegal financial channels, promote on-chain intelligence sharing and cross-border collaboration mechanisms among law enforcement agencies, and establish a more efficient anti-money laundering and anti-fraud governance system to curb this rapidly developing global security risk.
This article will analyze from the following four dimensions: the criminal ecosystem in Southeast Asia, global expansion beyond Southeast Asia, emerging illegal network markets and money laundering services, and transnational criminal networks and global law enforcement cooperation.
Southeast Asia is gradually becoming the core of the criminal ecosystem
With the rapid expansion of the Southeast Asian cybercrime industry, the region is gradually evolving into a key hub of the global criminal ecosystem. Criminal groups utilize the region's weak governance, convenient cross-border collaboration, and technological loopholes to establish highly organized and industrialized criminal networks. From Myawaddy in Myanmar to Sihanoukville in Cambodia, scam centers are not only large in scale but also continuously evolving, using the latest technologies to evade crackdowns and acquiring cheap labor through human trafficking.
High mobility and adaptability coexist
Southeast Asian cybercrime groups exhibit high mobility and strong adaptability, able to swiftly adjust their activity locations based on law enforcement pressure, political situations, or geopolitical conditions. For example, after Cambodia banned online gambling, many scam groups relocated to Myanmar's Shan State, Laos' Golden Triangle, and other special economic zones, later shifting again due to conflict in Myanmar and regional joint law enforcement to places like the Philippines and Indonesia, forming a cyclical trend of 'crackdown - transfer - return'. These groups disguise themselves through physical venues such as casinos, border economic zones, and resorts, while also 'descending' to more remote, law enforcement-weakened rural areas and border regions to evade concentrated strikes. Additionally, the organizational structure is increasingly 'cellular', with scam points dispersed into residential buildings, guesthouses, and even within outsourced companies, demonstrating strong survival resilience and redeployment capabilities.
Systematic Evolution of the Scam Industry Chain
The scam syndicate is no longer a loose group, but has established a 'vertically integrated criminal industry chain' from data collection, fraud execution to money laundering and cashing out. The upstream relies on platforms such as Telegram to obtain global victim data; the midstream implements scams through methods such as 'pig butchering', 'false law enforcement', and 'investment inducement'; the downstream relies on underground banks, OTC trading, and stablecoin payments (such as USDT) to complete fund laundering and cross-border transfers. According to UNODC data, cryptocurrency scams caused economic losses exceeding $5.6 billion in the U.S. alone in 2023, with an estimated $4.4 billion attributed to the so-called 'pig butchering' scams most prevalent in Southeast Asia. The scale of scam profits has reached 'industrial grade', forming a stable profit loop that attracts more and more multinational criminal forces to participate.
Human Trafficking and Labor Black Market
The expansion of the scam industry is accompanied by systemic human trafficking and forced labor. Personnel in scam parks come from over 50 countries worldwide, especially young people from China, Vietnam, India, and Africa, often deceived into entry under the guise of 'high-paying customer service' or 'technical positions', with their passports confiscated, subjected to violent control, and even resold multiple times. In early 2025, over a thousand foreign victims were repatriated from Myanmar's Kayin State in a single instance. This 'scam economy + modern slavery' model is no longer an isolated phenomenon but a human support mechanism running through the entire industry chain, leading to severe humanitarian crises and diplomatic challenges.
The digital and criminal technology ecology continues to evolve
Scam groups possess extremely strong technical adaptability, continuously upgrading counter-surveillance measures and constructing a criminal ecology of 'technical independence + information black box'. On one hand, they generally deploy infrastructure such as Starlink satellite communications, private power grids, and intranet systems, breaking away from local communication control to achieve 'offline survival'; on the other hand, they extensively use encrypted communication (such as end-to-end encrypted groups on Telegram), AI-generated content (Deepfake, virtual anchors), automated phishing scripts, etc., enhancing scam efficiency and disguise. Some organizations have also launched 'Scam-as-a-Service' platforms, providing other groups with technical templates and data support, driving the productization and servitization of criminal activities. This continuously evolving technology-driven model significantly undermines the effectiveness of traditional law enforcement measures.
Global Expansion Beyond Southeast Asia
Southeast Asian crime groups are no longer limited to local areas but are expanding globally, establishing new operational bases in other regions of Asia, Africa, South America, the Middle East, and even Europe. This expansion not only increases enforcement difficulties but also internationalizes criminal activities such as fraud and money laundering. Criminal groups quickly penetrate new markets by taking advantage of local regulatory gaps, corruption issues, and weaknesses in the financial system.
Asia
Taiwan, China: Becoming a center for fraud technology research and development, some criminal groups have established 'white-label' gambling software companies in Taiwan to provide technical support to Southeast Asian scam centers.
Hong Kong and Macau, China: Underground bank hubs, assisting in cross-border fund flows, with some casino intermediaries involved in money laundering (such as the Sun City Group case).
Japan: In 2024, losses from online scams increased by 50%, with some cases involving Southeast Asian scam centers.
South Korea: Cryptocurrency scams have surged, with criminal groups laundering money using KRW-pegged stablecoins (such as KRW-pegged USDT).
India: Citizens trafficked to scam centers in Myanmar and Cambodia, with the Indian government rescuing over 550 individuals in 2025.
Pakistan and Bangladesh: Becoming sources of scam labor, with some victims lured to Dubai and then resold to Southeast Asia.
Africa
Nigeria: Nigeria has become a key destination for the diversification of Asian scam networks into Africa. In 2024, Nigeria busted a major scam group, arresting 148 Chinese citizens and 40 Filipinos involved in cryptocurrency scams.
Zambia: In April 2024, Zambia busted a scam group, arresting 77 suspects, including 22 Chinese scam leaders, sentenced to a maximum of 11 years in prison.
Angola: At the end of 2024, Angola conducted large-scale raids, detaining dozens of Chinese citizens suspected of involvement in online gambling, scams, and cybercrime.
South America
Brazil: Through (the Online Gambling Legalization Bill) in 2025, but criminal groups still use unregulated platforms for money laundering.
Peru: Busting the Taiwanese criminal gang 'Red Dragon Group', rescuing over 40 Malaysian workers.
Mexico: Drug trafficking groups launder money through Asian underground banks, charging 0% - 6% low commissions to attract customers.
Middle East
Dubai: Becoming a global money laundering center. The mastermind of a $3 billion money laundering case in Singapore purchased luxury homes in Dubai, using shell companies to transfer funds. Scam groups have established 'recruitment centers' in Dubai to lure laborers to Southeast Asia.
Turkey: Some Chinese scam leaders obtain Turkish passports through investment citizenship programs to evade international warrants.
Europe
UK: London real estate has become a tool for money laundering, with some funds originating from Southeast Asian scam profits.
Georgia: A 'Little Southeast Asia' scam center has emerged in Batumi, where criminal groups launder money using casinos and football clubs.
Emerging Illegal Network Markets and Money Laundering Services
As traditional crime methods are being cracked down upon, Southeast Asian crime groups are turning to more covert and efficient illegal online markets and money laundering services. These emerging platforms generally integrate cryptocurrency services, anonymous payment tools, and underground banking systems, providing not only fraud toolkits, stolen data, and AI deepfake software to scam groups, human traffickers, drug dealers, and other criminal entities but also facilitating rapid capital flow through cryptocurrency, underground banks, and Telegram black markets, posing unprecedented challenges to global law enforcement agencies.
Telegram Black Market
The services provided by criminals on numerous illegal online markets and forums based on Telegram in Southeast Asia are increasingly globalized. In contrast, the dark web requires a certain level of specialized knowledge, lacks real-time interactivity, and has a higher technical threshold; whereas Telegram, due to its easy access, mobile-first design, strong encryption features, instant messaging capabilities, and automated operations through bots, allows Southeast Asian criminals to implement scams more easily and scale their activities.
In recent years, some of the most powerful and influential crime networks in the region have taken control of multiple Telegram-based platforms, which have become the main gathering, contact, and business operation venues for various local criminals and service providers. These illegal markets are often interconnected with cryptocurrency exchanges controlled by the same organization, gathering a large number of merchants dedicated to selling stolen data, hacking tools, malware, and various underground banking, money laundering, and cybercrime services, while other criminals - especially those engaged in online scams - profit from these services.
Fully Light Guarantee
Fully Light Guarantee, as an early prototype platform of the illegal market in Southeast Asia, was founded and operated by the Liu family, controlled by the Kokang Border Army, in Myanmar's Shan State, attracting over 350,000 users at its peak. This platform not only serves the scam centers in Kokang and Myawaddy but also acts as a trading market for human trafficking, intermediary recruitment, informal cross-border money laundering, and 'black industry' technical support. Its operations rely on hundreds of public and private groups, covering the entire chain from basic tool supply to fund laundering.
Although the Kokang Border Army was overthrown in 2024, a large number of emerging markets supported by other criminal groups, adopting a similar 'guarantee system', have emerged in the region before and after its arrest. These new platforms quickly absorbed business resources after the crackdown and are still evolving and expanding, continuously posing a threat to the integrity of the financial system, regional stability, and international security.
Huione Guarantee
In the past year, Huione Guarantee has become one of the largest illegal online trading markets in terms of global users and transaction volume, serving as a key infrastructure for the expansion of Southeast Asia's online scam ecosystem. The platform is headquartered in Phnom Penh, Cambodia, primarily in Chinese, and as of the writing of this article, it has over 970,000 users and thousands of interconnected suppliers. The company has affiliations with subsidiaries registered in countries/regions such as Canada, Poland, Hong Kong, and Singapore, and currently holds valid trademarks in the U.S. and other countries/regions.
Since 2021, Huione Guarantee has processed hundreds of billions of dollars in cryptocurrency transactions, with on-chain analysis showing that the platform has become a one-stop service center for criminals to obtain the necessary technology, infrastructure, data, and other resources for online scams, cyber crimes, large-scale money laundering, and evading sanctions. Some experts estimate that the cryptocurrency wallets used by Huione Guarantee and its suppliers have received inflows of at least $24 billion over the past four years. Law enforcement agencies and blockchain researchers report a clear connection between this market and crime groups targeting global victims.
Huione has also launched a series of its own cryptocurrency-related products, including a cryptocurrency exchange, a crypto-integrated online gambling platform, the Xone Chain blockchain network, and its self-issued dollar-backed stablecoin. This stablecoin claims to be 'not subject to traditional regulatory restrictions' and aims to 'avoid common freezes and transfer restrictions of traditional digital currencies'. In February 2025, the group announced the launch of the Huione Visa card and revealed that it is heavily investing in other large illegal online markets, social media, and messaging platforms, as well as professional money laundering services, including acquiring a 30% stake in Tudao Guarantee in December 2024. This series of actions highlights that Huione may be preparing to hedge against future restrictions on mainstream platforms.
Huione and Fully Light not only share part of their platform design and operational personnel but also reflect an illegally replicated business model - which centers on platform-based guarantees, 'fintech-ifying' traditional black market transactions and 'cross-border corporate-izing', forming an underground network economy based in Southeast Asia and radiating globally. With countries strengthening regulation and law enforcement, such platforms are showing a trend of shifting overseas, diversifying financial products, and smartening technological tools, severely disrupting the transparency of on-chain transactions and eroding the trust foundation of the global crypto asset ecosystem.
Transnational Criminal Networks and Global Law Enforcement Cooperation
In Southeast Asia, some transnational criminal groups utilize complex business structures to conceal illegal activities, particularly in money laundering and online fraud. For instance, a billion-dollar money laundering case revealed in Singapore in 2023 unveiled a massive, cross-border organized crime network operating under multiple nationalities and crypto assets. Most suspects in the case were born in China but obtained multiple national passports through investment citizenship programs in Cambodia, Cyprus, Turkey, etc., and widely established companies, bank accounts, and high-value real estate in Southeast Asia and overseas to conceal proceeds from telecom fraud and illegal online gambling. By flexibly combining on-chain transactions, stablecoin payments, and offshore accounts, this criminal network can 'island-hop' funds across different regulatory systems, greatly increasing the difficulty of cross-border financial regulation and criminal investigation tracing.
The case further reveals that this group has direct links with multiple Southeast Asian scam centers and defunct Hong Kong cryptocurrency exchanges (such as AAX), with its funding flow trajectories extending to scam parks in the Clark Freeport Zone in the Philippines, casinos in Cambodia, shell companies set up in Taiwan, and even related assets within Canada. Some suspects are also involved in human trafficking and forced labor, with their illicit profits laundered through false income statements, forged documents, and multiple underground stablecoin channels. With law enforcement advancements in the Philippines and Hong Kong, multiple executives involved in the case were arrested and assets frozen in 2024, marking initial successes in international cooperation. However, core fugitives still evade capture using private jets and multiple passports, highlighting deep-seated challenges in current cross-border law enforcement in terms of technology and systems.
This case is a microcosm of the current reconstruction of the illegal online economy landscape in Southeast Asia. The previously mentioned Huione Guarantee and Fully Light Guarantee platforms are key pivot points in building such cross-border financial crime 'infrastructure'. They act as industry intermediaries for scams, gambling, money laundering, and human trafficking while providing guarantee services, offering integrated services from tools, accounts, transaction matching to fund laundering for transnational organizations such as BG 2 (Mekong Crime Group), which has successfully expanded its criminal network to Georgia and begun to replicate the operational model of the Southeast Asian scam industry chain.
On one hand, these organizations use multiple national identities, complex shell company structures, and on-chain payment methods to traverse between different jurisdictions, creating a de facto 'law enforcement black hole'; on the other hand, due to lengthy judicial assistance processes, strong anonymity of crypto assets, and the global distribution of victims, law enforcement in various countries struggles to form an efficient joint strike mechanism. Although countries like Singapore and the Philippines have begun to strengthen anti-money laundering mechanisms, freeze on-chain assets, and initiate international wanted notices, relying solely on singular actions is still far from sufficient in the face of an increasingly fintech-oriented black network economy centered in Southeast Asia.
To curb such transnational organized crypto crimes, efforts need to be made in the following areas to promote international cooperation and the construction of on-chain governance systems:
Promote the global unification of anti-money laundering (KYC) standards;
Relying on blockchain intelligence and judicial assistance agreements, strengthen cross-border asset freezing and crime tracing cooperation;
Establish multilateral mechanisms to sanction 'high-risk platforms' and 'criminal guarantee markets' providing illegal services;
Strengthen tactical cooperation between law enforcement departments and on-chain monitoring companies and exchanges to compress the space for illegal capital flows.
Conclusion and Recommendations
Raise awareness and understanding: High-level government involvement is crucial for enhancing awareness of scam centers and related crimes. There is a need to increase understanding of risks such as online scams and underground banks, and to strengthen anti-corruption measures.
Strengthening the regulatory framework: Regular reviews and reforms of the existing legal framework are needed, especially regarding the regulation of money laundering, virtual assets, special economic zones, and online gambling. Improve supervision mechanisms to monitor fund flows in high-risk industries and strengthen legal provisions for asset recovery and victim protection.
Enhancing the technical and business capabilities of law enforcement agencies: Develop monitoring and investigation technologies, collect and analyze digital evidence, strengthen transnational cooperation, and enhance judicial fairness. Improve law enforcement effectiveness through professional training and inter-agency collaboration.
Promoting overall government responses and inter-agency coordination: Establish national coordination mechanisms to promote cooperation among ministries and law enforcement agencies, strengthen the identification and protection of victims of forced crimes. Enhance border management supervision to ensure cross-border strikes against criminal activities.
Promoting practical and effective regional cooperation: Strengthen cross-border collaboration, share information in a timely manner, and coordinate actions. Support joint investigations through regional platforms, implement risk-based response measures, and enhance multilateral cooperation.
These recommendations will help Southeast Asian countries address the key governance shortcomings identified in the report, enhance the awareness and responsiveness of governments, regulatory agencies, and law enforcement departments, thereby promoting regional security cooperation and combating transnational organized crime.
Summary
Through the analysis of the UNODC report, it is evident that Southeast Asia has become the center of global cybercrime and illegal financial activities, and this trend is continuously expanding worldwide. In the face of such cross-border criminal threats, governments, regulatory agencies, and law enforcement agencies urgently need to strengthen collaboration and build a more efficient international anti-money laundering and anti-fraud governance system. Especially against the backdrop of virtual assets and cryptocurrencies increasingly being misused for money laundering and fraud, global information sharing and technological collaboration will become key pathways to curb related crimes. Only through comprehensive, multi-layered international cooperation can we effectively address the increasingly complex global cybercrime issues and safeguard the security of the global financial system and social stability.
In this context, SlowMist has been continuously engaged in the field of cryptocurrency anti-money laundering for years, creating a complete set of efficient solutions covering compliance, investigation, and auditing, actively promoting the construction of a healthy ecosystem in the Web3 industry, and providing professional service support to financial institutions, regulatory units, and compliance teams. Among them, MistTrack, as SlowMist's wallet address analysis and fund tracking platform, has accumulated over 300 million address tags, thousands of address entities, more than 500,000 pieces of threat intelligence, and 90 million risk addresses, providing solid support for digital asset security and combating money laundering crimes. For more information, please visit https://aml.slowmist.com.
Previous content: Report Interpretation | UNODC Releases Fraud Report on Transnational Organized Crime in Southeast Asia
Related Links
[1] https://www.unodc.org/roseap/uploads/documents/Publications/2025/Inflection_Point_2025.pdf
[2] https://home.treasury.gov/news/press-releases/sb0129
[3] https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern