Author: Lisa
Editor: Liz
Background
In April 2025, the United Nations Office on Drugs and Crime (UNODC) released a report titled (Global Impact of Southeast Asian Scam Centers, Underground Banks, and Illegal Network Markets). This report systematically analyzes the emerging forms of transnational organized crime in Southeast Asia, particularly focusing on the new digital criminal ecology built around online scam centers, integrated with underground bank money laundering networks and illegal online market platforms.
Shortly after the report was published, the U.S. Department of the Treasury announced on May 5, 2025, sanctions against the Karen National Army (KNA) and its leaders and relatives, identifying it as a significant transnational criminal organization involved in online scams, human trafficking, and cross-border money laundering activities. The KNA-controlled border area between Myanmar and Thailand has become a gathering place for multiple scam groups, and its collusion with the Myanmar military has allowed it to rent land on a large scale, provide power supply and security services, supporting the daily operations of scam parks. On May 1, 2025, the U.S. Financial Crimes Enforcement Network also listed the Huione Group as a primary money laundering concern, noting it as a key channel for laundering the proceeds of virtual asset crimes by North Korean hacker organizations and Southeast Asian scam groups, involving various types of virtual asset investment scams such as 'pig butchering.'
The report points out that as the synthetic drug market in Southeast Asia becomes saturated, crime groups are rapidly transforming their profit-making methods through scams, money laundering, data trading, and human trafficking, and constructing a cross-border, high-frequency, low-cost black market system through online gambling, virtual asset service providers, Telegram underground markets, and crypto payment networks. This trend initially exploded in the Mekong subregion (Myanmar, Laos, Cambodia) and quickly spread to weakly regulated areas such as South Asia, Africa, and Latin America, forming a noticeable 'gray export.'
UNODC warns that this type of criminal model has developed highly systematic, professional, and global characteristics, relying on emerging technologies to continuously evolve, becoming a significant blind spot in international security governance. In the face of the ongoing threat, the report calls on governments to immediately strengthen the regulation of virtual assets and illegal financial channels, promote on-chain intelligence sharing and cross-border cooperation mechanisms among law enforcement agencies, and establish a more efficient anti-money laundering and anti-fraud governance system to curb this rapidly growing global security risk.
This article will analyze from the following four dimensions: the criminal ecosystem in Southeast Asia, global expansion beyond Southeast Asia, emerging illegal network markets and money laundering services, and transnational crime networks and global law enforcement cooperation.
Southeast Asia gradually becomes the core of the criminal ecosystem
With the rapid expansion of the Southeast Asian cybercrime industry, the region is gradually evolving into a key hub of the global criminal ecosystem, where criminal groups exploit weak governance, convenient cross-border cooperation, and technological loopholes to establish highly organized and industrialized crime networks. From Myawaddy in Myanmar to Sihanoukville in Cambodia, scam centers are not only large in scale but also continuously evolving, utilizing the latest technologies to evade crackdowns while procuring cheap labor through human trafficking.
High liquidity and adaptability coexist
Southeast Asian cybercrime groups exhibit high mobility and strong adaptability, able to quickly adjust their activities based on law enforcement pressure, political situations, or geopolitical conditions. For example, after Cambodia cracked down on online gambling, many scam groups moved to special economic zones in Shan State, Myanmar, and the Golden Triangle in Laos, then again relocated to the Philippines and Indonesia due to civil unrest in Myanmar and regional joint law enforcement, forming a cyclical trend of 'crackdown—relocation—return.' These groups disguise themselves using physical locations such as casinos, border economic zones, and resorts, while simultaneously 'sinking' into more remote, law enforcement-weak rural areas and border regions to evade concentrated crackdowns. Additionally, organizational structures are increasingly 'cellular,' with scam points dispersed into residential buildings, guesthouses, and even outsourced companies, demonstrating strong resilience and redeployment capabilities.
The systematic evolution of the scam industrial chain
Scam groups are no longer loose gangs but have established a 'vertically integrated criminal industrial chain' from data collection, scam execution to money laundering and cash out. The upstream relies on platforms like Telegram to gather global victim data; the midstream implements scams through methods like 'pig butchering,' 'false law enforcement,' and 'investment inducement'; the downstream completes fund laundering and cross-border transfers relying on underground banks, OTC trading, and stablecoin payments (such as USDT). According to UNODC data, cryptocurrency scams caused economic losses of over $5.6 billion in the U.S. alone in 2023, with an estimated $4.4 billion attributed to the so-called 'pig butchering' scams prevalent in Southeast Asia. The scale of scam proceeds has reached 'industrial level,' forming a stable profit loop that attracts more and more transnational criminal forces to participate.
Human trafficking and labor black markets
The expansion of the scam industry is accompanied by systematic human trafficking and forced labor. The personnel in scam parks come from over 50 countries worldwide, especially young people from China, Vietnam, India, and Africa, who are often deceived into entry for 'high-paying customer service' or 'technical positions' due to false recruitment, with their passports confiscated, subjected to violent control, and even resold multiple times. In early 2025, over a thousand foreign victims were repatriated in a single instance from the Karen State in Myanmar. This 'scam economy + modern slavery' model is no longer an isolated phenomenon but a human support method that runs through the entire industrial chain, leading to severe humanitarian crises and diplomatic challenges.
The ongoing evolution of digitalization and criminal technology ecosystems
Scam groups have a strong ability to adapt technologically, constantly upgrading their counter-surveillance methods and building a criminal ecology of 'technological independence + information black box.' On one hand, they widely deploy infrastructure such as Starlink satellite communications, private power grids, and intranet systems to escape local communication control and achieve 'offline survival'; on the other hand, they make extensive use of encrypted communication (such as Telegram end-to-end encrypted groups), AI-generated content (Deepfake, virtual anchors), and automated phishing scripts to enhance scam efficiency and camouflage. Some organizations have also launched 'Scam-as-a-Service' platforms, providing technical templates and data support to other groups, promoting the productization and servitization of criminal activities. This continuously evolving technology-driven model is significantly undermining the effectiveness of traditional law enforcement methods.
Global expansion beyond Southeast Asia
Southeast Asian crime groups are no longer limited to local activities but are expanding globally, establishing new operational bases in other parts of Asia, Africa, South America, the Middle East, and even Europe. This expansion not only increases law enforcement difficulties but also internationalizes criminal activities such as scams and money laundering. Crime groups exploit local regulatory loopholes, corruption issues, and weak links in financial systems to quickly infiltrate new markets.
Asia
Taiwan, China: Became a center for scam technology research and development, with some criminal groups setting up 'white label' gambling software companies in Taiwan to provide technical support for Southeast Asian scam centers.
Hong Kong and Macau, China: Underground banking hubs facilitating cross-border fund flows, with some casino intermediaries involved in money laundering (such as the Sun City Group case).
Japan: In 2024, online scam losses increased by 50%, with some cases involving Southeast Asian scam centers.
South Korea: Surge in cryptocurrency scams, with crime groups laundering money using KRW-pegged stablecoins (such as USDT).
India: Citizens trafficked to scam centers in Myanmar and Cambodia, with over 550 people rescued by the Indian government in 2025.
Pakistan and Bangladesh: Become sources of labor for scams, with some victims lured to Dubai and then sold to Southeast Asia.
Africa
Nigeria: Nigeria has become a significant destination for the diversification of Asian scam networks into Africa. In 2024, Nigeria dismantled a large scam group, arresting 148 Chinese citizens and 40 Filipinos involved in cryptocurrency scams.
Zambia: In April 2024, Zambia dismantled a scam group, arresting 77 suspects, including 22 Chinese scam leaders, who were sentenced to up to 11 years in prison.
Angola: At the end of 2024, Angola conducted a large-scale raid, detaining dozens of Chinese citizens suspected of involvement in online gambling, scams, and cybercrime.
South America
Brazil: In 2025, through the (Online Gambling Legalization Act), but criminal groups still use unregulated platforms for money laundering.
Peru: The Taiwanese criminal gang 'Red Dragon Group' was dismantled, rescuing over 40 Malaysian workers.
Mexico: Drug trafficking groups launder money through Asian underground banks, charging low commissions of 0% - 6% to attract clients.
Middle East
Dubai: Becomes a global money laundering center. The main suspect in the $3 billion money laundering case in Singapore purchased luxury homes in Dubai, using shell companies to transfer funds. Scam groups have established 'recruitment centers' in Dubai to lure workers to Southeast Asia.
Turkey: Some Chinese scam leaders obtained Turkish passports through investment citizenship programs to evade international warrants.
Europe
United Kingdom: London real estate becomes a tool for money laundering, with some funds originating from Southeast Asian scam profits.
Georgia: A 'Little Southeast Asia' scam center has emerged in Batumi, where criminal groups launder money using casinos and football clubs.
Emerging illegal network markets and money laundering services
As traditional criminal methods face crackdowns, Southeast Asian crime groups are turning to more covert and efficient illegal network markets and money laundering services. These emerging platforms generally integrate cryptocurrency services, anonymous payment tools, and underground banking systems, providing not only fraud toolkits, stolen data, and AI deepfake software for scam groups, human traffickers, and drug traffickers, but also enabling rapid fund flows through cryptocurrency, underground banks, and Telegram black markets, presenting unprecedented challenges for global law enforcement agencies.
Telegram Black Market
The range of services offered by criminals on numerous illegal online markets and forums based on Telegram in Southeast Asia is increasingly globalized. In contrast, the dark web requires a certain level of specialized knowledge, lacks real-time interaction, and has a higher technical threshold; Telegram, due to its accessibility, mobile-first design, robust encryption features, instant messaging capabilities, and automation through bots, allows Southeast Asian criminals to more easily execute scams and scale their activities.
In recent years, some of the most powerful and influential crime networks in the region have controlled multiple Telegram-based platforms, which have become the main places for various local criminals and service providers to gather, connect, and conduct business. These illegal markets are often linked to cryptocurrency exchanges controlled by the same organization, gathering a large number of merchants who specialize in selling stolen data, hacking tools, malware, and various underground banking, money laundering, and cybercrime services, while other criminals—especially those engaged in online scams—profit from these services.
Fully Light Guarantee
Fully Light Guarantee, as an early prototype platform of illegal markets in Southeast Asia, was established and operated by the Liu family controlled by the Kokang Border Army in Shan State, Myanmar, attracting over 350,000 users at its peak. This platform not only served the scam centers in Kokang and Myawaddy but also acted as a trading market for human trafficking, intermediary recruitment, informal cross-border money laundering, and 'black market' technical support. Its operations rely on hundreds of public and private groups, covering the entire chain from basic tool supply to fund laundering.
Although the Kokang Border Army was overthrown in 2024, numerous emerging markets supported by other criminal groups with similar 'guarantee systems' have surfaced in the region. These new platforms quickly absorbed the business resources that had been hit and are still continuously expanding and evolving, posing ongoing threats to the integrity of the financial system, regional stability, and international security.
Huione Guarantee
In the past year, Huione Guarantee has become one of the largest illegal online trading markets in terms of global users and transaction volume, serving as a key infrastructure for the expansion of Southeast Asia's online scam ecosystem. The platform is headquartered in Phnom Penh, Cambodia, primarily in Chinese, and as of the writing of this article, the number of users has exceeded 970,000, with thousands of interconnected suppliers. The company is associated with subsidiaries registered in countries/regions including Canada, Poland, Hong Kong, and Singapore, and holds currently valid registered trademarks in the U.S. and other countries/regions.
Since 2021, Huione Guarantee has processed hundreds of billions of dollars in cryptocurrency transactions, and on-chain analysis shows that this platform has become a one-stop service center for criminals to access the technology, infrastructure, data, and other resources needed for online scams, cybercrime, large-scale money laundering, and evading sanctions. Some experts estimate that the cryptocurrency wallets used by Huione Guarantee and its suppliers have received inflows of at least $24 billion over the past four years. Law enforcement agencies and blockchain researchers report clear connections between this market and crime groups targeting global victims.
Huione has also launched a series of its own cryptocurrency-related products, including a cryptocurrency exchange, crypto-integrated online gambling platforms, the Xone Chain blockchain network, and its own USD-backed stablecoin. This stablecoin claims to be 'not subject to traditional regulatory restrictions,' aiming to 'avoid common freezing and transfer restrictions of traditional digital currencies.' In February 2025, the group announced the launch of the Huione Visa card and revealed that it is making large investments in other major illegal online markets, social media, messaging platforms, and professional money laundering services, including acquiring a 30% stake in Tudao Guarantee in December 2024. This series of actions highlights that Huione may be preparing to hedge against future restrictions on use by mainstream platforms.
Huione and Fully Light not only share some platform design and operational personnel but also reflect a continually replicated illegal business model—centralized on platform guarantees, transforming traditional black market transactions into 'fintech' and 'cross-border corporate' operations, forming an underground network economic system based in Southeast Asia and radiating globally. As countries strengthen regulation and enforcement, such platforms are showing a trend of relocating overseas, diversifying financial products, and smartening technological tools, severely disrupting the transparency of on-chain transactions and eroding the trust foundation of the global crypto asset ecosystem.
Transnational crime networks and global law enforcement cooperation
In Southeast Asia, some transnational crime groups use complex business structures to cover up illegal activities, especially in money laundering and online scam fields. For example, the multi-billion-dollar money laundering case in Singapore in 2023 revealed a large, cross-border, organized crime network operating with multiple nationalities and crypto assets. Many of the suspects were born in China but obtained multiple passports through investment citizenship programs in countries like Cambodia, Cyprus, and Turkey, extensively setting up companies, bank accounts, and high-value real estate in Southeast Asia and abroad to cover up telecom fraud, illegal online gambling, and other illicit profits. Through flexible combinations of on-chain transactions, stablecoin payments, and offshore accounts, this criminal network can 'island-hop' funds between different regulatory systems, greatly increasing the difficulty of transnational financial regulation and criminal tracing.
The case further reveals that this gang has direct links to several Southeast Asian scam centers and the now-defunct Hong Kong cryptocurrency exchange (such as AAX), with its funding flow extending to scam parks in Clark Freeport Zone in the Philippines, casinos in Cambodia, shell companies set up in Taiwan, and even related assets in Canada. Some suspects are also involved in human trafficking and forced labor, with their illegal profits laundered through fake income documents, forged documents, and multiple underground stablecoin channels. With law enforcement advancing in the Philippines and Hong Kong, several high-level executives involved in the case were arrested and assets frozen in 2024, marking the initial success of international cooperation in this case. However, some core fugitives still evade capture using private jets and multiple passports, highlighting the deep technical and institutional challenges facing current cross-border law enforcement.
This case is a microcosm of the current reconstruction of the illegal online economy landscape in Southeast Asia. The aforementioned Huione Guarantee and Fully Light Guarantee platforms are critical pivot points in building this type of cross-border financial crime 'infrastructure.' While providing guarantee services, they actually serve as 'industry intermediaries' for crimes such as scams, gambling, money laundering, and human trafficking, offering integrated services from tools, accounts, and transaction matching to fund laundering for transnational organizations like BG 2 (Mekong Crime Group). BG 2 further expands its criminal network to places like Georgia by establishing legitimate business facades, investing in real estate and sports clubs to 'clean' illegal income, and begins replicating the operational model of the Southeast Asian scam industrial chain.
On one hand, these organizations utilize multinational identities, complex shell company structures, and on-chain payment methods to navigate across different jurisdictions, forming a de facto 'law enforcement black hole'; on the other hand, due to lengthy judicial assistance procedures, strong anonymity of crypto assets, and the global distribution of victims, law enforcement in various countries struggles to form an efficient joint crackdown mechanism. Although countries like Singapore and the Philippines have started to strengthen anti-money laundering mechanisms, freeze on-chain assets, and initiate international wanted notices, relying solely on point actions is still far from sufficient in the face of the increasingly fintech-oriented black network economy centered in Southeast Asia.
To curb such transnational organized crypto crimes, efforts need to be made in the following areas to promote international cooperation and the construction of on-chain governance systems:
Promote global standardization of anti-money laundering (KYC) standards for crypto assets;
Leverage blockchain intelligence and judicial assistance agreements to strengthen cross-border asset freezing and criminal tracing cooperation;
Establish multilateral mechanisms to sanction 'high-risk platforms' and 'criminal guarantee markets' providing illegal services;
Strengthen tactical cooperation between law enforcement agencies and on-chain monitoring companies, exchanges, to compress the space for illegal fund flows.
Conclusions and recommendations
Increase awareness and understanding: High-level government participation is crucial for enhancing awareness of scam centers and related crimes. There is a need to enhance understanding of the risks posed by online scams, underground banks, etc., and to strengthen anti-corruption measures.
Strengthen regulatory frameworks: There is a need for regular reviews and reforms of existing legal frameworks, especially regarding money laundering, virtual assets, special economic zones, and online gambling regulation. Improve oversight mechanisms to monitor fund flows in high-risk industries and strengthen legal provisions for asset recovery and victim protection.
Enhance the technical and operational capacity of law enforcement agencies: Develop monitoring and investigation technologies, collect and analyze digital evidence, strengthen transnational cooperation, and enhance judicial fairness. Improve law enforcement effectiveness through professional training and inter-agency cooperation.
Promote overall government responses and inter-agency coordination: Establish national coordination mechanisms to facilitate cooperation among various ministries and law enforcement agencies, strengthen the identification and protection of victims of forced crimes. Enhance border management oversight to ensure cross-border crackdowns on criminal activities.
Advance pragmatic and effective regional cooperation: Strengthen cross-border cooperation, timely share information, and coordinate actions. Support joint investigations through regional platforms, implement risk-based response measures, and enhance multilateral cooperation.
These recommendations will help Southeast Asian countries address the key governance shortcomings identified in the report, enhancing the awareness and response capabilities of governments, regulatory agencies, and law enforcement departments, thus promoting regional security cooperation and combating transnational organized crime.
Summary
Analysis of the UNODC report shows that Southeast Asia has become the center of global cybercrime and illegal financial activities, and this trend is continually expanding globally. In the face of this cross-border crime threat, governments, regulatory agencies, and law enforcement agencies urgently need to strengthen cooperation and build a more efficient international anti-money laundering and anti-fraud governance system. Especially against the backdrop of virtual assets and cryptocurrencies being increasingly misused for money laundering and scams, global information sharing and technical collaboration will become key pathways to curb related crimes. Only through comprehensive, multi-layered international cooperation can we effectively respond to the increasingly complex global cybercrime issues and safeguard the security of the global financial system and social stability.
Relevant Links
[1]https://www.unodc.org/roseap/uploads/documents/Publications/2025/Inflection_Point_2025.pdf
[2]https://home.treasury.gov/news/press-releases/sb0129
[3]https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern