The country’s cyber forces have raked in billions of dollars for the regime by pulling off schemes ranging from A.T.M. heists to cryptocurrency thefts. Can they be stopped?
North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History | TRM Labs
On October 29, 2026, an attacker moved about $6.36 billion out of Binance wallets across ten blockchains, the largest crypto theft on record, and TRM attributes it to North Korea’s TraderTraitor, with evidence pointing to a compromise of Binance’s hot wallet signing infrastructure. About $2.7 billion has been frozen, but the attacker still holds roughly $2.4 billion, and TRM is tracking the funds and alerting partners through the Beacon Network.
.pptx%20(54).png)
Hackers steal $6.3 billion from Binance in record heist blamed on North Korea
Hackers stole $6.3 billion from Binance, the world's biggest cryptocurrency exchange, in a theft that analysts blamed on North Korea and said could be the largest financial heist of all time.
US and UK put sanctions on alleged Cambodia cyber-scammers and seize $15bn in bitcoin
People trafficking among allegations against six people who face measures including property freezes and travel bans
Sold to gangs, forced to run online scams: inside Cambodia’s cybercrime crisis
Thousands of people from Taiwan, Vietnam and Thailand have been tricked into slavery and are unable to leave a ‘living hell’
North Korea Responsible for $6 Billion+ Binance Attack | Federal Bureau of Investigation
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance.
North Korea gets away with $3 billion from Binance
Stablecoin issuers froze about $2.4 billion of the roughly $6.3 billion stolen. The rest exceeds Binance’s insurance fund, and the man promising to make users whole isn’t supposed to be running the company.
North Korea gets away with $3 billion from Binance
Stablecoin issuers froze about $2.4 billion of the roughly $6.4 billion stolen. The rest exceeds Binance’s insurance fund, and the man promising to make users whole isn’t supposed to be running the company.
It’s always North Korea
Answering your questions about who was behind the Binance hack, how they launder the money, and where it goes
U.S. and U.K. Take Largest Action Ever Targeting Cybercriminal Networks in Southeast Asia
Treasury Designates One Scam Network As A Transnational Criminal Organization; Cuts Another Off from U.S. Financial SystemWASHINGTON — Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) and Financial Crimes Enforcement Network (FinCEN), in close coordination with the United Kingdom’s Foreign, Commonwealth, and Development Office (FCDO), took complementary actions against criminal networks responsible for targeting citizens of the United States and other allied nations through online scams and the laundering of stolen funds. OFAC has imposed sweeping sanctions on 146 targets within the Prince Group Transnational Criminal Organization (Prince Group TCO), a Cambodia-based network led by Cambodian national Chen Zhi that operates a transnational criminal empire through online investment scams targeting Americans and others worldwide. In addition, FinCEN finalized a rule under section 311 of the USA PATRIOT Act to sever the Cambodia-based financial services conglomerate, Huione Group, from the U.S. financial system. For years, Huione Group has laundered proceeds of virtual currency scams and heists on behalf of malicious cyber actors.“The rapid rise of transnational fraud has cost American citizens billions of dollars, with life savings wiped out in minutes,” said Secretary of the Treasury Scott Bessent. “Treasury is taking action to protect Americans by cracking down on foreign scammers. Working in close coordination with federal law enforcement and international partners like the United Kingdom, Treasury will continue to lead efforts to safeguard Americans from predatory criminals.”OVER $16 BILLION LOST TO ONLINE SCAMS SPURS U.S.–U.K. ACTIONU.S. losses to online investment scams have steadily increased over the last several years, totaling over $16.6 billion. A U.S. government estimate indicated that Americans lost at least $10 billion to Southeast Asia-based scam operations in 2024, a 66 percent increase over the prior year, with scams like those perpetrated by Prince Group TCO being particularly significant. Over the course of the past decade, transnational organized criminal groups, like Prince Group TCO, have established profitable cyberfraud operations across Southeast Asia, particularly in Cambodia. Prince Group TCO remains a dominant player in Cambodia’s scam economy and has controlled illicit financial flows of billions of dollars. The actions taken by OFAC and FinCEN were in close coordination with the U.K.’s FCDO, which took complementary actions against criminal networks responsible for targeting citizens of the United States and other allied nations through online scams and the laundering of stolen funds.The U.K.’s FCDO has concurrently imposed sanctions on Prince Holding Group, Chen Zhi, and his key associates. Today’s bilateral sanctions actions are accompanied by the unsealing of a criminal indictment in the U.S. District Court for the Eastern District of New York against Chen Zhi. This coordinated action is the result of close coordination between the Federal Bureau of Investigation (FBI), the U.S. Attorney’s Office for the Eastern District of New York, as well as the U.K.’s FCDO.HUIONE GROUP IS CUT OFF FROM U.S. Financial System for Laundering Billions Linked to DPRK and Southeast Asia Scam NetworksAlongside today’s coordinated sanctions action, Treasury’s FinCEN issued a section 311 final rule that severs Huione Group from the U.S. financial system. As described in the final rule, Huione Group serves as a critical node for laundering proceeds of cyber heists carried out by the Democratic People’s Republic of Korea (DPRK), and for TCOs in Southeast Asia perpetrating virtual currency investment scams, commonly known as “pig butchering” scams, among others. Significantly, Huione Group laundered at least $4 billion worth of illicit proceeds between August 2021 and January 2025. Of the $4 billion worth of illicit proceeds, FinCEN found that Huione Group laundered at least $37 million worth of virtual currency stemming from DPRK cyber heists, at least $36 million from virtual currency investment scams, and $300 million worth of virtual currency from other cyber scams. By finalizing this rule, covered financial institutions are now prohibited from opening or maintaining correspondent accounts for or on behalf of Huione Group, and are required to take reasonable steps not to process transactions for the correspondent account of a foreign banking institution in the United States if such a transaction involves Huione Group, preventing indirect access by Huione Group to the U.S. financial system. DESIGNATION OF PRINCE GROUP TRANSNATIONAL CRIMINAL ORGANIZATION Prince Group TCO is composed of Cambodia-based Prince Holding Group, its Chairman and CEO, Chen Zhi, his close associates and business partners, and their core commercial interests, all of which operate in furtherance of Prince Group TCO’s criminal enterprise. Headquartered in Phnom Penh, this multi-national conglomerate has investments in entertainment, finance, and real estate. Prince Holding Group’s promotional and marketing materials conceal its laundry list of transnational crimes including the construction, operation, and management of scam compounds reliant on human trafficking and modern-day slavery where industrial scale cyberfraud operations target victims around the world, including U.S. citizens. Today, OFAC additionally designated a network of 117 Prince Group TCO-affiliated businesses, the vast majority of which are offshore shell companies that engage in no apparent real commercial or business activity, as well as one associated official. OFAC has determined these entities and individual are in fact owned or controlled by, or purport to act for or on behalf of, members of Prince Group TCO. A list of these targets, designated as part of Prince Group TCO’s network pursuant to Executive Order (E.O.) 13581, as amended by E.O. 13863 (“E.O. 13581, as amended”), is included in Annex I to this press release. Additionally, Treasury targeted Prince Group TCO’s burgeoning operations in Palau, where the TCO works with known organized crime facilitators to lease an island and set up resorts. Treasury has taken this action in support of Palau’s ongoing efforts to protect against predatory investments by transnational organized criminal groups originating from the People’s Republic of China. CYBERFRAUD EMPIRE ENGANGES IN HUMAN TRAFFICKING, TORTURE, SEXTORTION, AND MONEY LAUNDERING Chen Zhi is a 38-year-old Chinese émigré who has since renounced his Chinese citizenship and has built a business empire in Cambodia through the Prince Group TCO. Chen Zhi, via the Prince Group TCO, comingles illicit revenues with the legitimate Cambodian economy, laundering these ill-gotten gains through a complicated network of over 100 shell and holding companies all around the world. Under Chen Zhi’s leadership, the criminal revenues generated by the Prince Group TCO’s have been instrumental in supporting its ostensibly legitimate business ventures, most of which operate through entities under the control of Prince Group TCO, including Prince Holding Group, Prince Bank Plc. (Prince Bank), and Prince Huan Yu Real Estate Cambodia Group Co. Ltd.Prince Group TCO profits from a litany of transnational crimes including sextortion—a type of fraud involving the solicitation for eventual blackmail of sexually explicit materials, often from minors—money laundering, various frauds and rackets, corruption, illegal online gambling, and the industrial-scale trafficking, torture, and extortion of enslaved workers in furtherance of the operation of at least ten scam compounds in Cambodia.In these compounds, workers are often lured by the promise of well-paid jobs in customer service, tech support, and related fields, but are instead held against their will and made to scam people from around the world in so-called “pig butchering” and other fraud schemes. These schemes involve cultivating, sometimes over the course of months, elaborate relationships with victims, gaining their trust and confidence, then inducing them to “invest” funds in fraudulent investment platforms ultimately controlled by scammers. The butchering comes when the scammers go dark after taking every dollar they can from their victims.The cruelty of this criminal activity is twofold: the scammers are—not always, but often—victims themselves of human trafficking for forced labor. They are subjected to barbaric methods of control at the hands of their captors including physical abuse, isolation, restriction of movement, arbitrary fines and fees, threats of sexual exploitation, and the confiscation of personal documents and electronics. In recent months, numerous reports have surfaced online of people enduring horrific treatment at sites associated with Prince Group TCO.Treasury actions against this growing transnational threat are ongoing, and include OFAC’s designations against Burmese and Cambodian cyber scam facilitators on September 8, 2025, Burmese Warlord Saw Chit Thu on May 5, 2025, and Philippines-based computer infrastructure company Funnull Technology Inc. on May 29, 2025. FinCEN also published a September 2025 Notice on financially motivated sextortion and a September 2023 Alert on virtual currency investment scams described above. LUXURY HOTEL AND CASINO INVOLVED IN EXTORTION, FORCED LABOR, AND MURDERAmong the most notorious of Prince Group TCO’s scam compounds are those under the umbrella of Jin Bei Group Co. Ltd. (Jin Bei Group), a luxury hotel and casino company that also operates a series of compounds throughout Cambodia linked to reports of extortion, scamming, forced labor, and the gruesome murder of 25-year-old Chinese national Yi Ming Dali in 2023. In a 2022 takedown of a Chinese money laundering network in New York, FBI identified 259 U.S. persons who collectively lost $18 million to scammers at Jin Bei Group. This sum represents just one takedown of one network associated with the scam compounds under Prince Group TCO’s operation and is only a fraction of total losses inflicted on U.S. persons by this group.While Prince Holding Group has made attempts to distance the conglomerate from scam operations, extensive public reporting links the conglomerate to the Jin Bei Group compounds and a June 2025 press release published by the Cambodian government confirms that Jin Bei Casino is owned by Prince Holding Group with Chen Zhi as the CEO. PRINCE GROUP TCO OFFICIALS COORDINATE CRIMINAL ACTIVITIESChen Zhi has directed the flow of billions of dollars in illicit funds in close coordination with vice-chairmen and financial assistants who manage Prince Holding Group’s various subsidiaries. These associates oversee the operation of both licit and illicit activities, and correspond with banks, government officials, and other witting and unwitting partners on Chen Zhi’s behalf. Together, these individuals compose the Prince Group TCO along with the core commercial interests of the TCO. Today’s action targets several Prince Group TCO members and associates, including Guy Chhay, Lei Bo, Ing Dara, Zhu Zhongbiao a.k.a. Jack Zhu, Sin Huat Alan Yeo a.k.a. Alan Yeo, Zhou Yun a.k.a. Sandy Zhou, Chen Xiuling a.k.a. Karen Chen, Wei Qianjiang, and Thet Li.Guy Chhay, Zhu Zhongbiao, and Ing Dara serve as Directors of Cambodian Heng Xin Real Estate Investment Co. Ltd., an entity also involved in Prince Group TCO’s scam business and the parent company of Jin Bei Group. Guy Chhay was formerly a director of Jin Bei Group and is currently one of two shareholders in Prince Bank alongside Chen Zhi. Lei Bo served as Chairman of the Board of Directors of Prince Huan Yu Real Estate (Cambodia) Group Co., Ltd., and oversaw the construction of the Golden Fortune Resorts World Co. Ltd. scam compound (a.k.a. Golden Fortune Science and Technology Park) near Chrey Thum, a village south of Phnom Penh. He and Ing Dara maintain an ownership interest in the Golden Fortune scam compound, where locals have told journalists that they’ve seen workers “beaten until they are barely alive” before being forcefully returned after escaping. Jack Zhu is wanted by Chinese law enforcement for charges related to money laundering and, alongside Ing Dara, directs a number of companies under the Jin Bei Group name.Sandy Zhou and Alan Yeo serve as financial assistants and wealth managers for Chen Zhi. They coordinate large wire transfers, correspond with banks, manage accounts, and work to obfuscate Prince Holding Group’s corrupt and criminal activities. Karen Chen oversees Prince Holding Group companies based in Mauritius, Taiwan, and Singapore. She is listed in corporate documents as the ultimate owner of numerous companies controlled by Prince Group TCO that share the same Singapore address and include the holding company that managed Chen Zhi’s luxury yacht.Thet Li is a close associate of Chen Zhi who serves as a de facto illicit finance CFO for Prince Group TCO. Thet Li is involved in bulk cash smuggling and managing dirty money in Prince Holding Group’s financial flows.Wei Qianjiang oversees Warp Data Technology Lao Sole Co., Prince Group TCO’s Laos-based bitcoin mining operation. This venture has funneled large quantities of bitcoin into wallets controlled by Chen Zhi.OFAC is designating Prince Group TCO pursuant to E.O. 13581, as amended, for being a foreign person that constitutes a significant transnational criminal organization.OFAC is designating Chen Zhi, Lei Bo, Zhu Zhongbiao, Guy Chhay, Ing Dara, Thet Li, Chen Xiuling, Wei Qianjiang, Cambodian Heng Xin Real Estate Investment Co. Ltd., Jin Bei Group Co. Ltd., Golden Fortune Resorts World Co. Ltd., and Warp Data Lao Sole Co. Ltd. pursuant to E.O. 13581, as amended, for being owned or controlled by or having acted or purported to act for or on behalf of, directly or indirectly, Prince Group TCO.OFAC is also designating Prince Holding Group, Prince Bank Plc., Sin Huat Alan Yeo, and Zhou Yun, pursuant to E.O. 13581, as amended, for being owned or controlled by or having acted or purported to act for or on behalf of, directly or indirectly, Chen Zhi. OFAC is designating Prince Huan Yu Real Estate Cambodia Group Co. Ltd. pursuant to E.O. 13581, as amended, for being owned or controlled by or having acted or purported to act for or on behalf of, directly or indirectly, Prince Holding Group.ORGANIZED CRIME FACILITATORS ENABLE PRINCE GROUP TCO’S PREDATORY INVESTMENTS ON PALAUPrince Group TCO has worked with Wang Guodan (a.k.a Rose Wang), a Palau-based organized crime facilitator, to establish a luxury resort in Palau. Grand Legend International Asset Management Co., Ltd. (Grand Legend) is a Chen Zhi-controlled company in Palau that is affiliated with the Prince Group TCO. Grand Legend acquired a 99-year lease to Ngerbelas Island in Kayangel, Palau, where it is in the process of developing the luxury resort. Chen Xiao’er and Yang Jian are directors of Grand Legend. Yang Yanming, Shih Ting-yu, Michelle Reishane Wang, and Huang Chieh are on the Palau-based management team of Grand Legend. Rose Wang is a Palau-based hotel owner and transnational organized crime facilitator who has helped Prince Group TCO establish commercial interests in Palau. Rose Wang handled local administrative affairs for Grand Legend and helped the company obtain the lease for Ngerbelas Island. Rose Wang is the vice-president of Palau’s Overseas Chinese Federation, which may conduct unofficial diplomacy for China. In 2018, Rose Wang introduced the notorious criminal boss Wan Kuok Koi (a.k.a. Broken Tooth), who was attempting to set up casinos in Palau, to the then-President of Palau. OFAC sanctioned Broken Tooth in December 2020 pursuant to E.O. 13818 for his organization’s role in spreading crime and corruption across Southeast Asia and Palau.Jing Pin Inc. and Aqua Pure Water Inc. are two companies in Palau owned or controlled by Wang Guodan. Jing Pin Inc. is a hotel and restaurant company. Aqua Pure Water Inc. is a bottled water company. OFAC is designating Grand Legend International Asset Management Co., Ltd. pursuant to E.O. 13581, as amended, for being owned or controlled by, or having acted or purported to act for or on behalf of, directly or indirectly, Chen Zhi. OFAC is designating Chen Xiao’er, Yang Jian, Yang Yanming, Shih Ting-yu, Michelle Reishane Wang, Huang Chieh pursuant to E.O. 13581, as amended, for being owned or controlled by, or having acted or purported to act for or on behalf of, directly or indirectly, Grand Legend.OFAC is designating Rose Wang pursuant to E.O. 13581, as amended, for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, Grand Legend. OFAC is designating Jing Pin Inc. and Aqua Pure Water Inc. pursuant to E.O. 13581, as amended, for being owned or controlled by, or having acted or purported to act for or on behalf of, directly or indirectly, Rose Wang.SANCTIONS IMPLICATIONSAs a result of today’s action, all property and interests in property of the blocked persons described above that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. Unless authorized by a general or specific license issued by OFAC, or exempt, OFAC’s regulations generally prohibit all transactions by U.S. persons or within (or transiting) the United States that involve any property or interests in property of designated or otherwise blocked persons.In addition, persons that engage in certain transactions with the individuals and entities designated today may themselves be exposed to sanctions or subject to an enforcement action. Non-U.S. persons are also prohibited from causing or conspiring to cause U.S. persons to wittingly or unwittingly violate U.S. sanctions, as well as engaging in conduct that evades U.S. sanctions. OFAC’s Economic Sanctions Enforcement Guidelines provide more information regarding OFAC’s enforcement of U.S. sanctions, including the factors that OFAC generally considers when determining an appropriate response to an apparent violation.The power and integrity of OFAC sanctions derive not only from OFAC’s ability to designate and add persons to the SDN List, but also from its willingness to remove persons from the SDN List consistent with the law. The ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior. For information concerning the process for seeking removal from an OFAC list, including the SDN List, please refer to OFAC’s Frequently Asked Question 897 here and to submit a request for removal, click here.For more information on the persons designated today, click here.View the chart on the individuals and entities designated today.The final rule for Huione Group, as submitted to the Federal Register, can be found here.###
South Korea Sanctions Sprawling ‘Prince Group’ Alleged Criminal Empire
Seoul’s sanctions list on a Cambodia-based alleged cyber-scamming network is almost identical to the people and entities targeted recently by the U.S.
UK crackdown on vile scam centres steps up with sanctions on illicit crypto network
The UK has taken further action against a network that operates illegal scam centres across Southeast Asia.
Politically Connected Crypto Project Pursued Resort With Alleged Scam Syndicate Figures
AB is a little-known blockchain network that recently partnered with the Trump family’s crypto firm. But one of the projects it has promoted — a proposed crypto technology resort in Southeast Asia — involved people sanctioned by the U.S. last year for ties to the Prince Group, an alleged multibillion-dollar fraud...
Tracers in the dark: the global hunt for the crime lords of cryptocurrency
"A propulsive story of a new breed of investigators who have cracked the Bitcoin blockchain, taking once-anonymous realms of money, drugs, and violence and holding them up to the light Black markets have always thrived in the shadows of society. Increasingly, these enterprises-drug dealing, money laundering, human trafficking, terrorist funding-have found their shadows online. Digital crime lords inhabiting lawless corners of the internet have operated more freely than their analog counterparts could have ever dreamed of. At the heart of their massive conspiracies: cryptocurrency. By transacting not in dollars or pounds but in Bitcoin-a currency with anonymous ledgers, overseen by no government, beholden to no bankers-black marketeers robbed law enforcement for years of their chief method of cracking down on criminal markets, namely, following the money. But what if the centerpiece of this dark economy held a secret, fatal flaw? What if their currency wasn't so cryptic after all? An investigator using the right mixture of technical wizardry, financial forensics, and old-fashioned persistence could crack open an entire world of crime. Men with No Names is a story of crime and consequences unlike any other. With unprecedented access to the major players in federal law enforcement and private industry, veteran cybersecurity reporter Andy Greenberg tells an astonishing saga of criminal empires built and destroyed. He introduces an IRS agent with a defiant streak; a Bitcoin-tracing Danish entrepreneur; and a colorful ensemble of hardboiled agents and prosecutors as they delve deep into the crypto-underworld. The result is a thrilling, globe-spanning story of dirty cops, drug bazaars, sex-abuse rings, and the biggest takedown of an online narcotics market in the history of the internet. This is a cat-and-mouse story and a tale of a technological one-upmanship that's utterly of our time. Filled with canny maneuvering and shocking twists, it answers a provocative question: How would some of the world's most brazen criminals behave if they were sure they could never get caught?"--
The crypto alternative | TechCrunch
Suppose, just for a moment, just for argument's sake, that (some) cryptocurrencies are not a giant scam, and what's more, they're not just another kind of
What the North Korean internet really looks like
North Korea notoriously restricts access to the internet for its own citizens, but the full list of its websites visible to the outside world have apparently been revealed for the first time.
Opinion | Internet Hacking Is About to Get Much Worse (Published 2018)
We can no longer leave online security to the market.
