Unmasking a Crypto Scam Network: The Royal Thai Police Crack Down

‍

During the COVID-19 pandemic, Thai law enforcement saw a surge in cybercrime across the country. To keep citizens safe from growing digital threats, the Royal Thai Police founded the Cyber Crime Investigation Bureau (CCIB) to protect Thai citizens and businesses from falling victim to online frauds and scams.

The team behind CCIB — including Thanatus Kangruambutr (Deputy Superintendent of Intelligence Analysis and Special Tools Sub-Division, CCID 1) — initially faced challenges in investigating cybercrimes due to cryptocurrency’s anonymity and the perceived complexity of blockchain technology. But thanks to CCIB’s investment in building a strong investigative infrastructure, acquiring the right blockchain intelligence tools and education, and growing partnerships throughout the APAC region and beyond, the bureau is now equipped to address the ~800 victim complaints they receive each day that mostly involve crypto-facilitated crime or money laundering.

Uncovering an international pig butchering network

In 2022, a victim approached CCIB after falling victim to a pig butchering investment scam. Soon after the investigators began tracing the victim’s stolen funds in TRM, they realized that the individual’s story was not unique. They began unraveling a much larger romance and investment scam network that had targeted about a dozen victims within Thailand, the United States, and the United Kingdom. As a result, CCIB launched operation “Trust No One” — a large-scale cryptocurrency scam case.

Starting with the suspect's wallet, Kangruambutr used TRM Forensics to trace the flow of illicit funds. By analyzing incoming transfers, he found additional fund movements originating from exchanges that suggested there may be more victims. Leveraging TRM's VASP intelligence, he was able to identify and contact the exchanges involved, which resulted in uncovering the victims’ information. The CCIB team spoke with the victims and encouraged them to file a complaint and register with the Anti-Money Laundering Office (AMLO) — an independent government agency in Thailand responsible for enforcing laws related to money laundering — in order to be eligible for compensation if the funds were recovered.

By tracing the transactions from one address to another, Kangruambutr and his team built a visual timeline of the pig butchering network’s operations. And by leveraging information obtained from the exchanges involved in these transactions, were able to identify the locations where the criminal group had been operating and active for about two years — including Laos, the Philippines, Dubai, Cambodia, and Myanmar.

Determined to seek justice for the victims, the investigators continued to trace the funds to their eventual cash-out points. This methodical approach provided CCIB with a comprehensive view of the illicit activity and allowed them to freeze a significant value of funds before AMLO took further action — a major win for the Thai law enforcement and the scam victims.

“We worked with Homeland Security’s Bangkok office and law enforcement in the US to gather additional information. We also worked with Binance, who played a major role in this case,” said Kangruambutr. Using the information they had gathered in TRM and from their interagency partners and Binance, CCIB identified and apprehended the primary suspect behind the pig butchering network. The suspect has since been sentenced to 28 years in prison, and CCIB is actively working to return the recovered funds to affected victims.

From crypto novices to crypto superpowers

Since CCIB’s inception in 2020, blockchain intelligence has played a critical role in the bureau’s ability to trace illicit financial activity and identify the digital footprints of cybercriminals. “Today, blockchain technology is integral to CCIB's operations. It allows us to trace and analyze cryptocurrency transactions with precision, helping us uncover and dismantle criminal networks that utilize digital assets,” said Kangruambutr.

"Without a tool like TRM, tackling cases involving large transnational criminal networks would feel like navigating in the dark. Over time, we've transformed our approach from reactive to proactive, becoming adept at using blockchain technology not just to trace illicit activities, but to anticipate and prevent them. The features we find most valuable in TRM include the extensive database of illicit actors, the customizable alerts, and visualization tools that enable us to quickly spot and analyze suspicious activity, streamlining our investigative processes."

Thanatus Kangruambutr
Deputy Superintendent of Intelligence Analysis and Special Tools Sub-Division, Royal Thai Police

As a pioneer in cryptocurrency investigations in Thailand, CCIB proudly serves as a catalyst for broader investment in crypto investigation tooling and training across Thailand. “We regularly invite other regional and provincial police forces to visit our crypto room at CCIB and learn how to carry out crypto cases,” Kangruambutr explained. 

Sharing knowledge to support legal process and empower investigators

Kangruambutr also noted that blockchain intelligence tools play a critical role in supporting the legal process. Since cryptocurrency is still relatively new to many Thai judges, prosecutors, and police officers, visual aids (such as blockchain analysis graphs), are incredibly helpful in explaining and contextualizing the movement of funds across blockchains.

“One of the challenges that these tools simplify is explaining the flow of funds as a chain of evidence, starting from the victim’s wallet to the suspect’s wallet,” said Kangruambutr. In the “Trust No One” case, he presented the detailed visualizations he had created in court, which helped secure the arrest warrant necessary to apprehend the suspect.

Finally, Kangruambutr explained that “in Thailand, maybe 15% or 20% of people know about crypto.” So in addition to investigating hundreds of cybercrimes each day, CCIB is also working hard to educate citizens on how to protect themselves against scams and frauds, while enabling more accessible financial systems to people all over Thailand. 

Kangruambutr and his team are working tirelessly to impart their knowledge of crypto investigations to local police officers across the country who handle similar cases, ensuring efficiency and maximizing the positive outcomes of ongoing and future investigations.