OFAC Sanctions Human Trafficking Network Engaged in Pig Butchering

Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Cambodian businessman Ly Yong Phat (Ly), his conglomerate L.Y.P. Group Co., LTD (L.Y.P. Group), and O‑Smach Resort for their role in serious human rights abuse related to the treatment of trafficked workers subjected to forced labor in online scam centers. OFAC also designated Cambodia-based Garden City Hotel, Koh Kong Resort, and Phnom Penh Hotel for being owned or controlled by Ly. 

With today’s sanctions, OFAC is targeting individuals and entities that force victims of human trafficking into acting as scammers in so-called “pig butchering” and other frauds. Often, the frontline scammers in cryptocurrency-related frauds are themselves victims of human trafficking, including forced labor, and are subjected to physical and mental abuse.

In pig butchering schemes, scammers – often victims of trafficking – encounter victims on dating sites, social media websites, or even random texts masquerading as a wrong number. Scammers initiate relationships with victims and slowly gain their trust, eventually introducing the idea of making a business investment using cryptocurrency. Victims are persuaded to invest money and once the money is sent to the fake investment app, the scammer vanishes with all the victim’s money. The term “pig butchering” comes from the idea of “fattening” up the victim as much as possible before stealing the money. These cases often involve victims who have lost their life savings, leaving the victims devastated and desperate for help.

The FBI Internet Crime Complaint Center (IC3) has warned of a spike in cryptocurrency investment schemes. IC3 reported that in 2023, losses from investment scams became the most of any crime type they tracked. Investment fraud losses rose from $3.31 billion in 2022 to $4.57 billion in 2023, a 38 percent increase. Within these numbers, investment fraud with a reference to cryptocurrency rose from $2.57 billion in 2022 to $3.96 billion in 2023, an increase of 53 percent. 

TRM's own analysis shows that scams and frauds totaled about USD 12.5 billion last year, accounting for approximately a third of all crypto-related crime last year. Pig butchering alone accounted for about USD 4.4 billion in 2023.

‍

‍

Targeting Scam Centers

On June 24, 2024, the Department of State’s Office to Monitor and Combat Trafficking in Persons published its annual Trafficking in Persons Report (TIP Report), which highlights abuses in Cambodia, including in the towns of O’Smach and Ko Kong, in particular. The TIP Report noted ongoing corruption and official complicity in trafficking crimes remained widespread and endemic, resulting in selective and often politically motivated enforcement of laws, inhibiting effective law enforcement action against trafficking crimes, including forced labor in online scam operations. Traffickers force victims to work up to 15 hours a day and, in some cases, “resell” victims to other scam operations or subject them to sex trafficking.

For more than two years, according to Treasury, O-Smach Resort has been investigated by police and publicly reported on for serious human rights abuse. Victims reported being lured to O-Smach Resort with false employment opportunities, having their phones and passports confiscated upon arrival, and being forced to work scam operations. People who called for help reported being beaten, abused with electric shocks, made to pay a hefty ransom, or threatened with being sold to other online scam gangs. There have been two reports of victims jumping to their death from buildings within O‑Smach Resort. Local authorities, according to Treasury's release, have conducted repeated rescue missions at O-Smach Resort, including in October 2022 and March 2024, freeing victims of various nationalities, including Chinese, Indian, Indonesian, Malaysian, Singaporean, Thai, and Vietnamese.

OFAC is not alone in targeting human trafficking networks and scam centers. Last year the UK's HM Treasury announced financial sanctions for human rights violations against individuals and entities connected to Malaysia, Cambodia, Myanmar, Thailand, China, and Laos for their involvement in the trafficking of individuals forced to work as scammers targeting English-speaking individuals. The sanctioned individuals were primarily executives of sanctioned entities such as Golden Sun Sky Entertainment, Heng He Casino, K.B. Hotel, Golden Phoenix Entertainment City and other hotels and entertainment complexes located in Cambodia. HM Treasury's designations asserted that these entities have been "involved in facilitating, providing support for and concealing evidence of an activity that violates the right not to be subjected to torture or cruel, inhuman or degrading treatment or punishment or the right not to be required to perform forced or compulsory labour."

Investigating Pig Butchering

Investigations involving networks of scammers are often complex. TRM’s analysis of on-chain transaction data, combined with proprietary source intelligence, has identified several key characteristics of pig butchering scams. 

Once cryptocurrency reaches a scammer’s wallet, it is typically shuffled from wallet-to-wallet in a complex web of transactions between scammers and money launderers (sometimes the same people), with each wallet accumulating funds from additional victims along the way. Funds often move circuitously, making it difficult for investigators to follow the money and to separate victim funds from other tokens. These fund movements consistently include multiple hops through intermediary addresses.

Victim funds typically end up reaching a few main exchanges, where they are often swapped for stablecoins before continuing to be cycled through the money laundering network both via the main exchanges and unhosted wallets.

TRM data indicates that cryptocurrency wallets that receive victim funds from individual pig butchering scams are also often associated with other scams. Furthermore, in a random sample of addresses to which victims stated they sent funds, over 75% exhibited signs of sophisticated on-chain money laundering activity.

The below graph illustrates a typical example of a pig butchering scheme studied by TRM Labs, showing the interconnected networks spanning multiple scams. Each color represents the scammer addresses in three different cases. As shown by the connections between the three coloured webs, the scammers appear to be operating multiple scams either in succession or in conjunction. In addition, the scammers appear to be relying on the same underlying money laundering network, with the same addresses appearing in multiple cases.   

The average amount received by addresses linked to one of the scammers depicted in the chart above was around $26.8 million, with the median around $5.1 million. While not all of those transactions could be definitively sourced to pig butchering victims, and some of the volume could be money laundering.

Far from being the work of lone scammers, over half of the pig butchering schemes studied by TRM exhibited apparent links to large transnational organized crime groups. Consistent with today’s sanctions designations, many of these are human trafficking networks operating in Laos, Myanmar, Cambodia and other neighboring countries.

Over the last few years law enforcement has had a number of key successes in investigating cases involving scam networks. For example, earlier this year, the Department of Justice announced that it seized cryptocurrency worth an estimated $112 million linked to “pig butchering” and other crypto-related investment scams. 

The investigation and prosecution team, as shown in the graph below, were able to unwind a huge, commingled network of transactions and follow the proceeds of fraud to cash-out points at exchanges where the government was able to seize proceeds for the victims.

Earlier this year, the United States Attorney’s Office for the District of Massachusetts, working with the United States Secret Service, filed a civil forfeiture action to recover cryptocurrency alleged to include proceeds of a “pig butchering” scheme. The government seeks to forfeit USD 2.3 million in fraud proceeds in cryptocurrencies USDC, USDT, TRX, ETH, SOL, and BNB. Investigators were able to trace proceeds of the fraud to accounts located at Binance and worked with the exchange to freeze the accounts. 

TRM Labs is proud to have assisted law enforcement in these investigations. If you are a victim, or believe you are a potential victim, of a scam, report to law enforcement and Chainabuse.com.