Author:Lisa
Editor: Liz
background
In April 2025, the United Nations Office on Drugs and Crime (hereinafter referred to as “UNODC”) released a report titled “The Global Impact of Fraud Hubs, Underground Banks and Illegal Online Markets in Southeast Asia”[1]. The report systematically analyzed the emerging forms of transnational organized crime in Southeast Asia, with a particular focus on the new digital crime ecosystem built around online fraud hubs, integrating underground bank money laundering networks and illegal online market platforms.
Shortly after the release of the report, the U.S. Treasury Department[2] announced sanctions against the Karen National Army (KNA) and its leaders and relatives on May 5, 2025, identifying it as a major transnational criminal organization that leads and assists in cyber fraud, human trafficking and cross-border money laundering. The Myanmar-Thailand border area controlled by the KNA has become a gathering place for multiple fraud groups. Its collusion with the Myanmar military has enabled it to lease land on a large scale in the armed-controlled area, provide power supply and security services, and support the daily operation of the fraud park. On May 1, 2025, the U.S. Financial Crimes Enforcement Network[3] also listed the Huione Group as a major money laundering concern, pointing out that it is a key channel for North Korean hacker organizations and Southeast Asian fraud groups to launder the proceeds of virtual asset crimes, involving various types of virtual asset investment frauds such as "pig killing".
The report points out that as the synthetic drug market in Southeast Asia becomes saturated, criminal groups are rapidly transforming, using fraud, money laundering, data trading, and human trafficking as means of profit, and building a cross-border, high-frequency, and low-cost black production system through online gambling, virtual asset service providers, Telegram underground markets, and encrypted payment networks. This trend initially broke out in the Mekong subregion (Myanmar, Laos, and Cambodia), and quickly spread to South Asia, Africa, Latin America and other areas with weak supervision, forming an obvious "gray export".
UNODC warned that this type of crime model has become highly systematic, professional, and globalized, and has evolved with the reliance on emerging technologies, becoming an important blind spot in international security governance. In the face of the continued spread of threats, the report calls on governments to immediately strengthen supervision of virtual assets and illegal financial channels, promote the sharing of on-chain intelligence and the construction of cross-border cooperation mechanisms among law enforcement agencies, and establish a more efficient anti-money laundering and anti-fraud governance system to curb this rapidly developing global security risk.
This article will analyze the following four dimensions: Southeast Asia’s criminal ecosystem, global expansion beyond Southeast Asia, emerging illegal network markets and money laundering services, and transnational criminal networks and global law enforcement collaboration.
Southeast Asia is becoming the core of the criminal ecosystem
As Southeast Asia's cybercrime industry rapidly expands, the region is gradually evolving into a key hub in the global criminal ecosystem, with criminal groups taking advantage of the region's weak governance, ease of cross-border collaboration, and technological vulnerabilities to establish highly organized and industrialized criminal networks. From Myawaddy in Myanmar to Sihanoukville in Cambodia, fraud centers are not only large in scale, but also constantly evolving, using the latest technology to evade crackdowns and obtaining cheap labor through human trafficking.
High mobility and adaptability
Southeast Asian cybercrime groups are highly mobile and adaptable, and can quickly adjust their locations according to law enforcement pressure, political situation or geopolitical conditions. For example, after Cambodia banned online gambling, a large number of fraud gangs moved to special economic zones such as Shan State in Myanmar and the Golden Triangle in Laos. Later, due to the war in Myanmar and regional joint law enforcement, they moved again to the Philippines, Indonesia and other places, forming a "strike-transfer-return" cycle. These gangs disguise themselves with physical places such as casinos, border economic zones, and resorts, while "sinking" to more remote rural areas and border areas with weak law enforcement to avoid concentrated crackdowns. In addition, the organizational structure is becoming more "cellular", and the fraud points are scattered in residential buildings, homestays and even outsourcing companies, showing strong survival resilience and re-layout capabilities.
The systematic evolution of the fraud industry chain
The fraud group is no longer a loose gang, but has established a "vertically integrated criminal industry chain" from data collection, fraud execution to money laundering and withdrawal. The upstream relies on platforms such as Telegram to obtain global victim data; the midstream implements fraud through "pig killing", "false law enforcement" and "investment inducement"; the downstream relies on underground banks, OTC over-the-counter transactions and stablecoin payments (such as USDT) to complete fund laundering and cross-border transfers. According to UNODC data, in 2023, cryptocurrency fraud caused economic losses of more than US$5.6 billion in the United States alone, of which an estimated US$4.4 billion was attributed to the so-called "pig killing" scam, which is most prevalent in Southeast Asia. The scale of fraud revenue has reached the "industrial level", forming a stable profit closed loop, attracting more and more transnational criminal forces to participate.
Human trafficking and the black market for labor
The expansion of the fraud industry is accompanied by systematic human trafficking and forced labor. The sources of personnel in the fraud park are from more than 50 countries around the world, especially young people from China, Vietnam, India, Africa and other places. They are often deceived into entering the country due to false recruitment of "high-paying customer service" or "technical positions", and their passports are confiscated, subjected to violent control and even resold many times. In early 2025, more than a thousand foreign victims were repatriated in Myanmar's Karen State alone. This "fraud economy + modern slavery" model is no longer an isolated phenomenon, but a human support method throughout the entire industry chain, bringing serious humanitarian crises and diplomatic challenges.
Digitalization and the criminal technology ecosystem continue to evolve
Fraud groups have strong technical adaptability, constantly upgrading anti-detection methods, and building a criminal ecology of "technical independence + information black box". On the one hand, they generally deploy Starlink satellite communications, private power grids, intranet systems and other infrastructure to break away from local communication control and achieve "offline survival"; on the other hand, they use a large number of encrypted communications (such as Telegram end-to-end encrypted groups), AI-generated content (Deepfake, virtual anchors), automated phishing scripts, etc. to improve the efficiency and disguise of fraud. Some organizations have also launched a "Scam-as-a-Service" platform to provide technical templates and data support for other gangs, and promote the productization and service of criminal activities. This evolving technology-driven model is significantly weakening the effectiveness of traditional law enforcement methods.
Global expansion beyond Southeast Asia
Southeast Asian criminal groups are no longer limited to the local area, but are expanding globally, establishing new operating bases in other parts of Asia, Africa, South America, the Middle East and even Europe. This expansion not only increases the difficulty of law enforcement, but also makes criminal activities such as fraud and money laundering more international. Criminal groups take advantage of local regulatory loopholes, corruption issues and weak links in the financial system to quickly penetrate new markets.
Asia
Taiwan, China: It has become a fraud technology research and development center. Some criminal groups have set up "white label" gambling software companies in Taiwan to provide technical support for Southeast Asian fraud centers.
Hong Kong and Macau: underground money laundering hubs that facilitate cross-border fund flows; some casino intermediaries are involved in money laundering (such as the Suncity Group case).
Japan: Internet fraud losses will increase by 50% in 2024, with some cases involving fraud centers in Southeast Asia.
South Korea: Crypto scams surge as criminal groups use Korean won stablecoins like KRW-pegged USDT to launder funds.
India: Citizens were trafficked to fraud centers in Myanmar and Cambodia. In 2025, the Indian government rescued more than 550 people.
Pakistan and Bangladesh: Become sources of labor for fraud, with some victims lured to Dubai and then resold to Southeast Asia.
Africa
Nigeria: Nigeria has become an important destination for Asian fraud networks to diversify into Africa. In 2024, Nigeria cracked a large fraud group and arrested 148 Chinese citizens and 40 Filipinos involved in cryptocurrency fraud.
Zambia: In April 2024, Zambia uncovered a fraud ring and arrested 77 suspects, including 22 Chinese fraud leaders, who were sentenced to up to 11 years in prison.
Angola: In late 2024, a large-scale raid was carried out in Angola, and dozens of Chinese citizens were detained for suspected involvement in online gambling, fraud, and cybercrime.
South America
Brazil: The Online Gambling Legalization Act was passed in 2025, but criminal groups still use unregulated platforms to launder money.
Peru: Cracked down on the Taiwanese criminal gang "Red Dragon Group" and rescued more than 40 Malaysian workers.
Mexico: Drug cartels launder money through Asian underground banks, charging low commissions of 0% - 6% to attract customers.
middle East
Dubai: Becoming a global money laundering center. The main culprit in a $3 billion money laundering case in Singapore purchased luxury homes in Dubai and used shell companies to transfer funds. A fraud group set up a "recruitment center" in Dubai to lure workers to Southeast Asia.
Türkiye: Some Chinese fraud leaders have obtained Turkish passports through investment citizenship programs to evade international arrest warrants.
Europe
UK: London real estate becomes a tool for money laundering, with some of the funds coming from fraud proceeds in Southeast Asia.
Georgia: A "Little Southeast Asia" fraud center has emerged in Batumi, where criminal groups use casinos and football clubs to launder money.
Emerging Illegal Online Markets and Money Laundering Services
As traditional criminal methods are hit, Southeast Asian criminal groups are turning to more covert and efficient illegal online markets and money laundering services. These emerging platforms generally integrate cryptocurrency services, anonymous payment tools and underground banking systems, not only providing fraud kits, stolen data, AI deep fake software to fraud groups, human traffickers, drug dealers and other criminal entities, but also realizing rapid capital flow through cryptocurrency, underground banks and Telegram black markets, posing unprecedented challenges to global law enforcement agencies.
Telegram Black Market
The range of services provided by criminals on many illegal online markets and forums based on Telegram in Southeast Asia is increasingly global. In contrast, the dark web not only requires a certain professional background, lacks real-time interaction, and has a high technical threshold; Telegram, with its easy access, mobile-first design, strong encryption, instant messaging capabilities, and automated operations through robots, makes it easier for criminals in Southeast Asia to commit fraud and scale their activities.
In recent years, some of the most powerful and influential criminal networks in the region have taken control of multiple Telegram-based platforms, which have become the main places for local criminals and service providers of all kinds to gather, connect and conduct business. These illegal markets are often interconnected with cryptocurrency exchanges controlled by the same organizations, and the platforms gather a large number of merchants specializing in selling stolen data, hacking tools, malware, and various underground banks, money laundering and cybercrime services, while other criminals - especially those engaged in online fraud - use these services to make profits.
Fully Light Guarantee
As a prototype platform of the early illegal market in Southeast Asia, Fully Light Guarantee was founded and operated by the Liu family controlled by the Kokang Border Guard in Shan State, Myanmar, and attracted more than 350,000 users at its peak. The platform not only serves the fraud centers in Kokang and Myawaddy, but also serves as a trading market for human trafficking, intermediary recruitment, informal cross-border money laundering and "black industry" technical support. Its operation relies on hundreds of public and private groups, covering the entire chain from basic tool supply to fund laundering.
Although the Kokang Border Guard was overthrown in 2024, a large number of emerging markets supported by other criminal groups and adopting a similar "guarantee system" have emerged in the region before and after their arrest. These new platforms quickly absorbed the resources of the businesses that were hit, and are still expanding and evolving, continuing to pose a threat to the integrity of the financial system, regional stability and international security.
Huione Guarantee
Over the past year, Huione Guarantee has become one of the world's largest illegal online trading markets in terms of users and transaction volume, and is a key infrastructure for the expansion of Southeast Asia's cyber fraud ecosystem. The platform, which is headquartered in Phnom Penh, Cambodia, is mainly Chinese-speaking and has more than 970,000 users and thousands of interconnected suppliers as of this writing. The company is associated with subsidiaries registered in countries such as Canada, Poland, Hong Kong, and Singapore, and has currently active registered trademarks in the United States and other countries.
Huione Guarantee has processed tens of billions of dollars in cryptocurrency transactions since 2021, and on-chain analysis shows that the platform has become a one-stop service center for criminals to obtain the technology, infrastructure, data and other resources needed for cyber fraud, cybercrime, large-scale money laundering and sanctions evasion. Some experts estimate that the cryptocurrency wallets used by Huione Guarantee and its suppliers have received at least $24 billion in inflows over the past four years. Law enforcement agencies and blockchain researchers have reported clear links between the market and criminal groups that operate against victims around the world.
Huione has also launched a range of its own cryptocurrency-related products, including a cryptocurrency exchange, a crypto-integrated online gambling platform, the Xone Chain blockchain network, and its self-issued dollar-backed stablecoin. The stablecoin claims to be "free from the restrictions of traditional regulators" and aims to "avoid the freezing and transfer restrictions common to traditional digital currencies." In February 2025, the group announced the launch of the Huione Visa card and revealed that it was investing heavily in other large illegal online markets, social media and messaging platforms, and professional money laundering services, including the acquisition of a 30% stake in Tudao Guarantee in December 2024. This series of actions highlights that Huione may be hedging against future restrictions on its use by mainstream platforms.
Huione and Fully Light not only share some platform design and operation personnel, but also reflect an illegal business model that is being replicated - that is, with platform-based guarantees as the core, traditional black market transactions are "fintech-ized" and "cross-border corporatized", forming an underground network economic system based in Southeast Asia and radiating the world. As countries strengthen supervision and law enforcement, such platforms are showing a trend of shifting overseas, diversifying financial products, and intelligentizing technical tools, which seriously interferes with the transparency of on-chain transactions and erodes the trust foundation of the global crypto asset ecosystem.
Transnational criminal networks and global law enforcement collaboration
In Southeast Asia, some transnational criminal groups use complex business structures to cover up illegal activities, especially in the areas of money laundering and cyber fraud. For example, the multi-billion dollar money laundering case that broke out in Singapore in 2023 revealed a large, cross-border, organized crime network that relies on multiple nationalities and crypto assets. Although most of the suspects in the case were born in China, they obtained passports of multiple countries through investment citizenship programs in Cambodia, Cyprus, Turkey and other countries, and widely established companies, bank accounts and high-value real estate in Southeast Asia and overseas to cover up illegal proceeds such as telecommunications fraud and illegal online gambling. Through a flexible combination of on-chain transactions, stablecoin payments and offshore accounts, the criminal network was able to transfer funds "island-hopping" between different regulatory systems, greatly increasing the difficulty of transnational financial supervision and criminal investigation tracing.
The case further revealed that the gang had direct links with multiple Southeast Asian fraud centers and defunct Hong Kong cryptocurrency exchanges (such as AAX), and its capital flow track extended to the Clark Freeport Zone fraud park in the Philippines, the Bavet Casino in Cambodia, shell companies established in Taiwan, and even related assets in Canada. Some suspects were also involved in human trafficking and forced labor, and their illegal profits were laundered through false income certificates, forged documents and multiple underground stablecoin channels. With the advancement of law enforcement in the Philippines and Hong Kong, China, several executives involved in the case were arrested and their assets were frozen in 2024, marking that international cooperation in the case has begun to bear fruit. However, there are still core fugitives who use private planes and multiple passports to abscond, highlighting the deep technical and institutional challenges of current cross-border law enforcement.
This case is a microcosm of the current reconstruction of the illegal online economy in Southeast Asia. The two platforms, Huione Guarantee and Fully Light Guarantee, mentioned earlier, are the key fulcrums for building this type of cross-border financial crime "infrastructure". While providing guarantee services, they actually act as "industry intermediaries" for criminal activities such as fraud, gambling, money laundering and human trafficking, providing integrated services from tools, accounts, transaction matching to fund laundering for transnational organizations such as BG 2 (Mekong Crime Group). BG 2 also "laundered" illegal income by setting up legal corporate fronts, investing in real estate and sports clubs, and successfully expanded its criminal network to Georgia and other places, and began to replicate the operating model of the Southeast Asian fraud industry chain.
On the one hand, these organizations use multiple identities, complex shell company structures and on-chain payment methods to shuttle between different jurisdictions, forming a de facto "law enforcement black hole"; on the other hand, due to the lengthy judicial assistance procedures, the strong anonymity of encrypted assets, and the global distribution of victims, it is difficult for law enforcement in various countries to form an efficient joint crackdown mechanism. Although countries such as Singapore and the Philippines have begun to strengthen anti-money laundering mechanisms, freeze on-chain assets, and initiate international arrest warrants, facing the black network economy centered in Southeast Asia and increasingly fintech, relying on single-point actions is still far from enough.
In order to curb such transnational organized crypto crimes, it is necessary to start from the following aspects to promote international cooperation and the construction of on-chain governance systems:
- Promote global unification of anti-money laundering (KYC) standards for crypto assets;
- Relying on blockchain intelligence and judicial assistance agreements, strengthen cross-border asset freezing and crime tracing collaboration;
- Establish a multilateral mechanism to sanction “high-risk platforms” and “criminal guarantee markets” that provide illegal services;
- Strengthen tactical collaboration between law enforcement agencies and on-chain monitoring companies and exchanges to reduce the space for illegal capital flows.
Conclusion and Recommendations
- Raise awareness and knowledge: High-level government involvement is essential to raise awareness of fraud hubs and related crimes. There is a need to increase understanding of risks such as online fraud and underground money laundering, and strengthen anti-corruption measures.
- Strengthen the regulatory framework: The existing legal framework needs to be regularly reviewed and reformed, especially for money laundering, virtual assets, special economic zones, and online gambling. Improve the supervisory mechanism to monitor the flow of funds in high-risk industries and strengthen the legal provisions for asset recovery and victim protection.
- Improve the technical and operational capabilities of law enforcement agencies: Develop monitoring and investigation techniques, collect and analyze digital evidence, strengthen cross-border cooperation and improve judicial fairness. Improve law enforcement effectiveness through professional training and inter-agency cooperation.
- Promote whole-of-government response and inter-agency coordination: Establish a national coordination mechanism to promote cooperation among ministries and law enforcement agencies to strengthen the identification and protection of victims of forced crime. Improve border management and supervision to ensure that criminal activities are not addressed across borders.
- Promote practical and effective regional cooperation: Strengthen cross-border cooperation, share information in a timely manner and coordinate actions. Support joint investigations, carry out risk-based responses and strengthen multilateral cooperation through regional platforms.
These recommendations will help Southeast Asian countries address the key governance shortcomings identified in the report and enhance the awareness and response capabilities of governments, regulators and law enforcement agencies, thereby promoting regional security cooperation and combating transnational organized crime.
Summarize
Analysis of the UNODC report shows that Southeast Asia has become the center of global cybercrime and illegal financial activities, and this trend is expanding globally. Faced with this cross-border crime threat, governments, regulators and law enforcement agencies urgently need to strengthen cooperation and build a more efficient international anti-money laundering and anti-fraud governance system. Especially in the context of virtual assets and cryptocurrencies being increasingly abused for money laundering and fraud, global information sharing and technical collaboration will become the key path to curb related crimes. Only through all-round and multi-level international cooperation can we effectively respond to the increasingly complex global cybercrime problem and safeguard the security of the global financial system and social stability.
Related links
[1]https://www.unodc.org/roseap/uploads/documents/Publications/2025/Inflection_Point_2025.pdf
[2]https://home.treasury.gov/news/press-releases/sb0129
[3]https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern
