Analysis｜UNODC Releases Report: “Global Implications of Scam Centres, Underground Banking and Illicit Online Marketplaces in Southeast Asia”

16 min read3 days ago

Author: Lisa
Editor: Liz

Background

In April 2025, the United Nations Office on Drugs and Crime (UNODC) released a report titled “Inflection Point: Global Implications of Scam Centres, Underground Banking and Illicit Online Marketplaces in Southeast Asia”[1] This report systematically analyzes the emerging forms of transnational organized crime in Southeast Asia, with a particular focus on a new digital criminal ecosystem centered on scam compounds, supported by underground money laundering networks and illicit online marketplaces.

Shortly after the report’s release, on May 5, 2025, the U.S. Department of the Treasury[2] announced sanctions against the Karen National Army (KNA) and its leadership and relatives, designating it a major transnational criminal organization. The KNA has been implicated in orchestrating and facilitating online scams, human trafficking, and cross-border money laundering. Areas under KNA control along the Myanmar–Thailand border have become hubs for scam operations. Their collusion with the Myanmar military enables large-scale land leasing, electricity provision, and security services, sustaining scam zones’ daily operations. On May 1, 2025, the U.S. Financial Crimes Enforcement Network (FinCEN)[3] also named Huione Group as a primary money laundering concern, identifying it as a key laundering conduit for North Korean hackers and Southeast Asian scam networks, including involvement in romance-investment scams like “pig butchering.”

According to the report, as the Southeast Asian synthetic drug market becomes saturated, criminal groups are rapidly transitioning to more lucrative activities such as online fraud, money laundering, data trafficking, and human exploitation. Leveraging online gambling, virtual asset service providers, Telegram black markets, and crypto payment rails, they have built transnational, high-frequency, low-cost criminal infrastructures. This trend, initially concentrated in the Mekong subregion (Myanmar, Laos, Cambodia), is now expanding into South Asia, Africa, and Latin America — regions with weak regulatory oversight — creating a clear “grey export” effect.

UNODC warns that these crime models have become increasingly systematic, specialized, and globalized, evolving through new technologies and posing a major blind spot for global security governance. The report urges governments to enhance oversight of virtual assets and illicit financial channels, foster inter-agency on-chain intelligence sharing and cross-border cooperation, and build more efficient AML and anti-fraud systems to curb this fast-growing global security threat.

The rest of the article proceeds with four key sections:

Southeast Asia as a Core Criminal Ecosystem
Global Expansion Beyond Southeast Asia
Emerging Illicit Markets and Money Laundering Services
Transnational Criminal Networks and Global Enforcement Collaboration

Southeast Asia as a Core Criminal Ecosystem

As Southeast Asia’s cybercrime industry rapidly expands, the region is gradually transforming into a key hub in the global criminal ecosystem. Criminal syndicates are taking advantage of weak governance, convenient cross-border operations, and technological vulnerabilities to build highly organized and industrialized criminal networks. From Myawaddy in Myanmar to Sihanoukville in Cambodia, scam centers are not only vast in scale but also continuously evolving, adopting the latest technologies to evade crackdowns and sourcing cheap labor through human trafficking.

High Mobility and Adaptability

Cybercrime groups in Southeast Asia exhibit high mobility and strong adaptability, capable of swiftly relocating their operations in response to law enforcement pressure, political shifts, or geographical conditions. For example, after Cambodia cracked down on online gambling, many scam syndicates relocated to special economic zones such as Shan State in Myanmar and the Golden Triangle in Laos. Later, due to civil unrest in Myanmar and joint regional law enforcement efforts, they shifted again to the Philippines, Indonesia, and other countries — forming a recurring cycle of “crackdown–relocation–return.”

These groups disguise themselves through physical establishments such as casinos, border economic zones, and resorts, while simultaneously moving into more remote rural areas and border regions with weaker law enforcement presence to avoid concentrated crackdowns. Moreover, their organizational structure is becoming increasingly “cellular,” with scam operations dispersed across residential buildings, guesthouses, and even within outsourced companies — demonstrating remarkable resilience and capacity for redeployment.

Systemic Evolution of the Scam Industry Chain

Scam syndicates are no longer loose criminal groups; instead, they have developed a vertically integrated criminal industry chain that spans from data collection and scam execution to money laundering and cash-out operations.

At the upstream level, platforms like Telegram are used to obtain victim data from around the world. The midstream segment carries out scams using tactics such as “pig-butchering” romance schemes, impersonation of law enforcement, and investment lures. Downstream, the proceeds are laundered and transferred across borders through underground banks, OTC (over-the-counter) trading, and stablecoin payments — particularly using USDT.

According to data from the UNODC, crypto-related scams caused over USD 5.6 billion in financial losses in the United States alone in 2023, with an estimated USD 4.4 billion attributed to the so-called “pig-butchering” scams most prevalent in Southeast Asia. The scale of scam proceeds has reached an industrial level, forming a stable and closed profit loop that continues to attract growing numbers of transnational criminal actors.

Human Trafficking and the Black Market for Labor

The expansion of the scam industry is accompanied by systematic human trafficking and forced labor. The personnel in scam compounds come from more than 50 countries around the world, particularly young individuals from China, Vietnam, India, and parts of Africa. Many are lured by false job ads for “high-paying customer service” or “tech positions,” only to be trafficked across borders, have their passports confiscated, and be subjected to violent control and repeated resale.

In early 2025 alone, over a thousand foreign victims were repatriated in a single operation from Karen State in Myanmar. This model of “scam economy + modern slavery” is no longer an isolated phenomenon but has become a structural element of the industry’s labor supply system, posing severe humanitarian crises and diplomatic challenges.

Digitalization and the Continuous Evolution of Crime-Tech Ecosystems

Scam syndicates exhibit a high degree of technological adaptability, constantly upgrading their counter-surveillance tactics to build a crime ecosystem characterized by “technological independence and information black boxes.”

On one hand, they widely deploy infrastructure such as Starlink satellite communications, private power grids, and internal network systems to operate independently of local communication controls, enabling “offline survival.” On the other hand, they extensively use encrypted communication tools (e.g., Telegram end-to-end encrypted groups), AI-generated content (such as deepfakes and virtual avatars), and automated phishing scripts to increase both efficiency and deception.

Some groups have even launched Scam-as-a-Service (SaaS) platforms, offering technical templates and data support to other gangs, thereby transforming criminal activity into a productized and service-based model. This ever-evolving, tech-driven model is significantly undermining the effectiveness of traditional law enforcement methods.

Global Expansion Beyond Southeast Asia

Criminal syndicates based in Southeast Asia are no longer confined to the region; they are expanding globally, establishing new operational hubs in other parts of Asia, Africa, South America, the Middle East, and even Europe. This expansion not only increases the difficulty of law enforcement but also further internationalizes crimes such as fraud and money laundering. These groups exploit regulatory loopholes, corruption, and weaknesses in local financial systems to quickly penetrate new markets.

Asia

Taiwan (China):
Has become a hub for scam-tech development. Some criminal groups have established white-label gambling software companies in Taiwan to provide technical support for scam centers in Southeast Asia.

Hong Kong and Macau (China):
Act as underground banking hubs, facilitating cross-border capital flows. Certain casino intermediaries have participated in money laundering (e.g., the Suncity Group case).

Japan:
Saw a 50% increase in online fraud losses in 2024, with some cases linked to Southeast Asian scam centers.

South Korea:
Experiencing a surge in crypto-related scams. Criminal groups are laundering money via Korean won–pegged stablecoins (e.g., KRW-pegged USDT).

India:
Citizens trafficked to scam centers in Myanmar and Cambodia. In 2025, the Indian government rescued over 550 victims.

Pakistan and Bangladesh:
Have become sources of scam labor. Some victims were lured to Dubai and later resold to Southeast Asian scam compounds.

Africa

Nigeria:
Has emerged as a key target for diversification by Asian scam networks. In 2024, Nigerian authorities dismantled a major scam syndicate, arresting 148 Chinese nationals and 40 Filipinos involved in cryptocurrency fraud.

Zambia:
In April 2024, authorities broke up a scam operation, arresting 77 suspects, including 22 Chinese ringleaders who received sentences of up to 11 years in prison.

Angola:
In late 2024, a large-scale raid led to the detention of dozens of Chinese nationals suspected of involvement in online gambling, fraud, and cybercrime.

South America

Brazil:
Passed the Online Gambling Legalization Act in 2025, but criminal groups continue to use unregulated platforms for money laundering.

Peru:
Dismantled the Taiwanese criminal group “Red Dragon Syndicate” and rescued over 40 Malaysian workers.

Mexico:
Drug cartels are laundering money through Asian underground banks, offering ultra-low fees (0%–6%) to attract clients.

Middle East

Dubai:
Has become a global money laundering hub. The main perpetrator in Singapore’s $3 billion laundering case purchased luxury property in Dubai and used shell companies to move funds. Scam groups have set up “recruitment centers” in Dubai to lure workers into Southeast Asia.

Turkey:
Some Chinese scam ringleaders have obtained Turkish passports through citizenship-by-investment programs to evade international arrest warrants.

Europe

United Kingdom:
London’s real estate market has become a tool for laundering proceeds from Southeast Asian scams.

Georgia:
In the city of Batumi, a “Little Southeast Asia” scam center has emerged, with criminal groups laundering money via casinos and football clubs.

Emerging Illicit Online Markets and Money Laundering Services

As traditional criminal methods come under increasing pressure, Southeast Asian criminal groups are turning to more covert and efficient illicit online markets and money laundering services. These emerging platforms typically integrate cryptocurrency services, anonymous payment tools, and underground banking systems. They not only provide fraud kits, stolen data, and AI deepfake software for scammers, human traffickers, and drug dealers, but also enable the rapid movement of funds through cryptocurrencies, underground banks, and Telegram black markets — posing unprecedented challenges for global law enforcement agencies.

Telegram Black Markets

The range of services offered by criminals across the many Telegram-based illegal online markets and forums in Southeast Asia is becoming increasingly global. Compared to the dark web — which requires technical expertise, lacks real-time interaction, and has a high entry barrier — Telegram is far more accessible. Its mobile-first design, strong encryption, instant communication, and automation via bots make it much easier for Southeast Asian criminals to carry out fraud at scale.

In recent years, some of the most powerful and influential criminal networks in the region have controlled multiple Telegram-based platforms that have become key hubs for local criminals and service providers to connect, communicate, and conduct business. These illicit marketplaces are often linked to cryptocurrency exchanges controlled by the same organizations. They host a large number of vendors selling stolen data, hacking tools, malware, underground banking services, money laundering solutions, and cybercrime toolkits. Other criminals — especially those engaged in online fraud — leverage these services for profit.

Fully Light Guarantee

Fully Light Guarantee, an early prototype of Southeast Asian illicit marketplaces, was established and operated in Myanmar’s Shan State by the Liu family, who were affiliated with the Kokang Border Guard Force. At its peak, the platform attracted more than 350,000 users. It not only served scam centers in Kokang and Myawaddy but also functioned as a marketplace for human trafficking, recruitment intermediaries, informal cross-border money laundering, and “black industry” technical support. Its operations relied on hundreds of public and private Telegram groups, covering the full chain from basic tool supply to fund laundering.

Although the Kokang Border Guard Force was overthrown in 2024, a wave of new emerging markets — backed by other criminal groups and using similar “guarantee-based” mechanisms — quickly appeared before and after the Liu family’s arrest. These new platforms have rapidly absorbed resources from dismantled operations and continue to evolve and expand, posing ongoing threats to financial system integrity, regional stability, and international security.

Huione Guarantee

Over the past year, Huione Guarantee has become one of the largest illicit online marketplaces in the world by both user base and transaction volume. It serves as critical infrastructure for the expansion of Southeast Asia’s online fraud ecosystem. Headquartered in Phnom Penh, Cambodia, and primarily operating in Chinese, the platform had over 970,000 users and thousands of interconnected vendors at the time of writing. The company is linked to subsidiaries registered in countries and regions including Canada, Poland, Hong Kong, and Singapore, and it currently holds active trademarks in the United States and other jurisdictions.

Since 2021, Huione Guarantee has processed tens of billions of dollars in cryptocurrency transactions. On-chain analysis indicates that the platform has become a one-stop service center for criminals seeking tools, infrastructure, data, and other resources needed for online fraud, cybercrime, large-scale money laundering, and sanctions evasion. Some experts estimate that cryptocurrency wallets used by Huione Guarantee and its vendors have received at least $24 billion in inflows over the past four years. Law enforcement agencies and blockchain researchers have reported clear links between this marketplace and criminal groups targeting victims worldwide.

Huione has also launched a range of proprietary crypto-related products, including a cryptocurrency exchange, crypto-integrated online gambling platforms, the Xone Chain blockchain network, and a self-issued USD-backed stablecoin. This stablecoin claims to be “unrestricted by traditional regulatory authorities” and aims to “avoid common freezes and transfer limitations faced by conventional digital currencies.” In February 2025, the group announced the launch of the Huione Visa Card, and revealed substantial investments in other major illicit online markets, social media and messaging platforms, and professional laundering services — including a 30% stake in Tudao Guarantee, acquired in December 2024. These moves suggest that Huione may be hedging against future restrictions imposed by mainstream platforms.

Huione and Fully Light share not only some platform design elements and operations personnel, but also reflect a replicable illegal business model: one that centers on platform-based escrow while “fintech-izing” and “transnational corporatizing” traditional black market transactions. This forms a global underground digital economy based in Southeast Asia. As governments ramp up regulation and enforcement, such platforms are increasingly shifting operations overseas, diversifying their financial products, and deploying more intelligent technical tools — severely disrupting the transparency of on-chain transactions and eroding the trust foundation of the global crypto asset ecosystem.

Transnational Criminal Networks and Global Law Enforcement Cooperation

In Southeast Asia, some transnational criminal syndicates have exploited complex corporate structures to conceal illicit activities, particularly in money laundering and cyber fraud. One striking example is the multi-billion-dollar money laundering case exposed in Singapore in 2023, which revealed a vast, cross-border, and highly organized criminal network operating through multiple nationalities and crypto-assets. While most suspects were born in China, they had acquired multiple passports through investment citizenship programs in countries like Cambodia, Cyprus, and Turkey. They also established extensive networks of companies, bank accounts, and high-value real estate across Southeast Asia and beyond to obscure proceeds from telecom fraud and illegal online gambling.

By leveraging on-chain transactions, stablecoin payments, and offshore accounts in a modular fashion, this network was able to “island-hop” funds between regulatory regimes, significantly complicating transnational financial supervision and criminal tracing efforts.

Further investigations revealed direct links between this syndicate and multiple Southeast Asian scam centers, as well as defunct Hong Kong-based cryptocurrency exchanges such as AAX. The flow of illicit funds extended to scam compounds in the Clark Freeport Zone in the Philippines, casinos in Bavet, Cambodia, and shell companies in Taiwan, even implicating assets in Canada. Some suspects were also involved in human trafficking and forced labor, laundering their illicit earnings through fabricated income statements, forged documents, and various underground stablecoin channels. Thanks to coordinated efforts by law enforcement in the Philippines and Hong Kong, several senior figures were arrested in 2024 and had their assets frozen, marking initial success in international cooperation. However, key fugitives escaped using private jets and multiple passports, underscoring the profound technical and institutional challenges facing cross-border law enforcement.

This case is emblematic of the broader restructuring of Southeast Asia’s underground digital economy. The platforms Huione Guarantee and Fully Light Guarantee, previously discussed, serve as key enablers of this type of transnational financial crime. While posing as escrow service providers, they have effectively acted as criminal “industry brokers” for scams, gambling, money laundering, and human trafficking. These platforms offer integrated services — including tools, accounts, transaction matching, and fund laundering — to transnational groups such as BG 2 (the Mekong criminal syndicate). BG 2 has further legitimized its illicit gains through investments in real estate and sports clubs, allowing it to expand into locations such as Georgia while replicating the Southeast Asian fraud supply chain model.

On one hand, these organizations exploit multiple national identities, layered shell companies, and on-chain payment systems to navigate between jurisdictions, creating “law enforcement blind spots.” On the other hand, lengthy mutual legal assistance procedures, the anonymous nature of crypto-assets, and the global dispersion of victims have made it extremely difficult for countries to mount effective, coordinated crackdowns. Although nations like Singapore and the Philippines have begun strengthening anti-money laundering frameworks, freezing on-chain assets, and issuing international arrest warrants, such isolated efforts are far from sufficient against the rapidly “fintech-ized” underground economy centered in Southeast Asia.

To curb this type of transnational organized crypto-crime, it is essential to promote international cooperation and develop robust on-chain governance systems through the following measures:

Promote global harmonization of KYC and anti-money laundering standards for crypto-assets;
Leverage blockchain intelligence and judicial assistance treaties to enhance cross-border asset freezing and forensic collaboration;
Establish multilateral mechanisms to sanction high-risk platforms and “criminal escrow marketplaces” offering illegal services;
Strengthen tactical collaboration between law enforcement agencies, blockchain analytics firms, and cryptocurrency exchanges to constrain illicit capital flows.

Conclusion and Recommendations

Raise Awareness and Understanding:
High-level government engagement is essential to improving awareness of scam centers and related criminal networks. There must be greater understanding of the risks posed by online fraud, underground banking systems, and associated illicit finance, alongside strengthened anti-corruption measures.

Strengthen Regulatory Frameworks:
Existing legal and regulatory frameworks must be regularly reviewed and reformed, particularly in areas concerning money laundering, virtual assets, special economic zones, and online gambling. Oversight mechanisms should be enhanced to monitor the flow of funds in high-risk sectors, while legal provisions for asset recovery and victim protection should be reinforced.

Enhance Law Enforcement Capabilities:
Agencies must improve their technical and operational capacities by developing tools for digital evidence collection and analysis, strengthening cross-border cooperation, and ensuring judicial fairness. Professional training and inter-agency collaboration are key to boosting the overall effectiveness of enforcement efforts.

Promote Whole-of-Government Response and Interagency Coordination:
National coordination mechanisms should be established to improve cooperation among ministries and law enforcement bodies, with an emphasis on identifying and protecting victims of forced criminality. Border surveillance and enforcement should also be improved to prevent cross-border criminal activity.

Advance Practical and Effective Regional Cooperation:
Cross-border cooperation must be reinforced through timely information sharing and coordinated actions. Regional platforms should be leveraged to support joint investigations, implement risk-based responses, and deepen multilateral collaboration.

These recommendations aim to help Southeast Asian countries address the key governance gaps highlighted in this report. By improving the awareness, regulatory capacity, and enforcement readiness of governments, regulators, and security agencies, the region can enhance its collective response to organized transnational crime and build a stronger framework for regional security cooperation.

Summary

This analysis of the UNODC report underscores that Southeast Asia has emerged as a global hub for cybercrime and illicit financial activity — one that is rapidly expanding its reach across borders. In the face of such transnational threats, governments, regulators, and law enforcement agencies must work together to build more effective international anti-money laundering (AML) and anti-fraud governance frameworks. As virtual assets and cryptocurrencies are increasingly exploited for money laundering and fraud, global information sharing and technical coordination will be essential to disrupting these crimes.

Only through comprehensive, multilayered international cooperation can the world effectively respond to the growing complexity of transnational cybercrime and safeguard the integrity of the global financial system and societal stability.

In this context, SlowMist has spent years at the forefront of anti-money laundering efforts in the cryptocurrency space. The company has developed a comprehensive suite of solutions covering compliance, investigation, and auditing — actively contributing to the development of a safer, healthier Web3 ecosystem. These services support financial institutions, regulators, and compliance teams alike.

Among its offerings, MistTrack, SlowMist’s flagship wallet analytics and fund tracing platform, has accumulated over 300 million address labels, thousands of address entities, more than 500,000 pieces of threat intelligence, and 90 million risk addresses — offering a robust foundation for crypto asset protection and anti-money laundering enforcement.

For more information, visit: https://aml.slowmist.com

Past Coverage: Analysis of UNODC Latest Report on Transnational Organized Crime in Southeast Asia

About SlowMist

SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.

SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.

By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.