120,000 Bitcoins from the Cambodian Pig-Butchering Kingpin: How Were They Seized by the US Government?

Author: Aki Wu Shuo Blockchain

On October 14, 2025, the Federal Court in Brooklyn, New York, unsealed an indictment revealing that the U.S. Department of Justice had recently conducted the largest cryptocurrency seizure operation in history, confiscating approximately 127,000 bitcoin valued at over $15 billion. The seized bitcoin assets originated from scam funds of Cambodia's "Prince Group," masterminded by Chen Zhi, who is known as the "Pig-Butchering Kingpin." This founder of Cambodia's Prince Group is accused of using forced labor to carry out crypto investment fraud, commonly referred to as "pig-butchering" scams, with illegal daily profits reaching tens of millions of dollars. Currently, these massive bitcoin funds are under the custody of the U.S. government. This article will outline the details behind this cross-border crypto enforcement legend, covering the background of the indictment, asset sources, and law enforcement breakthroughs.

The Fraud Empire Beneath the Gilded Exterior

Chen Zhi is the founder and chairman of Cambodia's"Prince Holding Group", which claims to operate real estate, finance, and other businesses in more than 30 countries, but is actually accused of secretly developing into one of Southeast Asia's largest transnational criminal organizations. According to information disclosed by the U.S. Department of Justice and the Treasury Department, since 2015, Chen Zhi and others have operated at least 10 scam industrial parks across Cambodia, luring global victims into fake crypto investments using the notorious "pig-butchering" method. U.S. prosecutors claim Chen Zhi is the mastermind behind this "online fraud empire," not only condoning violence against employees and bribing foreign officials for protection, but also allowing the group to squander scam proceeds on luxury consumption, including purchasing yachts, private jets, and even Picasso paintings auctioned in New York.

Currently, Chen Zhi himself remains at large. The U.S. has issued a wanted notice and sanctions against him. His dual British-Cambodian citizenship and deep political and business ties add uncertainty to subsequent extradition efforts. Naturally, such a massive fraud empire is backed by a systematic money laundering network.

Therefore, to combat the entire profit chain, OFAC has imposed comprehensive sanctions on 146 targets, including the Prince Group transnational criminal organization. Among them,Huione Group, a financial and e-commerce ecosystem in Cambodia controlled by Chen Zhi and his criminal gang—including HuionePay and Telegram intermediary markets—was directly identified by the U.S. Financial Crimes Enforcement Network (FinCEN) as one of the core links in Prince Group's major money laundering activities.

According to the U.S. Treasury Department, at least $4 billion in illicit funds were laundered through the Huione network between August 2021 and January 2025, including virtual assets from North Korea-related cyber theft, crypto investment fraud, and other cybercrimes. In its simultaneous sanctions notice against the Prince Group transnational criminal organization, the Treasury emphasized a complete severance of Huione Group's connection to the U.S. financial system. Regulated financial institutions are now prohibited from directly or indirectly opening or maintaining correspondent accounts for Huione Group and must take reasonable measures to avoid processing correspondent account transactions involving Huione Group for foreign banks, preventing Huione Group from indirectly accessing the U.S. financial system.

In response, OKX CEO Star posted that the Huione Group has caused serious negative impacts in the crypto asset sector. Given its potential risks, OKX has implemented strict AML controls on transactions involving the group. Any crypto asset deposits or withdrawals related to Huione will be subject to compliance investigations. Based on the results, OKX may freeze funds or terminate account services.

Asset Sources: Scam Profits and Bitcoin Mining Farms

Where did the astonishing figure of 127,000 bitcoin (worth about $15 billion) come from? According to the U.S. Department of Justice, these funds are the proceeds and tools of Chen Zhi's fraud and money laundering schemes, previously stored in non-custodial crypto wallets with private keys held by him personally. These massive funds defrauded from victims needed to be carefully laundered to evade regulatory scrutiny.

The indictment reveals that Chen Zhi and his associates invested scam proceeds into their own controlled crypto mining operations to "wash" the tainted money into new, clean bitcoin. Through seemingly legitimate mining activities, the original dirty money was converted into newly mined "clean" bitcoin assets, attempting to sever the link between the funds and the crime. This laundering strategy enabled Prince Group's mining farms to continuously produce bitcoin, becoming a key channel for hiding illicit gains.

The indictment specifically names a mining company related to Chen Zhi's laundering scheme, "Lubian Mining Pool." Lubian was once a globally renowned bitcoin mining pool headquartered in China, with operations extending to Iran, and at its peak controlled about 6% of the world's bitcoin hash rate. As part of Chen Zhi's money laundering network, Lubian Mining Pool helped convert scam funds into massive amounts of bitcoin. However, a bizarre "theft" at the end of 2020 drew Lubian into a mystery. In late December 2020, Lubian reported a hacker attack with a large amount of bitcoin stolen. On-chain data shows that in December 2020, hackers transferred 127,426 bitcoin from Lubian, worth about $3.5 billion at the time. The sheer volume of stolen BTC made this incident one of the "largest bitcoin thefts in history."

Lubian soon disappeared after the incident, abruptly shutting down its mining pool business in February 2021, and the more than 120,000 stolen BTC remained untraceable for a long time. On-chain analysis showed that the 127,426 stolen bitcoin were transferred to a cluster of main wallet addresses. Whether external hackers stole Chen Zhi's dirty money or Chen Zhi himself orchestrated the transfer out of Lubian remains unknown. However, these immensely valuable bitcoins remained dormant on-chain, as if they had vanished. It was not until years later that their whereabouts were revealed.

The more than 120,000 stolen bitcoin remained stationary for over three years, with no obvious on-chain movement. Analysis shows that from the theft at the end of 2020 until mid-2024, these BTC stayed in dozens of hacker-controlled wallet addresses. In July 2024, about 127,000 BTC were transferred in a large-scale consolidation. Since these addresses had long been registered in the crypto community, on-chain intelligence platforms like Arkham immediately identified that these consolidated bitcoins were the assets from the 2020 Lubian Mining Pool theft. The timing of these BTC moving from dormancy was intriguing, coinciding with the eve of cross-border law enforcement closing in.

When the U.S. Department of Justice filed a civil forfeiture lawsuit in October 2025, the documents listed 25 bitcoin addresses, specifying that these were the locations of the involved BTC. These addresses matched exactly with the hacker addresses from the Lubian Mining Pool theft, meaning that U.S. authorities determined that the 127,000 BTC were the proceeds laundered by Chen Zhi and his associates through Lubian, the same funds that flowed out during the 2020 fake "theft" incident. The complaint further stated that the private keys to these BTC were originally held by Chen Zhi himself, but are now under the control of the U.S. government. This suggests that the bitcoin consolidation in July was likely conducted by the U.S. government.

Is the U.S. Core Technology Just Simple Brute-Force Cracking?

Early publicity about bitcoin's anonymous transactions led the public to interpret bitcoin's "pseudonymity" as strong anonymity, creating the illusion that bitcoin is easier to launder. In reality, the transparency of the blockchain ledger provides law enforcement with an unprecedented "funds flow view." Investigators can use professional on-chain analysis tools to link scattered transaction addresses into networks, identifying which wallets belong to the same entity and which fund flows show abnormal patterns. For example, in this case, Arkham labeled Lubian Mining Pool's wallet addresses early on. When the huge BTC was stolen and moved again, the analysis system immediately associated the new addresses with Lubian's labels, thus tracking the whereabouts of the stolen bitcoin. The immutable blockchain records mean that even if scammers try to move assets years later, they cannot escape the eyes of trackers.

However, having on-chain addresses does not equate to controlling the assets; the key is control of the private keys. There is currently no accurate information on how the U.S. government obtained these private keys. According to Arkham's investigation, Lubian Mining Pool did not use a sufficiently secure random algorithm to generate wallet private keys during its operations, and its key generation algorithm had vulnerabilities that could be brute-forced. However, Cobo co-founder Shenyu stated that law enforcement did not obtain the private keys through brute force or hacking, but rather discovered that the private keys had randomness flaws during generation. Incomplete statistics show that more than 220,000 addresses are affected by this vulnerability, and the full list has been made public.

The private keys for these wallets were generated by a flawed pseudo-random number generator (PRNG). Because the PRNG used fixed offsets and patterns, the predictability of the private keys increased. Some users are still transferring funds to related addresses, indicating that the vulnerability risk has not been completely eliminated. It is speculated that U.S. law enforcement and cybersecurity experts may also have mastered similar techniques or clues. It is also possible that the U.S. government obtained mnemonic phrases or signing rights through social engineering, searches, and evidence collection offline, gradually gaining control of the private keys by infiltrating the fraud group. In any case, even though Chen Zhi himself remains at large, the "digital gold" that this fraud group prided itself on has been completely seized.

Lessons for Us and Regulators

The once untouchable fraud kingpin has now lost his hoarded digital gold; crypto assets once seen as money laundering tools have now become instruments for recovering stolen funds. This "Cambodian Pig-Butchering Kingpin's Bitcoin Seizure" incident offers profound lessons for both the industry and regulators. The security of crypto assets depends on cryptographic strength, and any technical oversight can be exploited by hackers or law enforcement, determining the ultimate ownership of assets. For this reason, more and more traditional judicial forces are introducing on-chain tracking and crypto-cracking technologies, shattering the illusion that criminals can use crypto technology to evade legal sanctions.