Thailand and the Philippines Force Crypto Exchanges to Hunt Scammers

A United Nations report released this week estimates that scam operations across East Asia, Southeast Asia, Australia and New Zealand stole as much as $114.1 billion in 2025 alone. That figure dwarfs the number a Singapore based think tank used just six weeks earlier when it urged regulators to force crypto exchanges into the fight against scams rather than let them stand by as payment rails.

The think tank, ISEAS, Yusof Ishak Institute, published its analysis through its Fulcrum commentary platform on 10 June 2026. Written by visiting fellow David Lam, a former managing director at a blockchain focused consulting firm, the paper leaned on an earlier UN estimate of nearly $40 billion in annual scam center profits to argue that the Philippines and Thailand had built the region’s only real teeth against crypto enabled fraud. Everyone else was still mostly checking boxes.

The UN Just Rewrote the Scam Math

The UN Office on Drugs and Crime (UNODC) put the earlier $40 billion figure in an April 2025 report on industrial scale scam centres generating annual profits concentrated in the Mekong region. The report UNODC released on 21 July 2026 covers more ground, East Asia, Southeast Asia, Australia and New Zealand, and measures victim losses rather than operator profits. Even accounting for that broader lens, the new range, scam losses reaching $114.1 billion across the wider region, signals an industry expanding faster than the compliance frameworks built to slow it.

The scale and complexity of this expanding organized crime economy are outpacing existing responses, which were not structured to address such sophisticated criminal activity.

Inshik Sim, the UNODC researcher who coordinated the report, made that assessment to reporters in Bangkok. A separate UNODC analyst, Seong Jae Shin, described what happens when Thailand and China do raid compounds along the Myanmar and Cambodia borders: They were destroyed, but none of the operations stopped, he said, noting the syndicates simply relocate to villas and smaller sites.

Exchanges Are the Bridge Scammers Need

Crypto exchanges such as Indodax in Indonesia and Bitkub in Thailand exist to let ordinary people buy and sell coins. That same function makes them the two hinge points of every scam. Victims use exchanges to send crypto to scammers who can then move it across blockchains without ever proving who they are. Scammers use different exchanges, often through money mule accounts, to convert that crypto back into cash.

Exchanges do not lack the information to spot this. Regulated platforms already hold a mix of blockchain data and internal customer records that could flag a scam in progress, including:

• Geolocation and IP address data attached to every login and transfer
• Device fingerprints and mobile identifiers tied to a single account
• Deposit and withdrawal patterns that match known money mule wallet clusters
• On chain flows to blockchain addresses already linked to scam payouts
• Behavioral shifts, such as a retiree suddenly trading like a professional day trader

The Financial Action Task Force, the global body that sets anti money laundering standards, requires exchanges to run a risk based compliance program plus customer verification, transaction monitoring and the so called Travel Rule for sender and recipient data. All five major ASEAN economies examined in the ISEAS paper, Indonesia, Malaysia, the Philippines, Singapore and Thailand, have implemented those basics. Singapore and the Philippines go further, requiring extra scrutiny of anonymity tools and self hosted wallets. It was not designed to catch a scam itself. It was designed to catch money laundering after the fact.

Manila and Bangkok Bet on Shared Liability

Two countries broke from that pattern. The Philippines’ 2024 Anti Financial Account Scamming Act, known as AFASA, requires regulated institutions including crypto exchanges to run a fraud risk management system built to flag suspicious transactions using transaction velocity, geolocation and behavioral data. Thailand followed with its 2025 Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes, which requires exchanges to screen customer activity against a blacklist of blockchain addresses tied to cybercrime, maintained by the country’s Technology Crime Suppression Centre.

Both laws share one mechanism that the rest of the region has avoided: joint liability. If an exchange fails to meet anti scam standards and a customer loses money, the exchange can be held responsible alongside the account holder and any third party involved.

Singapore’s own 2024 Shared Responsibility Framework proved the model works, splitting liability between banks and telecom firms for phishing losses. Regulators simply have not extended it to crypto. Thailand’s Emergency Decree closes that gap directly: exchanges are liable for losses from technological crimes unless they can prove they met prevention standards, essentially flipping the burden of proof onto the platform.

Inside the Hunt for Chen Zhi’s $15 Billion

The case that shows why regulators are moving centers on Chen Zhi, the Cambodian national who founded and chaired Prince Holding Group, a conglomerate that publicly presented itself as a real estate, banking and hospitality business. American prosecutors say that image was cover for forced labor scam compounds across Cambodia where trafficked workers ran pig butchering schemes, cryptocurrency investment frauds that build a victim’s trust before draining their savings.

1. October 14, 2025: The Department of Justice unseals an indictment charging Chen Zhi with wire fraud and money laundering conspiracy and files a forfeiture action against 127,271 Bitcoin worth roughly $15 billion, its largest ever crypto forfeiture. The same day, Treasury designates Prince Group a transnational criminal organization and sanctions 146 associated individuals and entities, while the UK’s Foreign, Commonwealth and Development Office adds its own sanctions.
2. October 30, 2025: Singapore police open an enforcement operation against Chen Zhi and his associates, freezing more than $115 million in assets across six properties.
3. June 23, 2026: The Treasury sanctions additional individuals and entities tied to Prince Group, expanding what officials call the largest action ever taken against a Southeast Asian cybercriminal network.

Treasury’s FinCEN also used a Section 311 order to sever Huione Group, the Cambodia based financial conglomerate behind the Huione Guarantee marketplace, from the US financial system entirely. Prince Group’s associated marketplace has processed transactions the ISEAS paper puts above $24 billion tied to laundering and stolen data.

“The rapid rise of transnational fraud has cost American citizens billions of dollars, with life savings wiped out in minutes,” Treasury Secretary Scott Bessent said of the crackdown. Chen Zhi remains at large. Cambodia’s Interior Ministry spokesman told the Associated Press that Prince Holding Group had met its legal obligations and called on foreign governments to share evidence before further action.

Older Traders Carry an Outsized Share of the Losses

Buried in the ISEAS analysis is a demographic detail regulators have largely left unaddressed. Elderly customers make up less than 10% of crypto users in the region but account for close to 40% of crypto crime losses. Exchanges already hold the behavioral data that would flag this, a retirement age account suddenly trading with the frequency and pattern of a professional, yet almost none are required to act on it specifically.

That vulnerability compounds over time. A pattern already visible in scammers circling back to previously defrauded crypto victims shows criminal networks treating a successful hit not as a closed case but as a lead worth reselling. Once an exchange’s data shows someone was scammed once, that same data could just as easily flag them as a target for the next attempt, if anyone were required to look.

Why Are So Few Exchanges Actually Punished?

Almost none are. Across the five countries the ISEAS paper studied, regulators have recorded only two anti money laundering enforcement actions against licensed exchanges themselves. Thailand cited one platform for inadequate identity checks. Malaysia, acting on a tip from its National Scam Response Centre, found a second had skipped its own risk assessments and failed to flag mule accounts.

Two cases, against a backdrop of national risk assessments that flag scams and mule accounts as major threats in every country studied, is a thin record. Blocking unlicensed operators shows more activity: the five governments have issued cease and desist orders to more than 50 unregistered exchanges, and Malaysia and the Philippines have both blocked Binance, the world’s largest exchange, which previously paid over $4 billion to settle US anti money laundering charges. Thailand is still catching up on the most basic FATF requirement, the Travel Rule. Its Securities and Exchange Commission opened a public consultation on the draft rule on 26 June 2026, with comments closing 10 July 2026, meaning exchanges will not face full enforcement until the rule clears that process.

The Blacklist Case for Crossing Borders

Thailand’s address blacklist, run by its Technology Crime Suppression Centre, and Malaysia’s mule account blacklist, run through its National Scam Response Centre, both work the same way: flag a wallet or account tied to fraud, then block exchanges from transacting with it. Neither list currently talks to the other.

The ISEAS paper argues that gap should close, with a regional list covering not just individual mule accounts but platforms known to enable laundering, such as the Huione Guarantee marketplace and mixers like Tornado Cash, long used by North Korean hackers to clean stolen funds. Scam infrastructure is already being targeted well beyond Southeast Asia’s own blacklists. All five countries studied already run national anti scam or anti financial crime units. Wiring those units together, so a blacklist built in Bangkok updates a compliance system in Jakarta the same day, would take the region’s existing tools and make them work as one.

Frequently Asked Questions

What is a pig butchering scam?

It is a cryptocurrency investment fraud where scammers build a relationship with a victim, often posing as a romantic interest or savvy trader, before convincing them to move money into a fake trading platform. US prosecutors say Chen Zhi’s Prince Group ran these schemes out of forced labor compounds, using trafficked workers to operate the fraud at scale.

Where does the crypto Travel Rule actually come from?

It traces back to FATF Recommendation 16, a rule written decades ago for banks moving money by wire, which required sender and recipient details to travel with the transaction. FATF extended that same logic to crypto exchanges in 2021, and Thailand’s current draft rule is its formal attempt to apply it to digital asset transfers.

Can Philippine crypto scam victims actually get their money back under AFASA?

Sometimes. AFASA lets regulators hold a financial institution, including a crypto exchange, liable for reimbursing a customer if the institution failed to run adequate risk controls, and that liability can apply even without a criminal conviction against the scammer.

Which platforms have regulators blacklisted beyond Thailand’s own list?

In March 2026, the UK sanctioned Legend Innovation, described as the operator of one of Cambodia’s largest scam compounds, alongside Xinbi, a Chinese language crypto marketplace accused of helping launder fraud proceeds and stolen data, signaling the blacklist approach is already spreading past any single country’s domestic system.