The crime economy at the level of hundreds of billions of dollars has evolved into a colossal entity that can influence the economic security of regions and even globally.

Written by: ChandlerZ, Foresight News

On July 21, the United Nations Office on Drugs and Crime (UNODC) released the "Southeast Asia Transnational Organized Crime Threat Assessment 2026" (TOCTA 2026) report in Bangkok. The report estimates that losses due to online scams in East Asia, Southeast Asia, Australia, and New Zealand will be between 88.3 billion and 114.1 billion dollars in 2025, which is about three times the estimate for 2023 (18 billion to 37 billion dollars).

The report lists cryptocurrency as a key financial infrastructure for this crime economy, pointing out that USDT on the TRON chain has become the preferred money laundering tool for scam groups. A single virtual asset service provider (VASP) located in the Mekong River basin handled 49 billion to 64 billion dollars in crypto transactions from 2021 to 2024.

The upper limit of the loss of 114.1 billion dollars exceeds the GDP of multiple Southeast Asian countries. Even taking the lower limit of 88.3 billion dollars, the scam losses in 2025 will reach 2.4 times the peak estimate for 2023.

In terms of geographic distribution, East Asia bears about 71% of the losses, while Australia and New Zealand account for 15.8% to 20.2%, with Southeast Asia itself only accounting for 8.4% to 13.2%. Southeast Asia serves as a production base for criminal activities, with victims distributed throughout the Asia-Pacific region and even globally. The U.S. Department of the Treasury separately assessed that losses from Southeast Asian scams for U.S. citizens alone would exceed 10 billion dollars in 2024.

The number of reported cases in various countries is also sharply rising, with Thailand's cybercrime cases increasing from less than 20,000 in 2023 to over 380,000 in 2025, accumulating losses exceeding 700 million dollars. Malaysia's online scam losses in 2025 are approximately 730 million dollars, doubling year-on-year, with the number of cases surging by 87% to over 66,000. Singapore's scam losses reached 822 million dollars in 2024, a year-on-year increase of 70.6%, dropping to 686 million dollars in 2025 after legislative intervention.

Heat distribution map of scam parks in Cambodia, Myanmar, and Laos

Cryptocurrency as the Financial Pipeline of the Crime Economy

Due to its fast transaction speed, low fees, and high anonymity, USDT on the TRON chain has become the preferred channel for scam groups to process and transfer funds. Chainalysis data shows that by 2025, stablecoins will account for 84% of the total illegal crypto transactions worldwide.

A single virtual asset service provider located in the Mekong River basin handled 49 billion to 64 billion dollars in crypto transactions from 2021 to 2024, making it the largest of its kind in the Asia-Pacific region.

Beyond guarantee platforms, a type of decentralized network known as CMLNs (Chinese Money Laundering Networks) is also rapidly expanding. Chainalysis data indicates that in 2025, CMLNs processed 16.1 billion dollars of illegal crypto assets through 1,799 active wallets, utilizing cross-chain bridges, DeFi protocols, and mixers for layered money laundering. The market has already seen the emergence of DeFi money laundering toolkits available for just a few hundred dollars, capable of automatically completing fund splitting, cross-chain transfers, and obfuscation operations.

Player → Local Bank → Mule Accounts → USDT on TRON → Offshore Wallets Money Laundering Path

Industrialized Operations and Global Expansion

These criminal networks have become highly industrialized. UNODC Southeast Asia and Pacific representative Delphine Schantz described their operational model as corporate franchising, with each link managed by specialized teams responsible for money laundering, human trafficking, smuggling, and data theft, sharing the same set of financial and logistical infrastructures. The report categorizes criminal organizations into four levels: strategic leadership responsible for overseas operations and asset allocation, operational management responsible for regional coordination and corrupt relationships, the operational level composed of recruiters, technicians, and coerced laborers, and a network of criminal facilitators, including lawyers, underground money changers, cryptocurrency exchanges, and corrupt officials.

At least 300,000 people are trapped in scam parks across Southeast Asia, with another approximately 6 million participating in a broader criminal support ecosystem. Victims from at least 80 countries and regions are lured into these parks by fraudulent recruitment ads, only to be restricted in their personal freedom and forced to engage in online scam activities. Data from Thailand's Anti-Scam Center for 2025 indicates that the country identified 13,195 individuals from 83 countries through its national referral mechanism, of which 4,407 were confirmed as victims of human trafficking. Conditions in the parks are dire; newcomers have their passports and phones confiscated and are subjected to blood tests and other medical examinations before being taken into dormitory areas protected by barbed wire and military checkpoints. Whistleblowers from the K99 Triumph City park reported instances of beatings and electric shocks.

The recruitment network has extended to transit hubs in Asia, the Middle East, and Africa, with related advertisements starting to target job seekers in Europe and North America, explicitly seeking users of German, French, Spanish, Italian, Dutch, Polish, Swedish, Norwegian, and English. Criminal networks are also expanding into South America and Africa, with Asian crime groups setting up physical scam centers in South America, recruiting Spanish and Portuguese-speaking workers and establishing cooperative relationships with local large drug trafficking organizations.

Deep Fake Utilizing Chain Inputs → AI Tools → Outputs → Impacts

On the technology front, criminal groups are deploying AI deep fakes and automated scam systems. In the first half of 2025, incidents of malvertising surged by 42%, with criminals using legitimate advertising networks to distribute malware to large numbers of users. The United Nations has previously reported that deep fakes and voice cloning technology have become weaponized tools for organized scams.

Screenshot of a recruitment ad for scams stating, "Integrity cooperation, recruiting public security internal personnel."

Criminal groups also use the portability of Starlink, which operates independently of national telecom networks, to maintain scam operations in remote areas such as Myanmar and Laos, where traditional internet access has been cut off by local governments. The smuggling routes connecting the Sulu - Sulawesi Sea with Indonesia, Malaysia, and the Philippines are also used to transport technical equipment supporting scam operations, including low-orbit satellite devices.

ClickFix social engineering attacks saw an explosion of 517% in the first half of 2025. Associated with the Lazarus Group, this technique has been adapted into a ClickFake Interview variant, specifically targeting practitioners in the cryptocurrency industry by faking recruitment processes. 48% of cybersecurity professionals listed Agentic AI (an AI system capable of independently planning, executing, and adjusting multi-step attacks) as the biggest attack vector in 2026. The number of AI service providers in the guarantee market grew at an average annual rate of 1,900% from 2021 to 2024, receiving 375.9 million dollars through cryptocurrency in 2024.

Action Against Crime and Law Enforcement Bottlenecks

Multiple countries are stepping up their crackdown efforts. The U.S. Department of Justice's Scam Center Strike Force seized 580 million dollars in cryptocurrency within the first three months of its establishment. Cambodia arrested key figures in the scam network, including Chen Zhi, and conducted one of the largest Bitcoin seizure operations in the country's history. Thailand announced a deepened cooperation with the U.S. FBI in combating global scam networks on the day the report was released.

In April 2026, the U.S. Treasury's OFAC sanctioned Cambodian Senator Kok An and his K99 group, along with Rithy Raksmei and another 26 individuals and entities, for committing digital asset investment fraud and romance scams using forced labor victims through scam parks. Thailand's Anti-Money Laundering Office (AMLO) and civil court previously issued temporary freezing orders on assets linked to Kok An, valued at 13.07 billion baht (approximately 407 million dollars).

In February 2025, the North Korean-associated Lazarus Group stole approximately 1.5 billion dollars' worth of ETH from the cryptocurrency exchange Bybit and laundered it through the THORChain cross-chain protocol. Wallet drainer attacks stole 494 million dollars in 2024, a year-on-year increase of 67%, with over 300,000 wallets targeted.

Targeted crackdowns in Myanmar and Laos have destroyed some scam parks, but criminal networks have quickly migrated to areas with weaker law enforcement. UNODC chief analyst Inshik Sim warned that the scale and complexity of the crime economy are exceeding the design limits of existing response systems. The ability of criminal organizations to establish spontaneous stablecoins, create their own blockchains, and encrypted communication platforms indicates that the freezing mechanisms—currently the main financial intervention method employed by the international community—may be rendered ineffective. Delphine Schantz believes that law enforcement agencies need to shift from combating individual criminal actions to systematically tracking and seizing criminal proceeds while extending regulatory frameworks to the underlying blockchain infrastructure level, rather than solely relying on cooperation with individual stablecoin issuers.