Pig-butchering β the long-con cryptocurrency fraud where victims are systematically cultivated over weeks or months via fake romantic or social relationships before being manipulated into fraudulent investment platforms β has generated hundreds of billions in losses globally since the model took hold in Southeast Asia around 2019. As of May 1, 2026, it has also produced the largest coordinated law enforcement response in its history.
Operation Tri-Force Sentinel, a joint operation between the FBI, the Dubai Police, and Chinaβs Ministry of Public Security (MPS), dismantled nine pig-butchering scam compounds, arrested 276 people, and seized $701 million in assets. A parallel sub-operation β Operation Level Up β reached would-be victims before their money was gone, preventing an estimated $562 million in additional losses.
What Pig-Butchering Is and Why Itβs So Hard to Stop
The term comes from the Chinese ζηͺη (shΔ zhΕ« pΓ‘n) β literally, to fatten a pig before slaughter. Operators invest significant time building a false relationship with a target β sometimes weeks of daily messaging β before introducing a fraudulent cryptocurrency investment platform. The victim, trusting the relationship, deposits money. The platform shows fabricated gains. The victim deposits more. Eventually, the βinvestmentβ disappears along with the operator.
The operation is industrial in scale. Scam compounds in Myanmar, Cambodia, Thailand, and elsewhere employ thousands of workers β many trafficked or coerced β who run scripted conversations with hundreds of victims simultaneously. The compounds are organized like businesses: shift workers, performance quotas, management hierarchies, HR departments. The technology stack includes purpose-built fraud platforms, money laundering infrastructure, and increasingly, AI-assisted conversation tools.
What makes them resilient is jurisdictional fragility. Operators site their compounds in ungoverned or weakly governed territories β Special Economic Zones along the Myanmar-Thailand border, enclaves in Cambodiaβs Sihanoukville, compounds in the Shan State. Extradition treaties donβt reach them. Local law enforcement is, in many cases, complicit.
Operation Tri-Force Sentinel represents a different model: simultaneous, coordinated pressure from three jurisdictions, targeting the management layer rather than the workers.
The Three-Agency Operation and How It Worked
The operationβs name reflects its structure: three distinct law enforcement authorities operating under a unified coordination framework.
Dubai was the linchpin. The UAE has positioned itself aggressively as a financial crime enforcement partner since signing a memorandum of understanding with the FBIβs Cyber Division in 2023. The nine compounds dismantled in this operation were registered in Dubai as corporate entities β Ko Thet Company, Sanduo Group, Giant Company, and six others β using the emirateβs business infrastructure to move money under the guise of legitimate commercial operations. Dubai Police executed the compound raids and arrests on UAE soil.
Chinaβs MPS contributed intelligence and executed arrests in Thailand. Two Chinese nationals β Jiang Wen Jie and Huang Xingshan β who ran the Shunda compound in Myanmarβs Shan State were arrested by Thai authorities in a coordinated action. The MPS has been increasingly active in pursuing Chinese nationals operating scam compounds abroad, partly in response to domestic political pressure around the trafficking of Chinese citizens into compound labor.
The FBI led the US-side prosecution and coordinated victim identification. Six defendants β including Burmese and Indonesian nationals β were charged in the Southern District of California (San Diego). Charges include wire fraud, conspiracy to commit money laundering, and participation in a transnational criminal organization.
The legal framework is significant. Federal prosecutors used the Racketeer Influenced and Corrupt Organizations (RICO) statute to charge the compounds as criminal enterprises β a designation that enables forfeiture of assets across the entire criminal network, not just those directly traceable to specific transactions.
Operation Level Up: Proactive Victim Notification at Scale
The sub-operation embedded within Tri-Force Sentinel may be the most significant procedural innovation in the action.
Operation Level Up is the FBIβs structured program for identifying pig-butchering victims before they reach total loss β and contacting them directly. Using intelligence gathered from seized compound databases, financial transaction records, and on-chain cryptocurrency analysis, FBI analysts identified victims who were actively in the middle of a pig-butchering engagement: money deposited, platform showing gains, victim not yet aware the operation is fraudulent.
FBI agents then reached out to those individuals directly β by phone, by email, through local law enforcement partners β to warn them that they were being defrauded before they sent additional funds.
The result: approximately $562 million in losses prevented across roughly 9,000 victim notifications sent prior to the May 1 announcement. That figure represents money that would-be victims did not transfer because they were warned in time. The 20,000+ total victims identified across 30 countries gives a sense of the scale of the underlying operation; the gap between 20,000 identified and 9,000 notified reflects the pace constraints of contacting individuals across international jurisdictions with wildly varying cooperation levels.
Operation Level Up is not new β the FBI announced it in early 2024 β but Tri-Force Sentinel is the first major operation to report its output at this scale. The $562M prevention figure is almost certainly conservative: victims who receive a warning and stop sending money often donβt self-report to law enforcement, so the actual prevented loss is likely higher.
Named Defendants and Charges
The San Diego federal complaint names six defendants from the Dubai compound network, though the DOJ has not yet released all names publicly as of this writing pending extradition proceedings. Jiang Wen Jie and Huang Xingshan, charged in connection with the Shunda compound, face wire fraud and money laundering charges; Thai authorities executed their arrests under a provisional arrest warrant ahead of a US extradition request.
The structural charges β conspiracy and RICO β are designed to reach senior management rather than the workers who actually ran the scripts. Prior pig-butchering prosecutions have largely netted lower-level operatives. The targeting of managers and recruiters in this action is a deliberate escalation, consistent with a stated DOJ priority to apply organized crime frameworks to scam compound networks.
What $701 Million in Seizures Covers
The $701M figure encompasses seized cryptocurrency, fiat currency, real property, and financial accounts across three jurisdictions. Dubaiβs civil and criminal asset forfeiture regime β which allows seizure on the basis of unexplained wealth in some circumstances β contributed substantially to the fiat component. On-chain forensics from blockchain analytics firms including Chainalysis and TRM Labs supported attribution of cryptocurrency wallets to the named compounds.
A portion of the seized assets will be directed to victim restitution through the DOJβs Asset Forfeiture Fund. The process of tracing, adjudicating, and distributing those funds across victims in 30 countries will take years; victims who have not filed complaints with the FBIβs Internet Crime Complaint Center (IC3) are unlikely to receive restitution.
What This Signals for the Scam Compound Ecosystem
Three observations for analysts tracking this space:
The geography is shifting. The Shunda compound was in Myanmar; the corporate registration was in Dubai; the workers were recruited from multiple countries. The internationalization of scam compound infrastructure is a direct response to previous crackdowns focused on Myanmar and Cambodia. Expect continued geographic diversification β potentially into East Africa, the Gulf, and Central Asia β as operators look for jurisdictions with lower enforcement risk.
The corporate registration angle is new. Using Dubai business entities to launder compound revenue is a more sophisticated model than pure cryptocurrency-only flows. It suggests the compound networks have access to financial and legal advisors capable of constructing legitimate-looking corporate infrastructure. This raises the bar for financial intelligence β AML teams at UAE financial institutions should be reviewing business formation patterns for the named compound names and their known beneficial owners.
Operation Level Up is the template. The proactive victim notification approach is replicable. If the FBI can build a database of would-be victims from seized compound records, so can other agencies. Expect Europol, the UKβs NFIB, and equivalent bodies to develop analogous programs. The challenge is speed: the window between a victimβs first deposit and total loss is sometimes 30 days or less.
Sources
- DOJ press release: Coordinated Takedown of Scam Centers Leads to at Least 276 Arrests of Alleged Managers and Recruiters (May 2026)
- BleepingComputer: Police Dismantles 9 Crypto Investment Scam Centers, Arrests 276 Suspects
- The Hacker News: Global Crackdown Arrests 276, Shuts 9 Pig-Butchering Scam Compounds
Breached.Company covers state-sponsored cyber and hybrid threats, breach disclosures, and signals intelligence for the security community. For threat intelligence retainers and vCISO consulting, CISO Marketplace connects you with vetted advisors.
