Elliptic and Thai Police Uncover $520 Million Crypto Laundering Network Across 32 Blockchains
Elliptic, working with Thailand’s Royal Thai Police, says it traced more than $520 million in incoming cryptoasset transactions linked to a sprawling Southeast Asia crime network spanning 32 blockchains, dozens of asset types, and a nasty mix of theft, scams, and laundering.
- More than 500 suspicious wallets linked to almost $14 million in victim losses
- $520 million in incoming cryptoasset transactions traced across 32 blockchains
- Common rails included Ethereum, Tron, and Bitcoin
- Used tools: DEXs, cross-chain bridges, and instant swap services
- Activity linked to pig butchering scams, wallet hacks, credential theft, and compounds in Cambodia and Myanmar
The joint effort involved Elliptic’s Asia-Pacific Intelligence team and the Royal Thai Police’s High-Tech Crime Division (HTCD). According to Royal Thai Police and Elliptic Uncover Crypto Crime Networks, the investigation started with hundreds of suspicious cases and grew into a much larger network using the same transaction patterns.
That distinction matters. The $520 million figure is not being presented as a neat pile of confirmed stolen coins sitting in one wallet. It refers to incoming cryptoasset transaction flow connected to the network Elliptic and Thai police examined. In plain English: suspicious money movement, not a clean accounting of every dollar as proven crime proceeds.
That may sound like semantics to the uninitiated, but in crypto investigations it is the difference between solid analysis and sloppy headline bait. Big difference. One is useful. The other is tabloid sludge.
What the investigators connected
Elliptic says it analyzed more than 500 reported suspicious cryptoasset wallets and tied them to almost $14 million in individual victim losses, with most of those losses occurring between January 2022 and October 2025. From there, the firm says it traced a wider laundering network handling $520 million in incoming cryptoasset transactions.
The activity covered cryptoasset thefts, wallet hacks, credential theft, professional money laundering, and fraud schemes including Unmasking a Crypto Scam Network: The Royal Thai Police. Elliptic also says some addresses were connected to organized criminal networks enabling compounds in Cambodia and Myanmar.
For readers new to the term, pig butchering is a long-con scam. Victims are groomed through fake romance, friendship, or investment pitches, then coaxed into sending crypto to fraudulent wallets or platforms. It is slow, manipulative, and built to drain people dry.
Elliptic says the network touched more than 400 different assets. The most common chains included Ethereum, Tron, and Bitcoin, but the flow was spread across 32 blockchains overall. That broad spread is the point. The criminals were not relying on one narrow lane. They were using the whole road network.
How the money moved
The laundering methods described by Elliptic are familiar to anyone who has watched crypto crime evolve over the last few years. Criminals move stolen or fraud-derived assets into services that are easy to access, fast to use, and difficult to police. Then they start fragmenting the trail.
That includes chain-hopping, which means moving funds from one blockchain to another to make tracing harder. It also includes converting niche stolen tokens into more liquid assets, then pushing them through decentralized exchanges (DEXs), cross-chain bridges, and instant swap exchanges.
These tools are not inherently dirty. They are legitimate parts of crypto infrastructure. The problem is that some are noncustodial, some operate with limited identity checks, and many can be used without the kind of know your customer (KYC) screening common at regulated financial firms and centralized exchanges.
That makes them useful for regular users and scammers alike. The same rails that help crypto move freely across borders also help criminals move cash out of sight. Decentralization cuts both ways, a feature, not a bug, unless you are trying to keep your stolen funds untraceable.
Elliptic also says criminals moved away from freezable stablecoins to avoid blacklisting. Those are stablecoins whose issuers can freeze or block specific addresses under certain conditions. Once a dirty wallet gets flagged, frozen funds are a bad day at the office for the people trying to cash out.
Why this case matters
The bigger takeaway is not just that a lot of money moved. It is that multiple crime types appear to feed into the same laundering backbone. Theft, scams, and money laundering are not showing up as isolated incidents here. They look like parts of the same machine.
That should worry exchanges, compliance teams, law enforcement, and ordinary users who still think scam operations are just random Telegram clowns with a VPN and a dream. The reality is uglier: these are organized, adaptive networks that reuse infrastructure across victims, across assets, and across chains.
$520, 000, 000 in Suspicious Crypto Transactions Involving 32 is Elliptic’s measurement of cross-chain crime activity, not a statement that every bridge transfer is illicit. Bridges and swaps are legitimate tools. Criminals just love tools that make tracing a pain in the neck.
The Cambodia and Myanmar link
Elliptic ties some of the activity to addresses connected with organized criminal networks enabling compounds in Cambodia and Myanmar. That is an important nuance: the firm is not claiming every address was physically inside those compounds, but that the on-chain activity is connected to networks associated with them.
That fits the broader picture of industrial-scale scam operations in Southeast Asia. These are not one-off hustles. They are organized systems built to run at volume, often combining social engineering, fraud, and layered laundering in ways that are hard to shut down quickly.
Elliptic put it bluntly:
“The cyber scam networks in Myanmar and Cambodia are known for their resourcefulness and ability to adapt in the face of disruption. Being able to trace their latest on-chain behaviors enables compliance professionals and wider law enforcement in the region to proactively mitigate emerging risks and laundering typologies.”
That is a polite way of saying these crews are not sitting still. Pressure on one route usually pushes them to another chain, another bridge, another swap venue, or another set of wallets. The game is evasive by design.
What blockchain analytics can actually do
This is where firms like Elliptic matter. Public blockchains are transparent, but transparency alone does not magically identify bad actors. You still need clustering, labeling, tracing, and human analysis to connect the dots across wallets, chains, and services.
In this case, Elliptic says its work began with more than 500 suspicious wallets and expanded outward through shared transaction behavior. That kind of tracing is exactly what law enforcement needs when the criminals are trying to shred the trail into a thousand little fragments.
It is also why crypto’s critics and defenders keep talking past each other. Critics point to the abuse and call the system broken. Defenders point to the transparency and the traceability. Both are right in part. Public ledgers make crime more visible, but they do not prevent it on their own. And when criminals can route through low-KYC infrastructure, visibility alone is not enough.
Elliptic's Typologies Report: Detecting the money flows behind the global pig butchering ecosystem is the kind of research that shows how these operations move, layer, and cash out across venues that are built for speed, not morality.
Key questions and takeaways
- What did Elliptic and Thai police uncover?
They traced more than $520 million in incoming cryptoasset transactions tied to a network of theft, scams, and laundering activity across 32 blockchains. - Does $520 million mean confirmed stolen funds?
No. It refers to incoming cryptoasset transaction flow connected to the network, which is not the same as proving every dollar was illicit proceeds. - Which blockchains were involved?
Elliptic names Ethereum, Tron, and Bitcoin among the main chains used, with the activity spread across 32 blockchains in total. - How were the funds hidden?
The network used chain-hopping, decentralized exchanges, cross-chain bridges, instant swaps, and moves out of freezable stablecoins to reduce the chance of freezing or blacklisting. - Why does the Cambodia and Myanmar angle matter?
Elliptic says some addresses were connected to organized criminal networks enabling compounds in those countries, which fits the broader pattern of industrial-scale scam operations in Southeast Asia. - Why should Bitcoiners care?
Bitcoin’s transparency helps investigators, but scammers often use Bitcoin as one stop in a larger laundering path before hopping into other assets and chains with weaker friction or weaker oversight. - Did this lead to arrests?
The material here does not confirm specific arrests or prosecutions from this data-sharing effort, so it should be treated as intelligence and tracing work, not a finished takedown.
The cleanest read on this case is simple: crypto’s openness makes it useful for legitimate finance, but it also gives organized scammers and launders a powerful set of tools when compliance is thin and enforcement is fragmented. Pretending that problem is not there is useless.
Elliptic and Thai police have shown what coordinated blockchain tracing can uncover. The uncomfortable next question is whether exchanges, protocol operators, and law enforcement will keep up, or keep acting surprised when criminals use the rails exactly the way criminals tend to use open rails.
For a broader view of the same operation, see Elliptic and Thai police uncover $520 million suspicious and the underlying Elliptic's Typologies Report: Detecting the money flows research that helped map the laundering behavior.
Further reading
A useful companion if you want the broader investigative breakdown behind the same network.
