An analysis of the blockchain records also revealed “a sophisticated and coordinated cryptocurrency scam,” according to a cyber forensics report produced by the country’s Financial Intelligence Unit. The scammers allegedly deposited worthless digital tokens into the wallets of more than two million users of the popular online crypto platform Tron. Users who attempted to redeem the tokens would then have their sensitive information extracted and accounts drained, the report said.
In total, the scheme netted proceeds worth at least $1.6 million for the Palau-based scammers in one eight-month period, Anson told OCCRP.
The files seized from Cocoro Hotel, some of which were encrypted and had to be cracked by investigators, show that the center also used detailed instructions on how to attract victims to gamble on a range of websites, according to the report, which did not identify the perpetrators behind the operation but recommended Palau authorities coordinate with other international law enforcement in order to do so.
Behind the scenes, the scammers appear to have run such sites from the back end, allowing them to change the amount of money held in an account, offer bonuses that were not real, and hide losses in order to trick users into thinking they were gambling successfully, the report’s author told OCCRP.
The files “clearly indicate that the individuals operating these devices were managing a coordinated criminal network under the guise of an online gambling enterprise,” the report concluded.
“There is a strong indication that the criminal operation extended beyond illegal gambling,” it added. “It likely involved malware deployment, potentially used to infect victims’ systems, conduct fraud, and expand the criminal network through unauthorized access.”
Jarod Baker, co-founder of Honolulu-based consultancy Pacific Economics, which advises the government of Palau, described both operations as having the same modus operandi as a string of other scam centers allegedly run by Chinese organized crime that have been busted in Palau in recent years.
“The activities of illegal gambling, cyber fraud, crypto laundering, identity fraud, and workforce exploitation are all hallmarks of Chinese TOCs [transnational organized criminal groups],” he said.
Baker noted that the scams discovered in January appeared similar to the cyber-crime ring busted in Palau in 2020, whose workers had also reportedly had their visas sponsored by former Vice President Chin.
“We see the same facilitators in Palau who are bringing these people over or hiring them as IT specialists for their companies,” he said. “It’s the exact same people, they’re just operating under different company names.”
Investigators who used digital forensic methods to follow the money trails from the Beluu hotel were able to trace payments sent through the crypto platform Tron. OCCRP found that one of the digital wallets receiving the money has been associated by outside researchers with the Huione Group, a Cambodian financial conglomerate that was recently sanctioned by the U.S. for allegedly laundering the proceeds of pig-butchering scams in Southeast Asia.
Huione did not respond to multiple requests for comment.
Going Global
Despite the recent U.S. and U.K. sanctions, and growing pressure from authorities in Southeast Asia, scam centers with “pig-butchering”-style operations continue to spread across borders.
