News

U.S. “Disruption Week” Pushes Back Against Pig‑Butchering Scams – 1.4 Million Accounts Hit, Crypto Flows Frozen

June 5, 2026
Author: Yury Serov

1.4 Million Accounts. Four Days. The Largest Coordinated Takedown of Pig Butchering Infrastructure Ever.

The U.S. Department of Justice has disclosed the results of a four‑day “Disruption Week,” a concentrated campaign run by the Scam Center Strike Force that targeted cyber‑enabled and cryptocurrency investment fraud schemes-commonly known as “pig butchering”-run from industrial‑scale scam compounds in Southeast Asia.

From 18 to 21 May in Washington, D.C., federal investigators from the FBI, U.S. Secret Service and Homeland Security Investigations briefed a hand‑picked group of private sector players-including Apple, Coinbase, Google, Meta, Microsoft, Silent Push, SpaceX, TRM Labs and Zenlayer-on specific scam infrastructure tied to Chinese‑linked transnational criminal organizations operating in Cambodia, Laos and Burma.

Based on those indicators and their own internal data, participating firms voluntarily disrupted more than 1.4 million social media and email accounts, blocked malicious IP traffic, and decommissioned servers and hosting environments used to lure victims into fake crypto investment platforms.

The week produced immediate law‑enforcement leads as well. Private platforms and government teams identified multiple scammers and scam platforms, referred cases for investigation in the United States, and worked with Thai authorities on arrests of seven suspects and the opening of new cases by the Royal Thai Police Anti Cyber Scam Center. Officials stressed that this marks the first time such a broad coalition of U.S. tech and infrastructure providers has convened around a single fraud threat and agreed to coordinated, voluntary disruption actions at this scale.

The backdrop is stark. According to the FBI’s Internet Crime Complaint Center, reported U.S. losses to crypto investment fraud rose from 3.96 billion dollars in 2023 to 5.8 billion in 2024, and then to more than 7.2 billion in 2025, with crypto investment schemes accounting for 83 percent of reported investment fraud last year.

One government report cited by the Department of Justice estimates that, as of the end of 2023, global scam syndicates were stealing a conservative 64 billion dollars annually, while public reporting shows scam‑generated revenue approaching half of national GDP in some Southeast Asian jurisdictions hosting compounds.

These “pig butchering” operations combine human trafficking-workers trapped in guarded compounds, facing beatings and electrocution-with industrial‑scale social engineering that drains the life savings of victims in the United States and beyond.

For additional background, DOJ’s dedicated Scam Center Strike Force portal details the wider initiative and highlights earlier actions, including more than 700 million dollars in crypto restrained and seizures of over 500 scam websites and a major Telegram channel used to funnel victims into fake platforms.

The Shift from Reacting to Fraud to Destroying Its Infrastructure

Disruption Week is less a one‑off enforcement spectacle and more a signal of a structural shift: cyber‑fraud is now treated as a shared infrastructure problem rather than a series of isolated victim complaints. U.S. Attorney Jeanine Ferris Pirro’s office framed the Strike Force from day one as a vehicle to “bring private industry into the fight,” and Disruption Week operationalizes that message by turning internal platform data, hosting logs and blockchain intelligence into coordinated takedowns rather than siloed abuse tickets.

Disruption Week reveals how enforcement narratives are shifting from purely reactive victim restitution toward proactive “infrastructure denial.” The Strike Force explicitly focuses on seizing U.S.‑based facilities and disabling the infrastructure that enables scams-including domains, servers, ISPs and social media accounts-while its crypto seizure team has already restrained more than 700 million dollars and initiated forfeiture for tens of millions more.

This approach resembles counter‑terrorism disruption doctrine applied to financial crime: break logistics, sever communications, and raise the cost of operating at scale. For CAT Investigators, this means evidence packages that map infrastructure-DNS, hosting, wallet clusters, comms channels-will likely receive more attention from prosecutors than narrow victim narratives alone.

The Compliance Implications of Disruption Week, And How to Get Ahead of Them

If you sit on the risk, fraud or compliance side of a crypto‑exposed business, Disruption Week is your warning shot that “we didn’t know” will no longer survive regulatory scrutiny.

Build a “Scam Center” typology library

Develop and continuously update internal typologies specifically tied to pig‑butchering schemes, incorporating indicators from public DOJ releases, OFAC designations, and threat intel from partners such as TRM Labs and Chainalysis. These should cover on‑chain patterns (layered transfers from addresses linked to Southeast Asian OTC desks), behavioral signals (romance‑style grooming patterns, investment app downloads following unsolicited contact), and technical markers (domains, IP ranges, hosting ASNs, Telegram channels) identified in enforcement materials.

Integrate law‑enforcement and analytics feeds into case routing

Map your case management systems so that addresses, domains, or infrastructure tied to the Scam Center Strike Force investigations trigger enhanced due diligence or fast‑track escalation, rather than standard queue handling. Where possible, link to open‑source indicators-such as those referenced on the DOJ Scam Center Strike Force page or in OFAC’s SDN updates-so investigators can quickly correlate internal alerts with public enforcement context.

Formalize your own “disruption weeks” with partners

Use Disruption Week as a model: convene internal and external stakeholders-fraud, AML, cyber, product, legal, plus key vendors-to run targeted disruption sprints against a defined scam typology. Pre‑agree metrics such as number of accounts disabled, transactions blocked, or wallets flagged to law enforcement, and measure the week’s output against your ordinary baseline. This not only reduces live exposure but also produces evidence that you are meeting emerging expectations around proactive public‑private cooperation.

Strengthen off‑ramp and recovery playbooks

The Strike Force’s crypto seizure team emphasizes asset recovery, not only disruption. Financial institutions and VASPs should develop clear playbooks for freezing suspicious outbound transfers linked to scam indicators, preserving logs and chain of custody, and packaging evidential reports suitable for DOJ, FBI or local law‑enforcement engagement. Embedding blockchain analytics outputs directly into SAR or STR narratives will reduce friction and increase the likelihood that your freezes translate into actual recoveries.

Update customer‑facing education with realistic threat models

DOJ press materials underscore that many victims are groomed over months, convinced they are investing in legitimate crypto products until they attempt withdrawals and find their accounts frozen or inaccessible. Instead of generic “never send money to strangers” advice, institutions should embed very specific pig‑butchering scenarios into in‑app warnings, onboarding flows and campaign content-especially when customers move unusually large sums into newly opened exchange accounts or high‑risk jurisdictions.

Prepare for scrutiny on inaction

Once large platforms demonstrate that they can, in fact, identify and disrupt over a million scam accounts in a single week, it becomes harder for other ecosystem participants to argue that similar action is impossible. CAT clients should assume that regulators will increasingly view failure to act on known indicators as a governance issue, not a technical limitation, and should document both their technical constraints and mitigation plans.