DOJ's Scam Center Strike Force Restrained $701M and Seized Its First Telegram Channel — The Precedent That Will Outlast the Headline

Six days before the 276-arrest takedown, the DOJ's Scam Center Strike Force restrained $701.96 million in cryptocurrency, seized 503 fake investment websites, and pulled off the first-ever federal seizure of a Telegram channel — the recruitment funnel that lured trafficking victims into Cambodian scam compounds. The arrests got the headlines. The Telegram seizure is the precedent.

The U.S. Department of Justice announced on April 23, 2026 a multi-front enforcement action against pig-butchering scam operations led by the Scam Center Strike Force — the joint DOJ, FBI, and U.S. Secret Service unit established in 2025 to target Southeast Asian cryptocurrency-fraud infrastructure. The operation restrained more than $701.96 million in cryptocurrency tied to the laundering of victim funds, executed the first-of-its-kind federal seizure of a Telegram channel used to recruit trafficking victims, and seized 503 fake cryptocurrency investment websites under the FBI's Operation Level Up initiative. Six days later, on April 29, a parallel coordinated operation produced 276 arrests across nine scam compounds — covered in our May 2 reporting.

The single most important fact: the Telegram seizure is a precedent that matters more than the dollar figure. U.S. authorities executed a first-of-its-kind seizure of a Telegram channel — @pogojobhiring2023, with more than 6,500 followers — that was used to recruit English-speaking workers to Cambodian scam compounds under false promises of high-paying employment. Once recruited, victims were trafficked into compounds, held against their will, and forced to run law-enforcement-impersonation and pig-butchering scams targeting U.S. citizens. The seizure establishes that U.S. federal authority extends to social-media recruitment infrastructure operating on platforms historically resistant to U.S. legal process.

The Telegram Seizure Establishes a New Federal Authority Vector

Federal seizures of fake investment websites are now routine — Operation Level Up has been doing this since 2024, and the 503 sites in this action bring its running total well past the original baseline. The novel piece is the Telegram channel. Telegram has been a sustained operational headache for U.S. law enforcement: incorporated outside the U.S., resistant to lawful-process requests, used by criminal recruiters across multiple categories of fraud and trafficking. The @pogojobhiring2023 seizure does not require Telegram's voluntary cooperation; it operates against the channel itself as criminal proceeds, taking control of the resource that the recruitment operation depended on.

The reason the Strike Force targeted this particular channel is that it sat at the front of the entire human-trafficking pipeline. Channel followers were lured to Cambodia under the guise of high-paying jobs, then forced — under threat of violence — to operate a sophisticated U.S. law-enforcement and bank impersonation scheme targeting Americans. Disrupting the channel disrupts the supply of trafficked workers; disrupting the supply of workers disrupts the compound's ability to scale. The seizure is a structural intervention, not just a symbolic one.

The legal precedent matters beyond pig-butchering. Other Telegram channels — used by ransomware affiliates for recruitment, by stolen-data brokers for sales, by extortion operations for victim shaming — now sit under the same federal authority. Whether DOJ extends the precedent will depend on the operational return on this action, but the door is open.

Shunda, the Karen National Liberation Army, and the Compound Evidence Base

The Shunda compound charges against Huang Xingshan and Jiang Wen Jie illustrate why the broader takedown was possible. The compound — located in Min Let Pan, Burma — was seized in November 2025 by the Karen National Liberation Army during regional armed conflict. Investigators subsequently reviewed more than 8,000 phones and 1,500 computers recovered from the site, providing the evidentiary foundation for the criminal complaints unsealed in April. One defendant supervised a team that defrauded a single American victim of more than $3 million; that theft, per court records, was "celebrated within the organization as a paradigm of success."

Huang allegedly served as a high-level manager and personally participated in physical punishment of trafficked compound workers. Jiang led the team specifically targeting Americans. Both defendants are at large. The criminal forfeiture allegations, the OFAC sanctions, and the Telegram seizure are the available tools when the human defendants are unreachable; they do not replace prosecution but they do impose ongoing operational cost.

The Karen National Liberation Army's role in the evidentiary chain is itself worth noting. The compounds operate in lawless border zones precisely because national governments have limited capacity to act — the substitute is non-state armed groups whose interests intermittently align with U.S. enforcement priorities. The October 2025 $15 billion Bitcoin forfeiture from Cambodian Prince Group founder Chen Zhi (still at large) followed similar logic: an enforcement action that worked despite the defendant's continued freedom because the financial infrastructure was reachable when the person was not. Our cybercrime coverage tracks how the financial-infrastructure side of these operations is becoming the durable enforcement vector.

Why $701M Restrained Is Not the Same as Recovered

The $701.96 million figure is consistently described in the DOJ announcement as "restrained," not "seized" or "forfeited." The distinction matters. Restrained funds are frozen pending forfeiture proceedings; they may eventually be seized, returned to victims, transferred to the U.S. Treasury, or — in some cases — released back to defendants if forfeiture fails. The historical record on large crypto restraints is that conversion to recovered victim funds is partial and slow.

The October 2025 $15 billion Bitcoin forfeiture against Prince Group is the largest forfeiture action in DOJ history; victim-restitution mechanics for that case are still being worked out. A January 2026 transfer of $225 million in seized USDT directly to Tether — executed on Ethereum without intermediary exchange — has emerged as the working template for how seized stablecoins are administered. That direct-to-issuer model is becoming infrastructure, not exception. Defenders advising victim organizations should set expectations accordingly: restraint is meaningful, recovery is partial, and the timeline for any individual victim's restitution is measured in years.

Chainalysis estimates crypto scams generated more than $17 billion in losses in 2025, with impersonation scams growing more than 1,400 percent year over year. The $701.96 million restrained in this action is meaningful but modest against that baseline. The structural impact comes from the seizure-precedent stack — Telegram channels, fake investment websites, OFAC sanctions on enabling banks — accumulating over time, not from any single dollar figure.

Defender Actions for Organizations Adjacent to This Threat

• For financial institutions and crypto exchanges: monitor for the OFAC-sanctioned Cambodian network — Senator Kok An, Rithy Raksmei, Crown Resorts, K99 Group, Heng Feng Cambodia Bank, and the 29 designated entities. Compliance failures around sanctioned-entity transactions remain enforcement priorities for FinCEN, OFAC, and SEC. Update screening lists; document remediation.
• For HR and trust-and-safety teams at platforms with job-recruitment functionality: the Telegram-channel seizure precedent applies to your platforms too. Recruitment funnels into trafficking compounds operate on LinkedIn, Indeed, Facebook Marketplace, and other commercial platforms. Build detection logic for "high-paying job in Southeast Asia, English-speaking, no specific employer name" patterns; refer suspected trafficking recruitment to NCMEC and regional anti-trafficking authorities.
• For organizations with employees traveling to Southeast Asia: brief staff on the trafficking-recruitment risk before travel. Documented cases include workers responding to legitimate-seeming job postings, traveling to interview, and being held at compounds upon arrival. The State Department's worldwide caution on Southeast Asian compound trafficking is a current advisory; treat it as relevant pre-travel briefing material.
• For organizations with users at risk of pig-butchering targeting — particularly older users, recent retirees, or users with substantial liquid assets — extend awareness training to family members. The fraud lives in personal relationships and family communication channels, not on enterprise endpoints. The IC3 reporting mechanism (ic3.gov) is the documented intake; organizations supporting affected users should know the path.
• For threat-intelligence and trust-and-safety teams: the Strike Force's expanded toolkit — Telegram seizure, OFAC sanctions, fake-website seizure, criminal complaints under in-absentia process — is now visible enough that operators will adapt. Watch for migration to alternative messaging platforms (Signal channels, WeChat, regional apps) and for increased operational compartmentalization. The pattern of adaptation is consistent with how ransomware operators responded to law-enforcement pressure in 2024–2025.

The CyberSignal Analysis

Signal 01 — The Telegram seizure is the operational precedent that scales

The $701 million figure will get the headlines; the Telegram-channel seizure will define how this enforcement model evolves. For a decade, criminal recruitment, marketing, and infrastructure on Telegram has operated under an assumption that the platform's jurisdictional and technical posture insulated those resources from U.S. process. The @pogojobhiring2023 seizure breaks that assumption. It does not require Telegram's cooperation; it operates against the channel as criminal property. Defenders watching the broader threat-intelligence ecosystem — ransomware leak channels, infostealer marketplaces, extortion intake portals — should expect this authority to be extended in the next 12 months. The relevant policy question is not whether DOJ has the legal authority; it is how often the government chooses to exercise it.

Signal 02 — Crypto restraint is now the durable consequence; defendants at large is the unresolved problem

Huang Xingshan, Jiang Wen Jie, Chen Zhi (Prince Group), Thet Min Nyi ("Pixy"), and most of the other named defendants in the linked Q1 2026 actions are at large. The 276 arrests on April 29 were largely in Dubai and Thailand — locations where U.S. cooperation is structurally available. Burma, Cambodia, and Laos, where the compounds actually operate, remain non-extradition jurisdictions for the most operationally important defendants. The U.S. government's response has been to make the financial infrastructure portable while the defendants are not: restraint, sanctions, and asset forfeiture impose costs even when the criminals themselves remain free. That is a meaningful evolution in enforcement strategy, but it is not a substitute for prosecution. Victims of pig-butchering schemes should not expect the named compound managers to face trial in U.S. courts in the near term.

Signal 03 — Operation Level Up's $562M in saved losses is the metric defenders should ask their TI teams about

The operationally interesting number in this announcement is not $701 million restrained or 276 eventual arrests — it is the $562 million in estimated losses prevented through Operation Level Up's victim-notification work. The FBI's San Diego and Phoenix field offices, working with Chainalysis-style blockchain tracing, have proactively identified roughly 9,000 victims and contacted them before they completed full deposits to fraudulent platforms. That intervention model — identify the wallet, identify the recipient, contact the user before the funds clear — is replicable by private-sector threat-intelligence teams with sufficient blockchain-tracing capability. CISOs at financial institutions and crypto exchanges should ask: what would it take to deploy a comparable proactive-notification capability internally? The structural ROI on prevention is multiples of post-fact restitution.

Sources