The Year Federal Enforcement Caught Up With the Scam Compounds Behind Bitcoin ATM Fraud

Between April 2025 and April 2026, U.S. authorities and partner agencies restrained more than $701 million in scam-related cryptocurrency, sanctioned a sitting Cambodian senator, severed a $4 billion money-laundering network from the U.S. financial system, and stood up a dedicated DOJ Scam Center Strike Force. That Strike Force has now produced indictments naming the compound managers who directed American Bitcoin ATM victims by phone in real time.

Twelve months ago, none of this enforcement infrastructure existed.

For Bitcoin ATM operators, this matters because the federal record now describes — with phones, ledgers, and named defendants — the same fact pattern state attorneys general have been litigating since 2024: federal filings now tie a substantial volume of scam proceeds to a small set of identifiable foreign criminal organizations. The compliance question has shifted from "is this happening?" to "what controls did you have in place while it was happening?"

How Federal Enforcement Looked a Year Ago

In April 2025, there was no Scam Center Strike Force. There was no Executive Order 14390. There were no federal indictments naming compound managers. The Karen National Army — the militia hosting the largest scam compounds in Burma's Karen State — was not yet sanctioned. Cambodia's Huione Group was still moving billions through the U.S. financial system. Chen Zhi, the Prince Group chairman whose Cambodian compounds would generate the largest forfeiture in DOJ history, was operating openly.

State AG cases against U.S. Bitcoin ATM operators were already filed or in development — Iowa's lawsuit against Bitcoin Depot alleging that more than 50% of Iowa kiosk transactions were scam-related, Massachusetts' lawsuit alleging more than 80% of Bitcoin Depot customers depositing $10,000 or more were scam victims, the DC AG's case against Athena Bitcoin documenting a median victim age of 71. What state regulators alleged about the kiosk end of the pipeline, federal authorities had not yet documented at the compound end.

That changed in twelve months.

The Twelve-Month Arc

Bitcoin ATM News has previously covered the April 29 arrests in detail. The bigger story is that the April 29 operation is the capstone of a year-long structural buildout — not a one-off event.

What Got Built

Three pieces of permanent enforcement infrastructure now exist that did not a year ago.

1. The DOJ Scam Center Strike Force

Formed in 2025, the Strike Force combines components of the DOJ Criminal Division, the FBI, the U.S. Secret Service, IRS Criminal Investigation, the U.S. Postal Inspection Service, the Drug Enforcement Administration, and U.S. Attorneys' Offices for the District of Columbia, Alaska, Rhode Island, and the Western District of Washington. According to the DOJ's public Strike Force page, its Crypto Seizure team has restrained $701,962,392.15 in cryptocurrency — a number that does not include the standalone $15 billion Chen Zhi seizure. The Strike Force also executed a first-of-its-kind seizure of a Telegram channel with over 6,000 followers used to lure English-speaking individuals to Cambodia under the guise of high-paying jobs, then force them into law-enforcement impersonation scams.

2. Executive Order 14390

Signed March 6, 2026, EO 14390 mandates that the Attorney General prioritize prosecutions of cyber-enabled fraud and develop a Victims Restoration Program (recommendation due June 4, 2026). It also directs the State Department to engage foreign governments with the threat of sanctions, visa restrictions, and expulsion of complicit officials. A full interagency action plan identifying transnational criminal organizations is due July 4, 2026.

3. Operation Level Up

The FBI's proactive victim-notification program — which uses blockchain analytics to identify victims before they realize they are being scammed — has now contacted approximately 9,000 people, 78% of whom did not know they were being defrauded. The program estimates it has saved $562 million in losses and has referred 38 individuals to suicide intervention specialists. This is the operational model that regulators are increasingly expecting Bitcoin ATM operators to mirror at the kiosk.

The Sanctions Web

The OFAC and Treasury actions over the past year are not isolated press releases — they collectively map the supply chain of the scam economy:

• Land and security: Karen National Army (May 2025), DKBA (November 2025) — the militias that control and protect the compound grounds.
• Real estate and operators: 19 Burma/Cambodia entities (September 2025); Prince Group + 100 associates (October 2025); Kok An network of 28 individuals and entities (April 2026).
• Infrastructure: Funnull Technology (May 2025) — bulk IP supply chain to pig-butchering websites.
• Money laundering: Huione Group severed from U.S. financial system (October 2025) — $4B in identified laundering.

The FBI's 2025 IC3 report, released April 7, anchors the urgency: $11.36 billion in crypto fraud losses, a 22% year-over-year increase, with $7.2 billion from investment/pig-butchering fraud alone. Americans over 60 lost $7.7 billion — up 37%. Total cybercrime losses crossed $20.87 billion across more than one million complaints.

What This Means for Operators

The federal record is now sufficient to establish, in court, that a substantial share of high-value Bitcoin ATM cash deposits in 2024 and 2025 went to identifiable foreign criminal organizations whose names, structures, and command hierarchies are part of the public record. This creates three concrete operational realities.

• The "we couldn't have known" defense is closing. When OFAC has named the militia, named the compound, named the manager, and the FBI has documented the phone scripts coaching workers to impersonate "JPMorgan investigators" and "NYPD detectives," operators that processed transactions matching those scripts without intervention face a harder evidentiary fight. The Missouri AG civil investigative demands issued in December 2025 to Bitcoin Depot, CoinFlip, Athena Bitcoin, RockItCoin, and Byte Federal are gathering exactly the kind of records that pair directly with the federal indictments. State AGs no longer need to prove the foreign end of the chain themselves — DOJ is doing it.
• Wallet screening is now table stakes. The 503 fraud domains seized by the Strike Force, the OFAC-designated wallets across the Kok An, Prince Group, DKBA, and KNA networks, and the Operation Atlantic indicators of compromise are all ingestible. Operators that screen against this corpus can document defensive controls; those that don't, can't.
• State enforcement is gathering federal evidence — and winning legislative momentum. Indiana banned crypto ATMs outright in March 2026. Tennessee followed in April 2026 with a full ban effective July 1, classifying operation or installation of a Bitcoin ATM as a Class A misdemeanor. Virginia enacted an 18% fee cap, mandatory licensing, and a 90-day scam refund window. Canada announced a nationwide ban on roughly 4,000 machines on April 28, 2026, in its Spring Economic Update — the most consequential legislative move for the North American industry in the enforcement cycle's final week. The UK has effectively banned crypto ATMs by withholding licenses since 2021; Australia imposed daily transaction limits in 2025; New Zealand is considering an outright prohibition. Every one of these actions cited federal and IC3 scam-loss data as part of the rationale.

For operators tracking the regulatory environment, our operators directory includes trust scores and compliance profiles across the industry.

The Trafficking Reality

Court records and U.N. data establish that these compounds are sites of mass human trafficking, not just financial crime. The U.N. Office on Drugs and Crime estimates 120,000 people in Myanmar and 100,000 in Cambodia have been forced to work in scam operations, with the industry generating roughly $40 billion in annual profits. Workers are typically lured through fake job postings, trafficked across borders, stripped of passports, and threatened with violence for missing fraud quotas.

Court records in the Shunda compound case allege that defendant Huang Xingshan personally beat trafficked workers who failed to meet fraud quotas. Co-defendant Jiang Wen Jie is alleged to have supervised teams specifically targeting American victims, one of whom lost more than $3 million. Evidence in the case derives from over 8,000 phones and 1,500 computers recovered from the site after the Karen National Liberation Army seized it in November 2025.

The Adaptation Problem

Despite the escalation, criminal networks are evolving. Analysts note that Chinese syndicates are accelerating adoption of AI tools — including deepfake video for fake romantic partners and AI-powered chat to scale pig-butchering conversations. The FBI's 2025 IC3 report attributes $893 million in losses to AI deepfakes and voice cloning. Cambodia's domestic crackdown has been extensive, with 2,709 sites raided in two weeks in February 2026, but observers note that those arrested are "mostly low-level workers" while named financiers remain at large. The U.N. has warned of relocation to East Timor and other jurisdictions with weaker enforcement capacity.

What This Means for Consumers

If you have already lost money to a Bitcoin ATM scam — or you are in a situation that may be heading there — the past twelve months of federal enforcement have created mechanisms that did not exist before.

What's Next

Three deadlines now drive the next phase. By June 4, 2026, the Attorney General must deliver a recommendation for a Victims Restoration Program. By July 4, 2026, the interagency action plan identifying additional transnational criminal organizations is due. And the Tai Chang investigation in Burma's Karen State — backed by a $10 million State Department reward — remains active.

The question for Bitcoin ATM operators is whether the next twelve months bring the same step-up in federal scrutiny of the U.S. end of the chain that the past twelve months brought to the foreign end. With state AG civil investigative demands in hand, federal evidence on the table, and IC3 data continuing to climb, the gap between "what scammers do at the compound" and "what kiosks do at the curb" is closing fast. Will the next FBI IC3 report, in April 2027, show losses going down — or will it show that the enforcement caught the compounds while the kiosks kept running?