How Slavery Settles · Part I of III · Recruited
The phrase is the FBI’s. Paragraph 39 of a 2025 seizure affidavit for the Tai Chang compound in Myanmar tells the story of “a 19-year old Malaysian man who was imprisoned in KK Park after responding to an online job advertisement for a waiter position in Thailand.” The same sentence turns up in at least four more Scam Center Strike Force filings I have read. Its source is a four-year-old Malaysian newspaper story.
This is the first of three posts on how slavery settles. Settles in both senses: how the money clears, and how the arrangement stays put. Southeast Asia’s scam compounds hold people who are made to defraud strangers, and the money moves in Tether on the Tron blockchain, through marketplaces like Xinbi Guarantee. This post is about the people: who answered the ad. The second follows the money. The third asks who kept the gate open.
I began this investigation on the money side. I traced a compound’s wallet out of Tether’s own freeze log, and I assumed that somewhere in the court papers the ad and the wallet would meet. They don’t. What the documents do show is that the lure is ordinary, the captivity is industrial, and the people typing the scam messages were victims before they were anything else.
The newspaper was Free Malaysia Today, on 8 June 2022. A 19-year-old from Melaka, identified only by his surname, told reporters he had answered “a lucrative job advertisement on Facebook in March”. He was told he would work “as a waiter at a karaoke centre in Thailand”. I am not using his name.
Syndicate members collected him from home and drove him to Kelantan, where he crossed into Thailand illegally. From there he was taken to the border town of Mae Sot and over to Myawaddy, in Myanmar. He said he found “around 300” Malaysians per floor of a four-storey building, watched by Malaysian supervisors called “motivators”. His targets were Chinese people living in the US, Singapore and Taiwan.
“I only worked for three days. After that, they hit me with a baseball bat every day because I refused to work,” he said. In April he was pushed from the third floor and broke his leg and a rib. After two weeks in hospital the syndicate offered to free him for a ransom of RM120,000. His family negotiated it down to RM70,000. “My family managed to raise the funds to get me home.”
The FBI’s version, citing this report, says “pig butchering” scams aimed at victims in the United States. The newspaper says love scams. The filings put him in KK Park. He said “a little village” in Myawaddy. The differences are small, but the filings are where most readers will meet him now.
Four years later the FBI went after an ad channel itself.
In March 2026 US law enforcement interviewed a trafficking victim, called TV-1 in the papers, who had contacted the Justice Department “on their own volition”, according to an FBI affidavit sworn on 22 April 2026 (case 26-SZ-32). TV-1 described a compound in the Anlong Veng district of Oddar Meanchey province in northern Cambodia, “on Cambodia’s National Road 67, directly across from a casino”. About 20 people worked there in 12-hour shifts. The bosses took TV-1’s “identification documents, money, and personal belongings”. Other workers, including Filipinos, said they had been “recruited under similar false pretenses”.
The work was a script. Workers called Americans pretending to be from JP Morgan Chase, then passed them to a fake New York police officer, then to a fake court, “sometimes referred to as the Supreme Court of New York”. The affiant found “approximately 267 victims who filed reports consistent with the scheme”.
TV-1 also named the compound’s recruiting channel.
The channel’s name and size, 6,564 members, as the FBI recorded them in the affidavit sworn on 22 April 2026, before the seizure. Source: FBI affidavit, case 26-SZ-32, paragraph 31; a US government work, boxes mine.
The affiant reviewed the channel. Members posted “lucrative job opportunities in customer service, telemarketing, casino agents, and other opportunities” in Malaysia, the Philippines and Cambodia, with “attractive salaries, commissions, travel expenses, and meals”. Some asked for applicants with “no visible tattoos, marks, or braces”. The affidavit explains why: the workers had to appear on video calls with the people they were robbing. It also notes that “legitimate and reputable companies do not typically rely on Telegram as a primary means of recruiting applicants”.
The channel now carries a single post, the seizure notice. When I opened it on 6 October 2026 it showed 44 subscribers. That number and the FBI’s 6,564 count different things at different times, and I am not comparing them. The seizure notice had 364 views and 17 reactions, 12 of them the clown emoji.
Mae Sot sits on the Thai bank of the Moei river. Myawaddy is on the other bank. The UN human rights office’s 2023 report describes Thailand as “increasingly a transit country for these operations. People travel into Thailand before being moved by their traffickers over the border to a neighbouring State.” The Malaysian teenager’s route matches that description. So does the hiring itself, which the UN agency on crime, UNODC, describes as jobs in “digital marketing, customer service, construction, translation, hospitality and online gaming”, paying around $1,000 to $1,500 a month with accommodation and travel included.
KK Park, where the teenager was held according to the FBI, is on the Myanmar bank of the Moei, south of Myawaddy.
KK Park from orbit, one frame per dry season: farmland in 2019, a compound still standing in November 2025, six weeks after the raid. The red outline is its January 2025 footprint; “EXHIBIT I-1” is my label, not a court’s. Contains modified Copernicus Sentinel data 2019-2025 via Element 84 Earth Search.
Once inside, people were also moved between compounds. A criminal complaint unsealed in April 2026 (1:26-mj-00018) has its own TV-1, a different person from the Anlong Veng witness. He “was lured to KK Park in or around July 2023 by promises of a high paying job offer”. He was held there “against his will” and made to work “without pay”. In July 2024 he “was forcibly transferred to Baoli Park”, and on or about 20 September 2025 to Shunda. “Each time TV-1 was transferred between compounds, TV-1 was transferred under restraint and armed escort.” The complaint says the workers were moved each time the business moved. The Tai Chang affidavit, citing public reporting, adds that those “who cannot or do not pay are sometimes sold between companies.”
Myanmar’s military raided KK Park in October 2025. State media reported 2,198 arrests and 30 Starlink terminals seized, Al Jazeera reported. More than 1,500 foreigners fled across the river into Mae Sot, according to Thai PBS World.
Every account of this industry carries a headcount. I tried to trace the three most quoted figures back to how they were made.
| Figure | Who, when | Where | Basis given |
|---|---|---|---|
| At least 120,000, and at least 100,000 | OHCHR, Aug 2023 | Myanmar; Cambodia | “Information on file with OHCHR” (footnote 13) |
| At least 300,000 | OHCHR via UN News, Feb 2026 | Southeast Asia, people “working in operations” | “credible estimates”; none published |
| Up to 100,000 | Thai police, Mar 2025 | Thai-Myanmar border | Thai police intelligence and information from Chinese authorities, unaudited |
Each estimate covers a different place and date. No source I found explains how they relate, and I have not added them up.
UN News’s 2023 headline on the first report already said “hundreds of thousands”. The 2026 figure may be the same arithmetic rounded up. I can’t show that, and nobody else has either.
The numbers also drift as they travel. UN News says the 300,000 are “working in operations”. UNODC’s page from July 2026 has the same number “currently trapped”. ABC News in Australia wrote in July 2026 that “at least 120,000 people are thought to be trapped in scam compounds in Myanmar, according to estimates by the UN Office on Drugs and Crime”. That is OHCHR’s number from 2023, credited to a different agency three years later. The FBI’s Anlong Veng affidavit quotes a US Institute of Peace report saying OHCHR “estimates that criminal gangs are holding at least 220,000 people from more than 40 countries”. The OHCHR report has two figures that add up to 220,000. It has neither the total nor the forty countries.
Even one compound has no agreed size. Chainalysis wrote in 2024 that KK Park was “reported to hold over 2,000 trafficked romance scam workers”. ABC says “up to 25,000 scammers worked in KK Park alone”. The two are years apart and give no common basis.
The strongest objection to calling these people victims comes from the Thai police.
In March 2025 Police General Thatchai Pitaneelaboot, head of Thai police’s Anti-Human Trafficking Center and Cyber taskforce, told Reuters: “Since the Wang Xing case, there were 3,600 foreigners who travelled Mae Sot, and we did not find one who was tricked or coerced to come.” The figure came from police checkpoints and has not been audited. He added that of about 260 people sent from Myawaddy to Thailand that February, most were not coerced, according to initial Thai investigations. The same article quotes Jason Tower of the US Institute of Peace: “Many did go in willingly, only discovering that they had been trafficked later.”
Eight months later, 270 Indian nationals, 244 men and 26 women, who had escaped KK Park into Mae Sot were questioned by Thai immigration officers. According to Thai PBS World, the officers “were convinced that all of them were voluntary scammers. They were charged and convicted for illegal entry”.
The FBI does not deny that some came willingly. The Anlong Veng affidavit says the trafficked workers are “sometimes joined by willing scam workers”. The same document says that some of TV-1’s co-workers “appeared unaware of the true nature of the work prior to arrival”. The US Congressional Research Service, in a report dated 30 September 2026, puts it plainly: “many of the individuals involved in perpetrating scams are victims of human trafficking”. UNODC goes further: “Rather than employees, they are victims of human trafficking.”
A checkpoint count cannot see Tower’s point: someone can cross a border willingly and then be held. The Malaysian teenager went willingly to a waiter’s job.
In Cambodia, Amnesty International identified 86 compounds in June 2026 and found evidence of state intervention at only 24. It interviewed 73 survivors and assessed that all of them met the international definition of a trafficking victim. “None of the 73 survivors Amnesty International interviewed had been recognized as a victim of human trafficking.”
The compounds take money from two directions. Most of it comes from the people they defraud. Some comes from the families of the people they hold.
UNODC describes the mechanism. Workers are told they owe for “training and relocation”. The debt “increases over time and becomes unpayable”, and “in some cases, these debts become the ransom extorted from the victim’s families, which ranges from USD 3,000 to USD 30,000.” The Malaysian family paid RM70,000.
How those ransoms are paid is barely documented. In 2024 Chainalysis wrote that Eric Heintz, an analyst at International Justice Mission, had told it that pig butchering gangs “will often tell the families of trafficked workers to pay them ransoms in exchange for their family member’s freedom”, and that “those payments also often happen in cryptocurrency”. Heintz gave Chainalysis two ransom addresses linked to a front company at KK Park. The Record reported that the two received nearly $100 million in under two years. Part of that was scam money: $24.2 million reached one address from four “scam-associated” wallets, and “some portion” of the other’s inflows were likely romance scam payments. The rest is “believed to be from ransoms” paid by families “often instructed to pay upwards of $30,000”, a figure The Record took from the New York Times. The addresses were not published.
None of the sources I opened says which token or which chain the ransoms use. The rest of this series is about one token on one chain, so it is tempting to assume. I won’t.
The FBI redacted the Anlong Veng compound’s wallet. Part of it can be recovered from public records, so I tried.
The affidavit traces a victim’s money from a US exchange, through a bridge from Bitcoin to USDT on Tron, to “a wallet address ending in ***2Fq34 (scam address E2Fq34)”. It says the address “was blocklisted by Tether … at the request of law enforcement”. Tether, the company that issues USDT, can freeze any address that holds it, and its contract on Tron records every freeze as a public event on the blockchain. I pulled all 3,539 freeze events from 1 December 2025 to 5 October 2026. Exactly one address ends in 2Fq34. It begins TWBtAxWscqh, which is also what the FBI’s own chart shows, cut short, in the crop below. Tether froze it at 08:08 UTC on 5 April 2026. Its last outgoing transfer was 43 minutes earlier.
The affidavit gives two more clues: the last characters of two transaction IDs, one with Xinbi Guarantee and one with Haowang Guarantee. Both are in this address’s history.
I ran the search again on 6 October with a short script of my own. It is given only what the FBI printed and does three things: it finds every address Tether froze in ten months that ends in 2Fq34, reads that address’s full history, and looks in it for the two transaction endings.
$ python recover.py 2Fq34 e4dee9 756e2# 1 Find the frozen address# every freeze Tether recorded on USDT (Tron), kept if the address ends 2Fq34freeze events: 3,539 (USDT, Tron)window: 2025-12-01 to 2026-10-05ending 2Fq34: 1 match TWBtAxWscqhpRgjXDVfDVLaqWSGJE2Fq34 frozen 2026-04-05 08:08:06 UTC# 2 Read its history# every USDT transfer into and out of that addresstransfers at that address: 5,792# 3 Look for the FBI's two transactions# the transfers whose IDs end in the two fragments…e4dee9 2025-07-01 03:51:51 FBI: Xinbi Guarantee TGT4w2…CVXeq -> TWBtAx…2Fq34 8,000.00 USDT…756e2 2025-05-06 01:20:15 FBI: Haowang Guarantee TWBtAx…2Fq34 -> TVS7mx…tuAEL 300.00 USDT
My script’s output, run 6 October 2026 on public data from TronGrid. The comments, boxes and FBI labels are mine. One address fits all three fragments.
The affidavit redacts the address, but its chart still shows the first eleven characters. Boxed: the two transaction endings, both in the recovered address’s history. Source: FBI affidavit, case 26-SZ-32, page 36 (it spells Haowang “Hawang”); boxes mine.
The end of the FBI’s chart, enlarged four times from the low-resolution image embedded in the filing. Source: FBI affidavit, case 26-SZ-32, Figure 9; a US government work, box mine.
The image below puts the FBI’s fragments beside the full records. You don’t have to trust my script for this part: both records are on a public block explorer, one click each.
Top: the FBI affidavit, case 26-SZ-32, pages 36 and 37. Bottom: TronScan’s records of the transfer and the freeze, 6 October 2026. Boxes mine. The Haowang transfer is here.
Xinbi Guarantee is a Chinese-language marketplace that runs on Telegram, as Elliptic documented in 2025. Britain sanctioned it on 26 March 2026 and the US Treasury followed on 9 September. Haowang Guarantee is, in the words of FinCEN’s final rule against the Huione Group, one of the group’s “Components”. The wallet that sent the 8,000 USDT also sent USDT directly to, or received it from, two of the addresses Treasury later designated as Xinbi’s (my count), so the FBI’s label and the chain agree.
These are two transfers, 8,300 USDT in all, at an address that took in $11.34 million from 1,025 senders between March 2023 and July 2026 (my count; a frozen address can still receive USDT, it just can’t send it). They are laundering-side flows: money moving between a compound’s collection wallet and the marketplaces. They are not ransoms and they are not wages, and I don’t know what either transfer paid for. The FBI calls them “direct funds transfers” and stops there, and so do I.
The Anlong Veng compound recruited on Telegram. Xinbi traded on Telegram. That is as close as they come. I found nothing that puts the recruitment ad and the payment rail in the same sentence. They meet only in the people between them, who answered ads like this one and, in the Shunda complaint’s account of one man, worked without pay.
The Shunda managers were paid. In December 2025, in a managers’ group chat that the FBI later read for the Shunda complaint, one manager’s advance of about 1,000 USDT went through. Someone posted the screenshot with a one-word caption.
Arrived.
Britain sanctioned Xinbi with two wallets that were already dead. The money stopped a day before the announcement, when, by an analytics firm's account, a US agency went to Tether. The first new wallet opened 26 minutes later. This part asks who kept the gate open.
A Telegram marketplace that moved billions in Tether, a scam wallet the FBI redacted and a deposit address Arkham labels Binance at the end of the trail. This is where the money went, step by step, on a public ledger.
A bishop who thanked a court, a patriarch who sent priests to the draft offices and a Pentagon that rewrote its chaplains.
