Emerging Threats

US Charges Vietnamese Man in $16 Million Crypto Scam

Analyst 207||Source: BleepingComputer
US officials stand in a government building, enforcing cryptocurrency charges.

"From Feb. 9, 2018, through Dec. 17, 2024, Van's cryptocurrency wallets received approximately $53,275,939 in cryptocurrency assets from wire fraud schemes targeting United States citizens. The wallet transferred approximately $53,188,466 worth of the same cryptocurrency assets to other accounts off the centralized blockchain network," the Department of Justice said.

Arrest in Los Angeles and travel timeline

Federal authorities arrested 37-year-old Trung Nguyen Van at Los Angeles International Airport on September 24 after he entered the United States through the San Ysidro, California / Mexico pedestrian border entry point on September 22. Van was detained before boarding a flight to Taiwan, according to charging documents made public in the case.

The $16 million transfer tied to "Triangle"

Prosecutors say one victim transferred about $16 million in cryptocurrency between June and August 2024 to what the victim believed was a crypto investment platform called "Triangle." Those transfers were directly traceable to Van's cryptocurrency wallet, and the indictment charges him with money laundering for his role in the scheme.

Cryptocurrency flows: unhosted wallets and large transfers

According to court filings cited by the Department of Justice, after collecting victim funds the defendant moved assets into a private, unhosted crypto wallet off the centralized blockchain network. The DOJ statement quantifies the activity: Van's wallets received roughly $53.3 million in cryptocurrency assets from wire fraud schemes between February 2018 and December 17, 2024, and transferred approximately $53.19 million of those assets onward away from centralized exchanges.

Those totals include at least $24 million in crypto assets that the filing links specifically to known "pig butchering" schemes. The broader set of charges tied to these investigations stems from a wire fraud scheme prosecutors describe as involving more than $125,000,000 in cryptocurrency.

Pig butchering scams, the FBI's 2025 data, and international enforcement

The case against Van is part of a larger pattern prosecutors and law enforcement have highlighted: in so-called pig butchering scams, fraudsters cultivate online relationships via social media, dating sites, or messaging apps, build trust, and then direct victims to fake investment platforms. Rather than investing the funds, the scammers divert the cryptocurrency into accounts they control.

The Federal Bureau of Investigation's 2025 Internet Crime Report, cited in the same reporting, found that Americans lost almost $21 billion to cyber-enabled crimes in the prior year; investment scams accounted for 49% of all scam-related incidents and produced $8.6 billion in losses. The article also notes a February sentencing in which a Chinese national was sentenced to 20 years in prison in absentia for participating in an international pig butchering scheme that defrauded victims of more than $73 million — a development that followed the establishment of a U.S. federal task force called the Scam Center Strike Force team, designed to disrupt Chinese cryptocurrency scam networks.

What this means for technologists, policymakers, and victims

  • Technologists and security teams: the case underscores the role of private, unhosted wallets in laundering proceeds; visibility into on‑chain receipts and rapid tracing to unhosted destinations formed the basis of the DOJ accounting in this indictment.
  • Policymakers and enforcement officials: prosecutors are coupling criminal charges with cross-border enforcement actions and task-force efforts, as shown by the reference to the Scam Center Strike Force team and prior long-distance sentences tied to pig butchering networks.
  • Victims and the public: the charging documents illustrate the scale and method of these scams — long grooming online, followed by directed crypto transfers to named sites (for example, "Triangle") and subsequent inability to withdraw funds once custody shifted to scam-controlled wallets.

This case ties together a single, high-dollar loss — roughly $16 million transferred to an allegedly fraudulent platform over a three-month span — with larger patterns prosecutors flag: tens of millions received into specific wallets and then moved off centralized services. The indictment, the FBI's recent loss figures, and parallel international sentences together frame a central question that remains: will cross-border investigations and task-force work demonstrably reduce the flow of large sums into unhosted wallets used in pig butchering operations?

Source: BleepingComputer — Vietnamese man charged in $16 million 'pig butchering' crypto scam

CryptocurrencyEmerging ThreatsLaw EnforcementNation-State ActorsUnited StatesVietnamFinancial CrimesCrypto ScamWire FraudArrest
Related Intelligence

Continue Reading

Rows of computer servers and networking equipment on racks in a well-lit data center environment.

NetScaler Zero-Days Exploited in Wild, 50,277 Instances Exposed

A whopping 50,277 NetScaler instances are potentially vulnerable to two newly exploited zero-day flaws, CVE-2026-88771 and CVE-2026-88772, according to Palo Alto Networks' Cortex Xpanse telemetry. This alarming number was highlighted in Unit 42's threat brief, revealing a possible zero-day attack on NetScaler devices.

Analyst 207
Empty server room with rows of equipment racks and monitoring screens.

Citrix Rushes Patches for Exploited NetScaler Zero-Days

Citrix has rushed out patches for two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, which were being actively exploited by hackers, with a severity rating of 9.5 on the CVSS scale. The patches fix command-injection flaws that allowed remote code execution, and were released just days after researchers warned of the threats.

Analyst 207
Server room with rows of computer servers and storage equipment, some with dimmed or off status lights.

Kiteworks Disrupts Operations on Intel from US Authorities

Kiteworks took a proactive stance against a potential threat, issuing a rare advisory that led to a nine-hour shutdown of its systems after receiving credible intel from US authorities about a possible targeted attack. The precautionary measure was lifted two days later, with the company allowing customers to resume operations.

Analyst 207
Dutch police officer stands near courthouse with detained 24-year-old man.

Dutch Police Apprehend ShinyHunters Hacker in Amsterdam

Dutch police have made a significant breakthrough in the case against the notorious hacker group ShinyHunters, arresting a 24-year-old Amsterdam resident on September 15, who is set to face the Rotterdam District Court on September 29, 2026. The suspect, identified as Pepijn van d, is now one step closer to facing justice.

Analyst 207