Nearly $37 million was stolen from 174 U.S. victims, prosecutors say.
A Chinese national extradited from the Netherlands has been arraigned in California for his alleged role in an international cryptocurrency investment scam that prosecutors say took nearly $36.9 million from 174 victims across the United States. The defendant, identified in court filings as 44-year-old Zhen Zhao, was charged in August 2025 with conspiracy to commit money laundering and faces a maximum sentence of 20 years in prison if convicted.
Zhen Zhao, extradition, and the scope of the operation
Prosecutors say Zhao worked with accomplices in the United States and Cambodia to trick victims into transferring large sums of money to attacker-controlled accounts, claiming the funds would be invested in digital assets. Eight accomplices in the same international ring have already pleaded guilty; two of those accomplices have been sentenced to 51 months and 46 months in prison. The case reached U.S. courtroom steps only after Zhao was extradited from the Netherlands and arraigned in California.
Pig butchering and romance baiting: the recruitment and deception techniques
The frauds at the center of the indictment are described by prosecutors as “pig butchering” or romance baiting scams. In these schemes, “cybercriminals contact targets through social media, dating sites, and messaging apps, build trust, and lure them into fake investment schemes, stealing their money instead of investing the funds as promised,” the public record says. The criminal ring allegedly contacted targets across the United States via unsolicited text messages, social media, phone calls, and online dating services, promoted fraudulent digital-asset investments, and falsely told victims their funds' value had increased while the money was being stolen.
The Department of Justice summarized one key element of the deception: “The co-conspirators created fake websites that resembled real cryptocurrency trading platforms and convinced victims to send funds through the fake websites for investments.” Victims, believing they were investing, moved money into accounts controlled by the fraudsters.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadHow the money moved: Deltec Bank, Axis Digital Limited, USDT, and Cambodia
According to prosecutors, more than $36.9 million was transferred from U.S. bank accounts to an account at Deltec Bank in the Bahamas that had been opened under the name Axis Digital Limited. The complaint describes a multi-step laundering process: “Zhao and other co-conspirators arranged for Deltec Bank to convert victim funds to the stablecoin Tether (USDT) and to transfer the converted funds to a digital asset wallet controlled in Cambodia. From there, co-conspirators in Cambodia transferred the USDT to the leaders of scam centers throughout the region.”
Those transfer steps—U.S. bank accounts into a Bahamian bank account, conversion to a widely used stablecoin, and onward transfer to wallets controlled in another country—form the financial backbone prosecutors allege allowed the scheme to move and hide the proceeds.
Wider context: the scale of investment fraud and how defenses are measured
The Zhao case sits against a much larger backdrop of investment fraud in the United States. According to the FBI's 2025 Internet Crime Report, investment scammers stole over $8.6 billion last year from 72,984 complaints, up from $6.5 billion in 2024. Those totals underscore the size and growth of the category prosecutors tie Zhao’s conduct to.
The public record also includes observations about defenses and detection: “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.” Separately, the Blue Report 2026 is cited as measuring defenses “technique by technique across 338 million simulations run in customer production environments.” Those references frame the operational challenge: initial access and social-engineering success can outpace standard prevention metrics.
What this means for technologists, policymakers, and the public
- Technologists and security teams: Expect attention to post-access controls and transaction-monitoring tied to digital-asset conversions; the record here specifically ties conversion at a commercial bank to Tether (USDT) and onward transfers to foreign wallets.
- Policymakers and regulators: The transactions described—U.S. customer funds moved into an account at Deltec Bank in the Bahamas opened under Axis Digital Limited and converted to USDT—highlight cross-border banking relationships and stablecoin conversion as concrete places for regulatory scrutiny.
- End users and the public: The tactics used—unsolicited texts, social media contact, phone calls, and online dating services—are the same channels prosecutors say led victims to fake trading websites and attacker-controlled accounts; awareness of these specific vectors is central to avoiding similar losses.
The case combines familiar elements—romance-baiting recruitment, counterfeit trading sites, and the use of stablecoins—with cross-border banking conduits. Prosecutors have obtained guilty pleas and prison sentences for some co-conspirators, and the defendant now faces prosecution after extradition, but the FBI’s national loss figures show this form of crime continues at scale. Will prosecutions and enforcement of the financial links described—Axis Digital Limited at Deltec Bank and the conversion to USDT—change that trajectory? The records in this case lay out the mechanisms; whether they prompt structural responses remains the next observable fact.