Chen Zhi, the mastermind behind a vast network of forced-labor crypto scam compounds, is back in the US government’s crosshairs.

On Thursday, the US Department of the Treasury’s Office of Foreign Assets Control updated their sanctions list with 25 new crypto wallet addresses belonging to kingpin.

According to Chainalysis, a blockchain security firm, those wallets contain $780 million worth of Bitcoin attributed to Zhi and Prince Group, the Cambodian multinational central to Zhi’s schemes.

The action comes after the US Department of Justice indicted Zhi on wire fraud and money laundering charges on October 14 for directing Prince Group’s operation of forced-labor scam compounds across Cambodia.

Individuals held in the compounds are forced to engage in crypto investment fraud schemes, known as “pig butchering” scams, which have cost victims in the US and around the world billions of dollars.

Last year, pig butchering scammers stole over $4 billion, according to Chainalysis, a 40% increase from 2023.

In July, raids on scam compounds in Cambodia resulted in more than 1,000 arrests. Zhi, however, is still at large.

The new sanctions expand the scope of Zhi’s known crypto holdings, used in connection with Prince Group’s scamming and money laundering operations.

$15 billion seized

The same day the Department of Justice charged Zhi, it also announced it had seized $15 billion worth of Bitcoin tied to him, the largest forfeiture action in the department’s history.

According to the DoJ indictment, the funds can be traced to LuBian, previously one of the largest Chinese Bitcoin mining pools, where they were allegedly stolen in early 2021. LuBian was an operational arm of Zhi’s business empire.

In the days following the theft, LuBian spent over $40,000 worth of Bitcoin sending hundreds of transactions to the thief’s wallets, containing a message asking for the return of the funds and offering a reward.

According to an analysis from Elliptic, a crypto security firm, the theft appears to have happened due to a weakness in the algorithm LuBian used to generate its cryptographic keys, which was susceptible to brute-force attacks.

The stolen Bitcoin remained dormant until June 2024, when they were moved to new wallets, where they have remained since, Elliptic said.

It’s not clear how US authorities obtained the huge haul.

Tim Craig is DL News’ Edinburgh-based DeFi correspondent. Reach out to him with tips at tim@dlnews.com.