Scam and kidnapping networks long associated with compounds along the Myanmar and Cambodia borders may be shifting operations toward Malaysia, according to recent reporting — a country that is also home to a significant concentration of crypto exchange employees. Two recent cases in Malaysia's Johor state, both involving Chinese nationals, are being cited as early evidence of the move: in the Country Garden Forest City development, police dismantled two telecom fraud rings operating out of the sprawling, largely underoccupied real estate complex.
Forest City's history makes it a plausible relocation target. The development was originally built as a massive residential and commercial complex aimed at Chinese buyers, but chronic underoccupancy has left large stretches of it economically idle — the kind of low-visibility infrastructure that scam operations elsewhere in the region have historically exploited.
Part of a Wider Enforcement Squeeze
The apparent relocation follows sustained pressure on the networks' traditional bases. In April 2026, the U.S. Department of Justice's Scam Center Strike Force launched a crackdown targeting the entire lifecycle of these operations — the compounds where trafficking victims are held captive, the digital infrastructure used to defraud victims, and the financial networks used to launder stolen cryptocurrency. That was followed in July by five civil forfeiture complaints from federal prosecutors seeking to recover more than $25 million in stolen crypto linked to fraud targeting U.S. and Canadian residents, with money movers in those cases already traced back to Southeast Asia, including IP addresses in Malaysia.
A Networked, Franchised Criminal Economy
A United Nations report on the region describes how once-separate scam syndicates have merged into a single transnational ecosystem, sharing financial networks, technology and specialized services rather than operating as isolated groups. The report characterizes the structure as a kind of corporate franchising model, in which core groups license capabilities — laundering pipelines, recruitment funnels, fraud platforms — to affiliated operators who deploy them independently. Regional analysis from the ISEAS–Yusof Ishak Institute has also flagged the Sulu and Celebes Seas — the maritime triangle connecting Indonesia, Malaysia and the Philippines — as an emerging smuggling corridor running in parallel with the networks' digital operations.
Related: Fake Hyperliquid Google Ad Drains About $550,000 From Users
Why Crypto Exchanges Are Watching
The Malaysia connection matters to the crypto industry specifically because of who lives there. A large share of exchange back-office and operations staff across the region are based in Malaysia, and security researchers have repeatedly warned that scam networks with this level of coordination don't limit themselves to retail victims — employees with access to exchange systems or customer data have become targets for coercion and social-engineering schemes in their own right. If the shift toward Malaysia holds, exchanges with meaningful headcount in the country may need to treat physical-security risk to staff as part of the same threat model they already apply to smart-contract exploits and phishing campaigns.
