The compound, the script, and the wallet that finally went quiet
An international sweep in late April pulled 276 people out of pig butchering scam centers. The script those workers ran is older than crypto. The room they ran it from is what changed.
The room you should picture is not the one you think.
It is not a basement. It is not a kid in a hoodie. It is a converted office building, often in a special economic zone in Southeast Asia, with fluorescent lights and rows of cheap desks and a phone in front of every chair. Sometimes two phones. The workers are sometimes there by choice. Sometimes they are there because someone took their passport. The script is taped to the monitor. The script tells them what to type when the woman in Ohio asks if this is real.
That is the room. On April 29, 2026, the U.S. Department of Justice and a coalition of foreign police forces announced they had walked into nine of those rooms and walked 276 people out of them. Dubai police made 275 of the arrests. Thai authorities made one. The Southern District of California unsealed federal wire fraud and money laundering charges against six people. Four were named: Thet Min Nyi, a Myanmar national, and three Indonesian nationals, Wiliang Awang, Andreas Chandra, and Lisa Mariam. Two more remain fugitives. The DOJ tied them to three front entities running the compounds. Ko Thet Company, also known as Pixy. Sanduo Group. Giant Company.
Read those names slowly. They are not crypto names. They are not blockchain names. They are shell company names. The crypto part of this story is what comes out of the building. The crime is the building.
I want to walk you through what happened inside it, because the woman in Ohio is the reader. She is the reason this column exists.
She met him on a dating app. Or she met him in a wrong-number text. Or she met him in a Facebook group for people who like hiking. The opening line was always polite. He apologized for bothering her. They talked for a week before he mentioned anything about money. They talked for a month before he mentioned trading. By then they had voice-noted each other. By then she had seen photos of his apartment in Singapore, photos of his dog, photos of his lunch. She knew him.
She did not know him. She knew the script. The script is the machine. Everything else is housing.
When he finally mentioned the platform, he did not push. He talked about it the way a person talks about a hobby. He showed her his dashboard. The dashboard was beautiful. Charts that moved. Numbers that climbed. A withdrawal button that worked the first time, when she put in two hundred dollars and pulled out two hundred and forty.
That withdrawal is not a glitch. It is the most important line in the script.
After that she sent more. The dashboard kept climbing. When she tried to withdraw a larger amount, there was a tax. There was a fee. There was a verification deposit. Each obstacle came with a sympathetic message from the man she thought she loved. He was frustrated too. He would help her cover it. He sent her a screenshot of his own balance going up.
Picture the dashboard. It does not exist. It is a webpage. The numbers on it are typed in by a worker in the compound. The worker has a spreadsheet that tells him what numbers to type for which victim and when. The worker is twenty-three. He has not slept. He is hitting his quota. If he does not hit his quota a man at the back of the room will make a phone call.
That is the room.
The money does exist. Hers, anyway. It went from her bank to a U.S. account she was told belonged to a brokerage. The account belonged to a money mule, sometimes a person, sometimes a shell. From there the dollars converted to stablecoins, the digital tokens pegged one-to-one to the dollar that move on blockchains the way email moves on the internet. Stablecoins are the carrier wave of this entire industry. They are how the money leaves America without leaving a wire.
From the stablecoin the funds hopped. Through exchanges that did not check hard. Through mixers, which are services designed to break the link between where money came from and where it went. Through wallets controlled by people whose names appear on those Southern District of California charging documents.
The blockchain shows the path. That is the part the FBI keeps repeating, and they are right. Crypto is not a perfect hiding place. It is a public ledger. Every hop is recorded. The tracing is hard but it is not magic. What is hard is the jurisdiction. The wallet sits on a chain that does not care about borders, but the person holding the keys sits in a building in a country whose police may or may not pick up the phone.
This week, in Dubai, they picked up the phone.
According to the FBI's 2025 Internet Crime Report, Americans lost $11.3 billion to crypto fraud last year. That is more than half of all reported internet crime losses. Read that number again. The FBI also says its Operation Level Up program, the one that calls victims while they are still being scammed, has notified roughly 9,000 people and saved an estimated $562 million as of this April. Both numbers are true. Both numbers can be true.
The compound is what makes both numbers possible. It is a factory. It runs three shifts. The script is honed. The dashboard is honed. The withdrawal-that-works is honed. The romance is honed. The compound exports a manufactured experience the way another factory exports shoes.
I spent years inside crypto rooms. Not these rooms. The other ones. The Discord servers and the Telegram groups where founders talked about decentralization the way people talk about religion. I want to tell you something I learned the slow way. The technology is not the crime. The technology is the delivery mechanism. The crime is what the crime always was. A confidence game. A long con. A patient relationship that ends with a wire.
What changed is the industrialization. One con artist used to mean one victim at a time. The compound means a hundred workers, a thousand conversations, a script refined by feedback loops, an A/B test on which opening line converts better. The compound is a call center for grief.
Six people were charged this week. Two hundred and seventy-six people were arrested. Nine compounds were dismantled. Now do the ugly math. There are more than nine compounds. There were more than nine compounds last year. There will be more than nine compounds next year. The DOJ knows this. That is why Assistant Attorney General A. Tysen Duva said fraudsters cannot operate with impunity no matter where they reside, and U.S. Attorney Adam Gordon said global crime now faces global justice. Those sentences are doing real work, but they are also doing aspirational work. The buildings are easy to rebuild. The script is already written.
Here is what I want the woman in Ohio to know. Not the one in this story. The one reading it.
If you are talking to someone you have not met in person, and they have shown you a trading platform, and the platform let you make a small withdrawal, you are not in a relationship. You are in a building. The building is in another country. The man you are talking to is reading from a page taped to a monitor. The dashboard is a webpage. The first withdrawal worked because the script said it had to. The next one will not.
Do not send the verification fee. Do not send the tax. Do not send anything. Call the FBI's IC3 portal. Call Operation Level Up. The number that answers is the only number in this entire story that is not a script.
He was not in love with her. He was on shift.
The wallet went quiet because the building got raided. That is the only reason a wallet like that ever goes quiet.
- U.S. Department of Justice press release | April 29, 2026 | Announcement of pig butchering enforcement operation, charges in Southern District of California
- FBI Internet Crime Complaint Center (IC3) 2025 Annual Report | 2026 | Crypto fraud loss figures ($11.3B); total internet crime losses ($20.9B)
- FBI Operation Level Up program updates | April 2026 | Victim notification and savings figures (~9,000 victims, ~$562M)
- Southern District of California unsealed indictment | April 29, 2026 | Charges against Thet Min Nyi, Wiliang Awang, Andreas Chandra, Lisa Mariam, and two fugitives; named entities Ko Thet Company (Pixy), Sanduo Group, Giant Company
- FinanceFeeds | April 30, 2026 | Original news report
- White House Executive Order on cybercrime priorities | March 6, 2026 | Policy context
- DOJ National Fraud Enforcement Division announcement | January 8, 2026 | Policy context
Editorial Notice
MarkTell is a true crime publication about financial fraud. Some scenes, dialogue, and sequential details are reconstructed from court filings, enforcement actions, news reports, and public records. Where the public record does not provide exact details, editorial reconstruction is used to convey the documented pattern of events. Names of private individuals may be changed to protect identity. All factual claims are sourced to public documents cited in the Evidence Trail above. MarkTell does not provide investment, legal, or financial advice. Nothing published here constitutes a recommendation to buy, sell, or avoid any investment. Allegations described in active cases have not been adjudicated and defendants are presumed innocent until proven guilty. Readers should conduct their own due diligence before making financial decisions.