Operation Level Up: The FBI Crackdown on Pig Butchering Compounds

For five years, the pig butchering industry operated out of fortified compounds in Myanmar, Cambodia, and Laos. Trafficked workers - often locked inside - ran romance and investment scams targeting Americans through dating apps, social media, and SMS. Victims sent billions of dollars in cryptocurrency to fake trading platforms believing they were earning returns. The FBI estimated US losses topped $5 billion a year. For most of that period, US law enforcement had no realistic way to reach the operators. That changed in 2026.

Operation Level Up is the FBI's answer to the first half of that problem. Launched in January 2024 with the Secret Service, it traces money moving to scam-controlled crypto wallets, finds the Americans sending it and calls them before they send more. By the spring of 2026 the FBI had warned 8,935 people this way. Seventy-seven percent of them did not know they were being scammed. The bureau estimates the calls prevented $562 million in losses.

The second half, reaching the operators, fell to a separate unit. In November 2025 the Justice Department set up the Scam Center Strike Force with the FBI, the Secret Service and the Treasury. On 23 April 2026 it announced that it had restrained, meaning frozen, more than $701 million in crypto tied to the scam centres and taken down 503 fake investment websites. The same week, police in Dubai and Thailand raided nine scam centres linked to a San Diego case and arrested 276 people: 275 in Dubai, one in Thailand.

The operational core of pig butchering is the compound. These are walled, often prison-like facilities staffed by trafficking victims forced to run scams under threat of violence. Each scammer operates dozens of fake personas at once, building "relationships" with US targets over weeks or months before introducing the fake investment platform. The compounds have professional structure: HR departments, training programs, and managers who get bonuses for hitting target revenue numbers. The largest compounds employ thousands of trafficked workers and process tens of millions of dollars per month.

The 2026 cases did something new: they named the managers and recruiters who run the compound floors, not just the launderers at the American end. In March 2026, a grand jury in the Southern District of California indicted Thet Min Nyi, a 27-year-old Burmese national known by the alias "Pixy," for wire fraud and money laundering conspiracy. Thet Min Nyi was an alleged manager and recruiter for the Ko Thet Company, an organization running multiple scam compounds in Myanmar. He had been actively recruiting workers and managing operations.

In April 2026, two criminal complaints in the same Southern District charged three Indonesian nationals - Wiliang Awang (23), Andreas Chandra (29), and Lisa Mariam (29) - plus a fugitive co-conspirator with wire fraud conspiracy. The charges connected to two separate scam organizations: Sanduo Group and Giant Company. Awang, Chandra, and Mariam were the operational layer above the trafficked scammers - the people who managed the floor, set quotas, and disciplined workers.

Days later, the DOJ charged two Chinese nationals, Jiang Wen Jie (also known as Jiang Nan) and Huang Xingshan (also known as Ah Zhe and Huang Xing Saan), for their role running the Shunda scam compound in Min Let Pan, Myanmar. According to the indictment, the two were planning to open a second compound in Cambodia after Burmese authorities seized the first compound in November 2025. The crackdown on Myanmar scam infrastructure was forcing operators to relocate. The DOJ wanted to make sure they could not.

The $701 million announced in April was restrained crypto, frozen with the help of exchanges and court orders, not money already handed back. Recovery for individual victims is slow and partial: the funds go through forfeiture, the court process by which the government takes legal ownership of criminal proceeds, and then through restitution processes that often take years. But the seizures themselves represent operational damage. Every dollar pulled out of the compound supply chain is a dollar that cannot be reinvested in next quarter's scams.

The compounds work like this. A US victim, typically an older adult or a divorced professional, gets contacted on a dating app by an attractive person claiming to be from their general region. The conversation moves to private messaging. Weeks of relationship-building follow. Eventually the "partner" mentions they have been making excellent returns trading cryptocurrency on a platform a friend recommended. They walk the victim through opening an account on a fake exchange that mimics a real one. Initial small deposits show fake gains. The victim deposits more. At some point, when they try to withdraw, they discover they need to pay tax on the gains, then a withdrawal fee, then an "anti-money-laundering deposit." Each new payment is real. The "gains" are not. Eventually the platform vanishes or the "partner" disappears.

The financial brutality is matched by physical brutality on the worker side. Trafficked compound workers are often Chinese, Vietnamese, or Filipino nationals lured by fake job ads promising customer service work in Cambodia or Thailand. Once across the border, their passports are confiscated and they are taken to compounds. They are taught the scam scripts and forced to work twelve-hour days against revenue quotas. Failure or escape attempts result in beatings. The compounds often operate behind active corruption with local officials.

Cambodia's response has finally accelerated. In late April 2026, Cambodia's parliament passed the country's first law specifically targeting scam compounds. Convictions for running such an operation now carry five to ten years in prison and fines up to $250,000. The law also targets people who provide infrastructure - building owners, telecom resellers, payment processors. Whether enforcement matches the law is the open question. Cambodia has a long history of selective prosecution. But the legal structure is finally in place.

Android banking trojans uncovered during the investigation revealed even more sophisticated infrastructure. One trojan, discovered to operate from multiple locations including the K99 Triumph City compound, has been used since at least 2023 for real-time surveillance, credential theft, data exfiltration, and financial fraud against victims who installed seemingly legitimate apps. The compounds are not just call centers. They are full-stack cybercrime operations.

For the 8,935 victims warned by Level Up, the news is mixed. They were saved from sending more money. Some who had already sent funds will recover partial amounts through forfeiture distributions. Most will not recover the bulk of their losses. The total US victim population is at least an order of magnitude larger - thousands more US citizens are still actively being scammed by surviving compounds in Myanmar and the Philippines.

The crackdown kept going after the spring. In late May 2026 FBI Director Kash Patel grouped the cases under the name Operation Blackout, alongside the bureau's forfeiture action against the Prince Group, the Cambodian conglomerate accused of running compounds on an industrial scale, over 127,271 bitcoin. In September 2026 the Strike Force seized Telegram channels and wallets used by Xinbi Guarantee, a Chinese-language marketplace that supplies the compounds, and spent two weeks in Madagascar helping local police disrupt 13 Chinese-run scam compounds, where nearly 400 people were arrested. That announcement put the Strike Force's total restrained since November 2025 at about $938 million.

Operation Level Up is not a finished operation. It is a posture change. US law enforcement has demonstrated it can identify victims in real time, freeze funds before they leave the US financial system, and indict overseas operators by name. The 276 arrests are the visible part. The deterrent effect is the bigger part. Compound operators previously calculated that geographic distance plus diplomatic friction made them effectively untouchable. That calculation no longer holds.