Rich by Coin

Thai Authorities Partner With Private Sector To Recover $432,000 in Stolen Crypto

Thai authorities recovered approximately 432,000 USDT stolen from multiple victims in a landmark public-private collaboration. The operation, conducted in November 2025, involved the Cyber Crime Investigation Bureau (CCIB) with Binance, Bitkub, and Tether, and was supported by TRM Labs. The effort demonstrates how blockchain analytics, cross-border cooperation, and rapid action can trace illicit funds and enable restitution.

The case began when a victim installed malware, believed to have originated from a phishing link on an investment-related site, that sought sensitive data including Google Authenticator backups, seed phrases, and wallet recovery words. Armed with these credentials, the attacker gained full control of the victim’s cryptocurrency trading accounts, converting assets into USDT (excluding Bitcoin) and transferring them into prepared wallets. Initial losses totaled about 93,000 USDT and 2.5 BTC, with six additional victims identified later. Investigators determined the attacker was a foreign national from an Eastern European country, and the malware campaign likely originated from phishing pages impersonating legitimate investment platforms. Using TRM’s blockchain tracing tools, CCIB analysts mapped the attacker’s movements across multiple wallets and exchanges. The stolen crypto was sold on peer-to-peer (P2P) markets and moved into a Perfect Money account, a payment service now discontinued but historically used for high-risk transfers. Despite the attacker’s attempts to fragment funds and conceal the trail, CCIB, Binance, and Bitkub investigators traced the flow of assets on-chain in real time and identified a cluster of wallets linked to the perpetrator. Once sufficient evidence was established, CCIB coordinated with Tether to freeze the suspect’s digital wallet transactions, stopping any further movement of funds and preventing cashouts. This swift freeze was instrumental — it locked the funds in place while technical teams prepared a recovery plan. 432,000 USDT was successfully moved from the attacker’s wallets to a secure, government-controlled wallet under CCIB management. This marked one of Thailand’s largest on-chain recoveries to date, an extraordinary example of the speed and precision achievable when technology and teamwork converge. Binance provided investigative support, assisting with wallet intelligence, compliance coordination, and exchange-level tracing. Bitkub contributed on-the-ground technical expertise to safeguard assets and facilitate secure transfer operations. Tether’s rapid response froze suspect wallets in near real time. TRM Labs’ blockchain analytics visualized the laundering network, analyzed fund flows, and supported evidentiary documentation for seizure orders. This layered approach — data, analysis, coordination, and action — underscores how blockchain intelligence enables meaningful, real-world enforcement outcomes. Following the recovery, CCIB initiated Thailand’s official restitution process. The recovered 432,000 USDT will be returned to victims in the form of stablecoins, preserving the value of their holdings and ensuring a transparent, on-chain return process. All funds are currently secured in a government-controlled, multi-signature cold wallet, pending final verification and court approval. The restitution process — returning stolen crypto in kind — represents an important milestone in the modernization of asset recovery frameworks worldwide. This case demonstrates key lessons for combating crypto-enabled financial crime: Speed and partnership save assets. The November 2025 CCIB–Binance–Bitkub–Tether investigation represents a milestone in global crypto enforcement. TRM Labs is proud to support CCIB and Binance in this case and in broader efforts to combat crypto-enabled financial crime. Together with global law enforcement and exchange partners, TRM continues to deliver advanced blockchain intelligence tools that enable investigators to trace illicit flows, recover stolen assets, and protect users worldwide. This case demonstrates what’s possible when technology, transparency, and teamwork intersect — a vision at the core of TRM’s mission to build a safer financial system through blockchain intelligence.