Thai-FBI Operation Recovers $432,000 in Crypto From Alleged European Hacker

Authorities in Thailand have successfully recovered more than $432,000 (14 million baht) in stolen digital assets from an alleged Eastern European cybercriminal who had been hiding in Phuket, officials announced Wednesday.

Lt. Gen. Suraphon Prempoot, who leads Thailand's Cyber Crime Investigation Bureau (CCIB), disclosed that "Operation 293" resulted in the seizure and return of $320,000 worth of crypto to Thai victims, according to a local media report.

The Federal Bureau of Investigation initially tipped off Thai investigators that a suspect from an Eastern European country bordering Asia had escaped to Thailand.

"This operation shows that even sophisticated hackers cannot hide behind digital anonymity," Suraphon said, as cited in the report.

The alleged hacker deployed malware that infiltrated victims' devices to capture authentication keys and seed phrases, critical access credentials for crypto accounts.

After stealing the credentials, the suspect moved victim funds into Tether’s stablecoin $USDT and Bitcoin, then dispersed the assets across numerous digital wallets, according to the report.

Authorities ultimately identified six Thai nationals who fell victim to the operation, with aggregate losses surpassing 100,000 (roughly 3.2 million baht), the report says.

Investigators reportedly worked with Tether to freeze the stolen $USDT and later teamed up with Bangkok-based crypto exchange Bitkub to trace smart contracts and secure the assets.

Officials moved 432,000 $USDT into a CCIB-controlled custody wallet before distributing recovered funds to two victims on Monday.

Decrypt has reached out to the Royal Thai Police, Tether, and Bitkub for further comment.

Thailand's crypto enforcement crackdown

Thailand has become a hub for both crypto fugitives seeking refuge and authorities cracking down on digital asset crimes.

Just last month, Thai police captured Liang Ai-Bing, a Chinese national accused of running an alleged $31 million Ponzi scheme in 2023 disguised as a DeFi platform called FINTOCH.

The scheme falsely claimed ties to Morgan Stanley and used a fake CEO, “Bob Lambert,” whose photo was actually actor Mike Provenzano, allegedly defrauding nearly 100 Chinese investors before collapsing.

In early October, Bangkok authorities arrested Portuguese national Pedro M. on suspicion of allegedly orchestrating $580 million in crypto and credit card fraud across multiple jurisdictions.

Thai police dismantled the "Lungo Company” in September, a criminal network that allegedly defrauded more than 870 South Koreans of $15 million through romance scams, fake lottery schemes, and fraudulent crypto investments.