USDT trail helps uphold prison term in Hong Kong trafficking case

A Hong Kong appeals court has upheld a 56-month prison term for Ma Zhihao after investigators linked ransom payments from a human trafficking operation to a crypto exchange account registered in his name.

Caixin reported on Aug. 20 that the Hong Kong Court of Appeal rejected Ma’s request for a reduced sentence, leaving intact the punishment imposed over his role in a scheme that lured victims to Southeast Asia with fake job offers before some were confined and forced into scam operations.

Blockchain transaction records became a key part of the prosecution after Hong Kong police traced a ransom paid by the family of one victim. Investigators found that roughly 9,527 Tether (USDT) had been transferred to a cryptocurrency wallet specified by the criminals.

Police then tracked 8,127 USDT from the ransom to an exchange account opened using Ma’s real name and Hong Kong identity documents, according to Caixin. The funds were converted into roughly HK$63,000 and sent to Ma’s personal HSBC bank account.

The Court of Appeal said the transaction trail supported the finding that Ma had participated in the scheme and received proceeds from it. Judges also said his punishment would have been substantially heavier had the District Court not been restricted by its seven-year sentencing limit.

Blockchain records tied the ransom directly to Ma

The case involved five victims who were recruited between 2021 and August 2022 through false employment and business offers circulated on platforms including Facebook, Telegram and Instagram.

Recruiters advertised jobs at Cambodian casinos, assignments involving the purchase and transport of luxury handbags from Thailand, and work carrying expensive watches, according to case details reported by Hong Kong media. Some offers promised payments reaching tens of thousands of Hong Kong dollars.

Once a victim accepted an offer, members of the network helped arrange passports and airline tickets. After arriving in Southeast Asia, victims could instead have their phones and travel documents taken before being moved to compounds controlled by criminal groups.

One 20-year-old victim responded to a Telegram advertisement offering HK$20,000 for travelling to Thailand and buying luxury goods for resale in Hong Kong. After arriving in August 2022, he was transported to Myanmar’s KK Park, where criminals told him that he had been purchased and demanded $20,000 for his release.

His girlfriend eventually transferred more than 9,500 USDT, worth about HK$75,000 at the time, to secure his return. Investigators later followed most of that cryptocurrency through the blockchain to the exchange account associated with Ma.

The transparent transaction history gave police a record connecting the ransom wallet, the exchange account and the subsequent withdrawal into the traditional banking system.

Hong Kong police have since developed more specialized tools for such investigations. As previously covered by crypto.news, the Cyber Security and Technology Crime Bureau unveiled its CryptoTrace system in May 2025 after developing the platform with the University of Hong Kong.

CryptoTrace uses blockchain analytics and transaction visualization to help officers follow suspected illicit funds and identify connections between wallets. Police had already trained frontline officers on the system before its public unveiling, according to the earlier report.

Fake jobs sent victims into Southeast Asian scam compounds

Ma and his associates used several recruitment methods depending on the victim, with high pay serving as a recurring lure.

One man was offered work at a Cambodian casino for $300 per day with accommodation and airfare included. Another victim was persuaded to travel after receiving an offer connected to luxury goods, while a man with mild intellectual disabilities was drawn to Thailand through an online relationship and a promise involving a large cash payment.

Victims who reached the compounds faced different forms of coercion. Court proceedings described confiscated passports, threats, confinement and physical abuse, while some victims were forced to participate in online scams.

The man with an intellectual disability suffered particularly severe treatment after refusing to join fraud operations. Case details presented in Hong Kong court proceedings said he was handcuffed to a bed, subjected to electric shocks and later confined in a cage for several days. His family eventually paid HK$35,000 through Alipay before he was able to return to Hong Kong.

Another victim taken to Cambodia initially refused to conduct online scams, but Ma repeatedly pressured him and threatened the safety of the victim and his family, according to the agreed facts of the case. Cambodian authorities eventually rescued him after his mother contacted Hong Kong law enforcement.

Similar recruitment methods remain in use across Southeast Asian cybercrime compounds. On July 4, an investigation in India was opened after the family of a 24-year-old man said he had accepted a graphic design and data-entry job in Thailand before being taken to a scam compound near the Myanmar border.

Police in that case said the advertised job offered roughly 70,000 Indian rupees a month. After crossing into the compound, the man allegedly had his passport and travel documents confiscated and later told his family that captives were being forced to work long hours in online fraud operations.

Hong Kong human trafficking case followed years of recruitment scams

The Hong Kong prosecution emerged from a wave of cases reported from 2022 onward involving people recruited for supposed jobs in Thailand, Cambodia and other parts of Southeast Asia before being moved into guarded compounds.

Ma and another defendant, Cheung Man-wai, later admitted conspiracy to defraud in connection with the recruitment of five people.

During sentencing in November 2024, the District Court imposed a 56-month prison term on Ma for conspiracy to defraud after using seven years as the starting point before applying a reduction for his guilty plea. He also received a 28-month sentence after admitting a money-laundering charge, bringing his total imprisonment to 84 months, according to local court reporting.

Cheung, whose role was described as less central, received a 36-month prison sentence. The sentencing judge found that he nevertheless knew the operation involved human trafficking when he helped take one of the victims to the airport.

The District Court treated Ma as an important participant in a planned operation connected with an international criminal organization. All five victims eventually returned to Hong Kong after periods of confinement or coercion abroad.

Crypto payments have remained common in investigations involving Southeast Asian trafficking and scam networks. A February 2026 Chainalysis report found that crypto-linked trafficking payments increased 85% in 2025 across services tracked by the blockchain analytics firm, including labor recruiters associated with Southeast Asian scam compounds.

Chainalysis said tracked activity involved hundreds of millions of dollars across identified services, with stablecoins forming part of the payment infrastructure used by criminal networks and related laundering channels.

Authorities continue tracing crypto across scam networks

Law enforcement agencies have increasingly followed cryptocurrency transfers alongside bank accounts and other payment channels when investigating transnational fraud.

A July 2026 INTERPOL operation blocked illicit crypto transfers during a crackdown spanning 97 countries and territories. The operation resulted in 5,811 arrests, more than 31,000 blocked bank accounts and the interception of $293 million in illicit assets.

Thai investigators involved in the operation uncovered a laundering network suspected of processing romance-scam proceeds through cross-chain token swaps. One identified wallet had handled more than $122.5 million, according to INTERPOL data cited in the report.

Authorities identified more than 142,000 victims during the operation and used payment-blocking mechanisms to freeze suspicious fiat and cryptocurrency transfers before some funds could move further through laundering networks.

In Ma’s case, the blockchain trail led investigators from the USDT ransom payment to an exchange account carrying his identity information and then to the HK$63,000 transferred into his HSBC account, evidence the appeals court relied on when rejecting his request for a lighter sentence.