Skip to main content
Mallory

Daren Li Sentenced in Absentia for $73M Pig-Butchering Crypto Laundering Scheme

enforcement-actioncryptocurrency-platform-riskidentity-impersonation-fraud
Updated March 21, 2026 at 02:36 PM5 sources
Share:
Daren Li Sentenced in Absentia for $73M Pig-Butchering Crypto Laundering Scheme

Get Ahead of Threats Like This

Know if you're exposed. Before adversaries strike.

A U.S. federal court sentenced Daren Li (42), a dual citizen of China and St. Kitts and Nevis, to 20 years in prison in absentia for conspiring to launder proceeds from an international “pig butchering” cryptocurrency investment/romance-baiting fraud that stole more than $73 million from victims. Li pleaded guilty in November 2024 and admitted that at least $73.6 million in victim funds was deposited into accounts controlled by his group, with a significant portion routed through U.S.-based shell companies; the operation was tied to scam centers in Cambodia and relied on a network of money launderers to move funds through U.S. bank accounts and onward to domestic/international accounts and crypto platforms to obscure origins.

Li was arrested in April 2024 at Hartsfield-Jackson Atlanta International Airport, but fled before sentencing in December 2025 after cutting off his ankle monitor; U.S. authorities have not publicly confirmed his current whereabouts and indicated they will work with international partners to return him to serve the sentence. The court also imposed three years of supervised release following imprisonment, and reporting noted that multiple co-conspirators have pleaded guilty, with Li described as the first sentenced defendant directly involved in receiving victim funds.

Timeline

  1. Feb 10, 2026

    U.S. court sentences Li in absentia to 20 years in prison

    A U.S. federal court sentenced Daren Li in absentia to 20 years in prison for conspiring to launder proceeds from Cambodia-based pig-butchering scams. Prosecutors said the operation stole over $73 million from victims and used shell companies, U.S. bank accounts, offshore transfers, and cryptocurrency conversions to hide the funds' origins.

  2. Dec 1, 2025

    Li cuts off ankle monitor and flees before sentencing

    Before sentencing, Li removed his electronic monitoring device and became a fugitive, leading to his later sentencing in absentia. Reports consistently place his flight in December 2025, though one source appears to conflict on the year.

  3. Nov 12, 2024

    Li pleads guilty to laundering proceeds of $73M crypto scam

    Daren Li pleaded guilty to conspiracy to launder proceeds from an international pig-butchering scheme that stole more than $73 million from victims. He admitted victim funds were funneled through U.S. shell-company bank accounts and then moved onward through other accounts and cryptocurrency platforms.

  4. Apr 12, 2024

    Daren Li arrested at Atlanta airport in pig-butchering probe

    U.S. authorities arrested Daren Li at Hartsfield-Jackson Atlanta International Airport as part of an investigation into laundering proceeds from Cambodia-linked cryptocurrency investment scams. The investigation involved the U.S. Secret Service, Homeland Security Investigations, and international partners.

See the full picture in Mallory

Mallory subscribers get deeper analysis on every story, including:

Impact Assessment

Who’s affected and how

Technical Details

Deep-dive technical analysis

Response Recommendations

Actionable next steps for your team

Indicators of Compromise

IPs, domains, hashes, and more

AI Threads

Ask questions and take action on every story

Advanced Filters

Filter by topic, classification, timeframe

Scheduled Alerts

Get matching stories delivered automatically

Related Stories

Southeast Asian “Pig Butchering” Scam Compounds and a US Money-Laundering Sentencing

Southeast Asian “Pig Butchering” Scam Compounds and a US Money-Laundering Sentencing

US authorities sentenced Chinese national **Jingliang Su** to **46 months** in federal prison for laundering proceeds from a Cambodia-based “**pig butchering**” fraud operation that stole **~$36.9M** from **174** US victims, according to reporting on the Justice Department case. Court filings described a three-stage playbook—social engineering outreach via social media/dating/texts, steering victims to **fraudulent crypto investment platforms**, and then blocking withdrawals or demanding additional “fees”—with Su acting as a financial conduit; the court also ordered **~$26.9M** in restitution. Separate reporting detailed the operational reality behind similar “pig butchering” scam centers in the **Golden Triangle** region of **northern Laos**, including the **Boshang compound**, where leaked internal chats and a whistleblower account described industrialized fraud run like a sales organization with quotas and scripted victim engagement. The material also described **forced labor and debt bondage** conditions—confiscated passports, coercion, and violence for rule-breaking or escape attempts—highlighting that many scam operators are themselves trafficking victims compelled to conduct online romance/crypto-investment scams at scale.

1 months ago
California Man Sentenced for Laundering Millions From Social-Engineering Crypto Heists

California Man Sentenced for Laundering Millions From Social-Engineering Crypto Heists

Evan Tangeman, a 22-year-old from Newport Beach, California, was sentenced to 70 months in prison after pleading guilty to a `RICO` conspiracy tied to a cybercriminal network that stole roughly **$230 million to $260 million** in cryptocurrency from victims. Prosecutors said Tangeman laundered at least **$3.5 million** between October 2023 and May 2025 for the group, which allegedly stole more than **4,100 Bitcoin** from a Washington, D.C., victim in August 2024 and used the proceeds to fund luxury homes, private jets, high-end vehicles, private security, and other lavish purchases. Authorities said the organization, identified by law enforcement as the **Social Engineering Enterprise**, targeted wealthy cryptocurrency holders using stolen and dark-web-sourced data, spoofed phone numbers, impersonation of Google and Gemini support staff, and remote-access tools including **AnyDesk** to obtain Bitcoin Core private keys. Investigators alleged the group then obscured the proceeds through mixers, exchanges, peel chains, pass-through wallets, and VPNs, while Tangeman also helped rent properties under false identities and destroy devices after arrests of key members. Another alleged launderer, **Kunal Mehta**, has also pleaded guilty and is awaiting sentencing.

2 days ago
Incognito Market Operator Sentenced to 30 Years for Darknet Drug Trafficking and Money Laundering

Incognito Market Operator Sentenced to 30 Years for Darknet Drug Trafficking and Money Laundering

A U.S. federal court sentenced **Rui-Siang Lin** (24), a Taiwanese national accused of operating the dark web narcotics marketplace **Incognito Market**, to **30 years in prison** for conspiring to distribute narcotics, **money laundering**, and conspiring to sell **adulterated/misbranded medication**. Prosecutors said Lin ran the marketplace under the alias **“Pharaoh”** and oversaw more than **$105 million** in narcotics sales, including large quantities of cocaine and methamphetamine and pills purported to be oxycodone, some allegedly **laced with fentanyl**; the sentence also included **five years of supervised release** and forfeiture of **more than $105 million**. Authorities described Incognito Market as a large-scale, “polished” online drug marketplace that supported cryptocurrency payments (including an internal payment mechanism described as **“Incognito Bank”**) and charged vendors a **5% commission**. Reporting cited platform scale estimates of roughly **1,800 vendors**, **400,000+ customer accounts**, and **~640,000 transactions**, with Lin exercising ultimate control over operations while living abroad (including in **St. Lucia**) and shutting the site down in **March 2024**; Lin was arrested in **May 2024** after arriving at **JFK Airport** en route to Singapore and pleaded guilty in **December 2024**. Investigators also obtained warrants (reported as in **2022** and **2023**) to access servers supporting marketplace operations, including transaction data, DDoS protection, and cryptocurrency processing.

1 months ago

Get Ahead of Threats Like This

Mallory continuously monitors global threat intelligence and correlates it with your attack surface. Know if you're exposed. Before adversaries strike.