From the FinCrime Agent course
Want to do this for a living?
This is the kind of story financial-crime professionals act on every day. Learn the craft in Marco’s AML & Financial Crime course.
DOJ says $36.9m of scam proceeds passed through one Bahamas account into USDT
Prosecutors say victim money moved from US shell company accounts to a Deltec Bank account, was converted to Tether and sent to a Cambodian wallet. Zheng Zhao is charged and presumed innocent.
What happened
On 23 October 2026, the US Department of Justice (DOJ) said Zheng Zhao, a 44-year-old Chinese national, had been arraigned in the Central District of California after extradition from the Netherlands. He was charged in August 2025 with conspiracy to commit money laundering, which carries a maximum of 20 years in prison. He is presumed innocent.
According to court documents described in the release, co-conspirators contacted US victims through social media, phone calls, text messages, and online dating services, and promoted fake digital asset investments through websites that resembled real trading platforms. Victims were told their investments were growing when the money had been stolen. DOJ identified 174 US victims.
DOJ says more than $36.9 million moved from US bank accounts controlled by co-conspirators to a single account at Deltec Bank in the Bahamas. Zhao and others allegedly arranged for the bank to convert the funds to the stablecoin Tether (USDT) and send them to a wallet controlled in Cambodia. From there, co-conspirators allegedly passed the USDT to the leaders of scam centres in the region. Eight co-conspirators have pleaded guilty. The release makes no allegation against Deltec Bank.
Why it matters
The route DOJ describes uses ordinary banking at almost every step. Victims paid into US accounts, the money gathered in one offshore bank account, and the switch to crypto happened through a bank conversion rather than an exchange. Each institution on that path is likely to have seen only part of the picture.
For US banks, the visible part is the front end. The release says victim money passed through US shell companies, which suggests business accounts receiving many payments from unrelated individuals and sending them on to a single foreign account. That pattern is detectable without any crypto data.
For banks that offer fiat to stablecoin conversion, the case raises a harder question. A conversion request is also a destination. If the receiving wallet sits with scam centre networks, the conversion step is where a bank still has a chance to see it.
Practitioner angle
- Look for business accounts, especially recently formed ones, that receive many payments from unrelated individuals and send most of the money abroad to one account.
- Ask respondent banks in offshore centres whether they convert client funds to stablecoins, and how they screen and monitor the destination wallets.
- If your institution offers fiat to stablecoin conversion, run blockchain analytics on destination wallets before conversion, not only afterwards.
- Train fraud and complaints teams on the investment scam script in the release: contact through social media or dating services, a convincing fake trading site, and reported gains that never pay out.
Start with the front end. Pull the business accounts that send most of their inbound retail money to one foreign beneficiary and review the top ten.
Want to do this for a living?
Turn this weekly intelligence into a career. Marco’s AML & Financial Crime course takes you from curious to hireable.
AML & Financial Crime course →