Chinese national extradited to US over alleged laundering of crypto scam money
Zheng Zhao was arraigned in the Central District of California on a charge of conspiracy to commit money laundering. The DOJ says more than $36.9 million in victim funds was moved to an account in the Bahamas and on to a digital asset wallet in Cambodia.
Zheng Zhao, 44, a Chinese national, was arraigned on 23 October 2026 in the Central District of California after being extradited from the Netherlands, the US Department of Justice (DOJ) said. He was charged in August 2025 with conspiracy to commit money laundering. If convicted, he faces a maximum of 20 years in prison. The charge is an allegation, and he is presumed innocent unless proven guilty.
According to the DOJ, co-conspirators ran a cryptocurrency investment scam from scam centers in Cambodia. They contacted victims through social media, phone calls, text messages and dating sites, and used fake websites made to look like cryptocurrency trading platforms. The government identified 174 US victims.
The DOJ says co-conspirators laundered victim money through US shell companies, international bank accounts and digital asset wallets. More than $36.9 million in victim funds was transferred from US bank accounts controlled by co-conspirators to a single account at Deltec Bank in the Bahamas. The funds were converted to the stablecoin Tether (USDT) and sent to a digital asset wallet in Cambodia.
Eight co-conspirators have pleaded guilty so far, the DOJ said. Two of them, ShengSheng He and Jingliang Su, each pleaded guilty to conspiracy to operate an unlicensed money transmitting business and were sentenced to 51 months and 46 months in prison. The US Secret Service led the investigation. The DOJ's Office of International Affairs worked with Dutch authorities on the arrest and extradition. The case is part of the DOJ Criminal Division's Cyber-Enabled Scam Initiative.
Why it matters to AML professionals
Investment scams run from overseas scam centers need ordinary bank accounts in the victims' country to collect money before it moves offshore. AML professionals at banks are often best placed to spot these collection accounts, and at banks receiving the funds, to spot large inbound flows that are quickly converted into stablecoins. Cases like this show that the accounts used to move scam money, not only the scammers, are a target for prosecutors.
Red flags in this case
- A newly opened business account receives many incoming payments from unrelated individuals, followed by large outgoing wires abroad
- A customer says they are investing in cryptocurrency through a platform introduced by someone they met online or on a dating site
- Business accounts with little real operating activity send funds to a single overseas account in round or near-identical amounts
- Incoming funds are converted to stablecoins and sent to external wallets soon after they arrive
If this landed in your queue
- Map the flow of funds: identify the senders, the receiving accounts and the overseas beneficiary, and check whether several accounts send money to the same destination
- Review the account holder's stated business against the activity, and request documents that explain the incoming payments
- Check blockchain analytics or the crypto platform's records for wallet addresses linked to known scam activity, where available
- If the activity is unexplained, escalate for a suspicious activity report and consider contacting the victims' banks through the appropriate information-sharing channels
Key terms
- Scam center
- A compound, often in Southeast Asia, where groups run online fraud schemes such as fake investment platforms at large scale.
- Stablecoin
- A cryptocurrency designed to hold a steady value, usually tied to the US dollar; Tether (USDT) is one example.
- Extradition
- The formal process by which one country hands over a person to another country to face criminal charges.
Interview angle
How would you identify an account being used to collect money for an overseas investment scam?
Describe the pattern: many small inbound payments from unrelated people, little genuine business activity, and fast outbound transfers abroad or into crypto. Explain how you would confirm it with customer contact, documents and network analysis, and when you would file a SAR.
Sources
Go deeper on AMLift
Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.
Report an error
Every report is checked against the official source. If we got something wrong, the story is corrected.