In this November 6 crypto roundup, the U.S. Treasury has sanctioned 46 individuals and entities connected to international scam operations, including companies supporting Cambodia-linked Prince Group and a Madagascar-based fraud network. Separately, a former FBI agent has pleaded guilty to stealing approximately $2.47 million in cryptocurrency using credentials obtained through 35 federal investigations. The cases expose different routes through which criminal activity can exploit financial systems, although there is no established connection between them.
U.S. Treasury sanctions 46 targets linked to international scam networks
The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced 46 new designations on November 5, targeting individuals and businesses allegedly supporting transnational cryptocurrency fraud and money laundering operations.
The action includes four individuals and 41 entities connected to the previously sanctioned Prince Group Transnational Criminal Organization (TCO), alongside a Malaysian individual accused of managing a seperate network of scammers operating from Madagascar.
The 45 Prince Group-related targets were designated under Executive Order 13581, which addresses transnational criminal organizations. The additional individual was designated under Executive Order 13694, covering significant malicious cyber-enabled activities.
Treasury identified the Malaysian individual as Chui Kok Wa, whom it accused of leading an extensive network of scammers in Madagascar that targeted Americans. According to the department, the operation used cryptocurrencies and other digital technologies to defraud U.S. victims of more than $400,000 in equivalent value, including digital assets.
The larger designation package builds on previous actions against Prince Group leadership in October 2025 and June 2026. Treasury says individuals associated with the organization have generated billions of dollars in illicit proceeds through digital asset investment scams, romance fraud and other online schemes targeting victims internationally.
Those billions represent cumulative historical proceeds attributed to the network, not newly identified cryptocurrency transfers on November 5.
The latest sanctions focus particularly on the corporate structures supporting the organization. Treasury alleges that the newly designated individuals and entities helped maintain offshore companies, conceal beneficial ownership, provide administrative and financial services, and facilitate commercial activities for previously sanctioned executives.
The network extends across several jurisdictions, including Cambodia, Hong Kong, the British Virgin Islands, Singapore and Mauritius. Some of the identified companies operate in seemingly conventional sectors, including money lending, construction, logistics, property and other commercial activities.
The list is broad, and not every company named was described as operating a scam itself. That is where the designation reaches beyond the obvious operators.
The department also described how individuals connected to previously sanctioned Prince Group executive Chen Bo allegedly transferred property ownership and maintained control over businesses through associates and family members. Other targets include Qiu Yong, whose ownership interests connect British Virgin Islands companies with Hong Kong businesses, including money-lending operations.
The approach resembles the international enforcement efforts examined in DaveFinances’ coverage of an earlier West African scam-center crackdown involving 28 arrests and more than $11 million in potentially freezable funds. Both investigations highlight the importance of identifying the financial and corporate infrastructure behind cross-border fraud rather than focusing exclusively on individual scammers.
Under the new designations, property belonging to designated individuals and entities within the United States, or controlled by U.S. persons, must be blocked and reported to OFAC. Businesses owned directly or indirectly, individually or collectively, at least 50% by blocked persons are also subject to blocking requirements.
U.S. persons are generally prohibited from conducting transactions involving blocked property without authorization or an applicable exemption. OFAC also warns that sanctions violations can result in civil or criminal penalties, with civil enforcement potentially applying on a strict-liability basis.
Former FBI agent admits to stealing $2.47 million in cryptocurrency
In a separate case, former FBI agent Patrick Steven Yaroch pleaded guilty on November 5 to wire fraud and money laundering after using his access to federal investigative systems to steal approximately $2,474,380.66 in cryptocurrency.
According to the U.S. Department of Justice, Yaroch, 37, worked at the FBI’s Boston Division from 2017 through early 2025 before joining its Counterintelligence and Espionage Division in February 2025. His position gave him access to systems containing cryptocurrency credentials collected during federal investigations.
Beginning no later than December 2024, he used that access to steal digital assets from wallets controlled by subjects of various investigations and adversarial nation-state actors. The stolen assets also included cryptocurrency held in at least one wallet the goverment had created for an operational purpose.
Investigators identified approximately 100 fraudulent transfers involving credentials associated with 35 seperate FBI investigations. The total proceeds amounted to approximately $2.47 million.
Yaroch subsequently exchanged the stolen cryptocurrency for other digital assets and moved the proceeds through additional financial transactions to conceal their origin, nature and ownership.
The DOJ detailed one portion of the financial trail involving approximately $93,082 transferred to one of Yaroch’s accounts between November 25, 2025, and January 13, 2026. He then moved the funds between other accounts and used the money to cover personal debts, including credit cards, car payments and other loans. Funds recieved through these transactions formed part of the wider laundering scheme, rather than an additional loss on top of the $2.47 million figure.
The transfer trail was not one clean line from a wallet to a bank account, and that made the scheme harder to follow.
Yaroch’s actions also had consequences beyond the stolen cryptocurrency. The Justice Department said the conduct compromised multiple investigations involving criminal organizations and nation-state adversaries, affecting FBI employees’ ability to perform their duties and compromising sources and methods used in intelligence collection and criminal investigations.
It is a lot of access for one employee, and the consequences were not limited to the money.
The case reads less like an outside wallet hack and more like misuse of access that investigators had gathered for other cases. The DOJ disclosure does not identify a compromise of a cryptocurrency exchange or establish that an external attacker breached the FBI’s systems.
Yaroch is scheduled to be sentenced on March 4, 2027, and faces a maximum possible prison term of 20 years. The final sentence will be determined by a federal judge after considering the applicable sentencing guidelines and statutory factors.
Sanctions and insider access expose different crypto enforcement challenges
The two developments concern unrelated investigations, but they highlight different vulnerabilities in the financial infrastructure surrounding digital assets.
Treasury’s sanctions action attempts to disrupt the corporate relationships, ownership structures and financial facilitators that allegedly allow international scam organizations to maintain access to legitimate commercial and financial services. The FBI case, meanwhile, demonstrates how cryptocurrency credentials collected for legitimate investigative purposes can themselves become targets of insider abuse.
For cryptocurrency exchanges, custodians, banks and other financial institutions, the latest OFAC designations reinforce the importance of examining beneficial ownership and corporate relationships rather than relying exclusively on the names of direct counterparties. A company that is not individually listed may still fall under blocking requirements through its ownership by designated persons.
Asset restrictions also remain different from actual recovery. Previous USDT wallet freezes involving approximately $3.75 million illustrated how issuers can prevent transfers from identified addresses without automatically returning the assets to their original owners.
Similarly, tracing cryptocurrency movements does not necessarily establish who controlled the wallets or how much can ultimately be recovered. A recent investigation in which ZachXBT raised a suspected European cryptocurrency theft estimate above $133 million demonstrated the difficulty of connecting exchange withdrawals, intermediary wallets and subsequent laundering activity to a confirmed victim and financial loss.
Neither of the November 5 announcements establishes a new cryptocurrency market exploit or a fresh wave of blockchain transactions. Treasury’s multibillion-dollar figures concern the historical proceeds attributed to Prince Group-related operations, while the FBI case describes a theft scheme that began no later than December 2024.
The immediate developments are the expansion of sanctions against the corporate infrastructure supporting international fraud and the guilty plea of a former federal agent accused of exploiting sensitive investigative access. Both investigations now provide a clearer picture of how cryptocurrency-related criminal activity can extend well beyond the initial movement of digital assets.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.