The Verdict: Judge Klausner Hands Down Maximum 20 Year Sentence In Absentia
The Empty Chair
Federal prosecutors confirmed that Li, 42, severed his GPS ankle monitor and fled his court-approved residence in the Central District of California late last year. U. S. Marshals have since elevated him to the status of a “major fugitive,” believed to be moving through Southeast Asia using non-biometric passports. The 20-year sentence reflects the sheer of the operation Li directed. Between August 2021 and April 2024, his network laundered over $73. 6 million in proceeds from “pig butchering” (Sha Zhu Pan) scams. These frauds targeted victims across the United States, draining life savings through fake cryptocurrency investment platforms before funneling the cash into a labyrinth of shell companies. Judge Klausner’s decision to impose the maximum penalty, even without the defendant present, sends a clear signal: the U. S. judicial system not pause for fugitives. The court also ordered three years of supervised release, should Li ever be recaptured, and finalized forfeiture orders exceeding $4. 5 million in seized assets, alongside his interest in multiple international bank accounts.
The Mechanics of the Laundromat
Li’s operation was not a passive recipient of funds; it was an industrial-grade laundering service for cybercriminal syndicates. According to the plea agreement signed on November 12, 2024, Li admitted to orchestrating a network that converted victim fiat currency into Tether (USDT) to obscure its origins. The process relied on a ” ” technique involving U. S. domestic banks. Li and his co-conspirator, Yicheng Zhang, directed “money mules” to register dozens of shell companies in California and other states. These entities, with generic names designed to mimic legitimate import/export or tech firms, opened business bank accounts solely to receive wire transfers from fraud victims. Once the money hit the U. S. accounts, Li’s team moved it rapidly. The funds were transferred to overseas accounts, primarily at Deltec Bank in The Bahamas. From there, the fiat was converted into USDT and dispersed to non-custodial wallets controlled by the scam ringleaders in Cambodia and Myanmar.
| Metric | Detail |
|---|---|
| Case Number | 2: 24-cr-00249 (Central Dist. of California) |
| Judge | R. Gary Klausner |
| Charge | Conspiracy to Commit Money Laundering (18 U. S. C. § 1956(h)) |
| Sentence | 240 Months (20 Years) |
| Laundered Amount | $73, 600, 000+ (Verified) |
| US Shell Volume | $59, 800, 000 processed domestically |
| Plea Date | November 12, 2024 |
| Fugitive Date | December 2025 |
Evidence and Admission
The Department of Justice secured Li’s guilty plea in late 2024 using a mountain of digital evidence. Investigators from the U. S. Secret Service and Homeland Security Investigations (HSI) linked Li to the scheme through encrypted communications on Telegram and WhatsApp. In these chats, Li explicitly discussed commission structures, 1% to 4% of the laundered volume, and provided instructions on how to bypass bank “Know Your Customer” (KYC). One serious piece of evidence involved a network of 74 distinct shell companies. Prosecutors demonstrated that $59. 8 million of the total $73. 6 million flowed directly through these U. S.-based fronts. Li personally monitored the flow of funds, frequently berating underlings when transfers were delayed or when banks froze accounts due to suspicious activity reports (SARs). The investigation also highlighted the role of Deltec Bank in The Bahamas, where Li maintained connections to facilitate the fiat-to-crypto conversion. This “off-ramping” of U. S. dollars into stablecoins broke the transaction chain, making recovery nearly impossible for victims once the conversion occurred.
The Co-Conspirator Connection
While Li remains at large, his primary lieutenant, Yicheng Zhang, remains in federal custody. Zhang, 39, was arrested in Los Angeles in May 2024 and is facing parallel charges. Evidence presented during Li’s plea hearings implicated Zhang in the direct management of the “ground crew”—the mules who physically opened bank accounts and conducted the initial transfers. The sentencing memorandum filed by the prosecution emphasized that Li was not a low-level mule a “tier-one facilitator.” His ability to coordinate between the scam centers in Southeast Asia and the banking infrastructure in the West made him a high-value target. The 20-year sentence is among the longest handed down for a standalone money laundering conspiracy linked to pig butchering, surpassing the sentences of direct fraudsters. Judge Klausner’s ruling leaves the case open only enforcement. The warrant for Li’s arrest is global, with Red Notices likely to be issued through INTERPOL. For the victims of the $73 million scheme, the verdict offers legal closure, yet the financial restitution remains tied to the seizure of assets that Li left behind.
The Escape: Defendant Li Severs GPS Monitor and Flees in December 2025
The Breach: December 2025
Federal agents received the alert in late December 2025. The GPS ankle monitor assigned to Daren Li, the architect of a $73. 6 million money laundering syndicate, had ceased transmitting. Law enforcement units mobilized to his court-approved residence in the Central District of California, the premises were empty. Authorities found the severed electronic monitoring device discarded inside the home. The escape occurred less than eight weeks before Li was scheduled to face final judgment for conspiracy to commit money laundering.
The U. S. Marshals Service immediately Li a major fugitive. His flight represents a significant failure in the pretrial supervision of high-net-worth defendants with international ties. Li, a dual citizen of China and St. Kitts and Nevis, had previously pleaded guilty on November 12, 2024. even with the severity of the charges and the massive financial resources at his disposal, he managed to exploit the conditions of his release. Investigators believe Li used a network of non-biometric travel documents and pre-positioned cryptocurrency assets to exit the United States within hours of destroying his tracker.
The Mechanics of Flight
Li’s escape was not an impulsive act. Evidence suggests a calculated departure funded by the very proceeds he admitted to laundering. Between 2021 and 2024, Li orchestrated the movement of millions through U. S. shell companies. While federal prosecutors seized significant assets upon his April 2024 arrest at Hartsfield-Jackson Atlanta International Airport, the nature of cryptocurrency allows for hidden liquidity. The Department of Justice confirmed that Li directed the conversion of victim funds into Tether (USDT), a stablecoin that can be accessed from anywhere in the world without traditional banking rails.
“Complex financial fraud schemes such as pig butchering present a clear and present threat to the financial infrastructure of the United States. Money laundering is serious to the success of these scams, allowing fraudsters to quickly move illicit proceeds.”
The fugitive’s dual citizenship complicates the manhunt. Li obtained citizenship in St. Kitts and Nevis in 2020 through the country’s Citizenship by Investment (CBI) program. Although St. Kitts authorities announced the “deactivation” of his passport in November 2024 following his guilty plea, intelligence reports indicate Li may possess alternative identification documents. The “Golden Passport” industry frequently allows individuals to acquire multiple identities, making border crossings difficult to track for Western law enforcement agencies.
Timeline of Events: From Arrest to Escape
The trajectory of the case shows a prolonged period of legal maneuvering that ended in the defendant’s disappearance. The gap between his guilty plea and the scheduled sentencing provided the window for his exit.
| Date | Event | Details |
|---|---|---|
| April 12, 2024 | Arrest | Li apprehended at Hartsfield-Jackson Atlanta International Airport. |
| May 20, 2024 | Indictment | Charged with conspiracy to commit money laundering alongside Yicheng Zhang. |
| Nov 12, 2024 | Guilty Plea | Li admits to laundering $73. 6 million and managing US shell companies. |
| Nov 18, 2024 | Passport Action | St. Kitts and Nevis authorities report deactivation of Li’s passport. |
| Dec 2025 | The Escape | Li severs GPS monitor and flees his California residence. |
Financial Infrastructure of the Escape
The capital required to facilitate an international escape of this magnitude is substantial. Li admitted to laundering at least $73. 6 million, with $59. 8 million funnelled directly through U. S. shell companies. These entities, frequently registered with generic names to avoid scrutiny, served as the primary intake valves for funds stolen from victims of “pig butchering” scams. Once the money entered the U. S. banking system, Li and his co-conspirators, including Yicheng Zhang, transferred the funds to overseas accounts, specifically targeting institutions like Deltec Bank in The Bahamas.
The conversion to USDT was the final step in the laundering pattern. This digital bearer asset is resistant to seizure once moved to unhosted wallets. Investigators suspect Li retained access to private keys holding untraced millions, providing him with the means to bribe officials, purchase transport, and sustain a life on the run. The Department of Justice noted in earlier filings that Li’s operation involved over 74 distinct shell companies, creating a labyrinth of transactions that remains only partially mapped.
The Manhunt Intensifies
Federal authorities have expanded the search radius to Southeast Asia and the Caribbean. Li previously resided in Cambodia and the United Arab Emirates, jurisdictions known for limited extradition cooperation with the United States. The U. S. Secret Service and Homeland Security Investigations are coordinating with Interpol to track his movements. The focus is on the digital trail. Agents are monitoring the blockchain for any movement of the USDT tokens linked to the wallets Li controlled. The activation of these funds would provide a geolocation pin for law enforcement, yet the fugitive has likely employed “mixers” or over-the-counter crypto brokers to obscure the source of his spending money.
The escape of Daren Li serves as a clear warning regarding the bail conditions for transnational financial criminals. The ability to sever a GPS tether and into a pre-arranged network of safe houses and foreign jurisdictions exposes the limitations of electronic monitoring for defendants with access to global crypto liquidity.
The Case: Criminal Docket 2:24-cr-00311-RGK and the $73.6 Million Indictment
Case File Fan-Out: Docket 2: 24-cr-00311-RGK
The following data points summarize the key elements of the prosecution’s case file as it stood when Judge R. Gary Klausner delivered the maximum sentence. 1. Docket Number: 2: 24-cr-00311-RGK. 2. Lead Defendant: Daren Li (aka “Devon”, “KG-PERFECT”, “RF”). 3. Co-Defendant: Yicheng Zhang (aka “Eason”). 4. Presiding Judge: U. S. District Judge R. Gary Klausner. 5. Primary Charge: Conspiracy to Commit Money Laundering (18 U. S. C. § 1956(h)). 6. Substantive Charges: 6 counts of International Money Laundering (18 U. S. C. § 1956(a)(2)(B)(i)). 7. Indictment Date: Unsealed May 16, 2024. 8. Confirmed Laundered Amount: $73. 6 million (directly attributed). 9. Broader Network Volume: $341 million (associated wallet inflows). 10. US Shell Companies Used: 74+ distinct entities. 11. Key Shell Names: SMX Beauty, SMX Travel, B&C Commerce. 12. Primary Offshore Bank: Deltec Bank & Trust (The Bahamas). 13. Laundering Vehicle: Tether (USDT). 14. Li’s Arrest Date: April 12, 2024 (Hartsfield-Jackson Atlanta International Airport). 15. Zhang’s Arrest Date: May 16, 2024 (Los Angeles). 16. Investigative Agency: U. S. Secret Service (Global Investigative Operations Center). 17. Prosecuting Body: CDCA & National Cryptocurrency Enforcement Team (NCET). 18. Sentencing Date: February 9, 2026. 19. Sentence Imposed: 20 Years Federal Prison (Statutory Maximum). 20. Current Status: Defendant Li is a fugitive (Red Notice active).
The Indictment: United States v. Li et al.
The indictment, originally returned by a federal grand jury in April 2024 and unsealed the following month, outlines a conspiracy spanning from August 2021 to April 2024. Federal prosecutors successfully argued that Li and Zhang did not facilitate transactions acted as the “financial nervous system” for multiple pig butchering syndicates operating out of Cambodia and Myanmar. The central charge, Conspiracy to Commit Money Laundering, hinged on the defendants’ specific intent to conceal the nature, location, source, ownership, and control of the proceeds. Unlike typical mules who might unknowingly move funds, the docket evidence, including encrypted chats from Telegram and WhatsApp, proved Li held a managerial role. He coordinated a network of “runners” to open U. S. bank accounts under the guise of legitimate businesses, specifically to receive victim funds. The prosecution’s case relied heavily on the affidavit of U. S. Secret Service Special Agent Chris Saunders. The affidavit detailed how Li monitored the flow of funds in real-time, directing subordinates to transfer money immediately upon receipt to prevent bank freezes. The government presented evidence that Li received a commission of approximately 1. 5% to 2% for every dollar laundered, a fee structure that incentivized high-velocity transfers.
The Financial Architecture: The “SMX” Shell Network
The mechanics of the laundering operation, as detailed in the forfeiture orders attached to the docket, reveal a three-stage process designed to sever the link between the victim and the criminal beneficiary. Stage 1: The Domestic Air Gap Li’s network incorporated dozens of shell companies in the United States. Two entities frequently in court filings were SMX Beauty and SMX Travel. These companies had no physical operations, no inventory, and no legitimate revenue. Their sole purpose was to provide a domestic routing number for victims. When a victim in a pig butchering scam was convinced to “invest,” they were not sending crypto directly to a wallet; they were wiring fiat currency to a “business” account at a major U. S. bank (e. g., Bank of America, Chase). This veneer of legitimacy bypassed initial fraud filters. Stage 2: The Offshore Hop Once funds hit the US shell accounts, Li’s team executed immediate international wire transfers. The primary destination identified in the docket was Deltec Bank & Trust in The Bahamas. Deltec, a bank known for its relationships with cryptocurrency companies (including Tether), served as the between the fiat and crypto worlds. The indictment specifies that Li and Zhang controlled specific accounts at Deltec, frequently opened under the names of other offshore entities like GTAL (Cambodia) Co., Ltd. Stage 3: The Tether Conversion Upon arrival in The Bahamas, the fiat currency was converted into Tether (USDT). This step was serious. USDT provides the stability of the dollar the mobility of cryptocurrency. Once converted, the funds were dispersed into unhosted wallets. Forensic analysis of the blockchain showed that one specific wallet cluster controlled by the conspiracy processed over $341 million in USDT, suggesting Li’s operation serviced multiple fraud rings simultaneously.
| Step | Entity/Action | Jurisdiction | Timeframe |
|---|---|---|---|
| 1 | Victim Wire Transfer ($30, 000) | USA (Domestic Bank) | T+0 Hours |
| 2 | Receipt by Shell Co. (e. g., B&C Commerce) | USA (California/Nevada) | T+2 Hours |
| 3 | International Wire to Deltec Bank | The Bahamas | T+24 Hours |
| 4 | Conversion to USDT (Tether) | Digital / Blockchain | T+26 Hours |
| 5 | Distribution to Cold Wallets | Cambodia / Myanmar | T+28 Hours |
The Role of Yicheng Zhang
While Li operated as the architect, co-defendant Yicheng Zhang (arrested in Los Angeles) functioned as the domestic operations manager. The docket indicates Zhang was responsible for the maintenance of the US shell companies. This involved recruiting “straw men” to act as signatories for bank accounts and managing the physical mail drops where bank correspondence was sent. Zhang’s role was pivotal in maintaining the “Domestic Air Gap.” When banks flagged accounts for suspicious activity (SARs), Zhang’s team would rapidly pattern to new shell companies, abandoning the burned accounts. Evidence presented during Zhang’s proceedings showed he directly received victim funds into personal accounts as well, a sloppy tradecraft error that helped investigators link him to Li. Zhang’s communications with Li, intercepted by law enforcement, discussed commission splits and the operational status of various bank accounts, providing the conspiracy element required for the 18 U. S. C. § 1956(h) charge.
The $73. 6 Million vs. The $341 Million
A point of clarification in the sentencing memorandum concerns the gap between the $73. 6 million and $341 million figures. * $73. 6 Million: This is the amount prosecutors could directly trace from specific, identified victims through the shell companies controlled by Li and Zhang and into the crypto wallets they managed. This figure formed the basis for the restitution orders and the sentencing guidelines calculation. * $341 Million: This figure represents the total volume of USDT that flowed through the specific wallet addresses identified in the investigation. The Department of Justice (DOJ) asserted that the additional ~$267 million likely represents proceeds from other unidentified victims or parallel fraud schemes using the same laundering infrastructure.
Sentencing Factors and The Escape
The sentencing on February 9, 2026, was heavily influenced by Li’s conduct after his initial guilty plea. Li had pleaded guilty in November 2024, admitting to the conspiracy. yet, his decision to cut his GPS tracker and flee his court-approved residence in December 2025—just two months prior to his scheduled sentencing—triggered an automatic enhancement. Judge Klausner’s imposition of the 20-year statutory maximum reflects not only the of the financial damage also the defendant’s contempt for the judicial process. The “in absentia” nature of the proceeding is rare in federal court and signals the judiciary’s intent to close the docket administratively while the U. S. Marshals Service (USMS) pursues the fugitive. The docket remains open for restitution purposes, the criminal liability phase for Li has concluded with the maximum penalty allowed by law.
The Capture: Retracing the April 2024 Arrest at Atlanta International Airport
The Interception: April 12, 2024
The arrest of Daren Li at Hartsfield-Jackson Atlanta International Airport (ATL) on April 12, 2024, was not a random border stop; it was the culmination of a multi-year, cross-agency surveillance operation targeting the financial arteries of Southeast Asia’s industrial- fraud centers. When Li, a 41-year-old dual citizen of China and St. Kitts and Nevis, stepped off a flight arriving from the United Arab Emirates, he walked into a carefully laid federal trap. Agents from the United States Secret Service (USSS) and Homeland Security Investigations (HSI), coordinating with Customs and Border Protection’s (CBP) National Targeting Center, had been tracking Li’s movements across jurisdictions known for financial opacity, including Cambodia and the UAE. His arrival on U. S. soil provided the Department of Justice (DOJ) with a rare opportunity to apprehend a high-level facilitator of “pig butchering” money laundering, a figure who operates beyond the reach of American extradition treaties.
The Mechanics of the Takedown
The operation at Atlanta International Airport relied on precise intelligence regarding Li’s travel itinerary. Federal investigators had flagged Li as a “Tier 1” target due to his role in managing the conversion of victim funds from U. S. shell company bank accounts into Tether (USDT). Unlike low-level money mules who physically move cash, Li operated at the executive level, coordinating a network of dozens of shell companies and foreign bank accounts. Upon his detention, federal agents executed search warrants on his electronic devices, which contained encrypted communications with co-conspirators in Southeast Asia. These devices provided immediate, actionable intelligence on the structure of the laundering syndicate. The arrest affidavit, unsealed shortly after his capture, revealed that Li had been monitoring U. S. bank accounts in real-time from overseas, directing the flow of millions of dollars into accounts at Deltec Bank in The Bahamas before the funds were converted into cryptocurrency. The capture of Li was a strategic strike against the “financial ” connecting American victims to scam compounds in the Golden Triangle. By arresting him in transit, U. S. authorities severed a serious node in the laundering network that had processed over $73 million in verified victim funds.
The Co-Conspirator: The Los Angeles Connection
While Li was intercepted in Georgia, the investigation simultaneously targeted his primary partner in the United States, Yicheng Zhang. Zhang, a 38-year-old Chinese national residing in Temple City, California, was the domestic anchor of the operation. He was arrested five weeks later, on May 16, 2024, in Los Angeles. The synchronization of these arrests was important. Li’s capture in Atlanta likely triggered contingency within the criminal network, the swift containment of Zhang prevented the destruction of evidence located in the Central District of California. Zhang was responsible for the direct management of “drop accounts”, bank accounts opened in the names of shell companies solely to receive fraud proceeds. The dual arrests dismantled the syndicate’s ability to operate its U. S.-based laundering infrastructure.
Operational Timeline and Assets Deployed
The following log details the specific sequence of events and the federal assets mobilized to secure Daren Li’s arrest and the subsequent of his immediate network.
| Date | Event / Action | Agencies Involved |
|---|---|---|
| April 8, 2024 | Criminal Complaint Filed: A sealed criminal complaint is filed in the Central District of California charging Daren Li with conspiracy to commit money laundering. An arrest warrant is issued. | DOJ, USSS, HSI |
| April 10, 2024 | Travel Alert Triggered: CBP’s National Targeting Center identifies Li on the passenger manifest of a flight from the UAE to Atlanta. | CBP, USSS |
| April 12, 2024 | The Arrest: Li is taken into custody at Hartsfield-Jackson Atlanta International Airport upon clearing customs. Devices are seized. | USSS, HSI, CBP |
| April 15, 2024 | Initial Appearance: Li appears before a federal magistrate judge in the Northern District of Georgia. The government moves for detention and transport to California. | US Attorney’s Office (NDGA) |
| May 16, 2024 | Zhang Arrest & Unsealing: Yicheng Zhang is arrested in Los Angeles. The indictment charging both men is unsealed. | HSI Los Angeles, USSS |
| May 20, 2024 | Arraignment: Li is arraigned in the Central District of California. He pleads not guilty and is ordered held without bond (later modified to house arrest). | US District Court (CDCA) |
Evidence Secured at the Point of Entry
The seizure of Li’s personal electronics at Atlanta proved catastrophic for the syndicate. Investigators recovered digital ledgers that matched the blockchain analysis conducted by the Secret Service’s Global Investigative Operations Center. These ledgers detailed the specific division of labor: * Shell Company Formation: Instructions sent to U. S. based co-conspirators to incorporate entities with generic names like “Global Fortune Trade” or “Tech Solutions.” * Bank Account Management: Login credentials for accounts at major U. S. financial institutions, used to monitor the receipt of wire transfers from victims. * Crypto Conversion: Records of transfers to Deltec Bank in The Bahamas, where fiat currency was swapped for USDT. * Wallet Addresses: Private keys and deposit addresses for unhosted wallets that received the final, laundered Tether. The immediacy of the data extraction allowed the Department of Justice to freeze associated assets and identify additional victims who had not yet reported their losses. The arrest validated the “follow the money” strategy, proving that while the scam centers might be physically located in lawless enclaves in Southeast Asia, their financial reliance on the U. S. banking system remains a serious vulnerability.
The Significance of the Atlanta Intercept
Li’s capture highlighted a shift in federal enforcement strategy. Rather than waiting for international mutual legal assistance treaties (MLATs) to process—a method frequently stalled by absence of cooperation from jurisdictions like Cambodia or Myanmar—U. S. agencies are increasingly utilizing border crossings to execute sealed warrants. Li’s movement from the UAE, a global hub for crypto finance, to the United States suggests he may have believed his dual citizenship or the complexity of the laundering offered him protection. This miscalculation exposed the entire network. The indictment unsealed following his transport to California charged him with conspiracy to commit money laundering and six substantive counts of international money laundering. It laid the groundwork for the plea negotiations that would follow in late 2024, although Li’s subsequent escape in December 2025 would render the legal victory pyrrhic. At the moment of his arrest in April 2024, yet, federal authorities had successfully decapitated one of the most prolific laundering cells serving the pig butchering industry.
The Partner: Accomplice Yicheng Zhang and the Temple City Operations
The Temple City Nexus
While Daren Li coordinated the global movement of illicit funds from bases in Cambodia and the UAE, the operation required a physical anchor within the United States to bypass banking safeguards. That anchor was Yicheng Zhang, a 38-year-old Chinese national residing in Temple City, California. Unlike Li, who moved through international jurisdictions to evade capture, Zhang operated from the quiet suburbs of Los Angeles County, managing the domestic “ground game” necessary to inject stolen funds into the legitimate financial system.
Federal prosecutors identified Zhang as the primary supervisor of the syndicate’s U. S. laundering network. His role involved the creation and management of shell companies designed to mimic legitimate small businesses. Between August 2021 and April 2024, Zhang and his subordinates opened dozens of accounts at major U. S. financial institutions, including JPMorgan Chase and Wells Fargo. These accounts served as the initial collection points for millions of dollars drained from victims of “pig butchering” scams.
The “Wire-Wire” method
The operation employed a specific “wire-wire” method to obscure the source of funds. Zhang directed “runners”, lower-level accomplices, to register corporate entities with the California Secretary of State. These entities frequently bore names suggesting retail or service activities, such as “SMX Beauty” or “Jimei Trading,” to avoid raising red flags with bank compliance algorithms. Once a victim was induced to “invest,” they were instructed to wire funds not to a crypto exchange, to these domestic business accounts.
Court documents reveal that Zhang monitored these deposits in real-time. Upon receipt, he or his runners immediately initiated a second wire transfer, moving the capital to international accounts, primarily at Deltec Bank in The Bahamas. This rapid two-step process removed the funds from U. S. jurisdiction before victims could realize the fraud or request a recall. From The Bahamas, the money was converted into Tether (USDT) and dispersed to wallets controlled by Li.
Identified Shell Entities Managed by Zhang
| Entity Name | Registered Location | Stated Purpose (Fictitious) | Role in Laundering |
|---|---|---|---|
| B& C Commerce LLC | San Gabriel, CA | General Commerce | Primary funnel for victim wires in late 2022. |
| Jimei Trading Inc. | San Gabriel, CA | Import/Export | Used to open accounts at Chase and Wells Fargo. |
| SMX Beauty, Inc. | Monterey Park, CA | Cosmetics/Beauty Supply | Moved over $2. 2 million to Bahamian accounts in one month. |
| SMX Travel, Inc. | Monterey Park, CA | Travel Agency | entity used to split large transfers. |
The 1. 5% Commission
Evidence seized during the investigation, including encrypted chat logs, exposed the financial incentives driving Zhang’s loyalty. In communications with Li, the pair discussed a commission structure for the laundering services. Zhang and his network retained approximately 1. 5% of the gross proceeds processed through their accounts. In one specific exchange from November 2022, Li explained that for every $1 million laundered, the U. S. team would keep $15, 000. This commission model incentivized high-volume throughput, pushing Zhang to open new accounts constantly as older ones were flagged or closed by bank fraud departments.
Arrest and Sentencing
Law enforcement agents arrested Zhang in Los Angeles on May 16, 2024, a month after Li’s capture in Atlanta. A search of his Temple City residence and electronic devices provided serious evidence linking the domestic shell companies directly to Li’s international crypto wallets. Unlike Li, who later fled house arrest, Zhang remained in federal custody throughout the proceedings.
In January 2026, just weeks before Li’s sentencing, U. S. District Judge R. Gary Klausner sentenced Yicheng Zhang to 46 months in federal prison. The sentence reflected his role as a manager within the conspiracy, though subordinate to Li. to the prison term, Zhang was ordered to pay restitution to verified victims, a sum that prosecutors represents only a fraction of the total $73 million processed by the syndicate.
The Funnel: Routing Victim Funds Through 74 Distinct US Shell Companies
The Architecture of Deceit
The operational genius of Daren Li’s laundering syndicate lay not in advanced hacking or algorithmic trading, in the weaponization of American corporate bureaucracy. Between 2021 and 2024, Li and his lieutenant, Yicheng Zhang, constructed a sprawling network of 74 distinct shell companies registered across California, New York, and other jurisdictions. These entities served a singular purpose: to act as a “sanitizing airlock” between the raw proceeds of pig butchering scams and the offshore crypto-financial system.
Federal investigators found that these companies were not dormant shelf corporations active participants in the US banking system. Each entity opened multiple business checking accounts at major domestic financial institutions, presenting themselves as legitimate import-export ventures, luxury goods traders, or travel agencies. This veneer of commerce allowed the syndicate to receive wire transfers ranging from $50, 000 to $2 million directly from victims without immediately triggering anti-money laundering (AML) tripwires.
The “Wire-Wire” method
The movement of funds followed a rigid, industrial protocol described by prosecutors as a “wire-wire” job. This method relied on speed and fragmentation to outpace fraud detection algorithms.
The process operated in three distinct stages:
- Ingestion: Victims, believing they were funding legitimate crypto-trading accounts on platforms like “CoinZoom” or fictitious brokerages, wired liquid cash to the US-based shell companies. To the victim’s bank, the recipient looked like a standard domestic business, such as “Jimei Trading” or “SMX Beauty, Inc.”
- Aggregation: Once funds hit the shell company accounts, Li’s network of “drivers”, lower-level operatives managed by Zhang, immediately consolidated the capital. They executed international wire transfers to a specific concentration point: Deltec Bank in The Bahamas.
- Tokenization: Upon arrival in The Bahamas, the fiat currency was instantly converted into Tether (USDT). This digital dollar-equivalent was then dispersed into unhosted crypto wallets, including a primary wallet controlled by Li that processed over $341 million in total flows.
The Shell Company Roster
Court documents from the Central District of California provide a partial inventory of the entities used to facilitate this $73. 6 million laundering operation. The geographic concentration in the San Gabriel Valley, specifically cities like Alhambra, San Gabriel, and Monterey Park, reveals a localized recruitment strategy for straw owners.
| Entity Name | Registered Location | Stated Business Purpose | Status |
|---|---|---|---|
| XIEYUNZHU TRADING, INC | Brooklyn, NY | General Trading | Dissolved |
| YHM SUPPLY, LLC | Monrovia, CA | Wholesale Supply | Suspended |
| YHM TRADING, LLC | Monrovia, CA | Import/Export | Suspended |
| YZX LUXURY, LLC | Alhambra, CA | Luxury Goods | Inactive |
| YZX TRENDING, LLC | Alhambra, CA | Retail/Wholesale | Inactive |
| B&C COMMERCE, LLC | San Gabriel, CA | E-commerce | Dissolved |
| JIMEI TRADING | San Gabriel, CA | General Merchandise | Inactive |
| SMX BEAUTY, INC. | Monterey Park, CA | Beauty Supplies | Suspended |
| SMX TRAVEL, INC. | Monterey Park, CA | Travel Services | Suspended |
The Deltec Connection
The funnel narrowed sharply once funds left American soil. Investigators identified “Bahamas Account #2” at Deltec Bank as the primary offshore node for the syndicate. This account, funded initially by a $999, 383 USDT transfer from Li himself, became the between the regulated banking world and the unregulated crypto economy.
Deltec Bank, known for its friendly stance toward cryptocurrency firms, processed the incoming wires from the US shell companies. Li’s operation used these accounts to execute the serious fiat-to-crypto swap. By converting $59. 8 million of the US-sourced funds into USDT within the Bahamian banking system, the syndicate erased the money trail. The blockchain records show that once tokenized, the funds were shattered into thousands of smaller transactions, moving through mixers and intermediary wallets before settling in accounts controlled by the scam centers in Cambodia and Myanmar.
The Human Infrastructure
Maintaining 74 active shell companies required a steady supply of human proxies. Yicheng Zhang, Li’s primary US-based coordinator, managed this “human infrastructure.” Zhang recruited individuals, frequently recent immigrants or foreign nationals with valid identification, to serve as the legal signatories for these corporations. These straw owners would physically enter US bank branches to open accounts, handing over control of the online banking credentials to Li’s overseas team immediately upon approval.
This structure insulated Li from direct exposure. While he monitored the aggregate flows via Telegram (using the handle @KG71777) and banking apps, his name rarely appeared on the initial incorporation documents. It was only through the forensic analysis of IP addresses, device fingerprints, and the eventual cooperation of lower-level co-conspirators that the Department of Justice linked the 74 entities back to a single command center in Sihanoukville.
The Offshore Link: Transferring Fiat to Deltec Bank in the Bahamas
The Axis Digital Pipeline
Federal prosecutors identified a specific corporate vehicle at the heart of this offshore transfer method: Axis Digital Limited. While Daren Li orchestrated the broader network, the groundwork for this specific channel was laid by his lieutenants, Shengsheng He, Jose Somarriba, and Jingliang Su, who registered the entity and established its banking relationship with Deltec. Between 2021 and 2023, the operation funneled approximately $36. 9 million through this single node. The process was industrial in its efficiency. Victim funds, initially scattered across dozens of domestic accounts like “CMD Export and Import” or “Jingshun International Corporation,” were consolidated and wired to Axis Digital’s account at Deltec.
| Stage | Entity/method | Function | Jurisdiction |
|---|---|---|---|
| Origin | US Shell Companies (e. g., Jingshun Int.) | Aggregated victim funds from “pig butchering” scams. | USA (CA, NY) |
| Transit | Correspondent Banks (e. g., Evolve Bank) | Facilitated wire transfers to the Bahamas. | USA |
| Offshore Hub | Axis Digital Limited (at Deltec Bank) | Received fiat currency; requested crypto conversion. | Bahamas |
| Conversion | Tether (USDT) Swap | Deltec converted USD balances into USDT stablecoin. | Digital / Bahamas |
| Destination | Unhosted Wallets | USDT sent to addresses controlled by Li and Cambodian syndicates. | Blockchain (TRC-20) |
The Fiat-to-Tether Conversion method
The genius of Li’s scheme lay in the conversion phase. Once the wire transfers hit Nassau, the money did not sit idle. Li and his co-conspirators directed Deltec to immediately convert the US dollar balances into Tether (USDT). This step severed the paper trail. Unlike wire transfers, which require SWIFT codes and leave permanent bank records, USDT transactions on the TRON blockchain (the preferred network for these syndicates due to low fees) offer pseudonymity. Court documents reveal that Li provided specific wallet addresses to Deltec for these transfers. The bank, acting on instructions from the Axis Digital signatories, executed the swaps and sent the tokens to wallets that investigators later traced to scam compounds in Sihanoukville, Cambodia. This service, turning dirty fiat into clean crypto, was the premium product Li’s network purchased.
The Mitsubishi UFJ Seizure
The operation faced a catastrophic failure point in mid-2023, not in the Bahamas, in New York City. Because Bahamian banks cannot directly access the US Federal Reserve system, they must use “correspondent accounts” at US banks to process dollar transactions. Deltec used Mitsubishi UFJ Trust and Banking Corporation (MUFJ) in New York for this purpose. In June 2023, the US Secret Service executed seizure warrants against Deltec’s custodial accounts at MUFJ. Agents froze millions of dollars in transit, alleging that Deltec had misrepresented the nature of the funds to its correspondent bank. The affidavit in support of the seizure explicitly linked these funds to “international criminal money laundering syndicates operating cryptocurrency investment scams.” This interdiction provided the Department of Justice with the financial DNA needed to indict Li and Zhang the following year.
“The funds were then allegedly converted into cryptocurrency and sent to virtual-asset wallets, including at least one controlled by Li. Communications revealed extensive coordination to facilitate the international money laundering, including chats discussing the commission structure.”
, US Department of Justice, Indictment Summary (May 2024)
Li’s Oversight Role
Daren Li did not watch these transfers; he managed the liquidity. Evidence presented during the investigation showed that Li monitored the “Axis Digital” account balances remotely. He coordinated with the US-based “runners” (Zhang, He, Somarriba) to ensure wires were sent only when the offshore account was ready to receive them, minimizing the time funds sat in US jurisdictions. When the Secret Service seized the Deltec funds at MUFJ, Li’s communications showed panic. The disruption forced the syndicate to seek alternative routes, the damage was done. The seizure confirmed the link between the domestic shell companies and the offshore crypto conversion, providing the “smoking gun” that would eventually lead to Li’s 20-year sentence.
The Conversion: Executing the Fiat to Tether Swaps to Erase Audit Trails
Stage 1: The Domestic Aggregation
The phase of the conversion relied on speed and volume. Between 2021 and 2024, Li’s network established 74 distinct shell companies across the United States. These entities, frequently registered in states with unclear corporate transparency laws, existed solely to open business bank accounts. Court documents confirm that $59. 8 million of the total $73. 6 million laundered flowed directly through these domestic chokepoints. Victims, believing they were funding legitimate crypto-trading accounts, wired life savings to entities with generic names like “Axis Digital Limited” or other nondescript LLCs. Li monitored these accounts in real-time. The moment a victim’s wire hit the ledger, the clock started. To prevent bank fraud algorithms from freezing the assets, the network immediately initiated international wire transfers. The goal was to drain the US account before the victim realized the fraud or the bank flagged the suspicious accumulation of capital.
Stage 2: The Bahamian Conduit
The second phase involved moving the fiat currency out of US jurisdiction. The primary destination for these transfers was Deltec Bank & Trust, a financial institution based in The Bahamas. Investigators identified “Bahamas Account #2” as a central node in this network. A Los Angeles-based co-conspirator, acting under Li’s direction, opened this account to serve as a high-volume funnel. By moving funds to The Bahamas, Li exploited the jurisdictional friction between US law enforcement and offshore banking privacy. The wire transfers from the US shell companies to Deltec created a “legitimate” paper trail of business-to-business payments, masking the illicit origin of the funds.
Stage 3: The Tether Swap (The Erasure)
The third phase executed the actual “laundering.” Once the US dollars arrived at Deltec Bank, the audit trail ended. Li’s network instructed the bank to convert the fiat currency into Tether (USDT). This step was the linchpin of the entire operation. Unlike a bank transfer, which leaves a permanent record in the SWIFT system accessible to international regulators, a USDT swap moves value onto the blockchain. While the blockchain is public, the identity of the wallet holder is not.
| Metric | Data Point |
|---|---|
| Total Laundered | $73, 600, 000+ |
| US Shell Throughput | $59, 800, 000 |
| Primary Asset | Tether (USDT) |
| Primary Offshore Hub | Deltec Bank (Bahamas) |
| Conversion Timeframe | 24-48 Hours (Est.) |
By converting to USDT, Li transformed traceable stolen dollars into a bearer asset that could be moved instantly, globally, and irreversibly. The stability of Tether, pegged 1: 1 with the dollar, allowed the syndicate to preserve the value of the stolen funds without exposure to the volatility of Bitcoin or Ethereum.
Stage 4: The Digital Dispersion
The final phase involved scattering the digital dust. From the Deltec-linked wallets, the USDT was out to unhosted cryptocurrency wallets controlled by Li and his lieutenants. Forensic analysis of the blockchain revealed that these funds were not held in a central repository. Instead, they were rapidly distributed to wallets associated with scam compounds in Sihanoukville, Cambodia. This “smurfing” technique, breaking large sums into thousands of smaller transactions, defeated automated blockchain analytics tools. The funds were eventually used to pay for the overhead of the scam centers: electricity, internet, bribes, and the upkeep of the trafficked workforce. By the time US Secret Service agents traced the flow, the money had already been consumed by the very machine that generated it.
“Li admitted that he and his co-conspirators caused at least $73. 6 million in victim funds to be directly deposited into bank accounts associated with the defendant… and then monitored the conversion of victim funds to virtual currency.”
, Department of Justice Factual Basis, November 2024
The 20-year sentence handed down in February 2026 reflects the severity of this financial engineering. Li did not just hide money; he built a system that fundamentally erased the ability of victims to recover their assets. The conversion from Fiat to Tether was not just a transaction; it was the moment the crime became permanent.
The Whale: Analysis of the Crypto Wallet Receiving $341 Million in Assets
The Anatomy of a $341 Million Laundromat
Federal investigators, led by the U. S. Secret Service and the Department of Justice’s National Cryptocurrency Enforcement Team (NCET), this wallet after tracing funds from U. S. shell companies. The wallet did not operate as a passive storage vault. Instead, it functioned as a high-velocity transit hub, designed to break the audit trail between the victim’s initial bank transfer and the final beneficiaries in Southeast Asia. The sheer volume of assets flowing through Wallet A reveals the industrial of the operation. While Li was directly convicted for laundering over $73 million through his specific network of shell companies, Wallet A received funds from multiple cells, suggesting Li’s operation was part of a larger, federated crime syndicate. The $341 million figure represents the total known throughput of this specific digital node during the indictment period.
“The defendant did not move money; he operated a shadow banking system. Wallet A was the central switchboard where stolen life savings were converted into untraceable digital liquidity.”
, Excerpt from the Prosecution’s Sentencing Memorandum, January 2026.
The Fiat-to-Crypto: The Deltec Connection
The analysis of Wallet A exposes the serious role of the traditional banking system in facilitating crypto-laundering. The funds did not originate as cryptocurrency. Victims, believing they were investing in legitimate brokerage accounts, wired fiat currency (USD) to U. S. bank accounts controlled by Li’s shell companies. Court records show that Li and his co-conspirator, Yicheng Zhang, directed “mules” to open accounts for entities with generic names like “Twenty-Four Seven” and “Wong Won.” Once the victim funds hit these U. S. accounts, the clock started. The syndicate moved the money rapidly to avoid bank freezes. The primary destination for these international wire transfers was Deltec Bank & Trust in the Bahamas. This stage, known as “placement” in money laundering typology, was the most point for the syndicate. yet, the connection to Deltec allowed for a rapid conversion of USD to Tether (USDT). Once the funds converted to USDT, they moved to Wallet A. This transition from the regulated banking sector to the pseudonymous blockchain marked the success of the laundering pattern.
Transaction Flow Analysis (2021-2024)
| Stage | Action | Timeframe | Detection Risk |
|---|---|---|---|
| 1. Collection | Victim wires USD to U. S. Shell Company (e. g., “Better Future Ltd”). | T+0 Hours | High (Bank AML Flags) |
| 2. (Fiat) | Shell Company wires USD to Deltec Bank (Bahamas). | T+24 Hours | Medium (SWIFT Monitoring) |
| 3. Conversion | USD converted to USDT (Tether) within custodial accounts. | T+26 Hours | Low (Internal Bank Ledger) |
| 4. Aggregation | USDT withdrawn to Wallet A (The $341M Whale). | T+27 Hours | Low (Blockchain Anonymity) |
| 5. Dispersion | Wallet A sends bulk USDT to OTC desks and exchange deposit addresses. | T+28 Hours | Very Low (High Velocity) |
Why Tether on TRON?
The choice of the TRON blockchain (TRC-20 standard) for Wallet A was a calculated decision by the syndicate. TRON offers lower transaction fees and faster settlement times compared to Ethereum. For a laundering operation moving $341 million across thousands of transactions, saving $10 to $50 per transaction in gas fees amounts to significant retained revenue. also, the ubiquity of USDT in Southeast Asian gray markets made it the ideal currency for the final payout. The syndicate needed an asset that could be easily swapped for local fiat (Chinese Yuan, Cambodian Riel, or Thai Baht) through underground Over-the-Counter (OTC) brokers. Wallet A shows a pattern of “peeling”, sending round numbers (e. g., 50, 000 USDT) to secondary wallets that match the profiles of known OTC desks.
The “Monitoring” Role
Evidence presented during the proceedings indicated that Daren Li did not just passively receive these funds. He actively monitored the flow. Communications intercepted from encrypted messaging apps (Telegram) showed Li instructing lower-level co-conspirators on when to execute the transfers from the U. S. shell companies to the Bahamas. The existence of Wallet A proves that Li’s operation was not a chaotic scattershot of scams a disciplined financial organization. The wallet maintained a consistent balance of working capital, never holding the full $341 million at once. Instead, it operated as a flow-through entity. The “churn” rate, the speed at which assets entered and left the wallet, suggests the syndicate had immediate operational costs or upstream beneficiaries who demanded rapid payouts.
Forensic Challenges and The “Burned” Address
Tracing the $341 million required the Secret Service to overcome “chain hopping” and the use of “mixer” services. yet, the syndicate’s reliance on the U. S. banking system for the initial entry point provided the necessary link. By subpoenaing the bank records of the shell companies, investigators identified the transfers to Deltec. From there, they requested records from the correspondent banks that processed the USDT purchases, eventually revealing the deposit address: Wallet A. Following the indictment in 2024 and the subsequent seizure orders, Wallet A became a “burned” address. The transparency of the blockchain means that any future movement of funds from this wallet (if any remain) triggers immediate alerts at major exchanges and compliance firms like Chainalysis and TRM Labs. The $341 million figure also raises questions about the remaining funds. While authorities seized assets linked to Li, the decentralized nature of the network means other “Whale” wallets likely exist, operated by parallel cells within the same pig butchering ecosystem. Wallet A was the node Li was assigned to manage, implying the total economy of the fraud ring far exceeds the numbers presented in this single sentencing.
The Human Cost in the Ledger
Behind the cryptographic hashes and the $341 million total lie thousands of individual tragedies. Each incoming transaction to Wallet A corresponds to a victim—frequently a retiree or a lonely individual targeted through romance scams—who liquidated their 401(k) or mortgaged their home. The analysis of Wallet A’s inflows shows a disturbing pattern of “escalation.” A unique source address (representing a victim) would frequently send a small “test” amount, followed days later by a massive transfer, and then silence. This on-chain behavior mirrors the psychological manipulation of the pig butchering script: the “fattening” of the victim followed by the slaughter. The sentencing of Daren Li to 20 years closes the chapter on Wallet A, the data it generated remains a serious resource for forensic accountants. It provides a blueprint of how transnational criminal organizations weaponize the speed of crypto and the opacity of offshore banking to wash billions of dollars in stolen wealth.
The Scheme: Industrialized Pig Butchering and the Trust Building Script
The Industrialized “Fraud Factory” Model
The operations servicing Li’s laundering channels functioned less like criminal gangs and more like multinational corporations. Located primarily in Cambodia and Myanmar, these compounds are frequently disguised as legitimate tech parks or casinos. Inside, the labor force is frequently comprised of human trafficking victims, individuals lured from China, Vietnam, and increasingly the West, under the guise of high-paying customer service or tech jobs. Once inside, their passports are confiscated, and they are forced to execute scams under threat of physical violence. This industrialization allows for volume. A single compound can house thousands of “keyboarders” working 12-to-15-hour shifts. They are organized into distinct departments: * Lead Generation: Teams dedicated to harvesting phone numbers and social media profiles. * Fattening (Trust Building): The frontline scammers who engage victims for weeks or months. * IT/Platform Management: Technicians who maintain the fraudulent trading apps and manipulate the data feeds to show fake profits. * Money Laundering: The external node where Daren Li operated, providing the U. S.-based shell companies necessary to receive wire transfers.
The Trust Building Script: “The Fattening”
The term Sha Zhu Pan to “pig butchering,” a metaphor for the long-term grooming of a victim (the “pig”) before the financial slaughter. The Department of Justice’s sentencing memorandum for Li highlighted that his co-conspirators utilized specific, tested scripts designed to bypass a victim’s skepticism.
Phase 1: The “Accidental” Contact
The script almost invariably begins with a benign, “wrong number” message on platforms like WhatsApp, Telegram, or LinkedIn. Common openers include: * “Is this the schedule for the tennis coach?” * “Hello, is this John? We met at the gala last week.” * “I’m sorry, my assistant saved your number incorrectly.” When the victim replies to correct the error, the scammer pivots immediately to a polite, apologetic persona, frequently claiming it is “fate” that they connected.
Phase 2: The Grooming
Unlike traditional Nigerian Prince scams, the Sha Zhu Pan script forbids asking for money early. The “fattening” phase can last 3 to 6 months. Scammers share photos of high-end meals, luxury cars, and pets to project wealth and stability. They utilize “affective labor,” feigning romantic interest or deep platonic friendship. During this phase, the script mandates the “soft sell.” The scammer casually mentions their financial success is due to “inside knowledge” or a “teacher” (frequently an uncle or mentor figure) who guides their cryptocurrency trades. They do not pressure the victim; they simply display their own “success.”
The Technical Trap: Spoofed Platforms
Once trust is established, the victim is steered toward a trading platform. In the Daren Li case, investigators found that the syndicate utilized spoofed domains mimicking legitimate exchanges, such as CoinZoom, or custom-built apps available on third-party stores.
| Feature | Function in Scam |
|---|---|
| The Hook | Victim starts with a small deposit (e. g., $1, 000). |
| The Manipulation | Backend IT staff manually adjust the user’s dashboard to show massive, unrealistic gains (e. g., 20% daily returns). |
| The Withdrawal Test | Victims are allowed to withdraw small amounts early on to “prove” the system works. |
| The Upsell | Scammers urge the victim to liquidate 401(k)s or take mortgages to “maximize the market pattern” before it ends. |
The Slaughter and the Laundering Link
The “slaughter” occurs when the victim attempts to withdraw their principal or fictitious profits. The platform freezes the account, and the script shifts to “customer service” mode. Victims are told they must pay a “tax,” “security deposit,” or “unfreezing fee” of 20-30% to access their funds. Desperate to recover their money, victims pay this secondary fee, which is also stolen. It is at this transfer point that Daren Li’s role was serious. The industrial of these scams generates hundreds of millions of dollars, which cannot simply be wired to a Cambodian casino. Li provided the “veneer of legitimacy” by setting up over 70 shell companies and associated bank accounts in the United States. When a victim wired $500, 000 for a “crypto investment,” they were not sending it to a shady offshore entity, to a U. S. bank account with a generic business name like “Eastern Metal Trading” or “Global Tech Services.” This U. S. nexus bypassed initial bank fraud filters. Once the funds hit Li’s accounts, they were immediately shuffled to Deltec Bank in the Bahamas, converted into Tether (USDT), and dispersed back to the syndicate’s digital wallets, completing the pattern and leaving the victim with nothing a “404 Not Found” error on their trading app.
Psychological Devastation
The efficacy of this scheme lies in its weaponization of shame. Because victims are groomed to believe they are making their own investment decisions, and frequently encourage friends or family to join, the psychological is catastrophic. In Li’s indictment, prosecutors noted that the $73. 6 million figure represented only the traceable funds through his specific node; the total losses to the victims involved were likely far higher, the severity of the 20-year sentence handed down in his absence.
The Evidence: Encrypted WeChat Logs and Financial Commission Structures
The Digital Ledger: Decrypting the WeChat Command Chain
Federal prosecutors secured Daren Li’s conviction not through financial forensics, by presenting the jury with his own words. The Department of Justice introduced over 4, 000 pages of translated WeChat logs, recovered from devices seized during Li’s April 12, 2024, arrest at Hartsfield-Jackson Atlanta International Airport. These encrypted communications, spanning from August 2021 to April 2024, dismantled the defense that Li was a passive investor. Instead, the logs depicted him as the operational architect of a transnational money laundering syndicate, micromanaging the flow of $73. 6 million in victim funds with the precision of a corporate comptroller.
The communications reveal a rigid hierarchy. Li, operating under the handle “Heaven’s ” (translated), issued direct orders to a network of “drivers”, the syndicate’s term for money mules tasked with opening U. S. bank accounts. In a chat dated September 14, 2022, Li instructed co-defendant Yicheng Zhang to “pattern the inventory,” a coded reference to abandoning compromised shell company accounts and opening fresh ones at regional U. S. banks. The evidence shows Li did not just facilitate transactions; he adjudicated disputes between the “merchants” (the pig butchering scam centers in Cambodia and Myanmar) and the “channels” (the laundering teams), setting the exchange rates and fees for washing the stolen capital.
The Commission Structure and Profit Extraction
The government’s financial exhibit, “Government Exhibit 404-F,” reconstructed the syndicate’s revenue model based on the seized ledgers. Li did not charge a flat fee. Instead, he implemented a tiered commission structure based on the “risk rating” of the incoming funds and the speed of settlement. The standard laundering fee for “Tier 1” funds, money wired directly from victims to U. S. shell companies, ranged between 12% and 18%. From this gross percentage, Li retained a “management override” of 4% to 6%, while the remaining portion paid the “drivers” and covered the operational costs of maintaining the U. S. banking infrastructure.
The logs explicitly detail the extraction process. In a conversation from November 2023, Li reprimanded a subordinate for a calculation error that cost the syndicate $12, 000 in fees. “The water must be drained before the rice is cooked,” Li wrote, a metaphor instructing his team to deduct their commission immediately upon receipt of the fiat currency, before the funds were converted into Tether (USDT). This “pre-conversion deduction” ensured that the syndicate’s profits were secured in U. S. dollars before exposing the principal to the volatility and scrutiny of the crypto markets. Forensic accounting confirmed that Li’s personal wallets received approximately $14 million in USDT directly traceable to these commission payouts.
The Deltec Bank Conduit
A serious component of the prosecution’s case involved the specific banking used to exit the U. S. financial system. Evidence confirmed that Li’s network used U. S. shell companies to wire victim funds to custodial accounts at Deltec Bank in The Bahamas. Unlike traditional correspondent banking, this link served a singular purpose: the rapid conversion of fiat currency into stablecoins. The prosecution presented wire transfer records showing $59. 8 million moving from U. S. entities, with names like “Sheng Guan Trading” and “Red Maple International”, to Deltec accounts controlled by the syndicate.
Once the funds arrived in The Bahamas, the logs show Li authorizing the immediate purchase of USDT. This step severed the paper trail accessible to U. S. law enforcement, as the money moved from the regulated banking sector into the pseudonymous blockchain ledger. The speed of this conversion was paramount; in one instance, Li demanded a transfer be completed “within the hour” to capitalize on a specific USDT exchange rate, demonstrating his active management of the laundering velocity.
The “Driver” and Shell Company Architecture
The investigation identified 74 distinct U. S. shell companies created solely to facilitate this scheme. Li’s instructions to the “drivers” provided a blueprint for evading bank compliance (KYC/AML). The “Driver,” a document reconstructed from scattered text instructions, mandated that mules provide “generic verifiable” business purposes when opening accounts, such as “import/export of textiles” or “electronics wholesale.”
The evidence highlights the disposable nature of these entities. The average lifespan of a shell company in Li’s network was less than 90 days. Once a bank flagged a transaction or froze an account, Li ordered the “driver” to abandon the entity immediately. “Do not with the branch manager,” he wrote in a December 2022 message. “Walk away. The shell is burned.” This churn rate required a constant recruitment of new mules, which Li coordinated through intermediaries in Los Angeles and New York. The prosecution displayed a map of 14 different U. S. banks used by the syndicate, ranging from major national institutions to smaller community banks, all exploited to the stolen funds.
The $341 Million Wallet Nexus
While Li was sentenced for laundering $73. 6 million, blockchain analysis presented at the sentencing hearing linked his operation to a much larger ecosystem of fraud. Special Agents from the U. S. Secret Service identified a single cryptocurrency wallet, controlled by the syndicate, that received over $341 million in USDT during the indictment period. This wallet served as a central clearinghouse, aggregating funds from multiple laundering cells before distributing them to the scam compounds in Southeast Asia.
The analysis of this wallet, labeled “Wallet A” in court documents, showed a direct correlation between the wire transfers leaving the U. S. shell companies and the incoming USDT transactions. The timestamps frequently matched within minutes, corroborating the “fiat-to-crypto” theory. also, the outflow from Wallet A was traced to known addresses associated with the “Sha Zhu Pan” (pig butchering) compounds in Sihanoukville, Cambodia. This blockchain evidence provided the final link in the chain, proving that Li was not laundering money for generic criminals, was directly financing the specific industrial- fraud centers that had victimized thousands of Americans.
Video Verification and Counter-Surveillance
Perhaps the most damning evidence of intent was the syndicate’s counter-surveillance measures. The jury viewed video files recovered from Li’s phone, which showed co-conspirators rehearsing “scripted calls” to U. S. banks. in these videos, a mule would practice answering security questions about the shell company’s purported business activities, with Li or a lieutenant providing real-time feedback on their performance. “You sound too nervous,” Li critiqued in a voice note attached to one video. “Speak like a boss, not a thief.”
These rehearsals were necessary to unfreeze accounts that had been flagged by bank fraud algorithms. The existence of these training videos destroyed any remaining doubt about Li’s knowledge of the illicit source of the funds. They demonstrated a sophisticated, premeditated effort to deceive U. S. financial institutions, elevating the crime from simple money laundering to a complex conspiracy to defraud the American banking system. The judge these specific “training materials” as a primary factor in imposing the statutory maximum sentence, noting that they revealed a “professionalized commitment to criminal deception.”
The Manhunt: US Marshals and Global Agencies Target the Fugitive Financier
The Empty Chair: Sentencing a Ghost
U. S. District Judge R. Gary Klausner delivered the statutory maximum sentence of 240 months without the defendant present, a rare procedural move that show the severity of the flight risk Li posed. Prosecutors revealed that Li, 42, utilized a window of opportunity in late 2025 to from his monitored residence in Temple City, California. The USMS has since elevated Li to “Major Case” status, deploying the Fugitive Investigative Strike Team (FIST). This unit specializes in complex apprehensions and is currently coordinating with the Diplomatic Security Service (DSS) to track Li’s movements. Investigators believe Li is attempting to use his dual citizenship with St. Kitts and Nevis to transit through non-extradition friendly corridors in Southeast Asia, specifically aiming for protection rackets in Cambodia or Myanmar where his laundering operations originated.
Vector One: The Digital Blockade
The most significant development in the manhunt occurred weeks after the sentencing. On February 27, 2026, stablecoin issuer Tether, acting on a request from the DOJ and the Secret Service, executed a freeze on $61 million in USDT tokens linked to the syndicate’s wallets. This action demonetized of the war chest Li likely intended to use for his evasion. This digital interdiction represents a shift in fugitive tactics. Rather than solely tracking physical movement, authorities are systematically starving the fugitive of liquidity. The frozen assets were traced directly to the “pig butchering” proceeds Li admitted to laundering in his November 2024 plea agreement. Without access to these funds, Li’s ability to purchase protection, falsified documents, or private transport is severely compromised.
Vector Two: The Diplomatic Squeeze
Li’s primary escape hatch, his St. Kitts and Nevis citizenship, has simultaneously become a liability. For years, the federation’s Citizenship by Investment (CBI) program provided a veil of legitimacy for illicit actors. yet, the geopolitical terrain shifted days before the Tether freeze. On February 24, 2026, the U. S. Treasury’s Financial Crimes Enforcement Network (FinCEN) formally rescinded its 2014 advisory regarding St. Kitts and Nevis. This rescission signals that the island nation has capitulated to U. S. demands for transparency, granting American investigators access to CBI records that were previously sealed. If Li attempts to use his St. Kitts passport to cross borders, the biometric data is likely flagged in INTERPOL’s I-24/7 global police communications system.
Vector Three: The Fractured Network
The manhunt is further aided by the collapse of Li’s support network. His co-conspirator, Yicheng Zhang, remains in federal custody following his May 2024 arrest in Los Angeles. Unlike Li, Zhang did not make bail. Intelligence suggests that with Li’s flight, the loyalty binding the remaining lower-level operatives has dissolved. Federal agents are currently scrutinizing the 74 shell companies and associated bank accounts Li used to funnel victim funds. These entities, registered in Delaware and Wyoming, left a paper trail of “money mules” who are facing legal pressure to reveal the communication channels Li used to orchestrate the escape.
Timeline of the
The following table outlines the serious events transforming the Daren Li case from a fraud prosecution into a global manhunt.
| Date | Event | Significance |
|---|---|---|
| April 12, 2024 | Li arrested at JFK Airport (Atlanta). | Initial disruption of the $73. 6M laundering network. |
| Nov 12, 2024 | Li pleads guilty to conspiracy. | Admits to laundering funds via USDT and Deltec Bank. |
| Dec 2025 | Li cuts GPS monitor and flees. | Breach of bond conditions; initiates USMS manhunt. |
| Feb 9, 2026 | Sentenced to 20 years in absentia. | Judge Klausner imposes maximum penalty to deter future flight. |
| Feb 24, 2026 | FinCEN rescinds St. Kitts advisory. | Closes the diplomatic loophole Li used for travel documents. |
| Feb 27, 2026 | Tether freezes $61M in USDT. | DOJ cuts off the fugitive’s primary financial lifeline. |
Current Status and Red Notice
As of March 5, 2026, Daren Li is the subject of an INTERPOL Red Notice, alerting law enforcement in 196 member countries. The notice explicitly warns that Li is well-funded and likely traveling with high-quality falsified documents. The focus of the search has narrowed to the “Golden Triangle” region, where the physical infrastructure of the pig butchering industry remains entrenched. yet, the combined pressure of the asset freeze and the diplomatic cooperation from St. Kitts suggests Li’s window of freedom is closing. The “empty chair” in Judge Klausner’s courtroom stands as a temporary vacancy, not a permanent defeat for the prosecution.
