Chapter 7 — Following Money

There is one domain in this book where the wins are checkable, and it is worth understanding exactly why before looking at the wins themselves.

Follow a criminal's reasoning and everything else is deniable — a match is contestable, a cluster is an opinion, a prediction is unfalsifiable in either direction. But money either moved or it did not, and when a government seizes it, a court docket says so. The claim "we recovered $3.6 billion" is adversarially checkable in a way that "our system improved investigations" never is.

That is why this is the strongest chapter in Part II, and it is also why it is the shortest list.

The seizures

Bitfinex. Around 120,000 bitcoin were stolen in the 2016 hack of the exchange. In February 2022 the US Department of Justice seized 94,643 BTC, worth roughly $3.6 billion — the largest financial seizure in its history at the time. Ilya Lichtenstein and Heather Morgan pleaded guilty in 2023 and were sentenced in 2024 to 60 and 18 months. By sentencing, the government reported recovering around $10 billion in stolen and appreciated funds. Investigators followed roughly 2,075 addresses controlled by the hacker. [ESTABLISHED] on the seizure and sentences, from DOJ records; [CLAIMED] on the specific attribution of the tracing to Chainalysis Reactor, which is the vendor's own framing. (TRM Labs recap of DOJ figures; Bloomberg)

Welcome to Video. A darknet site selling access to 250,000 child sexual abuse videos, paid in bitcoin. Tracing the payments located the server in South Korea and identified the administrator, then identified the user base through other exchanges. Result: 337 users arrested or charged worldwide and at least 23 children rescued, with around eight terabytes of material seized. [ESTABLISHED] for the arrests and rescues, corroborated by DOJ's own announcement and international reporting; [CLAIMED] for the tracing methodology narrative, sourced to the vendor. (Al Jazeera; Chainalysis)

That case is the one to hold on to. Twenty-three children were removed from ongoing abuse because somebody could follow a payment. Whatever scepticism the rest of this book earns, it does not extend to that outcome.

Colonial Pipeline. A $4.4 million bitcoin ransom paid in May 2021; the FBI recovered $2.3 million (63.7 BTC) in June by obtaining the private key to the DarkSide wallet and seizing the funds under warrant. [ESTABLISHED] on the recovery.

And a correction I owe you: no source I found names Chainalysis, Elliptic or any vendor as the tracing tool in this recovery. The record says the FBI obtained the key; the method of acquisition is undisclosed. This case is widely cited in vendor marketing. It should not be attributed to a named product without better sourcing than I could find. [ABSENT] (CNBC)

The honest caveat about the word "AI"

Blockchain tracing is usually described as artificial intelligence and mostly is not.

The core of what makes it work is graph analysis and clustering heuristics applied to a public, permanent ledger — grouping addresses that must share an owner because of how transactions are constructed, then attaching known entities at the edges where funds touch a regulated exchange. That is excellent engineering on an unusually cooperative data source. It is not a large model reasoning about crime.

The distinction matters because the transferability is limited. Blockchain tracing works so well partly because the blockchain is a complete, immutable, universally readable record of every transaction that ever happened. Almost no other investigative domain has that. Do not generalise from its success rate to anything else.

Thailand's version, and where its evidence stands

Thailand's money-side apparatus is collected in full in Appendix B. The relevant figures for this chapter, with their grades:

• 351,000-plus mule accounts closed and THB 3.6 billion frozen, October 2025 to June 2026;

more than 29,000 suspects arrested. [CLAIMED] — government spokesperson.

• 189,887 personal and 10,672 corporate mule accounts uncovered with over 1.1 million linked

transactions traced, October 2025 to May 2026. [CLAIMED]

• A single transnational syndicate's assets temporarily seized by the anti-money-laundering office at

THB 20,392 million, including THB 7,720 million in cash and equities. [CLAIMED]

• A cash-withdrawal reporting rule at THB 5 million credited by the government with cutting large

cash withdrawals by around 35%; a deposit rule at the same threshold from October 2026. [CLAIMED]

• A victim refund mechanism through the anti-money-laundering office without a court order,

under a ministerial regulation effective 12 August 2026. [ESTABLISHED] that the regulation exists and its date; its effect is unmeasured.

(Xinhua; Nation Thailand, June 2026; Nation Thailand, August 2026)

Every operational number is a government describing its own work. I searched for an independent audit and found none. [ABSENT]

The last item is the interesting one. A refund path that does not require a court order changes the economics of victimhood more than any detection technology in this book — because it shortens the distance between a report and money coming back, which is the only outcome most victims care about. It is also, structurally, a decision system operating on flags. Read it alongside the documentation gap at the end of Chapter 6.

Singapore, and the limits of a good example

Singapore's Anti-Scam Centre, established 18 June 2019 and expanded into an Anti-Scam Command in March 2022, is the model most often held up in this region, and deservedly — it fuses bank, telco and police data specifically to find connections between accounts that look unrelated.

Its reported results: more than S$730 million recovered for victims since 2019. In an earlier window, June 2019 to 2022, 40,900 bank accounts frozen and over S$310 million recovered — a recovery rate of about 25% of reported losses. In 2025, cross-border work under Operation FRONTIER+ recovered over S$28 million and led to more than 2,100 arrests; the 2026 iteration reported more than 3,000 arrests across ten jurisdictions. [CLAIMED] — every figure is Singapore Police Force self-report, and I found no independent audit of any of them. (SPF Mid-Year Scam Brief 2026; Operation Frontier+ III)

I want to be careful here, because the grade is easy to misread as an accusation. Singapore's police are not suspected of inventing numbers. The point is narrower and it applies to every force in this book including Thailand's: a self-reported recovery rate is not the same kind of object as a court docket. The 25% figure is the most useful number in this chapter — it is the only place anyone has published a denominator — and it is still unaudited.

If you use Singapore as your comparator in a meeting, and you should, use it honestly: this is what they report, and nobody outside has checked it. That sentence will do you more good in front of a sceptical officer than an unqualified claim, because the sceptical officer already suspects the number is polished, and saying so first makes everything else you say more credible.

Why this chapter is short

Because I could not honestly make it longer.

The independently verifiable wins for data-driven investigation, worldwide, in a decade, amount to a set of asset seizures where a government press release confirms the amount, a darknet takedown with a confirmed arrest count, and one class of operation — encrypted-network interception — whose breakthrough was not analytical at all. Everything else in the success column is the seller or the buyer describing the purchase.

That is the true state of the evidence in August 2026. It is much weaker than the discourse implies. It is also not nothing, and 337 arrests with 23 children rescued is not the kind of "not nothing" anyone should be casual about.

The Move — Sort every claim by who would suffer if it were false. For any figure you are about to rely on or repeat, ask who published it and what it would cost them to be wrong. A DOJ seizure amount is checkable against a docket and a false one is a scandal. A vendor's case study costs nothing to inflate. A force's recovery statistic sits between: real institutional accountability, no external audit. Write the answer next to the number. You will find the numbers reorder themselves, and the ones that survive are the ones to build an argument on.

What would change my mind: an independent audit of Singapore's or Thailand's recovery figures — by an auditor-general, a parliamentary committee, or academic researchers with data access — would promote a large block of this chapter from [CLAIMED] to something firmer, and would be the single most valuable piece of research anyone in this region could publish. Its absence is the reason the chapter reads more cautiously than the subject deserves.