TRM Labs Maps Southeast Asian Scam Infrastructure Beyond Wallet Transfers

TRM Labs is examining the services that support Southeast Asian scam compounds alongside blockchain transfers, an approach that helps investigators trace operations and identify where flagged funds reach crypto platforms.

Jonno Newman, TRM Labs’ APAC head of deployment strategy, described the work during TOKEN2049 Singapore on Oct. 7-8. “Instead of just tracing the blockchain funds, we look at the supply chain,” he said.

That means looking at how compounds obtain internet access and other resources, as well as how operators run them. Those details give investigators a view of a scam operation that wallet addresses alone cannot provide.

Newman also described chatbot workflows that let scam operators communicate across language barriers. “Now we’re seeing them use more agentic workflows where they’ve got chatbots instead of people,” he said. In the scam reports examined, the share involving AI rose roughly 13-fold from 2022 to 2025.

Cyber-scam operations in Southeast Asia have been linked to trafficking, forced criminality and other abuses. Examining how compounds function therefore reaches beyond the movement of funds: their operations depend on people, connectivity and other resources.

A blockchain trail becomes available when funds move onchain. Onchain stablecoin transfers leave a record investigators can follow, showing where assets move after a transfer. Examining a compound’s services and communications adds context about the operation behind that movement.

TRM Labs launched Beacon Network in August 2025 to help investigators and participating platforms respond while flagged funds are moving. Verified investigators can flag addresses linked to financial crime, and the network traces related funds. Participating platforms receive alerts when those funds arrive.

A platform can then review a deposit and act before withdrawal, including by holding funds. An alert gives it an opportunity to intervene, but does not ensure that assets will be frozen or recovered. The process also depends on the funds reaching a participating platform.

For theft victims, reporting promptly gives investigators and platforms more time to respond while funds are moving. “Speed and time of that reporting is critical,” Newman said.