Investigation
Published August 2026
24 min read

World Cup 2026: How Illegal Betting Feeds the Shadow Crypto Economy

A $3 billion Singapore laundering case. A Telegram marketplace bigger than Silk Road and AlphaBay combined. A casino empire extradited to China. This is where the money goes after the bet lands — and why the system moving it has learned to survive anything.

← Back to ShadowMonitor

On the morning of 15 August 2023, Singapore Police Force mobilised more than four hundred officers across the island. The targets were ten people — almost all ethnic Chinese from Fujian province, holding passports from five different countries: Vanuatu, Turkey, Saint Kitts and Nevis, Cambodia. The raids turned up 152 properties, 62 cars — Ferraris, Rolls-Royces — 250 designer handbags, 726 bottles of premium alcohol, two gold bars. And 170,284 in .

By the time the case was fully mapped, the total figure stood at three billion Singapore dollars. It remains the largest money laundering case in the country's history. One of the accused, Su Jianfeng, had been wanted in China since 2017. For illegal gambling.

The details are remarkable on their own terms. But the more interesting thing is what prosecutors chose to charge. The predicate crime — the anchor of the entire case — was illegal betting. Not because gambling was the primary source of these men's wealth, but because it was the easiest thing to prove. People with three adjacent floors of a tower block facing the Burj Khalifa and a fleet of Ferraris simply had no legitimate explanation for where the money came from.

This investigation is not about those ten men. The first part of this series examined how sports betting manipulation works — from a Ligue 1 yellow card to the syndicate model behind it. This part follows what happens to the money after the bet lands. Illegal betting is not the protagonist here and not the endpoint. It is one of several entry channels into a system that has learned to do one thing better than almost anything else: survive under pressure.

How the Money Leaves the Bet

puts it directly: online casinos and betting platforms have expanded to service virtually the full spectrum of criminal activity that uses crypto for laundering. The reason is structural. These platforms provide a plausible explanation for sudden wealth, accept cryptocurrency, and in most cases require no identity verification. In other words: they look like a normal business.

In practice, it begins with a system the Chinese call 跑分 — running points. The mechanics are close to industrial. A gambler follows a payment link to a betting site, but the link does not go directly to the platform. It goes to an intermediary service, where a registered participant — someone who has sold or lent their bank account details for a small fee — picks up the order and processes the payment through their own account. The money reaches the offshore gambling site looking like an ordinary transfer between individuals. The platform takes 2.5 to 4 percent. The chain participants take 1 to 2 percent. Chinese law enforcement estimates that between five and six million people work in this illegal payments industry — inside China alone.

From there, crypto enters the chain — not as an option but as a structural node. The money converts into : stable enough for settlement, liquid enough for instant cross-border movement, and critically not required to pass through bank-level AML controls. Then come what Chinese criminal networks call 车队 — motorcades: a sequence of bank or exchange accounts through which a transaction passes progressively, each step adding distance from its origin. By the end of the chain, the money looks clean.

TECHNICAL BRIEF

Why USDT Still Works Despite AML Tracking

Technical Reference
THE PROBLEM
Tether (USDT) is the most closely monitored stablecoin in existence. Elliptic, Chainalysis and TRM Labs build real-time transaction graphs that can trace tainted funds — tokens that have passed through addresses linked to criminal activity — across multiple transaction hops. Tether Inc. can freeze any address on request from a regulator, and does: in the Xinbi action alone, $52.8 million was frozen this way.
BLACK U — THE BUILT-IN MIXER
Guarantee marketplaces like Huione and Xinbi offered a service their vendors called "Black U" — black USDT. Dirty tokens were exchanged for clean ones drawn from pools with no direct blockchain connection to criminal addresses. A money-laundering service built into the marketplace itself, with no need to leave its perimeter.
THE PHYSICAL BREAK
Dirty USDT was exchanged for cash — dirhams in Dubai, baht in Bangkok — through OTC brokers who conducted no taint analysis. The cash was then converted back into clean USDT or fiat through legitimate channels. The blockchain trail snapped at the physical layer: the one place analytical tools are structurally blind.
NETWORK-HOPPING
USDT on TRON (TRC-20) was bridged to USDT on Ethereum (ERC-20) or other networks via cross-chain bridges. Analytical tools have historically struggled to follow cross-network transfers cleanly — though this window continues to narrow.
WHY THE SYSTEM IS MOVING OFF TETHER
This is the answer to the question that Xinbi's stablecoin migration raises. Tether Inc. has demonstrated that it can freeze addresses quickly and effectively on OFAC's request. The alternative stablecoins to which the infrastructure is migrating are either issued in jurisdictions that do not cooperate with US regulators, or built on decentralised protocols where no technical mechanism for freezing an address exists at all. One more iteration of the same arms race. The regulator learned to work effectively with one instrument. The system changed the instrument.

This is the point at which illegal betting stops being a sports story and becomes a story about criminal financial infrastructure. The proceeds of a fixed yellow card and the proceeds of a crypto investment scam travel through exactly the same nodes. The system does not ask where the money came from.

The Guarantee Marketplaces: Anatomy of a Hydra

In Greek mythology, the Lernaean Hydra had a specific property: cut off one head and two grow back. The investigators who built the cases against , and might find the metaphor precise.

launched in 2021 as a Telegram marketplace — nominally for cars and property. In practice, the largest category of services was laundering: receiving payments from victims worldwide, moving them across borders, converting them into cash, stablecoins and Chinese payment apps. By July 2024, when blockchain analysts at first publicly mapped its scale, more than $31 billion had passed through it — more than Silk Road and AlphaBay combined. A dedicated gambling bot inside processed nearly $6 billion in crypto; a significant portion of that volume, analysts concluded, was not genuine betting but laundering dressed as play.

Then the enforcement cycle began. It is worth tracing step by step, because it has since repeated with mechanical regularity.

In May 2025, began the process of designating Group as a primary money laundering concern — a step toward cutting it off from the dollar financial system. Telegram blocked thousands of associated channels. The market's response was immediate: merchants migrated to , a platform in which had quietly acquired a stake. processed another $14.6 billion before closing in early 2026 under pressure from Chinese law enforcement. , meanwhile, rebranded as — another step in the same choreography.

had been growing in parallel. By March 2026, when the UK imposed its first sanctions, $19.9 billion had passed through it. By September 2026, placed 's total throughput at more than $36 billion. On 9 September 2026, designated as a significant transnational criminal organisation. The Justice Department froze $52.8 million in crypto across 52 wallets. Telegram banned the channels.

But the most telling detail of that operation is not the dollar figure. It is the timing. had begun preparing for exactly this scenario back in June 2025 — eighteen months before the sanctions landed. It migrated its merchants and money-laundering networks onto , an encrypted messaging application built for the purpose by Singapore-registered . It launched , a proprietary crypto wallet developed by Cambodia-registered . And it began moving settlements away from toward a stablecoin that is technically harder to freeze.

For the first time, regulators struck not just the marketplace but its technological backbone: and were designated alongside . A new level of precision. The problem is that by the time the designations landed, the infrastructure was already operating in its next configuration.

is currently tracking more than thirty active guarantee marketplaces. Not three. Thirty.

One head cut off. Two growing back.

Scam Compounds: When a Casino Is Not Just a Casino

On 14 October 2025, the United States and the United Kingdom moved simultaneously. sanctioned 146 people connected to . The Justice Department unsealed an indictment against its chairman, : forced-labour scam compounds across Cambodia where trafficked workers were held against their will and compelled to run crypto investment fraud at industrial volume. Prosecutors seized approximately $14 billion in bitcoin — the largest asset forfeiture in the history of the Department of Justice. The UK froze £134 million in London property at the same time.

denied everything, calling the allegations baseless.

The connection to betting is direct and documented. According to US prosecutors, laundered criminal proceeds through online gambling and cryptocurrency mining — not as a side operation but as a structural mechanism. The , connected to , operated a network of hotels and casinos that functioned simultaneously as nodes in the scam infrastructure. A casino in this system is not a cover story. It is an operational component of the same architecture.

On 6 January 2026, something unexpected happened. was arrested in Cambodia and extradited — not to the United States, whose prosecutors had been building the case, but to China, at Beijing's direct request. Cambodia revoked his citizenship. Chinese state television CCTV broadcast footage of a man in handcuffs and a hood being walked off a plane by Chinese security forces.

What he has been charged with in China has not been officially disclosed. "The related cases are under further investigation," said the Ministry of Public Security.

The surprise is not that was caught. The surprise is who caught him. That China, not the US, ended up with custody may say more about the real distribution of leverage in the region than any official report on transnational organised crime.

estimates that approximately 300,000 trafficked workers are held in these compounds under threat of torture and violence. Among the goods sold by vendors on the guarantee marketplaces: electric shock shackles.

The Arms Race Has No Finish Line

Blockchain analytics works. That needs to be said plainly. It was 's July 2024 publication that set off the chain of events — designation, Telegram takedowns, DOJ seizures, 's arrest. The detection tools proved their value.

The problem lies elsewhere. The entire ecosystem of Chinese-language crypto laundering networks grew from $10 billion in throughput in 2020 to more than $82 billion in 2025. That is eightfold growth — occurring precisely during the period of maximum enforcement pressure. The system did not contract under pressure. It expanded.

's explanation is blunt: the explosion of under-regulated online gambling platforms and crypto exchanges gave organised crime an instrument unconstrained by traditional banking controls. Transaction speed, anonymity, cross-border reach — all of it makes the system faster than any regulatory cycle.

One further detail closes the loop between this investigation and its first part. From 1 May to 20 July 2026 — the duration of the World Cup — Singapore Police Force specifically intensified its illegal betting suppression operations, officially acknowledging elevated risk during the tournament period. In one operation on 6 July alone, sixteen men and three women were arrested; more than S$730,000 in cash was seized.

A yellow card in Ligue 1. Anomalous bets across dozens of jurisdictions. A French criminal investigation. That is the beginning of the chain. Its other end is somewhere inside the infrastructure described in this piece.

The State as Infrastructure

The most uncomfortable part of this story is not the scale of the criminal networks or the speed of their adaptation. It is what happens when the state turns out to be not the system's opponent but one of its structural components.

acquired Cambodian citizenship in 2014. He became an adviser to both the sitting and former prime ministers. He was awarded the neak oknha title — one of Cambodia's highest civilian honours, granted to the largest donors to the ruling party. All of this is documented, public biography. It belongs to the same man US prosecutors later called the head of a transnational criminal organisation.

Analysts studying the region ask the structural question directly: can Cambodia's ruling Cambodian People's Party sustain its grip on power without the revenue streams that figures like Chen provided? The alternative they describe is a slow drift toward international-pariah status.

The UAE is a less dramatic story but a structurally similar one. The country's grey-listing by was driven in part by what experts describe as institutional indifference to financial crime: free economic zones that allow businesses to register and operate with minimal oversight. The model is not unlike the special economic zones that became scam compounds in the Mekong region — only in a more presentable form.

Telegram occupies a specific place in this picture. When the platform explained why it no longer considers guarantee markets grounds for removal — they give Chinese users an alternative channel for moving funds around capital controls — that was not a hedged non-answer. It was a policy position. A platform with hundreds of millions of users said, publicly: we will not adjudicate between the launderer and the person who simply wants to get their savings out. Work it out among yourselves.

What the System Does Under Pressure

System Logic
Illegal betting is one of several equivalent entry channels into this infrastructure. The system does not distinguish between the proceeds of a fixed yellow card, a crypto investment scam or a human trafficking operation. The plumbing — running points, USDT, motorcades, guarantee marketplaces — is the same for all three.

Under pressure, this system does not collapse. It does what the Hydra does: loses one head and grows two. became became became , which is already in the process of becoming something else. tracks thirty-plus active marketplaces. The next round of sanctions, however precise, will not change that arithmetic.

Both parts of this investigation are about the same pressure and the same response to it. In the first part, the pressure is AI-based detection of betting anomalies, and the response is compression — the object of manipulation shrinks to one gesture by one person, indistinguishable from honest play. In this part, the pressure is sanctions, takedowns and arrests, and the response is evolution — new messaging apps, new wallets, new stablecoins, new jurisdictions.

The mechanism is identical in both cases. A grey system, transforming under pressure. Not disappearing. Transforming.

Continue Investigation
World Cup 2026: How Spot-Fixing Works — From One Yellow Card to a Global Syndicate

One yellow card in a French league match. Anomalous bets across dozens of jurisdictions. A French criminal investigation. A player now on the pitch at the World Cup. This is how sports betting manipulation works in 2026 — and why the system designed to catch it almost never can.

Read Investigation
← All Investigations