Loading story…
A U.S. federal court sentenced Ramil Ventura Palafox, head of Praetorian Group International (PGI/PGI Global), to 20 years in prison for operating a large-scale bitcoin investment Ponzi scheme and related crimes including wire fraud and money laundering. Prosecutors and court records say Palafox marketed PGI as a bitcoin trading and multi-level marketing operation, promising 0.5% to 3% daily returns—and used an online investor portal to display fabricated account growth to convince victims their funds were increasing in value.
Between December 2019 and October 2021, more than 90,000 investors worldwide reportedly placed over $201 million into PGI, including about 8,198 BTC (valued at ~$171M during the period reviewed) and more than $30M in fiat deposits; documented investor losses were at least ~$62.6M. Reporting also notes that withdrawals were frozen and blamed on “technical issues,” while Palafox allegedly diverted funds to personal spending, including ~$16M on real estate and luxury purchases; the Philippines SEC issued a public warning in 2021 advising the public not to invest and describing the operation as a Ponzi scheme.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
In February 2026, a federal court in Virginia sentenced Ramil Ventura Palafox to 20 years in prison for operating the $201 million PGI Ponzi scheme. The U.S. Department of Justice said the fraud affected more than 90,000 investors and involved false profit claims, fabricated account growth, and misuse of investor funds.
In September 2025, Palafox pleaded guilty to wire fraud and money laundering charges tied to the PGI scheme. He also agreed to repay about $63 million, though reports indicated victims were unlikely to recover much even after asset sales.
In April 2025, the U.S. Securities and Exchange Commission charged Palafox in connection with the PGI fraud. The action marked a formal U.S. regulatory case against the operator of the bitcoin-linked Ponzi scheme.
By October 2021, the PGI scheme had run its course after collecting more than $201 million from over 90,000 investors worldwide, including fiat currency and 8,198 bitcoin. Prosecutors said investor funds were used to pay earlier participants, support promotion of the scheme, and fund Palafox's personal luxury spending, leaving documented losses of roughly $62.6 million to $63 million.
In September 2021, the Philippines Securities and Exchange Commission publicly warned about PGI. The warning reflected regulatory scrutiny as the firm's investment claims and operations drew official concern.
By April 2021, investor concerns intensified after PGI froze withdrawals, signaling growing problems with the operation. The freeze became a key indicator that the purported investment business was failing or fraudulent.
Beginning in December 2019, Praetorian Group International (PGI), led by CEO Ramil Ventura Palafox, marketed itself as a multi-level marketing and bitcoin trading firm promising daily returns of 0.5% to 3%. Investors were told profits came from bitcoin trading, while account growth shown in PGI's online portal was falsely portrayed as legitimate gains.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A U.S. federal court sentenced **Daren Li** (42), a dual citizen of **China** and **St. Kitts and Nevis**, to **20 years in prison in absentia** for conspiring to launder proceeds from an international **“pig butchering”** cryptocurrency investment/romance-baiting fraud that stole more than **$73 million** from victims. Li pleaded guilty in **November 2024** and admitted that at least **$73.6 million** in victim funds was deposited into accounts controlled by his group, with a significant portion routed through **U.S.-based shell companies**; the operation was tied to scam centers in **Cambodia** and relied on a network of money launderers to move funds through U.S. bank accounts and onward to domestic/international accounts and crypto platforms to obscure origins. Li was arrested in **April 2024** at **Hartsfield-Jackson Atlanta International Airport**, but fled before sentencing in **December 2025** after cutting off his ankle monitor; U.S. authorities have not publicly confirmed his current whereabouts and indicated they will work with international partners to return him to serve the sentence. The court also imposed **three years of supervised release** following imprisonment, and reporting noted that multiple co-conspirators have pleaded guilty, with Li described as the first sentenced defendant directly involved in receiving victim funds.
Jun 29, 2026
Evan Tangeman, a 22-year-old from Newport Beach, California, was sentenced to 70 months in prison after pleading guilty to a `RICO` conspiracy tied to a cybercriminal network that stole roughly **$230 million to $260 million** in cryptocurrency from victims. Prosecutors said Tangeman laundered at least **$3.5 million** between October 2023 and May 2025 for the group, which allegedly stole more than **4,100 Bitcoin** from a Washington, D.C., victim in August 2024 and used the proceeds to fund luxury homes, private jets, high-end vehicles, private security, and other lavish purchases. Authorities said the organization, identified by law enforcement as the **Social Engineering Enterprise**, targeted wealthy cryptocurrency holders using stolen and dark-web-sourced data, spoofed phone numbers, impersonation of Google and Gemini support staff, and remote-access tools including **AnyDesk** to obtain Bitcoin Core private keys. Investigators alleged the group then obscured the proceeds through mixers, exchanges, peel chains, pass-through wallets, and VPNs, while Tangeman also helped rent properties under false identities and destroy devices after arrests of key members. Another alleged launderer, **Kunal Mehta**, has also pleaded guilty and is awaiting sentencing.
Jun 29, 2026
Zhimin Qian, a 47-year-old Chinese national also known as Yadi Zhang, was convicted in the United Kingdom for orchestrating a massive fraudulent investment scheme in China and laundering the proceeds through cryptocurrency. Between 2014 and 2017, Qian ran a company in China that promised investors extraordinary returns of up to 300%, ultimately defrauding more than 128,000 victims and raising approximately 40 billion yuan. The majority of victims were individuals aged between 50 and 75, who were lured by false promises of daily dividends and guaranteed profits. When the scheme collapsed, Qian converted the illicit proceeds into Bitcoin and fled China using false documents, entering the UK in 2018. Upon her arrival, she attempted to launder the funds by purchasing luxury properties and running businesses with the assistance of Jian Wen, who was later convicted and sentenced to over six years in prison for her role. In October 2018, the Metropolitan Police, acting on intelligence about the movement of stolen cryptocurrency, raided Qian’s London residence and seized 61,000 Bitcoin, which was then worth hundreds of millions of pounds and has since appreciated to over £5.5 billion ($7.3 billion), making it the largest cryptocurrency seizure in history. The investigation, which spanned seven years and involved cooperation with Chinese law enforcement and the UK’s National Crime Agency, required the review of thousands of documents and evidence from multiple jurisdictions. Qian pleaded guilty at Southwark Crown Court to acquiring and possessing criminal property under the Proceeds of Crime Act. The case is considered a landmark in both the scale of the fraud and the value of the assets recovered. Authorities highlighted the complexity of the investigation, which included tracking the movement of cryptocurrency wallets and unraveling the laundering process. The UK government is now engaged in negotiations regarding the disposition of the seized funds, with Chinese victims seeking restitution. The conviction underscores the growing use of cryptocurrency in large-scale financial crimes and the challenges faced by law enforcement in tracing and recovering digital assets. The Metropolitan Police emphasized their commitment to pursuing justice for the thousands of victims and to disrupting the use of the UK as a haven for laundering proceeds of international fraud. The case also demonstrates the importance of international cooperation in tackling transnational cyber-enabled financial crime. Qian’s sentencing is pending, and the outcome is expected to set a precedent for future cases involving cryptocurrency and cross-border fraud.
Jun 29, 2026