Thai Police Arrest Chinese Suspect in 500 Million Yuan Crypto Laundering Case

Bangkok Arrest in a 500 Million Yuan Ring

A 37-year-old Chinese man accused of moving money for a laundering network that handled more than 500 million yuan has been arrested by Thai immigration police in Bangkok. Officers identified the suspect only as Wu and detained him at a luxury housing estate in the Saphan Sung district on Friday, 2026-10-16, a day before local police laid out the case in a posted arrest announcement. Chinese authorities had issued a warrant over his alleged role in a transnational crime network and a loan-sharking operation.

@KhaosodEnglish · X post

Posted arrest announcement.

View on X

Police said Wu recruited account holders, took possession of their bank cards and login credentials, and passed that access on to laundering groups. The same operation converted digital currencies into foreign currencies for criminal clients, a service that ran outside licensed spot trading venues and gave the ring a conversion layer between crypto and fiat. Investigators put the network's turnover above 500 million yuan across more than 133 bank accounts, while noting that not all of that volume was cryptocurrency. Wu is also alleged to have arranged visas for members of transnational networks linked to other laundering cases.

The trail closed through international police channels, with officers from Immigration Division 3 tracing the suspect to a property in the Ramkhamhaeng area of Saphan Sung. During the search they found forged residence-registration documents, and Wu had reportedly swapped vehicle plates and wrapped his car in a different color to break pursuit. Immigration checks showed his Thai permit had lapsed roughly three years and eight months earlier, so officers charged him under Section 81 of the Immigration Act 1979, an offense tied solely to his status in the country. He has been handed to investigators for those proceedings, and authorities plan to coordinate his return to China, where the laundering allegations sit in the outstanding warrant. Thai regulators were already probing high-value USDT transfers, with source-of-funds checks on cash deposits of at least 5 million baht slated for the fourth quarter of 2026.

Ledger Confirms CryptoBilis Hardware Tampering

Ledger's security team, Ledger Donjon, has confirmed a supply-chain attack in which hardware wallets sold by the Southeast Asian distributor CryptoBilis were physically tampered with before reaching buyers. In its official confirmation, the manufacturer stressed that every theft verified so far involves devices sold through CryptoBilis, with no anomalies reported on units from other channels. Loss figures circulating online remain third-party estimates that the company has not fully verified.

@Ledger · X post

Official confirmation.

View on X

The operational warning is direct. Buyers who purchased a device from CryptoBilis and have not yet initialized it are told never to power it on, since initialization on compromised hardware can expose the private key material guarding the funds. Anyone who has already set such a device up is instructed to move holdings immediately to a wallet built on a newly generated recovery phrase, because a leaked phrase exposes every wallet address derived from it.

The case has already reached retail shelves in Europe. Electronics group MediaMarktSaturn suspended sales of Ledger products across its stores and online platforms on 2026-10-13, acting with Ledger's cooperation after a German consumer reported a suspected malicious implant inside a device. No fund losses have been reported in connection with that unit, and the investigation is ongoing. An X user named Johannes has claimed that wallets bought at two separate MediaMarkt stores contained unauthorized cables and cellular communication modules; those claims remain unconfirmed. Ledger says there is no indication its own infrastructure, systems or services were breached, and its Donjon team will examine devices submitted for inspection. The manufacturer has also announced Atom, an Android-based hardware device planned for mid-2027 with a tamper-proof enclosure designed to block the screen-reading implants used in this class of attack. Many accusations and damage numbers circulating publicly remain unconfirmed, and Ledger says official findings should govern.

The two cases describe laundering and theft hitting different layers of the same stack. Wu's ring is alleged to have rented human trust: real account holders, real bank cards and an off-exchange conversion desk, which is why the trail ran through international police channels rather than a blockchain ledger. The Ledger attackers went after the hardware itself, so no amount of on-chain monitoring would have flagged anything before funds moved. Neither matter has produced findings yet: Wu faces only the Thai overstay charge at this stage, and the loss totals attached to the tampered devices remain unverified estimates. Off-exchange desks that quote prices between crypto and fiat also sit outside the obligations a licensed market maker carries on an exchange, leaving conversion slots in gaps regulators have yet to map.