How did America unlock 15 billion USD Bitcoin from the "scam king" of Cambodia, Tran Chi?

The incident of American officials seizing 127,271 Bitcoin – equivalent to 15 billion USD – from fraudster Trần Chí (Chen Zhi), Chairman of Prince Holding Group in Cambodia, is shaking the global crypto community. However, what the community is most concerned about is not the record number, but how America was able to unlock this Bitcoin – which is believed to be stored in 25 personal wallets that only Trần Chí holds the private keys to.

The mystery of how America accesses 25 Bitcoin wallets

The U.S. Department of Justice (DOJ) did not disclose technical details, but many sources suggest that the agency has traced the movement of Trần Chí's assets since 2020 – the time when these Bitcoin wallets began to change ownership.

According to Angela Ang, Director of Policy at TRM Labs, the blockchain trail shows that transactions in Trần's wallet network have an “unnatural movement chain,” suggesting the possibility of an insider collaborating with authorities.

A civil complaint from the DOJ also revealed that an individual “in control of or able to access the private keys” may have assisted the government in accessing these wallets.

TRM's on-chain analysis shows that the majority of Bitcoin from 25 wallets of Trần Chí has consolidated into a large wallet cluster worth over 14 billion USD, with the remainder moving through several intermediary wallets before returning to the main cluster – a structure seen as a “sign of manipulation by someone with direct access to the private keys.”

According to TRM, most of the funds from blockchain addresses listed in the indictment against Chen Zhi were consolidated into a single cluster holding approximately 14.13 billion USD Bitcoin, with the remaining funds being transferred through intermediaries to other unhosted wallets and global exchanges before reconnecting to the same cluster.## Weak private keys – critical vulnerability

According to Yu Xian, the founder of the security company SlowMist, Trần's wallets may have been created using the pseudo-random number generator (PRNG) – a key generation tool that is not strong enough, making the private keys easy to guess or exploit.

If so, this is a serious security flaw that has been documented in over 10 attacks in the crypto market, where hackers or investigative agencies can recreate private keys through duplicate random patterns.

A separate report from Distrust in August also confirmed that 25 wallets of Trần Chí “have been at risk since they were created,” due to the use of a weak key generation algorithm that does not comply with industry encryption standards.

Yu Xian believes that:

“If the PRNG is flawed, the private key can be regenerated. If the US government has technical evidence or insider support, unlocking 25 wallets is entirely feasible.”

Clue from the insider

Some cybersecurity experts believe that the incident may be related to an internal figure from Prince Group or an associate of Trần Chí – the person who holds a copy of the private key or seed phrase ( recovery phrase ).

Since these wallets are identified as unhosted wallets (, only the owner of the key can access them. This makes the hypothesis of being “hacked” less convincing compared to the possibility that someone may have surrendered or sold the information to the authorities.

A source from TRM Research stated that the investigation process lasted more than four years, during which blockchain analysts tracked thousands of addresses related to the Prince Group network.

When unusual transactions emerged in mid-2020, the investigation team “linked the entire system”, leading to the successful seizure and control of a total of 127,271 BTC by the end of 2024.

Valuable lesson about “absolute control”

The event of America unlocking Trần Chí's Bitcoin wallet worth 15 billion USD shows that no system is completely invulnerable – even when assets are stored in a personal wallet.

According to Shawn Yan, CEO of Cregis Technology, this incident “shatters the blind trust that crypto is anonymous and untraceable,” while also demonstrating that law enforcement agencies possess blockchain analysis technology that surpasses what many imagine.

Yu Xian concluded:

“It’s not the blockchain that gets hacked. It’s the weak keys, poor management, and humans that are the weakest links.”

From Trần Chí's “treasure”, the crypto investment community draws a clear lesson: digital assets are only safe when the holder has enough knowledge and discipline to protect them.

A former official of the Cambodian opposition party, Mr. Hing Soksan, believes that Tran Chi has stored Bitcoin in 25 hot wallets )hot wallets( instead of cold wallets )cold wallets(. He said: “If this Bitcoin is held in cold wallets, American law enforcement would almost be unable to seize it.”