Check out the BitPinas Token 2049 Coverage Here
At major crypto conferences like Token2049, the floor is usually dominated by talk of bull markets, high-yield protocols, and token launches. But behind the scenes, blockchain intelligence firms are locked in a high-stakes, real-time battle against cybercriminals, state-sponsored hack groups, and regional scam cartels.
In an interview during Token2049, Jonno Newman, APAC Head of Deployment Strategy at TRM Labs, sat down with BitPinas to unpack how the blockchain forensics firm collaborates with regional law enforcement, intercepts stolen crypto, and adapts to the rapid evolution of crypto fraud across Southeast Asia and the Philippines.
From Massive Scam Compounds to Decentralized AI Hubs
Across Southeast Asia, organized cybercrime has long operated through massive physical scam compounds, which are facilities historically fueled by forced labor and human trafficking. However, according to Newman, the rapid rise of artificial intelligence is fundamentally changing how these syndicates operate.
“Scam compounds in particular are a massive priority for us at the moment, and we’re investing a lot of money there,” Newman explained. “Instead of just tracing the blockchain funds, we look at the supply chain: Where are they getting internet from? How are they accessing other resources, and how are they actually operating?”
While scam compounds previously relied on large human workforces to run manual “pig-butchering” scams, perpetrators are now deploying AI agents and automated chatbots to eliminate language barriers and scale operations. (Read More: [Coinfest Asia] TRM Labs APAC Compliance Lead Claudia Hui Explains Crypto Risk Blind Spots for Traditional Banks)
“Now we’re seeing them use more agentic workflows where they’ve got chatbots instead of people,” Newman noted. “Even if you don’t speak Mandarin, you can target Mandarin-speaking countries. If you don’t speak English, you can still target English-speaking countries.”
This shift toward automation may soon alter the physical footprint of regional crime rings.
“I do wonder if it’s going to mean that scam compounds aren’t as much of a thing, and we see more of a decentralized model with isolated hubs of scams instead of the big major compounds,” Newman said. “One of the interesting things about scam compounds is they normally start primarily by human trafficking victims. If it does go to this hub model, I’m hoping that means we’re not seeing as much of that human trafficking side.”
Tracking Payment Rails: Stablecoins and Fake Merchant QRs
The conversation also turned to localized financial fraud in the Philippines, such as illicit operators abusing local payment channels like QR Ph. In these setups, illicit gambling rings or illegal services disguise their merchant profiles as legitimate businesses, like bakeries or hair salons, to move fiat undetected. (Read More: Illegal Casinos Tried Passing Themselves Off as Bakeries and Salons, Prompting Tighter BSP E-Wallet, QR Ph Rules)
While TRM Labs primarily focuses on blockchain-native transactions, Newman pointed out that as Southeast Asian economies increasingly adopt stablecoins onto public and permissioned rails, compliance monitoring becomes vital.
“When you adopt a stablecoin, all of a sudden that becomes on a blockchain, and then that’s when you can attribute those sort of things,” Newman explained. “Because of how payment rails have existed previously, a lot of people across Southeast Asia are moving towards stablecoins. That’s a big bit of what TRM does: You want to know who is the party on the other side. Is that a bank? Is it coming from a casino? Are we looking at laundering or structuring of funds?”
The 60-Minute Rule: How Victims Can Freeze Stolen Crypto
When high-net-worth individuals, founders, or everyday users fall victim to spear-phishing or private key exploits, the window to act is extremely narrow. Newman emphasized that immediate reporting to law enforcement and intelligence networks is the single most critical step in asset recovery.
“Pre-attack, one of the best things to do is diversification of funds,” Newman advised. “When one of those bits fail and you are hacked, the main thing is reporting it immediately. Speed and time of that reporting is critical.” (Read More: How to Report a Crypto or Investment Scam)
TRM Labs operates an incident response network called the Beacon Network, designed to intercept stolen assets as they flow through intermediate wallets.
“If we tag those funds in TRM, and they then move to an exchange in two or three hops, if that exchange is part of the Beacon Network, they get an email, the investigator gets an email, and those funds are held and can be frozen,” Newman revealed. “If you report it three days later, they could be well and truly gone.”
Newman’s immediate advice for anyone who suspects their device has been compromised:
- Assume the device is infected: Do not attempt sensitive recovery steps on the affected hardware.
- Report immediately: Provide wallet addresses to law enforcement and intelligence partners to tag the funds across exchange networks.
- Isolate and rotate: Rotate seed phrases and move remaining assets using a separate, uncompromised device upon returning home.
Navigating the Threat of AI Key-Cracking and User Privacy
As AI capability accelerates, concerns have grown within the crypto community regarding the potential for advanced models or future computing tech to compromise cryptographic keys. Newman framed this as a broader, societal infrastructure challenge rather than a strictly crypto-specific problem.
“AI is accelerating phenomenally,” Newman stated. “People always talk about quantum computing or AI cracking Bitcoin. But if it’s cracking Bitcoin, it’s also cracking banks and critical infrastructure. So it’s not a Bitcoin problem, it’s a societal and global issue.”
On the question of balancing legitimate user privacy with financial compliance, Newman reiterated that privacy remains a foundational pillar of public blockchains, but structured transparency is necessary to fight malicious actors. (Read More: Is Crypto Encryption In Trouble? Google’s Willow Quantum Chip Breaks Speed Records)
“Privacy is important because knowing who someone is creates the risk of them being targeted,” Newman said. “It’s about having a balance between privacy and being able to identify illicit actors. That requires working directly with blockchain foundations to strike a balance between what can be decrypted for law enforcement during illicit activity while keeping user data private by default.”
Expanding Support in the Philippines
Looking ahead, TRM Labs plans to deepen its involvement in the local ecosystem, supporting public agencies and private sector platforms operating in the country.
“We’re really interested in the Philippines,” Newman concluded. “We want to show that we’re thought partners in the area and that we want to be helping the Philippine community build a safer crypto ecosystem.”
This article is published on BitPinas: Token2049: How TRM Labs Tracks Crypto Scams, Fake Merchant QRs, and Stolen Funds in Southeast Asia
What else is happening in Crypto Philippines and beyond?
