Sri Lankan police arrested 628 foreign nationals on May 10 following raids on high-end residential apartments in Colombo that had been converted into staffed cybercrime operations. The suspects were running cryptocurrency fraud networks and pig-butchering investment scams targeting victims internationally, using the luxury housing as call center infrastructure equipped with computers, phones, and fabricated banking documentation.
Colombo Luxury Apartments Converted Into Crypto Scam Call Centers
The arrested suspects are nationals from multiple countries. Deportation proceedings are underway in coordination with international law enforcement partners. Seized assets included cryptocurrency wallets and financial fraud infrastructure. Sri Lankan authorities described the operation as the largest single cybercrime sweep in the country’s history.
The apartments’ presentation — high-end residential buildings rather than commercial premises — allowed the operations to avoid the scrutiny typically applied to business registrations and commercial leasing. Workers inside conducted fraudulent investment solicitations, romance-based scam conversations, and cryptocurrency transfer fraud from what appeared externally to be ordinary residential units.
Pig-Butchering Scam Mechanics Behind the Colombo Operation
Pig-butchering fraud — named for the practice of fattening a pig before slaughter — involves building a false relationship with a victim over weeks or months through messaging apps and dating platforms, then steering them toward a fraudulent cryptocurrency investment platform controlled by the criminals. Victims are shown fabricated account dashboards reflecting large returns, encouraged to invest more, and then denied withdrawal when they attempt to recover their funds. The operation typically ends when the victim’s funds are fully transferred and contact is cut off.
Running this type of fraud at scale requires staffed operations: workers managing dozens of simultaneous victim relationships, supervisors reviewing conversation scripts and escalating high-value targets, technical staff maintaining the fake investment platforms, and financial operators moving cryptocurrency through layered wallets to frustrate tracing. The Colombo apartments provided exactly that structure — a full-service fraud factory housed within a residential building.
Geographic Expansion of Cyber Fraud Compounds Beyond Traditional Southeast Asian Bases
Cyber fraud compounds of this type have been documented extensively in Myanmar, Cambodia, Laos, and the Philippines, where trafficked or coerced workers — often recruited under false promises of legitimate employment — operate under physical duress. Sri Lanka’s emergence as a hosting location reflects a documented geographic expansion as international pressure on the traditional compound countries has mounted.
Sri Lanka’s legal framework, its position as a transit hub, and the relative ease of establishing residential operations without triggering business registration scrutiny made it an attractive relocation target. The international coordination behind this sweep — Sri Lankan police working with foreign law enforcement partners — follows a model developed through operations against compound networks in Southeast Asia, applied now to a country that had not previously been a primary enforcement focus.
The scale of the arrest — 628 individuals in a single coordinated action — is significant for a country-level operation. It indicates the fraud networks had established substantial staffed capacity in Colombo before detection, and that the intelligence picture developed over enough time to support a simultaneous, multi-site raid rather than a sequential series of smaller enforcement actions.
For the broader law enforcement effort against pig-butchering operations, the Sri Lanka sweep adds to a running count of arrests that now spans multiple continents. The persistent challenge is the replacement rate: arrested workers are replaceable at the criminal network level, and the underlying economics driving both the organizers and the often-coerced workers remain intact unless the financial infrastructure — cryptocurrency wallets, exchange accounts, money laundering chains — is simultaneously disrupted.
Deportation of the 628 suspects will return foreign nationals to their home countries, where follow-on prosecution may occur depending on bilateral agreements and the evidence collected during the Sri Lankan raids. The seized cryptocurrency wallets represent the most durable investigative asset from the operation.
