Thai Immigration Police Arrest Man Suspected of Theft in Pattaya, Accused of Involvement in Transferring Approximately 4.707 Million USDT from OKX Account
Thai Immigration Police Arrest Man Suspected of Theft in Pattaya
Thai immigration police arrested a 30-year-old Chinese national, Xin Zhang, in Pattaya, who is accused by Chinese authorities of participating in the transfer of approximately 4.707 million USDT from an OKX account.
The Guangdong Public Security Bureau issued a wanted notice for him in 2025. The allegations state that he, along with at least three accomplices, used self-developed face-swapping and camera software to impersonate victims, apply for replacement cards from operators, intercept SMS one-time passwords, and quickly transfer assets after taking over exchange accounts. The man entered Thailand on a tourist visa in July 2024 and overstayed. He was apprehended on September 8 in an apartment in Pattaya. He will first be processed under immigration law, and Thai authorities will coordinate his deportation and extradition. Thai media estimate the loss at approximately 162 million Thai Baht. The report did not disclose the identity of the victims or the final destination of the funds.
SMS verification combined with remote facial recognition is a common method for account recovery. Once operators issue replacement cards, if the exchange's risk control only recognizes one mobile channel, assets can be withdrawn in seconds. This case brings face-swapping from social fraud into the intersection of telecommunications and custody.
In market mechanisms, this is a custody run triggered by a failure at the identity layer. The beneficiaries are the receiving addresses still holding on-chain assets and underground exchanges; the pressured parties are users tied only to SMS and exchanges that must verify both the operator and facial recognition channels simultaneously. Once funds leave OKX, they enter a commingled stablecoin circulation, and recovery depends on the speed of freezing rather than the arrest itself.
The arrest addresses the individual in Thailand. Whether the 4.707 million USDT can still be reclaimed depends on on-chain and platform freezing, not on the press release.
Source: Public Information
ABAB AI Insight
The account key has been split into a SIM card and facial recognition. The face-swapping occurred at the operator's counter, not at the exchange's cold wallet. The replacement card redirected the victim's SMS channel to the perpetrator's card, making the OTP accessible to the attacker. If the exchange treats "facial recognition + SMS" as the same person, it is essentially re-authenticating an identity that has already been replaced. The overstay in Pattaya indicates that the crime and concealment can cross borders; assets can leave first, followed by the individual.
Capital will shift the two-factor authentication from SMS to hardware keys and independent live facial recognition, making operator card replacements a high-risk event. OKX has been named as the location of the victim's account but is not the only platform that could be targeted using the same method. The three accomplices have not been apprehended simultaneously, and the software and roster may still be circulating.
This parallels SIM hijacking and social engineering takeovers. The industry is transitioning from password leaks to the operator identity market: whoever controls the replacement card can temporarily become the account owner.
This belongs to a scenario where technological substitutes are first exploited by criminals: facial recognition, originally meant for identity verification, is used to prove to the operator, "I am the original owner." The mechanism ties telecommunications identity and exchange identity to the same card; once the card is swapped, the asset channel is also changed.
ABAB News · Cognitive Laws
SMS verification tied to the SIM card means that a replacement card equals a temporary transfer of account ownership
Face-swapping must first pass through the operator, not necessarily through the cold wallet
When a person is apprehended in one country, whether the stablecoin is still there depends on freezing, not on the wanted notice