Chinese Man Used AI Face Swap To Steal US$4.7 Million Worth of Crypto

A Chinese man accused of orchestrating a sophisticated cryptocurrency theft using artificial intelligence and a fraudulent SIM card replacement has been arrested in Thailand, exposing a new generation of cybercrime in which criminals can combine digital impersonation with weaknesses in mobile authentication.

Thai authorities detained the 30 year old Chinese national, identified as Zhang, in Pattaya after receiving information that a foreign man with no apparent regular employment was living comfortably in an apartment while possessing a steady source of money. Investigators monitored the suspect before moving in and subsequently discovered that his legal permission to remain in Thailand had expired.

The arrest took on greater significance when authorities confirmed that Zhang was wanted by Chinese law enforcement in connection with a cryptocurrency theft case. Chinese investigators allege that he was a leading member of a group that stole approximately 4.707 million USDT from an OKX cryptocurrency account.

At the time, the stolen digital assets were valued at around 33 million yuan, equivalent to approximately 162 million baht. Based on current exchange rates cited in regional reporting, the loss would amount to roughly RM20 million, placing the case firmly among the more substantial cryptocurrency theft incidents involving a single victim.

What makes the case particularly concerning is the alleged method. Investigators said Zhang and at least three associates obtained the victim's cryptocurrency account information and mobile phone number before using artificial intelligence face swapping technology to impersonate the victim.

The group allegedly developed its own software capable of altering Zhang's appearance so that he could present himself as the account holder. The attackers then contacted the telecommunications provider and claimed that the victim's SIM card had been lost.

A replacement SIM card linked to the victim's existing number was subsequently obtained. That step was crucial because control of the mobile number allowed the group to receive one time passwords sent through SMS.

With the mobile number under their control, the attackers could then attempt to regain access to the cryptocurrency account and authorise transfers. Chinese authorities said the entire sequence could be completed within seconds, turning what might traditionally have required prolonged hacking into a rapid attack combining identity fraud, telecommunications manipulation and digital asset theft.

The case also demonstrates why artificial intelligence is becoming an increasingly important issue for financial crime investigators. Deepfake technology was once associated largely with fabricated videos and manipulated images, but criminals are increasingly exploring whether synthetic identities can be used to defeat real world verification systems.

The arrest followed Zhang's alleged flight to Thailand. Reports indicate that he entered Thailand on a tourist visa in July 2024 and subsequently remained in the country beyond the authorised period. Thai immigration officers eventually located him in Pattaya and detained him on immigration grounds before transferring the case to local police. Thai authorities are coordinating with Chinese officials over the next steps, including his eventual return to China.

For Malaysian investors, the incident carries an uncomfortable lesson as cryptocurrency adoption and digital financial services continue to develop across the region. Malaysia's Securities Commission has strengthened its framework for digital asset exchanges, with revised rules introduced in May 2026 to improve client asset safeguards, governance and operational resilience.