Disruption Week: 1.4 million accounts, ten companies, one operational – Good Machine

TL;DR

Over the last week, the US Department of Justice's Scam Center Strike Force, the Royal Thai Police, and nine major technology companies disrupted more than 1.4 million accounts tied to Southeast Asian scam networks. Sixty-three arrests were made.
The corporate participants — Apple, Coinbase, Google, Meta, Microsoft, Silent Push, SpaceX, TRM Labs, Zenlayer — span device, payments, communications, satellite connectivity, hosting, threat-intelligence, and crypto-tracing. That list, more than the headline number, is the news.
The operation hit social accounts (Facebook, Instagram), Microsoft identities, Starlink terminals supplying the compounds, malicious infrastructure, and hosting environments. It is the first time satellite connectivity has been visibly named in a takedown of this scale.
These compounds — concentrated along the Thai-Myanmar and Thai-Cambodian borders — run "pig butchering" investment frauds that extracted an estimated US$10 billion+ from American victims in 2025 alone (FBI IC3 figures). The networks rebuild quickly; the durability question is real.
For consumers: this changes very little about your immediate risk surface. The compounds will be reconstituted. What it changes is the question of who is accountable for the connectivity layer — and the answer is no longer "nobody asked".

What happened

In a coordinated action announced on 4 June 2026 under the name "Disruption Week," the US DOJ's Scam Center Strike Force, the Royal Thai Police, and a consortium of technology companies dismantled infrastructure used by Southeast Asian scam operations. The reported numbers:

More than 1.4 million social media accounts, pages, and groups on Facebook and Instagram taken down by Meta.
Microsoft accounts associated with the operations disabled.
Starlink terminals supplying connectivity to the compounds disrupted by SpaceX.
Malicious IP traffic and network connections severed; associated servers and hosting environments decommissioned.
63 individuals arrested in connection with the scam activities.

The corporate participants — Apple, Coinbase, Google, Meta, Microsoft, Silent Push, SpaceX, TRM Labs, and Zenlayer — represent an unusually broad cross-section: device manufacturers, payment and crypto-exchange operators, communications platforms, satellite providers, threat-intelligence firms (Silent Push), blockchain-analytics firms (TRM Labs), and hosting/CDN infrastructure (Zenlayer).

Reuters and SecurityWeek carried the announcement; Bloomberg picked up the Thai government's framing.

What it actually means

The headline number — 1.4 million accounts — is not the story. Meta has, in past years, disclosed quarterly removal numbers an order of magnitude larger across its full integrity surface. The story is the shape of the participant list.

Pig-butchering operations work because they exist across layers. A victim is contacted on a social platform, moved to an encrypted messenger, persuaded to send funds via a crypto exchange to a wallet routed through a compound in Sihanoukville or Mae Sot, and serviced from there by trafficked workers operating on Microsoft and Google identities, behind Starlink terminals that bypassed local telcos, on hosting infrastructure that fronted the entire scheme. For a takedown to bite, all of those layers have to coordinate on the same operational window. Until this week, that had not happened publicly at this scale.

The inclusion of SpaceX is the genuinely new element. Satellite connectivity has been the operational lifeline of the compounds for two years — once local telcos started cooperating with Thai and Cambodian authorities, Starlink became the workaround. SpaceX naming itself as a participant in a takedown of compound infrastructure is an admission, however carefully worded, that the company has been part of the problem and is now part of the response. That has been a quiet political fight in Bangkok and Phnom Penh for the better part of eighteen months. It just became loud.

The inclusion of Silent Push and TRM Labs matters in a different way. These are the two firms whose specialist intelligence — indicator-of-compromise tracking and on-chain wallet tracing — actually maps the networks. They are how Meta knew which 1.4 million accounts to suspend rather than the wrong 1.4 million.

The piece that isn't moving

Sixty-three arrests against a workforce estimated by UNODC at upwards of 300,000 trafficked workers across Cambodia, Myanmar, Laos, and the Philippines is, statistically, a rounding error. The compounds are run by transnational organised crime groups — predominantly Chinese-origin syndicates operating through local political protection — and the infrastructure regenerates inside weeks. Past disruptions have followed a consistent pattern: accounts are recreated, terminals are re-provisioned, hosting moves to the next cooperative jurisdiction, victims keep arriving.

What changes after this week is not the supply of the operation. It is the friction. Each layer that now has named, public-facing participation in disruption is a layer that has to be re-paid, re-bypassed, or re-engineered around. The economics of running a compound get marginally worse. The half-life of any specific piece of infrastructure shortens.

That is a real win. It is also not the win the headline implies.

Stakeholder landscape

Victims of pig-butchering fraud. Marginally better protected at the discovery layer (fewer fake accounts reaching them, faster). Not better protected at the persuasion layer, which is where the money is actually lost.
The US DOJ and Royal Thai Police. Political wins. The DOJ Strike Force now has its showcase operation; the Thai government can point to action without acknowledging the political-protection question at the compound layer.
Cambodia, Myanmar, Laos. Conspicuous absences. Any disruption that stops at the Thai border is hitting half the surface.
SpaceX / Starlink. Reputational repair on a story that had been building unfavourably. Expect more visible cooperation; expect quiet continued workarounds at the compound layer.
Meta, Microsoft, Google, Apple. Routine integrity work, packaged into a high-profile coordinated announcement. The marginal effort is modest; the political value is large.
Specialist intelligence firms (Silent Push, TRM Labs). Significant validation. Their inclusion in a DOJ-led operation moves them up the procurement queue for every government and large platform working this problem.
Coinbase. Useful brand association at a moment when crypto exchanges are still defending their compliance posture.
Zenlayer. A less familiar name to general readers — a CDN and edge-infrastructure provider whose inclusion signals the operation reached into hosting layers most takedowns do not touch.

Cross-layer implications

Satellite connectivity policy. Expect renewed calls in the EU, UK, and Australia for a "lawful access" framework that obliges satellite operators to disable terminals against verified criminal infrastructure. Starlink's participation here makes that conversation easier — and harder, because the company can now point to voluntary action as the alternative to mandate.
Crypto-exchange compliance. TRM Labs' inclusion deepens the case that on-chain analytics now sits inside the law-enforcement workflow, not adjacent to it. Exchanges without a credible tracing partnership are increasingly exposed.
ASEAN regional coordination. Thailand acting unilaterally with the US, rather than through ASEAN's existing cybercrime cooperation frameworks, is a quiet but real signal about how slow those frameworks have become.
Trafficking response. The 63 arrests are predominantly of operators, not of trafficked workers — who are themselves victims. The international response to compound trafficking still lags badly behind the cybercrime response. UNODC has been raising this for two years.

What this means for you — the general reader

This is the natural-audience framing for this story, not an organisational one. Three honest points:

Your immediate fraud risk has not meaningfully changed this week. The compounds rebuild. If you have been targeted by an investment-romance approach before, you will be again, possibly within the month.
The signals you should look for are unchanged. Unsolicited contact that quickly moves to "let me show you a trading platform"; emotional intimacy disproportionate to time elapsed; "guaranteed returns"; pressure to act before a market window closes; requests to move money via crypto. These are the durable indicators. They have not been engineered around because they cannot be — they are intrinsic to the model.
**If someone you know has been caught in this — particularly an older relative — the practical advice has not changed: do not lead with judgement, do not assume the money is recoverable, report to your national cybercrime agency (in Australia, ReportCyber via cyber.gov.au; in the US, IC3.gov; in the UK, Action Fraud), and engage a specialist victim-support service. The shame is the lock; conversation is the key.

For policy-engaged readers: the more interesting question opened by Disruption Week is whether your jurisdiction's regulatory posture toward satellite connectivity providers is going to remain "voluntary cooperation is sufficient." The answer this week is yes. The answer in eighteen months may not be.

Uncertainty ledger

Attribution of the 1.4 million account figure. The number is what the consortium reported; it is not independently audited. Past takedowns have been generous about counting.
Sustained impact. No public commitment exists to a sustained disruption tempo. The history of these operations is "big bang followed by silence". Watch for whether Strike Force activity becomes monthly or returns to annual.
Cambodia and Myanmar. The conspicuous absence of the two jurisdictions where the largest compounds operate is the central durability question.
Starlink's ongoing posture. SpaceX participating once is different from SpaceX maintaining a standing process for terminal disruption against verified criminal infrastructure. The latter has not been committed to publicly.
Crypto-recovery rates. Funds traced are not funds recovered. Public data on actual restitution to victims of these schemes remains weak.

Bottom Line

Disruption Week is a real coordination achievement and a modest operational one — the same week's victims will still be conned, the same compounds will rebuild, and the trafficked workers inside them remain almost entirely beyond the reach of the response. What changed this week is not the fraud economy; it is the public admission that dismantling it requires every layer of the internet to show up at the same table, including the satellite layer. That admission is more durable than the takedown.

Sources

SecurityWeek — "Over 1.4 Million Accounts Disrupted in Cybercrime Crackdown" (4 Jun 2026) — Tier 2
US Department of Justice, Scam Center Strike Force announcement (4 Jun 2026) — Tier 1
Royal Thai Police public briefing (4 Jun 2026) — Tier 1
UNODC reporting on Southeast Asian compound trafficking (2024–2026) — Tier 1 (context)
FBI IC3 Internet Crime Report 2025 (pig-butchering loss figures) — Tier 1 (context)