Everything you're about to read is based on verified reporting. Court documents, company disclosures, cybersecurity research, and major news outlets. The facts are real. But to put you inside the experience, we've dramatized certain moments. Some of the people in this story were never publicly identified, so we've created composite characters to bring them to life. We do this because cybercrime isn't just about data. It's about people.

It's April 12th, 2024, and we're inside the Hartsfield-Jackson Atlanta International Airport, the busiest airport in the world.

A 41-year-old man named Daren Li unbuckles his seatbelt in first class, stands, stretches, and pulls his bag from the overhead bin. It's been a long flight. He adjusts his jacket and steps into the aisle. Another trip, another country. This was routine for him.

Daren had two passports. One from China, where he was born and raised, and one from a tiny Caribbean island called St. Kitts and Nevis, where you can buy citizenship if you have the cash and Daren Li definitely had the cash. He kept homes in Cambodia, Dubai, and mainland China. He moved between countries the way most people move between rooms.

He walked off the jet bridge and into the airport terminal at a normal pace, past the gate, past the shops and restaurants, heading straight towards baggage claim. He was just another business traveler in a sea of business travelers. Outside looking in, nothing about him stood out. And for Daren, nothing about this day felt different from any other.

Then someone grabbed his arm.

The grip was firm. He instinctively pulled away, but it was strong. Before he could process what was happening, he felt pressure on his other arm. He looked over his shoulder and saw men in uniform closing in from every direction. Federal agents. Their uniforms said Secret Service. They had him boxed in right there in the middle of the terminal while other travelers walked by staring as he was read his rights.

The U.S. Secret Service had been building a case against him since September of 2022. They spent almost two full years investigating him. They followed stolen money through 74 fake companies. They traced tens of millions of dollars from American bank accounts to offshore accounts in the Bahamas. They had chat logs, transaction records, the whole picture. And they had been waiting patiently for the day this man set foot on U.S. soil.

The story of how Daren Li ended up in handcuffs starts with people like Molly.

Molly isn't her real name. The court documents connected to this case don't reveal victim identities. But for the sake of the story, we'll call her Molly.

Molly was sitting at home on the couch watching TV, half paying attention to whatever was on and half daydreaming about being somewhere else. COVID had her feeling isolated and lonely. Those months of being cooped up inside do something to you, and you don't even fully realize how much it's affecting you until something small reminds you.

Her phone vibrated. She looked at the screen. A text from a number she didn't recognize.

"Hey, is this Sarah?"

That little dopamine hit from the notification, that split second of someone reaching out, faded quickly into a pinch of sadness when she realized it wasn't anyone she knew checking in on her. Slightly annoyed, she texted back that they had the wrong number and put her phone face down on the pillow beside her.

A few seconds later, her phone vibrated again. Same number.

"Sorry about that. Well, how's your day going?"

Molly stared at the message and squinted. Why would this random person care about how her day was going? Normally she would have ignored something like that. But maybe being cooped up inside for months had made her crave some kind of social interaction, even if it was with a stranger over text. So she texted back. She said she'd had better days. The person responded with something warm, something light. Nothing weird, nothing forward. Just a normal human response to someone saying they'd had a rough day.

And without even thinking about it, Molly replied again.

The next morning, the person texted her. A simple good morning, hope today's better than yesterday. Molly read it and smiled a little. She texted back. And just like that, day two of a conversation started with someone she'd never met.

Over the next few days, it became a thing. The stranger asked what she did for work, what part of the country she was in, what kind of food she liked, what shows she'd been watching. Normal small talk. These are like the conversations you'd have with someone random at a coffee shop. Nothing about it felt off. Nothing about it felt calculated. It was just two people who strangely connected and actually got along.

A few days turned into a week. A week turned into two. And somewhere in there, without Molly even realizing it, the stranger became part of her daily routine. She woke up to good morning texts. She got "how was your day" messages in the evening. When she mentioned something small, like a rough day at work or a restaurant she wanted to try, the person remembered and brought it up days later. They asked how it went. They followed up in a way that a real friend would.

This wasn't a scam that happened in a day. This wasn't someone calling and demanding a wire transfer right then and there. This was weeks. Weeks of someone showing up in her messages, being consistent, being thoughtful, remembering the little things. It didn't feel like a con. It felt like someone actually cared about her. Molly started looking forward to hearing from this person. She noticed when they didn't respond for a few hours. She caught herself wondering what they were up to.

Then one day the conversation shifted. The person mentioned, almost in passing, that they'd been doing some investing. Crypto, specifically. And it had been going really well. They weren't pushy about it at all. They just mentioned it the same way a friend would mention something exciting going on in their own life. Molly asked a few questions out of curiosity, and the person answered casually. They dropped a few numbers, talked about how it had changed things for them financially, and then the conversation moved on.

A few more days went by, and this time Molly brought it up. She asked more questions.

“How does it work?”, “What platform are you using?”

And the person, still not being pushy, offered to show her what they'd been using.

They sent Molly a link.

Molly clicked the link and the website looked professional. It looked clean. What Molly didn't know was that this was a near-perfect copy of a real exchange called CoinZoom. Same user interface, same design, same branding. To someone unfamiliar with the real company, there was no reason to think anything was off about this fake one.

She created an account and put a few hundred dollars in just to test it out. Almost immediately, her dashboard showed a return. Her money was growing right there on the screen. She could see it. A few days later, she put in more. A few weeks after that, even more. The numbers kept climbing. And every time she checked, she felt a little more confident. She was making money. This was working. The friend who showed her this platform was right.

She started to think about what this could mean for her life. Maybe she could pay off some debt. Maybe she could take a few trips. Maybe THIS was the thing that could change everything.

Over the next few months, Molly deposited everything she had. All of her savings, money she pulled from other accounts, money she borrowed. Her total investment crossed into six figures. But on her screen, she was wealthier than she'd ever been in her entire life.

And then one day she tried to withdraw some money.

Nothing happened.

She tried again. The site gave her an error. She tried a third time and the platform locked her out completely. She reached out to her contact, the person she'd been texting almost every single day, the person she now considered her friend.

No response.

She sent another message. Nothing. She called the number. It went nowhere. She went back to the platform. It was now gone. The URL led to a blank page and the website didn't even exist anymore. The money, the account, the portfolio she watched grow for months, the person she trusted; All of it, gone.

The realization crept in slowly. She started going back through the conversations in her head, replaying the moments, looking for signs she missed. And the weight of it, the embarrassment, the anger, the loss, it all came crashing down at the same time.

Her head began to swim. Her stomach started to churn. She felt sick. She didn’t didn’t know who to call, or what to say.

All she could do was cry..

Proton Mail offers what others won’t:

We don’t scan your emails. We don’t sell your data. And we don’t make you dig through settings to find basic security. Proton is built for people who want control, not compromise.

Simple, secure, and free.

Explore Proton’s benefits

Molly was one of at least 174 people this happened to. Some lost $30,000. Some lost $200,000. One person, one single person, lost $1.5 million over the course of a few months. And every dollar they sent ended up flowing through a system built by a man they'd never heard of.

That man was Daren Li.

He wasn't on the phones. He wasn't the one texting Molly or any of the other 173 victims. He never sent a message or pretended to be anyone's friend. That wasn't his job.

His job was what happened after the money was stolen. His job was to make it disappear. He was the money launderer, and he was exceptional at it.

By the time a victim hit deposit on that fake platform, the money was already in motion. It landed in a U.S. bank account belonging to a shell company that didn't actually exist. Daren and his crew set up 74 of these shell companies across the country. They had legit-sounding names like CMD Export and Import and Crestview Services. Incorporation papers, tax IDs, business bank accounts. If you looked them up, everything checked out. But there were no employees, no products, no offices. They were hollow. They existed for one purpose and one purpose only: to catch stolen money and move it along.

From there, the funds got wired to the Bahamas, to an account at an offshore bank called Deltec. Once the money hit that account, it was converted into Tether, a cryptocurrency pegged to the U.S. dollar. After that, it was sent to crypto wallets that Daren controlled.

By the time a victim like Molly realized something was wrong and called her bank, her money had already crossed three borders and changed form twice.

Daren ran the whole operation behind a screen through encrypted messaging apps like Telegram. He had a partner on the ground in the U.S., a 38-year-old named Yicheng Zhang who lived in Temple City, a quiet suburb outside of Los Angeles. Zhang handled the day-to-day. He managed the operatives who opened accounts, moved deposits, and kept the paper trail looking clean. Daren coordinated everything from above, traveling constantly, never staying in one place long enough to leave a footprint. Cambodia one week, Dubai the next. Always giving orders through encrypted messages, moving money across borders from whatever hotel room or apartment he was sitting in.

Investigators traced $73.6 million through that system. But that was just what prosecutors could tie to specific victims with specific losses. The real amount that flowed through Daren's network was probably four or five times that. Most people don't report that they've been scammed. They're too ashamed or too embarrassed to admit it. So investigators can't tie every dollar to a victim.

The investigation had been running quietly for almost two years. It was a coordinated effort between the Secret Service, Homeland Security, and international law enforcement in Cambodia, all working together, following the blockchain, tracing the shell companies, pulling financial records, and building the case in a way that didn't leave room for doubt.

That cooperation is what brought them to the Atlanta airport on April 12th, 2024. Two years of work across multiple continents, and it ended right there in the terminal.

About a month later, they picked up Zhang at his house in Temple City. That quiet neighborhood with nice houses and manicured lawns. Nobody on that street had any idea the guy living next door was laundering tens of millions of dollars for a criminal syndicate operating out of Southeast Asia.

When investigators went through the seized phones and devices, the case blew wide open. They found chat logs where Daren personally laid out commission structures for his entire team. They found conversations about which shell companies to use for which batches of money. They found victim data, transfer records, and payment schedules. They even found a video of one of his guys recording himself calling a U.S. bank to set up a fraudulent account.

In November of 2024, Daren stood in a federal courtroom and pleaded guilty. One count of conspiracy to commit money laundering. He was looking at 20 years, the statutory maximum.

His sentencing was scheduled for early 2025, but it kept getting delayed and pushed back. While the courts worked through the calendar, Daren was placed on supervised release with an ankle monitor. He had regular check-ins with a federal officer. Standard procedure for someone on house arrest.

In December of 2025, Daren Li cut his ankle monitor off and disappeared.

A reporter from OCCRP tracked him down by email after the sentencing. Daren told the reporter the verdict was "unjust" and that he'd been "deceived and induced to plead guilty." He said his legal team had filed an appeal.

The Department of Justice put out a statement saying they would work with international law enforcement to track him down and bring him back. But the reality is that Daren has money, connections, and years of experience moving between countries without leaving a trace. He’s a man that spent his entire career making things disappear. Money, identities, and now himself.

If a stranger reaches out to you, whether it's a text, a DM, a dating app message, or whatever, and after a few weeks the conversation turns to investing or crypto, that's a red flag. Move forward very cautiously.

If you're investing on any platform, verify that it's real before you put a single dollar into it. Go to the website yourself. Don't click a link someone sent you. Look it up independently. Check if it's registered with the SEC or FINRA. If you can't find it through those official channels, that should tell you everything you need to know.

Talk to someone. These scams work because the victim is usually isolated or not telling anyone what's happening. The moment you bring in an outside perspective, whether it's a family member, a friend, a coworker, or a financial advisor, the spell starts to break. If something feels too good to be true and you find yourself not wanting to tell anyone about it, that's exactly the moment you should.

If you or someone you know has been a victim, report it to ic3.gov. That's the FBI's Internet Crime Complaint Center. The more reports they get, the better the data. The better the data, the better the chances of catching the next Daren Li before he disappears.

If you're running a company or managing a team, check out our security awareness training at dontgetgot.co/training. Weekly stories delivered to your team's Slack about the threats targeting your industry. People learn from stories and forget slideshows.

Listen to the full audio version on the podcast.

Source Notes: Daren Li is a real person who pleaded guilty in federal court. Yicheng Zhang is a real co-defendant who has pleaded not guilty. "Molly" is a composite character based on victim descriptions in court filings and DOJ press releases. Some dialogue and scenes have been dramatized. Li was sentenced in absentia on February 9, 2026 and remains a fugitive. Sources include DOJ press releases, U.S. Secret Service statements, court filings from the Central District of California, and reporting from The Record, CoinDesk, OCCRP, and The Block.