{"id":"gpu-diversion-pass-through-companies-64275","slug":"gpu-diversion-pass-through-companies-64275","title":"How Smuggled GPUs Move Through Real Companies","description":"Export controls bar advanced AI chips from China, but illicit networks bypass restrictions using real, operational businesses across Southeast Asia rather than empty shell companies. Investigating recent federal indictments and enforcement actions across Singapore, Malaysia, and Thailand reveals how intermediaries exploit cross-border licensing gaps. Simple paperwork tells—like freight forwarders funding multi-million dollar purchases and unverified buyer identities—ultimately betray these high-stakes GPU diversion routes.","excerpt":"Freight forwarders, not buyers, wired over $176 million for restricted Nvidia chip servers, unraveling a major export diversion scheme.","pubDate":"2026-11-09T22:27:01.887Z","tags":["sanctions","supply-chain","ai-security"],"heroImage":"https://files.myweirdprompts.com/covers/gpu-diversion-pass-through-companies-64275.png","podcastAudioUrl":"https://episodes.myweirdprompts.com/audio/gpu-diversion-pass-through-companies-64275.m4a","podcastDuration":"22:09","episodeNumber":6519,"transcript":"Corn: Another week, another chapter of the great GPU heist saga. Daniel's back on the trail, and this time he's chasing the bit nobody films: the paperwork. Taiwan builds the hardware and, from the seller's side, everything about Taiwan is above board. China is locked out by export controls. In between, a trade has grown up in Singapore, Malaysia and Thailand, where companies buy servers on paper and quietly send them on. Daniel's question is simple and hard at the same time: what actually is a pass-through company, how does the deceit work mechanically, and how does anyone get caught?\n\nHerman: And the first thing to say is that \"pass-through\" is not a term you'll find in a statute anywhere. It's prosecutor shorthand. When the FBI's New York office described the Supermicro co-founder case in March, they said the defendants \"used a pass-through company to conceal their misconduct and true clientele list\". That's the FBI describing a thing, not citing a law.\n\nCorn: We covered that case, so I'll leave it at the one line.\n\nHerman: Right. And BIS, the export-control side, doesn't even use the word. They say diversion, transshipment. And I think the vocabulary split is actually telling you something: the export people are asking where the goods went, and the prosecutors are asking who lied on the way.\n\nCorn: So before the mechanics, the definition. Daniel's framing it against shell companies, which we've done before, and the distinction is the whole ballgame.\n\nHerman: It is. A shell company has no operations. No warehouse, no staff doing anything, no real business. It's a name on a registry that exists to hold money or sign things. A pass-through company is the opposite in one specific way: it's a real, operating business that gets placed in the paper trail as the end customer, and then the goods move on. Now, that's an editorial reading, not a legal definition, I want to be honest about that. But it's the distinction that matters for understanding why these schemes are so hard to catch.\n\nCorn: Because the audit passes.\n\nHerman: A shell fails a basic vendor check. There's no website, or there's a website and nobody answers the phone. A pass-through has a phone, a receptionist, a bank account, a shipping address, a business selling something real. The deception isn't that the company doesn't exist. It's that the company isn't the actual customer.\n\nCorn: The lie isn't forged. It's borrowed.\n\nHerman: That's a nice way to put it, and the borrowing is exactly what makes it durable. Let's walk the paper route, because that's where this lives or dies. Take the case the DOJ brought in March against Stanley Yi Zheng, a Hong Kong national, and two Americans, Matthew Kelly and Tommy Shad English. All alleged, scheme starting May 2023. In October 2023, English allegedly ordered seven hundred and fifty servers on behalf of a Thailand-based company. About a hundred and seventy million dollars' worth. Six hundred of those servers held export-controlled Nvidia chips.\n\nCorn: He signed the end-user form himself, I assume.\n\nHerman: He did. Signed a form saying the servers were not destined for a controlled country. And here's the tell that killed it: the vendor noticed that nobody from the Thai buyer was on the email thread. Zheng's China-based company was all over the thread. The actual customer couldn't stay off its own purchase order.\n\nCorn: The heist genre has really declined. The old crews never CC'd the vault.\n\nHerman: The buyer couldn't be verified, the order collapsed in January 2024, they tried again for five hundred servers, that failed too. Zheng was arrested on the twenty-second of March this year, the other two surrendered days later.\n\nCorn: And on the money side, the second case.\n\nHerman: The second case is Greg Lui, owner of Earthmade Computer in the City of Industry, California. Indictment returned end of September, arrested the first of October. Allegedly about three hundred million dollars of servers with Nvidia GPUs, 2023 to 2024. The paperwork named buyers in Malaysia and Singapore, where no US licence was needed at the point of sale. Freight forwarders then moved the servers on to China. Nvidia is not accused of anything here.\n\nCorn: Three hundred million in servers, and the tell is in the bank statement.\n\nHerman: Yes. Earthmade allegedly received more than a hundred and seventy-six million dollars from two Malaysia-based shipping companies. The money came from the logistics firms, not the supposed buyers. Which, if you're an auditor, is the sound of the whole story falling apart, because real customers pay and freight companies carry. Here the freight companies were doing both.\n\nCorn: The movers were the buyers, on paper and in the ledger.\n\nHerman: There's a detail I want to flag carefully because it comes from a secondary summary of the indictment, not the document itself: one order of twenty-seven servers, about seven and a half million dollars, went to Kuala Lumpur in January 2024, and a co-conspirator allegedly confirmed all twenty-seven went on to a Chinese buyer. And there was a hundred-server H100 order worth more than twenty-two million, naming a Malaysian buyer whose CEO, one \"Jackie Lui\", was allegedly a purchased identity.\n\nCorn: A CEO you can buy.\n\nHerman: A person who exists on paper, has an ID, can be verified, and is for sale. I find that detail more chilling than the dollar amounts, honestly. It means the audit isn't checking whether you're real. It's checking whether someone spent enough to appear real.\n\nCorn: I said on the heist episode that if I were running this I'd use one route and a bigger lie. This is the bigger lie, done on a budget.\n\nHerman: Bloomberg also reported in May that a Thai client in these investigations is linked to a Bangkok firm called OBON, the company behind Siam AI, which took roughly two and a half billion dollars of Supermicro servers, with Commerce reportedly halting shipments. OBON isn't a defendant, and Alibaba denies any relationship and says it's never used banned chips. So the Thailand thread is very much alive.\n\nLarry: Friends, are you tired of shell companies that do nothing but sit on paper? Then you need PassThrough Pal, the only monthly subscription box that delivers a brand new real, operating company to your door every single month, complete with a factory floor, a coffee machine and a receptionist named Brenda who genuinely believes she works there.\n\nLarry: Choose the Paper Trail tier for one company, or the Chokepoint Elite tier for three companies and a freight forwarder who will look the other way for a small fee, and remember, cancellation requires a notarised form signed by every member of your board in person at our office, which is a shell company, so good luck finding it.\n\nCorn: So the intermediary on the paperwork is a real company with real operations, and that's exactly what makes it a pass-through rather than a shell. It has a loading dock.\n\nHerman: I... have a PassThrough Pal subscription. Corn, I'm not going to defend it. Brenda sends me a birthday card every year and I have not found the courage to tell her the company was discontinued in March.\n\nCorn: Moving on. Why those three countries? That's Daniel's second question, and I don't think the answer is what people assume.\n\nHerman: No, and the misconception is that Singapore, Malaysia and Thailand were chosen because they're somehow lawless. They're not. They're legitimate trading hubs with world-class logistics infrastructure. Singapore runs one of the busiest transshipment ports on Earth. The choice has nothing to do with lax morals and everything to do with a licensing gap. US export controls on advanced chips applied to China, not to Malaysia or Singapore. So a shipment to Kuala Lumpur needed no US licence at the point of sale. Perfectly legal sale, wrong final address.\n\nCorn: The paperwork was clean because the law hadn't arrived yet.\n\nHerman: And the enforcement lag. Malaysia only introduced a Strategic Trade Permit requirement for US-origin high-end AI chips in July 2025. Before that, the paperwork on the Malaysian side was lighter. You had a window where the US restricted the goods but the countries in the middle hadn't built their own controls, and the trade grew up in that window.\n\nCorn: Singapore is the interesting one, because the case there shows the gap working in the open.\n\nHerman: It really does. February 2025, Singapore charged three people, Singaporeans Aaron Woon and Alan Wei and Chinese national Li Ming, with fraud by false representation, lying to Dell and Super Micro about where the servers would end up. Prosecutors put the transactions at about three hundred and ninety million dollars. Police looked at twenty-two people and companies. But here's the thing: Singapore charged fraud against the server makers, not an export offence, because the servers were not restricted under Singapore law at the time.\n\nCorn: So the same conduct was a lie in one jurisdiction and a non-event in another.\n\nHerman: The deception was illegal, the shipment wasn't. A minister said the servers may have contained Nvidia chips, and that's the whole paradox in one sentence: everybody could see where this was likely heading, and nobody's export law had been broken locally.\n\nCorn: Where does that case stand now?\n\nHerman: There have been further charges this year, including allegations of misleading Asus, and Li Ming is accused of posing as an employee of a company called, and I want you to sit with this name, \"Luxuriate Your Life\" in dealings with Super Micro. Wei pleaded not guilty in July. Authorities seized a bungalow reportedly worth fifty-five million Singapore dollars plus about a million in bank funds. No trial date that I've seen. I'd treat the newer details as reported rather than settled.\n\nCorn: \"Luxuriate Your Life\" is my favourite corporate name in this entire saga, and the saga includes a company whose CEO was purchased by the pound.\n\nHerman: Daniel's third question is how these get caught, and I love the answer because it's so unglamorous. There's this assumption that the chips are tracked, beamed from the board like a lost phone. Nvidia says it can't track hardware after sale, and puts diversion at under half a percent of its products. What actually catches these schemes is human tells.\n\nCorn: The tells we've seen so far are almost embarrassing.\n\nHerman: They're office tells. The real customer on the email thread. Payments arriving from freight companies instead of buyers. A buyer nobody can verify. A CEO whose identity was bought. Each scheme is built to pass one vendor audit, and it passes it. What it isn't built for is a second look, a subpoena for the bank records, someone asking why the shipping company is the payee.\n\nCorn: So the second look is the whole game.\n\nHerman: And the government knows it. In May 2025 BIS put out guidance listing diversion red flags, and one of them has stuck with me: a customer that only began ordering advanced chips after the October 2022 controls. Meaning, a company with no history in this trade suddenly wants GPUs the moment they became controlled. That's not a technical signal. That's someone reading a pattern.\n\nCorn: The pattern is the market. That's the C4ADS piece.\n\nHerman: The C4ADS report, \"Covert Compute\", out in September, is the systemic view, and it moves this from a few colourful defendants to an actual market. They documented about fifty shipments of restricted GPUs between 2023 and 2025, routed through Vietnam, India and Malaysia to Hong Kong and China, about thirteen point four million dollars. Smaller numbers, but those are the ones they could trace.\n\nCorn: The university part is the detail I keep chewing on.\n\nHerman: Chinese universities bought at least fifty-six restricted chips, about one point seven million dollars, between July 2025 and January of this year, bundled into larger contracts through intermediaries. So the demand goes all the way down the food chain, not just hyperscalers and spy agencies, faculty procurement offices. And Megaspeed, which we covered in the spy-story episode, imported about four point six billion dollars of goods from 2022 to 2025 through layered ownership.\n\nCorn: Which loops us back to Taiwan, because Daniel's angle was the awkward position it's in. Source of the hardware, enforcer of the rules.\n\nHerman: Taiwan is both, and it's awkward. It added Huawei and SMIC to its strategic high-tech export entity list in June 2025, which means Taiwanese exporters now need a permit to ship to them, but experts quoted by CNN called the move largely symbolic, since the US had listed both entities years earlier. And the Keelung indictment, which we covered, went after nine individuals over a hundred and thirty servers, including an Nvidia Taiwan employee and two Supermicro Taiwan employees. The companies weren't charged. Taiwan's prosecutions target insiders, not firms.\n\nCorn: The one country that can't sanction its way out of being the source.\n\nHerman: So here's my question for you, Corn, on the structural side. Which matters more in this trade, the geography or the paperwork? Because I keep going back and forth.\n\nCorn: Paperwork, and it isn't close. Geography decided where the warehouses went, but the whole trade exists on forms. Taiwan can be entirely legitimate on one side of a shipment because the form names a buyer in Kuala Lumpur. Distance didn't do that. A signature did.\n\nHerman: I half agree, and the half I'd push on is that the paperwork only works because of where it's signed. The form is a promise about geography. If the form named a buyer in a town with no port, no airport and no data centres, nobody would believe it. Singapore works because Singapore works, if that makes sense. The world's best port is the best cover story.\n\nCorn: Fair. The lie needs a truthful setting.\n\nHerman: Which is why the misconception that these countries are shadowy annoys me. They're the opposite of shadowy. They're extremely well-run, and that's the point.\n\nCorn: And then Congress shows up late with the Chip Security Act.\n\nHerman: H.R. 3447, Representative Huizenga, Senate version from Tom Cotton. Passed House Foreign Affairs forty-two to zero in March. No floor vote that I've found. It would make Commerce require location verification on advanced chips, without prescribing the method, which is Congress doing its favourite thing, demanding an outcome and declining to design it. The Semiconductor Industry Association opposes it, and you can guess why: verification on chips that go into servers that go into racks that go into rented floorspace is not a small ask.\n\nCorn: And Nvidia's answer is that it can't track hardware after sale, and that diversion is under half a percent of what it ships.\n\nHerman: Under half a percent of an enormous number is still an enormous number.\n\nCorn: That's the trade in one line. The percentage shrinks, the pile doesn't.\n\nHerman: And I'd want to stress, across all of this, every case we've named is allegations. Charges, not convictions. Zheng, Kelly, English, Lui, the Singapore three, none of it has been tried.\n\nCorn: What strikes me is that the scarcity now has a black market with a compliance department. And the question I keep circling is the freight forwarder's role. In the Lui case, the shipping companies weren't just carrying, they were paying. That's a strange arrangement to build.\n\nHerman: It is, and I don't think people realize how central the freight forwarder is to the whole design. The forwarder is the entity that physically touches the goods after the clean sale, so it's the hinge between the legal shipment and the illegal one. My guess is that some of these forwarders are complicit and some are just moving boxes marked for a destination, and the prosecutions will sort out which is which, but the design needs them either way.\n\nCorn: The getaway driver, basically.\n\nHerman: The getaway driver, if the getaway driver filed everything in triplicate.\n\nHilbert: No, it's better. Herman called them a hinge. They're not a hinge. Every freight forwarder I ever dealt with was a man with a filing cabinet and strong opinions about bills of lading, and he cared about the customs code the way Herman cares about validation studies. Meticulous. Boring. That's what makes them good cut-outs. The scheme doesn't work despite the logistics trade, it works because the logistics trade moves things exactly as described on the paperwork. Nobody re-checks a well-made document.\n\nHerman: That's the part I hadn't given enough weight. The paperwork is professional-grade because the people doing it are professionals.\n\nHilbert: I did a stretch in a warehouse job in Southeast Asia, part of it was repacking electronics shipments. Boxes come in with one set of labels, get opened, go out with different ones. Nobody at the dock asked anything because the paperwork was always in order. There was a man at the customs office, Mr. Tan, took eleven weeks to process a permit that should have taken ten days, and nobody thought that was strange either. I kept one of the original labels off a repacked box. I have forty-one of them, folded in a notebook. These claws aren't made for peeling them, you do it with a stanley knife and patience. I don't think they're evidence of anything. I just didn't like the way nobody wrote anything down.\n\nCorn: You kept forty-one labels from shipments you thought were wrong and consider that the unremarkable part.\n\nHilbert: The unremarkable part is that everyone else threw theirs away.\n\nHerman: The repacking is the detail I'd underline, though. That's the moment a pass-through becomes physical, the box opened, the label changed. It's also the most evidenced moment there is. Cameras, manifests, signatures, a man with a stanley knife who remembers.\n\nHilbert: Mr. Tan wouldn't have noticed a camera. He had a fan and a ledger.\n\nCorn: And the second look finds the man with the notebook every time. In the cases we've walked through, the tell is never the chip. It's a person who was in the room.\n\nHerman: Which is the honest reason I'm skeptical of the Chip Security Act, much as I want to like it. Location verification sounds decisive until you ask what certifies the location. A device can report where it is. A form can say where it will be. Both are statements, and statements are what this whole trade runs on.\n\nCorn: If the bill passes, my guess is the deception moves one step earlier, to the paperwork that certifies location. The purchased identity gets a cousin: the purchased address.\n\nHerman: And the price gap still exists, so the intermediaries still exist. This is a market response to a control. That's the thing about whack-a-mole, the mole isn't malfunctioning. The mole is arbitrage.\n\nCorn: The one thing I'd take from this episode: the pass-through survives because it's real. Every audit in this story was passed honestly by a company that existed, with real staff and a real address, and the lie was only ever about who the customer actually was. The check that catches it isn't a better database, it's somebody asking why the freight company paid the invoice.\n\nHerman: And the second look is cheap, which is the encouraging part. The email thread that unravelled a hundred and seventy million dollars cost nothing to read.\n\nCorn: So we leave it there, on the mole and the paperwork. One thing worth watching: whether the Chip Security Act gets a floor vote, and whether location verification, if it ever arrives, turns out to be the thing that ends the trade or just the newest form to sign.\n\nHerman: If Hilbert's warehouse taught us anything, the newest form will be filled in beautifully.\n\nCorn: If you enjoyed this one, try episode eighteen, Beyond the GPU; episode sixteen, On Deepfakes, SynthID, And AI Watermarking; and episode two, Local STT For AMD GPU Owners. This has been My Weird Prompts. If you enjoy the show, the website is my weird prompts dot com, and a review wherever you listen helps more than you'd think.\n\nHerman: See you tomorrow, everyone.\n\nCorn: See you tomorrow.","showNotes":"Efforts to enforce export controls on advanced artificial intelligence semiconductors have increasingly run up against the murky mechanics of pass-through companies. Unlike empty shell corporations, pass-through entities maintain real facilities, active bank accounts, and legitimate commercial footprints, allowing illicit hardware orders to survive preliminary vendor screening. Intermediaries take advantage of regional licensing gaps across trading hubs like Singapore, Malaysia, and Thailand, where shipments originally required no export permits at the point of sale before being diverted onward to China.\n\nYet, despite sophisticated disguises, these multi-million-dollar server operations unravel through mundane clerical missteps: freight forwarders unexpectedly wiring purchase funds, excluded buyers remaining copied on internal emails, and fabricated corporate identities failing deeper scrutiny.","promptSanitized":"One more instalment in the GPU heist saga, and this is the part I find most intriguing: the Asia ring. Taiwan is where so much of this hardware gets made and assembled, and from Nvidia's point of view Taiwan is perfectly legitimate. China is cut off by US export bans. In between, a whole trade has grown up of so-called pass-through companies in places like Singapore, Malaysia and Thailand that buy the servers on paper and quietly send them on. We've talked about shell companies before, but what exactly is a pass-through company, how does this particular brand of deceit and mischief actually work, and how do these schemes get caught?","transcriptUrl":"https://episodes.myweirdprompts.com/transcripts/gpu-diversion-pass-through-companies-64275.md","url":"https://myweirdprompts.com/episode/gpu-diversion-pass-through-companies-64275/","_links":{"self":"https://myweirdprompts.com/api/episodes/gpu-diversion-pass-through-companies-64275.json","html":"https://myweirdprompts.com/episode/gpu-diversion-pass-through-companies-64275/","audio":"https://episodes.myweirdprompts.com/audio/gpu-diversion-pass-through-companies-64275.m4a"}}