New York Times: Inside Cambodia's Money Laundering Empire — The Hidden Pipeline Behind Crypto Scams
TechFlow Selected TechFlow Selected
New York Times: Inside Cambodia's Money Laundering Empire — The Hidden Pipeline Behind Crypto Scams
Documents and insiders have exposed the inner workings of one of the world's largest money laundering networks.
Navigating Web3 tides with focused insightsBy Selam Gebrekidan & Joy Dong
Selam Gebrekidan is an investigative reporter for The New York Times based in Hong Kong.
Chang W. Lee is a photographer for The New York Times with 30 years of experience covering global events, currently based in Seoul.
Translation: TechFlow
Every few weeks, Cambodia’s night sky lights up with fireworks. Scammers set off these pyrotechnics to celebrate their latest big scam.
As the fireworks burst overhead, someone’s life savings may have just vanished. Victims might have fallen for a fake online romance scam or invested in a fraudulent cryptocurrency exchange. Regardless of the method, the money is already gone—funneled into a complex money-laundering network that moves billions of dollars at dizzying speed.
The FBI, China’s Ministry of Public Security, Interpol, and other agencies have all attempted to crack down on these scammers. Typically operating on social media and dating apps, they trick people into fake financial schemes or other cons. Telecom companies have blocked phone numbers, and banks have issued repeated warnings.
Yet the industry persists, powered by highly efficient money laundering operations. Unwitting victims around the world lose hundreds of billions of dollars annually. These illicit funds must be “cleaned” to conceal their criminal origins before being funneled into the legitimate economy. This underground system operates like a hydra—when governments cut it off in one place, it resurfaces elsewhere.
This shadowy world flickers into view in Phnom Penh, Cambodia’s capital and one of the world’s key hubs for money launderers. It’s even more visible in the coastal city of Sihanoukville, a notorious safe haven for fraudsters. Scammers run call centers from heavily guarded buildings or unfinished high-rises, while launderers and other criminals conduct business over spicy Chinese meals at seaside restaurants.
In March, outside the Golden Sun Sky Casino & Hotel in Sihanoukville, Cambodia, British and U.S. authorities linked the casino to cyberfraud and human trafficking.
We obtained a trove of documents that can be seen as a “money laundering manual.” We also interviewed nearly half a dozen scammers and their money-laundering accomplices. While the documents don’t point to specific scams or victims, they reveal a method of moving illegal funds that is nearly impossible to stop.
From The New York Times
To criminals, money launderers are as essential as getaway drivers in a bank heist. Without them, stolen cash cannot be accessed.
Once scammers successfully extract victims’ life savings, they need to swiftly move the money from one account to another, across borders, before victims realize the fraud and report it to banks or police.
Eventually, the money becomes “clean”—almost impossible to trace back to its original scam.
But how is this accomplished?
Following the trail, we unexpectedly uncovered ties to Huione Group, a financial powerhouse based in Cambodia.
This isn’t some back-alley operation secretly “washing black money.” Huione is a prominent company conducting legal business across Southeast Asia, with branches worldwide. Its QR code payment system is ubiquitous in Cambodia, used by consumers to pay bills at hotels, restaurants, and supermarkets. Huione’s advertisements line major highways, and its financial services span banking and insurance.
Yet Huione (pronounced “Hu-WAY-wahn”) consists of multiple affiliated companies—not all of which operate legally. According to documents and two anonymous individuals with direct knowledge of its operations, part of the group offers customized money laundering services. The two sources requested anonymity due to safety concerns. The company did not respond to requests for comment on these allegations.
Another affiliate openly operates an online black market that connects criminals and launderers. Although the exact scale of this marketplace is nearly impossible to measure, analytics firm Elliptic has linked it to $26.8 billion worth of cryptocurrency transactions since 2021. Given the industry’s extreme opacity, distinguishing legal from illegal activity is difficult, but Elliptic identifies the market as one of the world’s largest illicit online platforms.
Notably, Hun To, a cousin of Cambodia’s prime minister, serves as a director at a subsidiary of Huione Group.
According to a scammer, a money launderer, and research by analytics firms Elliptic and Chainalysis on its cryptocurrency transactions, Huione Group’s clients include major criminal organizations such as a Myanmar-based syndicate profiting from exploiting human trafficking victims.
Huione Group comprises multiple interconnected companies, including Huione Pay, headquartered in Phnom Penh, Cambodia.
Yet this money-laundering network operates with near impunity. To date, no government has sanctioned the organization. While Tether, a cryptocurrency company, froze some of the group’s accounts upon unspecified law enforcement requests, and Telegram shut down some of its channels, these measures had little lasting impact.
Here’s how it works:
Imagine you’re a scammer who has stolen someone’s life savings. You need a way to move those funds globally—and you need a “middleman.”
A middleman is a trusted intermediary who safely transfers your illicit funds to their destination. A good middleman has a global network of contacts known as “money mules,” capable of moving money within hours.
A money mule can be an individual or a shell company controlling local bank accounts or cryptocurrency wallets.
When you find a middleman, they deposit funds into an escrow account, ensuring they won’t abscond with the money during the transfer process.
Now you're ready to launch your scam.
Suppose you successfully trick someone into sending you $40,000.
Step 1: As the scam boss, you strike a deal with the middleman. In U.S.-targeted scams, the middleman typically takes 15% of the proceeds as payment for themselves and the money mules.
Step 2: The middleman locates suitable money mules and arranges the transaction for you.
Step 3: The middleman sends you the bank account details or cryptocurrency wallet information of the money mule, which you then pass on to the victim.
Step 4: The victim transfers $40,000 into the money mule’s account.
Step 5: The money mule moves the funds between accounts and ultimately converts them into cryptocurrency.
Step 6: The money mule takes a cut as a service fee and forwards the rest to the middleman. After deducting their own commission, the middleman delivers the remaining $34,000 to you.
Through this process, the entire money-laundering chain is completed, rendering the funds nearly untraceable and allowing the scam to proceed smoothly.
The “Brick Moving” Business
Huione Group profits at every stage of this process.
First, one of its subsidiaries—until recently called Huione Guarantee—operates a marketplace where scammers can find middlemen. Middlemen are crucial to the system, and their repetitive work is so mechanical that, according to anthropologist Yanyu Chen, who studies money laundering in Cambodia, Chinese speakers refer to the practice as “brick moving.”
This online marketplace consists of thousands of Telegram chat groups.
Some branches of Huione Pay advertise currency exchange services, including conversions between Tether and U.S. dollars.
Within these Telegram channels, anonymous users openly advertise money laundering services using barely concealed language. These posts are public—anyone with the Telegram app can see them. Some vendors also sell stolen personal data, spoofing apps, and other tools critical to scammers.
One channel named “Demand and Supply” had over 400,000 users, with hundreds of messages daily—including ads for money laundering services. After we sent questions to Huione Group and related parties in late February, Telegram said it deleted the channel. However, a similar channel quickly emerged, attracting about 250,000 members within a week.
Huione Guarantee did not respond to repeated requests for comment but denied any connection to the financial conglomerate Huione Group. The company even rebranded last October, removing the “Huione” name. Yet it told customers on Telegram that Huione Group remains one of its “strategic partners and shareholders.”
Second, the marketplace provides escrow services for laundering transactions. Why? Because even thieves distrust each other. To prove credibility, middlemen and money mules must pay a deposit to Huione Guarantee, which holds the funds in escrow. This assures scammers that no one will run off with the money—or if they do, they’ll lose their deposit.
Pricing depends on the type of crime generating the funds. For instance, scams impersonating government officials cost more because victims are more likely to report the fraud to banks or police.
Geography also affects pricing. In China, laundering fees can reach up to 60% of the illicit funds. Since 2020, China has tightened financial controls through nationwide crackdowns, arresting thousands and freezing large sums of money.
China and Cambodia have established cooperation agreements for joint law enforcement actions, resulting in the arrests of several criminals—mostly low-level operatives. Still, these efforts have not significantly disrupted the scam and money laundering industries.
Although middlemen conduct transactions privately, the group itself profits. It earns revenue by selling ads in public groups, charging maintenance fees for private groups, and taking small commissions from transactions. Most deals are priced in Tether cryptocurrency, though some occur via cash, gold, or bank transfers. (Last year, the marketplace even launched its own cryptocurrency.)
The platform disclaims responsibility for criminal activities on its website and Telegram channels. One post states: “All businesses in public groups are provided by third-party vendors and are unrelated to Huione Guarantee.”
Third, another Huione subsidiary, Huione International Pay, is more directly involved in money laundering. According to internal company documents and two individuals familiar with its operations, Huione International Pay functions as a middleman itself.
These documents and insiders say Huione International Pay operates with the efficiency of a professional bank. Its headquarters occupy a glass-and-concrete building in Phnom Penh, flanked by two giant panda statues at the entrance.
Huione International Pay operates within the group's headquarters in Phnom Penh, according to two individuals familiar with its operations.
Internally, one department handles client relations for scammers and other illicit actors; another monitors Telegram channels; and a third tracks money mule accounts spread across at least a dozen countries—all detailed in internal documents we reviewed.
Huione operates under a “veneer of legitimacy” in countries with extremely lax or nonexistent regulation, says John Wojcik, a threat analyst at the United Nations Office on Drugs and Crime (UNODC). He adds that Huione’s complex and opaque ownership structure poses challenges for targeted enforcement.
Still, he notes, even if Huione were shut down, others would quickly take its place.
“We’ve already seen competitors actively positioning themselves,” Mr. Wojcik said.
The National Bank of Cambodia—the agency regulating financial institutions—says the government is committed to ensuring the “security and transparency” of financial transactions and is working to comply with international anti-money laundering recommendations.
The central bank also stated that Huione’s payment services (its QR-code-based system) failed to meet renewal requirements, so its Cambodian license was not renewed. In response, Huione swiftly announced plans to register its business in Japan and Canada.
Tracking the Money Mules
Money mules are individuals who operate bank accounts and digital wallets.
According to Elad Fouks, a Chainalysis expert who monitors on-chain fraud, some money mules open bank accounts using fake identities—a task made easier by advances in artificial intelligence.
Money mules spread deposits and withdrawals across multiple transactions to reduce detection risk. For example, transactions below $10,000 typically fly under the radar. Accounts and virtual wallets used for laundering are often active for only weeks or months.
However, the highest risks aren’t borne by the middlemen or scammers—but by the money mules themselves, who are most likely to be caught.
A U.S. court case reveals how this system works. The main defendant, Daren Li, ran a money mule network, registering 74 shell companies in the United States to launder nearly $80 million. These companies opened accounts at institutions like Bank of America. Once victims deposited funds, the money was rapidly transferred to a bank in the Bahamas, then used to purchase Tether cryptocurrency held on Binance.
Within days, the funds were moved again to another digital wallet.
According to records we reviewed, Daren Li worked with Huione International Pay on money laundering. However, both the FBI and the U.S. Secret Service declined to confirm this link. Mr. Li pleaded guilty last November to conspiracy to commit money laundering.
Payday
Imagine again that you’re the boss of a scam operation. Something goes wrong: your money mule gets arrested; the bank freezes his account; or he runs off with the cash.
In such cases, your middleman steps in to mediate disputes.
If the fault lies with the money mule, the middleman helps retrieve the escrowed deposit and returns it to you. If no party is at fault, the loss is simply treated as a cost of doing business.
But if everything goes smoothly, you reach “payday,” usually paid in Tether. You can then convert these Tethers into U.S. dollars via casinos or Huione’s payment system.
British authorities say buildings near the Golden Sun Sky Casino & Hotel in Sihanoukville once housed large-scale scam operations.
You can use this money to pay employees.
Today, scam operations mimic professional enterprises, complete with marketing, sales, and HR departments employing thousands. Many workers are actually victims of human trafficking, forced to defraud distant targets. Some scam organizations even replicate 19th-century company towns, paying wages only after a full work season—until then, employees rely on company credit lines.
These salaries fuel restaurants, casinos, and brothels within the closed-off zones where scammers live, all profiting from employees trapped against their will.
Scam payrolls also include attractive models hired to participate in video calls that lure victims into sending money. Some models even use AI-powered face-swapping technology.
Like everyone else, scammers must pay rent—not just for housing, but also for “protection.”
They also pay for backend scam services, many available through Huione’s “marketplace.” Scammers hire software developers to build fake investment platforms. They require internet and computing infrastructure. They pay hackers to steal potential victims’ personal data—national ID numbers, credit card info, location data, even past hotel booking records.
Part of the money flows to luxury car dealers, part to real estate purchases in London and Dubai.
And of course, some funds go toward fireworks.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@nytimes
