On-Chain "Phantom": The HV-Money Behind Over $55 Billion in USDT Transactions
TechFlow Selected TechFlow Selected
On-Chain "Phantom": The HV-Money Behind Over $55 Billion in USDT Transactions
As global efforts to combat online fraud, underground payment networks, and illegal cross-border money laundering continue to intensify, the platform named HuionePay has attracted significant regulatory scrutiny.
Navigating Web3 tides with focused insightsAuthor: Lisa
Editor: Liz
Data statistics: SlowMist AML Team
As global efforts to combat online fraud, underground payment networks, and illegal cross-border money laundering intensify, the platform known as HuionePay has drawn significant regulatory scrutiny. It is suspected of being used for receiving, transferring, and cashing out fraudulent funds—particularly through frequent USDT transactions on the TRON blockchain.
To further reveal its on-chain behavioral patterns, SlowMist conducted an in-depth analysis of HuionePay’s USDT deposit and withdrawal activities on the TRON chain, leveraging MistTrack—an on-chain anti-money laundering and tracking tool—and public blockchain data via a Dune analytics dashboard.
Note: The data in this article covers the period from January 1, 2024, to June 23, 2025, sourced from the SlowMist-built data dashboard: https://dune.com/misttrack/huionepay-data.
On-Chain Fund Flows
Total Deposit and Withdrawal Amount (Sum)
-
Total withdrawals: 57,246,854,379 USDT
-
Total deposits: 54,475,887,524 USDT
Both deposit and withdrawal amounts exceed 50 billion USDT, indicating substantial continuous inflows and outflows over the past year and a half. Notably, withdrawal volumes consistently surpass deposits, with a net difference of 2.771 billion USDT—revealing a clear pattern of "net fund outflow."
Weekly Fund Movements (Value Statis)
The chart shows sustained high activity in HuionePay’s fund flows, peaking at three key moments:
-
July 8, 2024: First major peak, with both deposits and withdrawals exceeding 1 billion USDT.
-
March and May 2025: Two instances where withdrawal amounts approached or exceeded 1.1 billion USDT.
Number of Deposit/Withdrawal Transactions (Tx Count)
Data indicates that the number of withdrawal transactions rose stepwise since February 2024, reaching a peak near 150,000 transactions in a single day on May 12, 2025—exhibiting a "high-frequency withdrawal" characteristic.
In contrast, while the number of deposit transactions has generally increased, it shows less volatility, steadily growing to nearly 140,000 daily transactions, suggesting user engagement remains stable without notable decline.
Additionally, the spikes in withdrawal amounts during March and May 2025 coincided with surges in transaction counts, with both peaks nearly overlapping.
User Behavior
Number of Depositing and Withdrawing Users (Users)
Since early 2024, the number of active deposit addresses on HuionePay’s TRON-based operations has grown from under 30,000 to over 80,000, showing a steady upward trend. The data is de-duplicated by address, meaning deposit addresses roughly represent unique users, whereas withdrawal addresses may be user-defined recipients and thus not equivalent to actual user count. The continued growth in deposit addresses suggests the platform is still attracting new users, although the growth rate appears to be moderating.
Active Addresses
Top 3 Withdrawal Addresses
Using the on-chain AML and tracking tool MistTrack, we found that HuionePay exhibits a degree of "fund concentration" in its withdrawal behavior. The top three withdrawal addresses are:
-
Address 1 — TWS84SZ2GE2EgyZDCrfVuEJXpoXYuBxteS — 816 million USDT
-
Address 2 — T9yFi9yxwBUjMbHwBFKDdwFdBwvzUAqBfR — 580 million USDT
-
Address 3 — TTSSC4TEYtQMAMURND6i1FPYaaBJMGY4ed — 512 million USDT
All three addresses have transaction histories dating back to 2023, indicating long-term activity and rich on-chain footprints.
Address 1 has received funds from multiple HuionePay hot wallets and has interacted with addresses flagged by MistTrack as “OFAC Sanctions,” “Theft,” and “BingX Exploiter”:
Address 2 is suspected to be a wallet controlled by Haowang Guarantee (formerly Huione Guarantee).
Address 3 has interacted with multiple cryptocurrency exchanges:
Top 3 Deposit Addresses
-
Address 4 — TL8TBpubVzBr1UWPXBXU8Pci5ZAip9SwEf — 1.665 billion USDT
-
Address 5 — TPEpdLYtHr8cN1Jbwf6CGNB9Ppho7L2otr — 449 million USDT
-
Address 6 — TM1zzNDZD2DPASbKcgdVoTYhfmYgtfwx9R — 436 million USDT
Among these, Address 4 contributed 1.6 billion USDT in deposits—1.3 times the amount withdrawn by the top withdrawal address—with its earliest transaction traced back to 2022, likely belonging to Haowang Guarantee (formerly Huione Guarantee). Addresses 5 and 6 appear to be hot wallets associated with certain platforms.
Activity Timing
We randomly selected 10 ordinary addresses that deposited and withdrew funds via HuionePay and analyzed their transaction timestamps (UTC), as shown below:
Withdrawal transactions from selected addresses mainly occurred between UTC 01:00 and 16:00, with peak activity from 07:00 to 13:00. Some addresses, such as TUXsppberDuVqQmNN5mnxg4pJ3HU9YtCEw, showed transaction surges between 02:00 and 03:00. Certain withdrawal addresses had almost no activity from 15:00 to 00:00 the next day.
Deposit activities were primarily concentrated between UTC 03:00 and 10:00, partially overlapping with withdrawal peaks. Deposit addresses TRAA9R9151eE522crrxQgQTr9WGVRubmou and TEdVW72PWcJ9Fwmw3w9uSBTLK6rjRUM1GJ demonstrated consistent deposit behavior during 03:00–09:00.
Supplementary: International Regulatory Developments
Recent international regulatory and enforcement actions have intensified scrutiny on HuionePay:
-
July 14, 2024: Bitrace reported that Tether froze the Huione-related address TNVaKW, holding 29.62 million USDT, suspected to be a guarantee service operational wallet.
-
May 2, 2025: The U.S. Department of Treasury’s Financial Crimes Enforcement Network (FinCEN) proposed banning U.S. financial institutions from providing correspondent accounts to Cambodia-based Huione Group. The Treasury Secretary labeled Huione a “marketplace of choice for cybercriminals,” citing platforms including Huione Pay, Huione Crypto, and Haowang Guarantee.
-
May 8, 2025: The United Nations Office on Drugs and Crime (UNODC) stated in a report that Haowang Guarantee has become part of Southeast Asia’s “industrialized cyber fraud ecosystem,” having processed over $24 billion in crypto assets cumulatively.
-
May 14, 2025: Elliptic reported that Telegram shut down thousands of crypto crime channels linked to “Xinbi Guarantee,” which handled over $8.4 billion in suspicious transactions—ranking alongside Huione Group as one of the largest crypto black markets.
-
May 15, 2025: Haowang Guarantee (formerly Huione Guarantee) announced on its official website that it would cease operations due to Telegram’s blockage.
Conclusion
HuionePay’s fund flow patterns, transaction frequency, and active addresses on the TRON chain provide foundational insights into its on-chain operations.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@SlowMist_Team
