Cambodia's Huion, a "super hub" for crypto black markets
TechFlow Selected TechFlow Selected
Cambodia's Huion, a "super hub" for crypto black markets
The U.S. Department of the Treasury said this Cambodian network laundered over $4 billion for clients including North Korean hackers and transnational criminal organizations.
Navigating Web3 tides with focused insightsBy Kai Schultz, Bloomberg
Translated by Luffy, Foresight News
New ad alerts keep coming. Want counterfeit money? Money laundering services? Hacking tools? As long as you understand Chinese and the criminal slang—“liaozhu” refers to someone holding stolen funds or bank information; “goutui” means employees working in scam compounds—all these and even more are for sale in corners of what has become the world’s largest marketplace for illegal goods.
Finding it isn’t hard. Most of the activity centers around public chat rooms operated by Huione Group. The Cambodian conglomerate is well known within local Chinese-speaking communities, famous for selling insurance, currency exchange, and financial services. Its online banking arm, Huione Pay, brands itself as “Alipay of Cambodia.” Red stickers bearing Huione’s QR codes appear at restaurants and corner stores, allowing people to pay by scanning.
But the full suite of services offered under the Huione umbrella is far darker. Despite repeated denials from affiliated companies about involvement in criminal activities, the U.S. Treasury Department says Huione has laundered at least $4 billion in proceeds from scams and cryptocurrency theft.
This article, based on more than 20 interviews with government officials, company insiders, and alleged victims, along with internal documents, details how Huione helped fuel Asia’s cyber-scam industry into a multi-billion-dollar behemoth.
“Huione is like Amazon for criminals,” said Ngo Minh Hieu, a cyber threat investigator and former hacker studying the conglomerate’s digital footprint. “The way their business is structured and the range of products they offer shocked me.” Ngo’s assessment aligns with views held by some regulators.
Evolving Operational Model
Huione’s corporate history is extremely opaque. Archived web pages show it was founded in Cambodia in 2014, but Hong Kong records indicate local registration only occurred in 2018. It appears to have never made public financial disclosures, nor does it list employees or offices. Essentially, it’s a shell network of affiliated entities. Directors frequently overlap across subsidiaries, while relationships between divisions remain unclear.
The U.S. Treasury specifically named three entities for enabling criminal groups to move illicit funds: Huione Pay, cryptocurrency exchange Huione Crypto, and online trading platform operator Haowang Guarantee (formerly Huione Guarantee). The Treasury stated these three are “essentially one and the same” as the parent company. In May, the U.S. Treasury announced plans to fully bar Huione from the U.S. financial system, noting its clients include transnational crime syndicates and North Korean hackers “Lazarus Group.” Due to “inadequate anti-money laundering / know-your-customer (AML/KYC) policies and procedures,” the risks posed by Huione’s links to illicit actors and transactions were “further exacerbated,” the Treasury said.
Other countries are also stepping up containment efforts. Thailand, bordering Cambodia, announced in June it was investigating Huione Group over suspected processing of funds from illegal gambling and fraud. In the tech space, messaging app Telegram has shut down dozens of Huione-related chat groups. A spokesperson for stablecoin issuer Tether said nearly $30 million in USDT linked to Haowang Guarantee wallets had been frozen, adding that the company would act immediately if law enforcement flagged additional wallets tied to Haowang.
These actions have had some visible impact. According to Cambodia’s central bank, both Haowang Guarantee and Huione Crypto have announced closures, and Huione Pay was liquidated in June. The National Bank of Cambodia said in a statement to Bloomberg that Huione Pay had its license revoked due to “serious violations of applicable regulations,” was ordered to close offices and cease all operations—a process completed by June 19. Yet, just three weeks after appearing defunct, Huione Pay issued an email statement to Bloomberg saying it was “committed to constructive engagement with U.S. officials and other authorities” to promote safety and transparency in the financial system. In a public response to the U.S. Treasury, Huione Pay claimed it was “fully addressing compliance issues and taking remedial measures.”
Although these entities previously acknowledged direct ties (Huione Pay’s old website described itself as “originating from Huione Group”; Haowang Guarantee referred to Huione Group as one of its “strategic partners and shareholders” in social media posts last year), no independent entity now publicly admits affiliation with Huione Group.
Yet digital activity and two individuals familiar with the operations say the three units appear to continue functioning in some form, rebranding or redirecting customers to affiliated companies to avoid disruption and regulatory pressure.
For example, weeks after Haowang Guarantee announced closure, cryptocurrency transaction volumes linked to Huione entities, as identified by blockchain analytics firm Chainalysis, actually increased. A large Haowang Guarantee group on Telegram remains publicly accessible and active, with administrators directing users to “Tudou Guarantee.” According to statements from both companies, Haowang recently acquired a 30% stake in the platform.
Tudou Guarantee provides no public email or phone number. Customer service staff on its Telegram channel said no one could respond to media inquiries. Haowang Guarantee declined interview requests, stating it had ceased operations and had no connection to any Huione entity. The company previously denied playing any role in aiding cybercrime. A Telegram spokesperson said, “We assess reports case by case and firmly oppose blanket bans,” adding the app remains committed to protecting user privacy and financial autonomy.
On Huione Crypto’s website, a chatbot directs customers to register with a new service provider called Kex. Registered in the British Virgin Islands, Kex is unreachable. A source who requested anonymity for safety reasons said Kex is operated by former Huione Crypto employees. Ngo added that Kex uses the same custom website template as Huione Crypto. Emails sent by Bloomberg to official addresses for both Huione Crypto and Kex were returned undelivered.
Huione Group’s continued presence highlights the difficulty of shutting down decentralized markets, underscores the resilience of its structure, and reflects its adeptness at finding workarounds. Internal documents show its so-called “money mules” (individuals handling money laundering) have targeted victims in at least 12 countries. Corporate filings show parts of Huione have branches in Poland, Canada, and Japan.
“When sophisticated criminal financial networks take root, public shutdowns are often just cosmetic,” said Andrew Fierman, head of national security analysis at Chainalysis, whose research informed the U.S. Treasury’s conclusion that Huione is a “key conduit for money launderers.” “The real infrastructure—their money laundering pipelines—continues operating beneath the surface, smoothly processing billions of dollars.”
Hidden Core
Inside Huione, this infrastructure centers on a mysterious unit: Huione International Pay. Two sources, speaking anonymously for safety reasons, said this department is the primary operational hub supporting daily scam activities. Company documents seen by Bloomberg and the two individuals confirm that beyond managing online criminal markets on instant messaging apps like Telegram, employees directly connect scammers with money mules for fees.
Huione International Pay staff reportedly worked on the second floor of Huione Pay’s Phnom Penh headquarters, using aliases internally and helping link different money laundering networks. Documents reviewed by Bloomberg contain detailed accounting records of thousands of victims targeted by various gangs using Huione International Pay’s services. While verifying every incident is nearly impossible, Bloomberg cross-referenced some details and identities with ongoing U.S. court cases.
Huione Pay claims it has no connection to Huione International Pay and is unaware of any entity or individual using that name. However, the U.S. Financial Crimes Enforcement Network’s May report described Huione International Pay as “part of Huione Pay” and said it facilitated transactions “related to money laundering” for Haowang Guarantee.
Explosive Industry Growth
Cybercrime predates personal computers—it arguably dates back to the 1830s, when French brothers exploited an optical telegraph system to get ahead of Paris stock prices. But the 2010s saw a true explosion in ransom-driven cybercrime, much of it originating in new scam compounds across Southeast Asian nations like Cambodia, Myanmar, and Laos, which began targeting global victims.
Many compounds are run by Chinese-led crime syndicates, with staff comprising trafficked individuals forced to scam victims in countries like the U.S., Germany, and Japan. Often, targets are lured into fake cryptocurrency investment schemes or romantic relationships—so-called “pig-butchering scams.”
The scam industry has grown rapidly. Chainalysis data shows pig-butchering scam revenues surged nearly 40% in 2024 compared to the previous year. As the industry expands, global law enforcement agencies are asking: How do crime bosses obtain tools—fake passports, malware, facial recognition software, money mules—to enable such rapid growth? The answer lies in a new wave of online marketplaces. Unlike Western counterparts like Silk Road, which required technical know-how to access, these new platforms operate openly.
Many of the Telegram groups managed by Huione—numbering in the thousands—appear harmless, serving functions similar to classified ads for currency exchange or real estate. But according to analysts at the United Nations Office on Drugs and Crime who monitor the platform, the tone on Haowang Guarantee darkened after Fully Light Guarantee—an underground marketplace in Myanmar with no known link to Huione—was shut down. Anonymous users began using more coded language hinting at illegal trades, and advertisements dropped pretenses about illicit intent. Most ads are written in Chinese, indicating the main customer base isn’t Cambodian.
While China’s Foreign Ministry hasn’t commented directly on Huione, it said China actively cooperates on law enforcement and security with neighboring countries including Cambodia, and will continue deepening international collaboration to combat cross-border crimes like online fraud.
A 2023 advertisement reviewed by Bloomberg advertised counterfeit Chinese yuan capable of passing currency detectors. Other ads promoted smuggled iPhones, hacked computers, or services to unfreeze bank accounts. Several directly sold items tied to the scam trade: using Chinese terms like “killing pigs,” offering fake crypto investment websites, advertising electric batons and tear gas to control “escaped dogs”—a clear reference to abused trafficked workers. Most ads require payment in cryptocurrency.
“The collapse of Fully Light Guarantee became a major catalyst for other trading platforms,” said John Wojcik, former UNODC threat analyst. “Haowang Guarantee grew almost overnight from a few thousand users to tens or even hundreds of thousands,” as former Fully Light users sought alternatives.
As Haowang Guarantee’s influence expanded, blockchain investigators dug deeper to estimate its true scale. Elliptic, one of the largest firms, released a January report concluding at least $24 billion flowed through cryptocurrency wallets used by Haowang Guarantee and its merchants. Blockchain intelligence firm TRM Labs estimated even higher—$81 billion. Either figure means Haowang Guarantee dwarfed its largest predecessor: Hydra Market, a Russia-based platform shut down by U.S. and German authorities.
Source: Elliptic
“They’re several times larger than any comparable platform,” said Tom Robinson, chief scientist at Elliptic.
Haowang Guarantee denied any role in aiding cybercrime in a February statement, saying all activities in its Telegram groups were provided by third parties.
Complex Operations
Bloomberg reviewed partial internal documents from Huione International Pay covering 2022 to 2023, mostly written in Chinese, detailing thousands of victims and tens of millions of dollars in transactions. The files show employees directly monitored deals and handled disputes, with the platform regularly taking commissions. They also reveal Huione International Pay’s deep operational involvement, including providing large credit lines to high-performing money laundering teams.
One document is a multi-page manual written by Huione International Pay’s transaction department, outlining rules for logging data on “clients” (i.e., victims) from the U.S., Europe, and Australia. The 2022 report describes handling risks ranging “from minor to severe,” including situations where victims report the scam or money mules are detained. The manual instructs staff to mark a field as “person arrested” and “immediately report to manager or regional supervisor.”
Screenshot of a document written by Huione International Pay’s transaction department, showing rules for logging data on victims (referred to as “clients”)
The documents use a coding system to track money mules and scammers, revealing their scope and complexity. Money launderers are labeled with an “X” followed by numbers. Scammers are grouped roughly by target region: EZ3 refers to gangs focused on European victims; US26 to those targeting Americans. Huione International Pay also logs victim details, sometimes storing their bank account information. Operations targeting Taiwan are particularly detailed, including notes on fabricated reasons scammers gave for wire transfers. For example, one entry cites “bulk pet food orders.” Harris Chen, a Taiwanese prosecutor specializing in cybercrime investigations, said he could match details from the documents to at least two money laundering convictions in Taiwan.
Bloomberg matched personal details from the files with information in investigations led by the U.S. Federal Bureau of Investigation and the Secret Service (which handles financial crimes and presidential protection).
One case involves Daren Li, a dual citizen of China and St. Kitts and Nevis, who pleaded guilty in the U.S. to laundering over $73 million through cryptocurrency investment scams. U.S. authorities seized his phone, showing he communicated with accomplices on Telegram under the nickname “KG71777.” Not only does Huione International Pay’s file list this username, but also his WhatsApp account. Records show Li earned about 9% commission. (Huione did not appear in public court documents related to the case.)
One victim listed in the logs is Shashi Iyer, a U.S. resident. U.S. court documents show that in late 2022, Iyer received a strange alert on his phone: he had been automatically added to a Telegram group. When he asked the admin why, he was told the group was for investors interested in cryptocurrency option contracts from a Boston-based financial services firm. Iyer often looked for investment opportunities in Telegram groups and decided to try after being promised returns of 50% to 95%.
“It was a honey trap,” he said in an interview.
After nearly doubling his money and successfully withdrawing, Iyer was invited into a private Telegram group for high-volume investors, where he invested about $40,000. When he tried to cash out, he discovered the investment firm didn’t exist and reported it to U.S. authorities. Last year, the U.S. Secret Service filed a civil lawsuit in Tennessee on behalf of victims including Iyer (Huione was not mentioned), resulting in a court order to return some funds.
Court documents show victims transferred millions of dollars to shell company accounts at Evolve Bank & Trust in Memphis. A spokesperson for Evolve declined to comment on the case but emphasized the institution’s “full commitment to maintaining the highest standards of compliance, financial integrity, and anti-money laundering controls.”
Huione International Pay’s logs include details on Iyer and two other Tennessee victims, down to timestamps of wire transfers, bank account numbers, and the ID of their assigned money laundering gang: X3.
Evasion Tactics
Limited records of Huione’s operations in Cambodia—including Huione Pay and Haowang Guarantee—show they were co-led by Chinese managers and local power figures, a common symbiotic relationship in Cambodia. In recent years, massive inflows of Chinese capital have transformed the country. Driving through Phnom Penh today, many construction sites display Chinese signage. According to a former employee, Mandarin is heard more frequently than Khmer, Cambodia’s main language, inside Huione Pay’s offices.
Hun To, listed in Cambodia’s business registry as a director of the now-dissolved Huione Pay, is a cousin of Cambodian Prime Minister Hun Manet. Hun To’s home in Phnom Penh resembles a fortress, surrounded by thick concrete walls and nets above ground—possibly to prevent escaped hornbills, which he keeps. Local media reported that years ago, during Australia’s “Operation Elveden” investigation, officials suspected him of smuggling drugs via timber shipments. He denied the allegations and was never charged. The Australian Criminal Intelligence Commission said it couldn’t assist with queries.
Reporters contacted Hun To through associated emails of three companies where he serves as director but received no response. Cambodia’s Cabinet Office, led by the prime minister, also did not respond to requests for comment. Hun To has consistently denied involvement in online scams, and there is no indication he knew about Huione International Pay’s operations.
Affiliated entities of Huione, source: U.S. Treasury, company filings, and Bloomberg reporting
He Yanming, registered owner of Huione Crypto in Poland, is listed in Cambodia’s business registry as a director of Panda Commercial Bank Plc, one of the country’s major financial institutions. Hun To and Li Xiong, who served as director in at least four Huione companies, were board members of the bank until resigning last October.
Reporters reached out via associated emails of other companies where Li Xiong and He Yanming serve as directors but received no replies. There is no indication either was previously aware of alleged illegal activities within the conglomerate. Panda Bank also did not respond to requests for comment.
Foreign officials familiar with the group say Huione’s operations faced little scrutiny in Cambodia. However, in September last year, Cambodia’s central bank revoked Huione Pay’s license. Months later, when news broke, customers rushed to withdraw funds at its main Phnom Penh office. Huione Pay temporarily raised interest rates on all USDT deposits from 2% to 7.3%.
But the panic was short-lived. The company soon announced on a social media account that it would shift payment and blockchain services to Japan and Canada—countries where its units previously held licenses.
Japan’s financial regulator declined to comment on whether any Huione branch is under investigation but said the group holds no valid payment services license. Erica Constant, a spokesperson for Canada’s financial regulator, said Huione Pay’s registration as a money services business in Canada expired at the end of 2023. She declined to say whether law enforcement had shared intelligence about the company. Recently, reporters visited Huione Crypto’s registered address in Poland—a four-story apartment building in a leafy residential area of Warsaw. The person on the intercom said it was a “virtual office.” After reporters identified themselves, the line went dead. Poland’s virtual currency regulator did not respond to requests for comment.
According to two sources, after action by Cambodia’s central bank, Huione Pay continued operating under the name “HPay.” HPay was registered in Cambodia in October last year, and its website shows its headquarters located in the same building as a branch of Panda Bank. HPay did not respond to requests for comment.
Even as the U.S. Treasury seeks to exclude Huione from the American financial system, the threat may not be as significant as it seems. Cyber scams generally don’t require physical proximity, and money launderers are skilled at routing funds through mule accounts.
Huione has another layer of protection: its own currency.
Historically, many transactions were conducted in USDT. But after Tether began freezing suspicious wallets linked to Huione, Huione Crypto launched its own stablecoin, USDH, last year.
An archived statement on Huione’s website says USDH is “not subject to traditional regulatory constraints” and “ensures user assets won’t be arbitrarily frozen.”
Chen Yanyu, a scholar in Taiwan studying cybercrime, spent months in Cambodia speaking with alleged money launderers, scammers, and their leaders. She said this interconnected network has mastered numerous workarounds, exploiting loopholes in Cambodia’s financial system or favorable regulations elsewhere.
“Cybercrime is deeply embedded in the workings of global capitalism, extracting resources from around the world,” Chen said. “It cannot be easily dismantled.”
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@Bloomberg
