The $2.4 Billion Undercurrent: The Collapse of Huiwang Guarantee
TechFlow Selected TechFlow Selected
The $2.4 Billion Undercurrent: The Collapse of Huiwang Guarantee
Li Xiong, a core member of the Crown Group, was escorted back to China, marking the end of an underground financial empire operating on Telegram.
Navigating Web3 tides with focused insightsBy Xiao Bing, TechFlow
April 1, 2026, Phnom Penh International Airport.
A man wearing handcuffs was hooded with a black sack by Chinese special police and forcibly boarded a China Southern Airlines flight. Several hours later, the plane landed somewhere in China. The officers removed the hood to reveal a pale, exhausted face.
His name is Li Xiong—Chairman of Huione Group and the most trusted lieutenant of Chen Zhi, founder of Prince Group. During the years he oversaw Huione Group, his name became ubiquitous among the Chinese community in Phnom Penh: red QR codes bearing the “Huione Pay” logo were plastered on street-corner shops; restaurant owners used them for payments; casinos settled accounts through them. Huione Pay branded itself “Cambodia’s Alipay”—an innocuous-sounding moniker.
But this was merely the tip of the iceberg.
Beneath the surface lay a $24 billion underground financial empire—a criminal service supermarket woven together from thousands of Telegram groups—a black market five times larger than Hydra, the legendary dark web marketplace, and three times larger than FTX at its peak.
Its name: Huione Guarantee.
Li Xiong’s arrest came exactly 84 days after Chen Zhi, founder of Prince Group, was extradited back to China. The sequential arrests of these two men mark the formal end of the largest money laundering empire in cryptocurrency history.
The Dark Rise of a Fujian Teenager
To understand Huione Guarantee, one must first understand the man behind it.
Chen Zhi was born in 1987 in Xiao’ao Town, Lianjiang County, Fujian Province—a coastal town facing the Matsu Islands across the water. His family was unremarkable, economically modest even by local standards. Chen dropped out of junior high school after the second year, leaving formal education behind at age 15 or 16. His classroom shifted from school desks to internet cafés.
Around 2005, internet cafés along Fujian’s coast boomed, serving as incubators for China’s earliest generation of cybercriminals. Chen was among them. He assembled a small team with classmates, earning money by setting up private servers for the online game *Legend of Mir 2*, cracking official servers, and trafficking user data. These activities skirted legal gray zones—but proved highly lucrative. Private gaming servers became his first fortune.
A fellow townsman later recalled that Chen also traded in personal data, launched matchmaking websites, and built social platforms for gamers. In short, he pursued any internet-based profit opportunity—legal or not.
Around 2010, Chen left Lianjiang with roughly RMB 500,000 (approx. USD 70,000) in illicit proceeds.
Destination: Cambodia.
Dream-Building in Phnom Penh
In 2011, Phnom Penh was still a city in its infancy. Chinese capital had just begun flowing into Southeast Asia, and Cambodia’s real estate market remained wide open. Chen seized the moment.
Instead of competing with major developers for prime land, he bought cheap plots on the city’s outskirts and built low-cost housing and commercial units. This low-capital, fast-turnover strategy suited a shrewd speculator operating on limited funds.
In 2014, Chen paid USD 250,000 for Cambodian investment immigration and obtained citizenship. With that, the identity of the “Fujian internet café teen” vanished completely—replaced by “Vincent Chen Zhi,” a Cambodian-Chinese entrepreneur.
In 2015, Prince Holding Group was officially founded.
What followed was dizzying growth. The Prince Group logo rose over downtown Phnom Penh; its business rapidly expanded beyond real estate into banking, insurance, telecommunications, retail, and tourism. Prince Plaza Shopping Mall became a city landmark; Prince Bank received its formal license in 2018. Chen even established the Prince Foundation, launching high-profile charitable initiatives totaling over USD 16 million—crafting an image of a “respected entrepreneur and philanthropist.”
Political connections served as the engine’s most critical lubricant. Chen reportedly spent USD 20 million hosting Prime Minister Hun Sen’s 68th birthday banquet, inviting foreign diplomats to lend prestige. He received royal appointments as advisor to multiple senior officials—including Interior Minister Sar Kheng, National Assembly President Heng Samrin, Prime Minister Hun Sen, and his successor Hun Manet. In 2020, he was granted the title of “Duke” and issued a diplomatic passport.
In Phnom Penh, more than one-third of all Rolls-Royces belonged to Prince Group. Chen traveled with bodyguards and drove a Rolls-Royce himself. A person who met him described him thus: “Short stature—about 1.68 meters tall—with a prominent forehead and a strong Fujian accent. His eyes conveyed ‘a certain ruthlessness.’”
Beneath all this glittering façade, however, Prince Group’s true profit engine ran on another kind of business.
The Fraud Factory
Beginning in 2015, Chen constructed at least ten enclosed industrial parks across Cambodia.
Surrounded by high walls and barbed wire, these compounds were off-limits to outsiders. Thousands of cross-border workers—recruited from China, Vietnam, Myanmar, Indonesia, and elsewhere—were lured by job ads promising high-paying IT positions. Upon entering the gates, their passports were confiscated and phones monitored. They became mere “tools” in telecom fraud operations.
A U.S. Department of Justice indictment revealed operational details: Prince Group’s fraud syndicates possessed millions of phone numbers and operated “call farms”—large-scale call centers—in multiple parks. Two such centers alone employed 1,250 mobile phones and controlled approximately 76,000 social media accounts. Internal Prince Group documents even instructed staff on how to build false intimate relationships with victims—and advised against using “excessively beautiful female profile pictures” to boost credibility.
This is known as the “pig-butchering scam”: first, establish trust and emotional bonds under fake identities (“raising the pig”), then lure victims into investing real money on counterfeit trading platforms (“slaughtering the pig”).
Chen personally managed these fraud bases. His accounting records explicitly labeled profits as “pig-butchering,” specifying responsible floors and buildings for each operation. For workers who resisted, his instruction was blunt: “You may beat them—but do not kill them.”
Elliptic, a blockchain analytics firm, even found advertisements selling electric-shock ankle restraints for worker confinement within Telegram groups linked to these parks.
Money generated from fraud flowed continuously from victims’ bank accounts into Prince Group’s underground coffers. But this money was “dirty”—and could not enter the formal financial system directly.
It needed a river to wash it clean.
That river was Huione.
The Dark Web’s Taobao
In 2021, Huione Guarantee quietly launched on Telegram.
Its original positioning appeared legitimate: a transaction escrow platform for real estate and used cars. Buyers sent payment to a Huione Guarantee bot; sellers delivered goods; buyers confirmed receipt; only then did Huione release funds to sellers—charging a commission. It was essentially Taobao’s “confirm receipt” model.
But soon, the “products” traded on this platform changed dramatically.
Money laundering services quickly became the core offering. Within Huione Guarantee’s Telegram groups, vendors openly advertised: “Accepting dirty money, disbursing clean funds.” Slang terms abounded: “Material owners” referred to individuals holding stolen funds or bank account credentials; “dog pushers” denoted frontline fraud operatives; and “brick-moving” described the work of money laundering intermediaries.
A typical laundering flow looked like this: Fraud gangs executed a “pig-butchering” scam, collected funds, and handed them to intermediaries on Huione Guarantee. Those intermediaries routed money through a network of “money mules”—shell accounts spread across more than a dozen countries—before returning it to the fraud gangs in the form of USDT stablecoins. Intermediaries and mules each took commissions.
The entire process functioned like a precision-engineered industrial assembly line.
Huione Guarantee sold far more than money laundering services. Its merchants offered: scam scripts, fake website development, AI face-swapping tools, databases of trafficked individuals’ personal information, forged national ID documents, Starlink satellite terminals (for park communications)—in short, virtually every imaginable crime-enabling tool was available for purchase.
Huione Guarantee was a fully priced criminal supermarket—and Telegram groups were its shelves.
By mid-2024, when Elliptic first exposed the platform, its transaction volume exceeded USD 11 billion. By early 2025, that figure had more than doubled—to USD 24 billion. Telegram hosted 9,289 active public Huione Guarantee groups, with over 900,000 registered users.
For perspective: Hydra—the largest dark web marketplace in history—operated for six full years, generating only USD 5 billion in total trade. Huione Guarantee achieved five times that amount in under four years.
Internal documents from Huione International Payment (2022–2023), obtained by Bloomberg, recorded thousands of victims and tens of millions of dollars in transactions. The documents show Huione employees directly monitored transactions and mediated disputes; the platform regularly extracted commissions from trades—and even extended large credit lines to “top-performing money laundering teams.”
In Phnom Penh, Huione International Payment occupied the second floor of the Huione Pay headquarters—a glass-and-concrete building guarded at its entrance by two panda statues. Employees used aliases; one department liaised with fraudsters, another monitored Telegram channels, and a third tracked money mule accounts across more than a dozen countries.
When Even USDT Wasn’t Safe Enough
What truly shocked observers about the Huione empire wasn’t just its scale—but its astonishing speed of evolution.
In July 2024, Tether froze USD 29.62 million worth of USDT held in a Huione Pay wallet. The reason? That wallet had received funds stolen by the North Korean hacking group Lazarus. Blockchain investigator ZachXBT further discovered that USD 35 million stolen from Japan’s DMM exchange ultimately flowed into Huione Pay addresses.
Freezing USDT posed an existential threat to Huione.
Although USDT runs on blockchains, it remains fundamentally centralized—Tether can freeze any address’s USDT instantly upon law enforcement request. For a money laundering empire whose lifeblood was USDT, this amounted to having its throat squeezed.
Huione’s response stunned the entire industry.
In September 2024, Huione Group launched its own dollar-pegged stablecoin: USDH. Its official slogan was brazenly direct: “Avoid common freezing and transfer restrictions associated with traditional digital currencies”; “Unconstrained by traditional regulatory authorities.” Translated plainly: “We built a USDT no one can freeze.”
USDH was only the beginning. Huione swiftly launched its own blockchain—Huione Chain (also known as Xone Chain)—its own cryptocurrency exchange, Huione Crypto—and its own messaging app, ChatMe: a complete, self-contained digital underworld.
It even attempted to raise funds via an ICO, issuing its native blockchain token “HC.”
The logic behind this sequence was chillingly clear: if Tether held the chokehold on USDT, create your own unfreezable stablecoin; if Telegram could ban groups, build your own messaging app; if existing blockchains allowed tracking, launch your own chain.
The Siege
But they miscalculated.
In July 2024, Elliptic released its first investigative report on Huione Guarantee—a bomb detonating in regulators’ global consciousness.
Huione Guarantee immediately rebranded as “Haowang Guarantee” (Good Fortune Guarantee), attempting to sever brand ties with Huione Group. Huione Pay’s official website deleted pages describing Huione Guarantee as its “subsidiary.” Yet Haowang Guarantee itself acknowledged on social media that Huione Group remained its “strategic partner and shareholder.”
In May 2025, the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) formally designated Huione Group a “Primary Money Laundering Risk Entity,” announcing plans to fully exclude it from the U.S. financial system. FinCEN’s report specifically named three Huione entities—Huione Pay, Huione Crypto, and Haowang Guarantee—as “functionally indistinguishable” from the parent company.
That same month, Telegram struck.
On May 13, Telegram banned over 3,000 Huione-related accounts and channels, citing violations of its Terms of Service. Within 48 hours, Haowang Guarantee posted a shutdown notice stating “all NFTs and groups have been banned” and announced cessation of all operations.
The empire appeared to collapse. Yet Huione demonstrated astonishing resilience.
In the weeks following shutdown, blockchain analytics firm Chainalysis observed that cryptocurrency transaction volumes linked to Huione entities actually increased—not decreased. Haowang Guarantee redirected users to a new platform called “Tudou Guarantee” (Potato Guarantee), claiming it had acquired a 30% stake. Haowang also invested in Tudou Guarantee, effectively reincarnating its operations under a new shell. It even developed its own standalone messaging app, ChatMe, aiming to break free entirely from Telegram dependence.
But a far greater blow was yet to come.
On October 14, 2025, the U.S. Department of Justice and Treasury jointly announced criminal charges against Prince Group founder Chen Zhi, issuing a global arrest warrant—and seizing 127,271 bitcoins under his name, valued at approximately USD 15 billion at the time. This set a U.S. judicial record for the largest single seizure of crypto assets. Simultaneously, the Treasury added 146 individuals and entities tied to Prince Group to its sanctions list. The UK froze Chen’s 19 properties and all other assets in London the same day.
Cambodia’s GDP in 2024 totaled approximately USD 46 billion. The bitcoin seized from Prince Group alone equaled one-third of that national output.
The Collapse
The domino effect of sanctions unfolded faster than anyone anticipated.
At midnight on December 1, 2025, Huione Pay abruptly announced: due to “massive, concentrated withdrawals by millions of users,” it would activate a “Deferred Redemption Plan.” All physical branches nationwide suspended operations, locking user funds until January 5, 2026—at the latest.
Lines formed instantly across Phnom Penh streets.
Bitrace’s audit data showed that after processing its final withdrawal on December 1, Huione Pay held only ~USD 990,000 in USDT on-chain. Its Ethereum operations had depleted their balances as early as October; its TRON operations repeatedly consolidated hot-wallet funds throughout November to meet withdrawal demands—until being completely drained around November 28. Daily USDT outflows plummeted from USD 41.83 million at month’s start to USD 7.17 million.
Huione Pay—self-proclaimed “Cambodia’s Alipay”—had overnight become an empty shell.
Tens of thousands of Chinese merchants in Cambodia saw their livelihoods frozen inside a dying platform. To this day, multiple Huione users continue organizing spontaneously via social media groups to protest at Cambodia’s National Bank—without meaningful resolution.
In December 2025, Cambodian authorities revoked Chen Zhi’s citizenship, citing “acquisition of nationality through improper means.”
On January 7, 2026, Chen was extradited back to China by Cambodian authorities.
In January 2026, “Tudou Guarantee,” a Huione subsidiary, returned USD 130 million in USDT before reportedly ceasing operations.
On April 1, 2026, Li Xiong was extradited back to China.
Thus concluded the full, sinister lifecycle of an empire that began in a Lianjiang internet café, gilded itself in Phnom Penh real estate, scaled via Telegram, laundered through USDT, and fattened itself on “pig-butchering” scams.
The Underground River Never Dies
The story of Huione Guarantee has ended. But the business model it validated lives on.
Shortly after Haowang Guarantee announced its shutdown, Elliptic exposed another Telegram black market: “Xinbi Guarantee” (New Coin Guarantee). Since 2022, it has facilitated at least USD 8.4 billion in illegal transactions and boasts over 230,000 users. Registered in Colorado, USA, Xinbi Guarantee’s merchants offer identical services: money laundering, forged identification documents, personal information databases—essentially a carbon copy of Huione Guarantee.
A United Nations Office on Drugs and Crime report notes that annual profits from organized cybercrime in Southeast Asia now approach USD 40 billion. Cryptocurrencies and underground banking channels enable rapid money laundering, while Telegram-style instant messaging platforms provide low-cost, high-efficiency criminal infrastructure.
Chen Yanyu, a Taiwanese scholar specializing in cybercrime research, spent months in Cambodia interviewing money launderers, scammers, and their bosses. Her conclusion is stark and sobering: “Cybercrime is deeply embedded in the global capitalist system—extracting resources from every corner of the world. It cannot be easily dismantled.”
The $24 billion underground river appears severed—at least on the surface. But its riverbed remains intact. Its upstream sources persist. Its downstream demand endures.
Huione fell—but the world’s shadow economy still needs a place where dirty money becomes clean. The next Huione may already be quietly growing inside some Telegram channel.
Sources: Elliptic Research Reports, U.S. Treasury FinCEN Notices, U.S. Department of Justice Indictments, Bloomberg Investigations, Caixin Media Reports, Jiemian News Reports, Bitrace On-Chain Analytics
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
深潮TechFlow
