Author: Kai Schultz, Bloomberg
Translated by: Luffy, Foresight News
New advertisement prompts are coming in succession. Want counterfeit money? Money laundering services? Hacking techniques? As long as you understand Chinese and the lingo—"料主" refers to those holding stolen funds or bank information, "狗推" refers to scam park employees—all of these, and even more, are sold in the corners of the world's largest illegal goods trading market.
Finding it is not difficult. Relevant information is mainly published in public chat rooms operated by Huione Group. This Cambodian conglomerate is well-known in the local Chinese-speaking community for selling insurance, currency exchange, and financial services. Its online banking division, "Huione Pay," claims to be "the Alipay of Cambodia." Restaurants and corner shops are everywhere displaying red stickers with Huione QR codes, allowing people to pay by scanning.
However, the full range of services offered by Huione's affiliated companies is actually much darker. Despite repeated denials of involvement in any criminal activities by Huione's associated enterprises, the U.S. Treasury Department claims that Huione has laundered at least $4 billion in proceeds from scams and cryptocurrency theft.
This article is based on over 20 interviews with government officials, company insiders, and alleged victims, as well as internal documents, revealing in detail how Huione has helped the Asian online scam industry balloon into a multi-billion dollar behemoth.
"Huione is like Amazon for criminals," said cyber threat investigator and former hacker Ngo Minh Hieu, who is studying the company's online footprint. "The way they organize their business and the range of products they offer shocked me." Ngo's conclusion aligns with the views of some regulatory agencies.
Evolving Operational Models
The corporate history of Huione is extremely opaque. Archived web pages show it was established in Cambodia in 2014, but Hong Kong records indicate it was registered locally only in 2018. It appears to have never made public financial disclosures and has no known employees or office locations. Essentially, it is just a shell of a network of affiliated enterprises. The directors of these branches often overlap, but the relationships between departments are murky.
The U.S. Treasury specifically named three entities, stating they played a role in helping criminal groups transfer illegal funds: Huione Pay, cryptocurrency exchange Huione Crypto, and online trading platform operator "Haowang Guarantee" (formerly Huione Guarantee). The Treasury stated that these three entities are "essentially one and the same" as the parent company. In May of this year, the U.S. Treasury announced plans to completely exclude Huione from the U.S. financial system, while noting that Huione's clients include transnational criminal organizations and North Korean hackers known as the "Lazarus Group." The Treasury stated that "the risks associated with Huione's connections to illegal actors and transactions are further exacerbated by the lack of effective anti-money laundering/customer identification (AML/KYC) policies and procedures."
Other countries are also ramping up their efforts to curb this. Thailand, which borders Cambodia, announced in June that it is investigating Huione Group for allegedly handling funds from illegal gambling and scams. In the business sector, the instant messaging app Telegram has shut down dozens of Huione-related chat groups. A spokesperson for stablecoin issuer Tether stated that nearly $30 million in USDT associated with Haowang Guarantee has been frozen, adding that if law enforcement marks more wallets related to Haowang Guarantee, the company will take immediate action.
These measures have had some public impact. According to the National Bank of Cambodia, both Haowang Guarantee and Huione Crypto have announced closures, and Huione Pay was also liquidated in June. The National Bank of Cambodia stated in a statement to Bloomberg that Huione Pay's license was revoked for "serious violations of applicable regulations," and it has been ordered to close its offices and cease all operations, a process that was completed by June 19. However, just three weeks after seemingly ceasing operations, Huione Pay stated in an email to Bloomberg that it is "committed to constructive engagement with U.S. officials and other authorities" to promote the safety and transparency of the financial system. In a public response to the U.S. Treasury, Huione Pay stated it is "working diligently to resolve compliance issues and take remedial measures."
Despite these entities historically claiming direct connections to each other (the old version of Huione Pay's website stated it "originated from Huione Group"; at the end of last year, Haowang Guarantee referred to Huione Group as one of its "strategic partners and shareholders" in a social media post), no independent entity has publicly acknowledged any connection to Huione Group.
However, online activities and two individuals familiar with the business operations indicate that these three departments seem to continue operating in some form, evading disruption and regulatory pressure by changing names or directing clients to affiliated enterprises.
For example, in the weeks following Haowang Guarantee's announcement of closure, the cryptocurrency trading volume associated with Huione entities identified by blockchain analysis firm Chainalysis actually increased. A large Haowang Guarantee group on Telegram remains publicly accessible and active, while administrators are directing clients to "Tudou Guarantee." According to statements from both companies, Haowang Guarantee recently acquired a 30% stake in that platform.
Tudou Guarantee has not publicly disclosed an email or phone number. Its customer service personnel on Telegram stated that no one can respond to media inquiries. Haowang Guarantee declined interview requests, stating it has ceased operations and has no connection to any Huione entities. The company previously denied playing any role in assisting cybercrime. A spokesperson for Telegram stated, "We evaluate reports on a case-by-case basis and firmly oppose blanket bans," adding that the app is committed to protecting user privacy and financial autonomy.
On Huione Crypto's website, a chatbot guides customers to register with a new service provider called Kex. Kex is registered in the British Virgin Islands and could not be contacted. An anonymous insider (for safety reasons) stated that Kex is operated by former employees of Huione Crypto. Ngo added that Kex's custom website template is the same as Huione Crypto's. Emails sent by Bloomberg to the official addresses of Huione Crypto and Kex were returned.
The continued existence of the Huione Group highlights the difficulty of shutting down decentralized markets and reflects the resilience of Huione's structure, as well as the group's ability to find workarounds. Internal documents show that its so-called "money mules" (those responsible for laundering money) have targeted victims in at least 12 countries. Corporate documents indicate that some branches of Huione operate in Poland, Canada, and Japan.
"When complex criminal financial networks take root, public closures are often just for show," said Andrew Fierman, Chainalysis's national security analysis director. The U.S. Treasury drew on the company's research to conclude that Huione is "an important channel for money launderers." "The real infrastructure (their money laundering pipeline) continues to operate beneath the surface, processing billions of dollars smoothly."
The Secret Core
Within Huione, this infrastructure is located in a mysterious department called "Huione International Pay." According to two anonymous insiders (for safety reasons), this department is the main operational hub assisting daily scam activities. Company documents seen by Bloomberg and these two individuals indicate that, in addition to managing online crime markets on instant messaging apps like Telegram, employees also directly connect scammers with money mules and collect fees.
It is alleged that employees of Huione International Pay once worked on the second floor of Huione Pay's headquarters in Phnom Penh, using aliases internally and assisting in establishing connections between money launderers. Documents seen by Bloomberg contain detailed accounting records of thousands of victims who were scammed by different gangs using Huione International Pay's services. While it is nearly impossible to verify every incident, Bloomberg has cross-referenced some details and identity information with cases currently being adjudicated in U.S. courts.
Huione Pay claims it has no connection to Huione International Pay and is unaware of the entity or individuals referred to by that name. The U.S. Financial Crimes Enforcement Network stated in a report in May that Huione International Pay is "part of Huione Pay" and facilitated "transactions related to money laundering activities" for Haowang Guarantee.
Industry Explosive Growth
Cybercrime has existed long before the personal computer became widespread, arguably dating back to the 1930s when a pair of French brothers used optical telegraph systems to gain early access to stock market data in Paris. However, it was not until the 2010s that cyber extortion truly exploded, with many activities originating from newly emerging scam parks in Southeast Asian countries (such as Cambodia, Myanmar, and Laos) that began defrauding victims worldwide.
Many of these parks are operated by Chinese-led criminal groups, with staff being trafficked individuals forced to scam victims in countries like the U.S., Germany, and Japan. In many cases, targets are lured into participating in fake cryptocurrency investment schemes or fraudulent romantic relationships, known as "pig butchering."
The growth of the telecom fraud industry has been rapid. Data from Chainalysis shows that in 2024, "pig butchering" scam revenues surged nearly 40% compared to the previous year. As the industry expands, global law enforcement officials are increasingly questioning how crime bosses acquire tools (such as fake passports, malware, facial recognition software, and money mules) to achieve such rapid growth. The answer lies in a new batch of online trading markets. Unlike Western platforms like "Silk Road," which require users to overcome technical barriers to access, these new platforms operate in plain sight.
In the Telegram groups managed by Huione (which number in the thousands), many appear innocuous, functioning roughly like classified ad pages for currency exchange or real estate sales. However, according to analysts from the United Nations Office on Drugs and Crime tracking the platform, the atmosphere on Haowang Guarantee became darker after an underground market in Myanmar called "Fully Light Guarantee" (with no known connection to Huione) was shut down. Anonymous users began using more lingo suggesting illegal transactions in their posts, and user advertisements no longer made a concerted effort to disguise illegal intentions. Most advertisements are written in Chinese, indicating that the primary clientele is not Cambodian.
While the Chinese Ministry of Foreign Affairs has not directly commented on Huione, it has stated that China is actively conducting law enforcement security cooperation with neighboring countries, including Cambodia, and will continue to deepen international law enforcement cooperation to combat cross-border criminal activities such as cyber fraud.
An advertisement from 2023 reviewed by Bloomberg offered counterfeit RMB that could pass through bill validators. Other ads promoted smuggled iPhones, hacked computers, or services to unfreeze bank accounts. Several ads directly sold products related to the scam industry: using Chinese terms like "pig butchering," offering services to create fake cryptocurrency investment websites, and promoting the use of electric batons and tear gas to control "fleeing dogs," clearly referring to the abuse of trafficked employees. Most ads require payment in cryptocurrency.
"The closure of Fully Light Guarantee became a major catalyst for other trading platforms," said former UNODC threat analyst John Wojcik, "Haowang Guarantee almost overnight grew from thousands of users to tens of thousands, hundreds of thousands of users," as former users of Fully Light Guarantee sought alternative platforms.
As the influence of Haowang Guarantee expands, blockchain investigators have begun to dig deeper, attempting to estimate its true scale. One of the largest investigative firms, Elliptic, released a research report in January concluding that at least $24 billion has flowed through the cryptocurrency wallets used by Haowang Guarantee and its merchants. Estimates from blockchain intelligence firm TRM Labs are even higher, reaching $81 billion. Regardless of the estimate, it indicates that Haowang Guarantee's scale far exceeds that of its largest predecessor—the Russian-operated "Hydra Market," which was shut down by U.S. and German officials.
Data Source: Elliptic
"They are several times larger than any similar platform," said Tom Robinson, chief scientist at Elliptic.
Haowang Guarantee denied playing any role in assisting cybercrime in a statement in February, claiming that all business in its Telegram groups is provided by third parties.
Complex Operations
Bloomberg reviewed some internal documents from Huione International Pay from 2022 to 2023, primarily written in Chinese, which recorded thousands of victims and tens of millions of dollars in transactions. The documents show that employees are directly involved in monitoring transactions and handling disputes, and the platform regularly takes commissions from transactions. The documents also indicate that Huione International Pay is deeply involved in operations, even providing large credit limits to high-performing money laundering teams.
One document is a multi-page manual prepared by the trading department of Huione International Pay, outlining the rules for logging "clients" (i.e., victims) from the U.S., Europe, and Australia. This 2022 report describes how to handle risks "ranging from minor to severe," including situations when victims report to the police or money mules are detained by authorities. The manual states that a certain column in the log should be changed to "person arrested" and "immediately report to the manager or regional supervisor."
Screenshot of a document prepared by the trading department of Huione International Pay, showing the rules for logging information for victims (referred to as "clients")
These documents use a coding system to track money mules and scammers, demonstrating their coverage and complexity. Money launderers are classified with a prefix "X" followed by a numerical identifier. Scammers are roughly grouped by target region: EZ3 refers to gangs focused on European victims; US26 refers to gangs targeting the U.S. Huione International Pay also records victim information, sometimes even storing their bank account details. Operations targeting Taiwan are recorded in great detail, including fabricated reasons for wire transfers by scammers. For example, one case noted "bulk order of pet food." Harris Chen, a prosecutor specializing in cybercrime investigations in Taiwan, stated that he could match the details in the documents with at least two money laundering conviction cases in Taiwan.
Bloomberg matched the details of several individuals in the documents with information from investigations led by the FBI and the Secret Service (responsible for financial crime jurisdiction and presidential protection).
This includes the case of Daren Li, who holds dual citizenship in China and Saint Kitts and Nevis, and who admitted to laundering over $73 million through cryptocurrency investment scams in the U.S. U.S. officials seized his phone, stating that he communicated with accomplices on Telegram under the nickname "KG71777." The documents from Huione International Pay not only record this username but also his WhatsApp account. The documents show that Li earned about 9% in commissions from this.
One victim mentioned in the logs is U.S. resident Shashi Iyer. U.S. court documents show that at the end of 2022, Iyer received a strange notification on his phone: he had been automatically added to a Telegram group. When he asked the administrator why, he was told that the group was for investors interested in cryptocurrency trading options contracts for a financial services company in Boston. Iyer often looked for investment opportunities in Telegram groups, and tempted by promises of 50% to 95% profits, he decided to give it a try.
"That was a honey trap," he said in an interview.
After his funds nearly doubled and he successfully withdrew, Iyer was invited to join a small Telegram group limited to high-cap investors, where he invested about $40,000. When he tried to cash out, he discovered that the investment company did not exist, and he reported it to the U.S. government. The U.S. Secret Service filed a civil lawsuit in Tennessee for victims including Iyer (Huione was not mentioned), and the court ultimately ordered the return of some funds.
Court documents show that victims transferred millions of dollars to shell company accounts at Evolve Bank & Trust in Memphis. A spokesperson for Evolve Bank & Trust declined to comment on the case but emphasized that the institution "is fully committed to maintaining the highest standards of compliance, financial integrity, and anti-money laundering controls."
The logs from Huione International Pay recorded information about Iyer and two other victims from Tennessee, down to wire transfer timestamps, bank account numbers, and the money laundering gang number responsible for them: X3.
Evasion of Scrutiny
Limited records of Huione's operations in Cambodia (including Huione Pay and Haowang Guarantee) show that these businesses are jointly led by Chinese managers and local power figures, a common symbiotic relationship in Cambodia. In recent years, a large influx of Chinese capital has transformed the country. Today, driving through Phnom Penh, many construction sites display Chinese signage. According to a former employee, Mandarin is heard more frequently in the Huione Pay office than Khmer, Cambodia's primary language.
Hun To, who was listed as a director of the now-dissolved Huione Pay in Cambodia's business registry, is a cousin of Cambodian Prime Minister Hun Manet. Hun To's home in Phnom Penh resembles a fortress, surrounded by thick concrete walls, with nets above the ground, possibly to prevent a group of foreign hornbills from escaping. Local media reported that years ago, during the "Operation Elipango" investigation in Australia, officials suspected him of smuggling drugs using timber transport. He denied the allegations and was ultimately not prosecuted. The Australian Criminal Intelligence Commission stated it could not assist with related inquiries.
The reporter attempted to contact Hun To through the associated email addresses of three companies where he served as a director but received no response. The Cabinet Office led by the Cambodian Prime Minister also did not respond to requests for comment. Hun To has consistently denied any involvement in cyber fraud through his businesses, and there is no indication that he is aware of the operations of Huione International Pay.
Affiliated enterprises of Huione, Source: U.S. Treasury, company documents, and Bloomberg reports
He Yanming, the registered owner of Huione Crypto in Poland, is listed in Cambodia's business registry as a director of the country's major financial institution, Panda Commercial Bank Plc. Hun To and Li Xiong, who served as a director of at least four Huione companies, were board members of that bank until they resigned in October last year.
The reporter requested comments through associated email addresses of other companies where Li Xiong and He Yanming serve as directors but received no response. There is no indication that either was previously aware of the alleged illegal activities within the corporate group. Panda Bank also did not respond to requests for comment.
Foreign officials familiar with the corporate group stated that Huione's operations in Cambodia have not faced much scrutiny. However, in September last year, the National Bank of Cambodia revoked Huione Pay's license. A few months later, when the news became public, customers rushed to withdraw funds from the company's main office in Phnom Penh, prompting Huione Pay to temporarily raise the interest rate on all USDT deposits from 2% to 7.3%.
But this panic was merely a minor episode. The company quickly announced on a social media account that it would transfer its payment and blockchain services to Japan and Canada, where Huione's units previously held operating licenses.
Japanese financial regulators declined to comment on whether any branches of Huione are under investigation but stated that the corporate group does not have valid payment service licenses. A spokesperson for Canadian financial regulators, Erica Constant, stated that Huione Pay's registration as a money service provider in Canada expired at the end of 2023. She declined to comment on whether law enforcement agencies had shared intelligence about the company with her agency. Recently, the reporter visited Huione Crypto's office address in Poland—a four-story apartment building in a tree-lined residential area—where the person on the intercom stated it was a "virtual office." After the reporter identified themselves, the person hung up. The Polish virtual currency regulatory authority did not respond to requests for comment.
According to two insiders, after the National Bank of Cambodia took action, Huione Pay continued to operate under the name "HPay." According to information from Cambodia's business registry, HPay was registered in the country in October last year, and its website shows that its headquarters is located in the same building as a branch of Panda Bank. HPay did not respond to requests for comment.
Even as the U.S. Treasury attempts to exclude Huione from the U.S. financial system, its threats may not be as significant as they appear. Generally speaking, cyber fraud does not require physical distance, and money launderers are adept at transferring funds through money mule accounts.
Huione has another layer of protection: its own currency.
Historically, many transactions were conducted in USDT. However, when Tether began freezing suspicious wallets using Huione, Huione Crypto launched its own stablecoin, USDH, last year.
Huione's archived statements claim that USDH "is not subject to traditional regulatory constraints" and "ensures that user assets will not be arbitrarily frozen."
Chen Yanyu, a scholar studying cybercrime in Taiwan, spent months in Cambodia talking to alleged money launderers, scammers, and their leaders. She stated that this interconnected network of interests has become adept at various workarounds, whether exploiting loopholes in Cambodia's financial system or leveraging favorable regulations in other countries.
"Cybercrime has deeply embedded itself in the operations of global capitalism, plundering resources from around the world," Chen Yanyu said, "and it cannot be easily dismantled."
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
