The "Super Hub" of Crypto Black Market: Decoding Huiwang Group's $4 Billion Money Laundering Network

By Kai Schultz, Bloomberg

Compiled by Luffy, Foresight News

New advertising prompts followed one after another. Want counterfeit currency? Money laundering services? Hacking skills? As long as you understand Chinese and the jargon—"material owner" refers to someone holding stolen money or bank information, "dog pusher" refers to someone who scams park employees—all of these things, and more, are for sale in this corner of the world's largest illegal goods market.

Finding it isn't difficult. Information about it is primarily posted in public chat rooms run by the Huione Group. This Cambodian conglomerate is a household name in the local Chinese-speaking community, known for selling insurance, currency exchange, and financial services. Its online banking arm, Huione Pay, calls itself "Cambodia's Alipay." Restaurants and corner shops are ubiquitous with red stickers bearing the Huione QR code, which can be scanned for payment.

But the full suite of services provided by Huiwang’s subsidiaries is far more murky. Despite repeated denials from Huiwang affiliates of any criminal activity, the U.S. Treasury Department alleges that Huiwang laundered at least $4 billion in proceeds from fraud and cryptocurrency theft.

Based on more than 20 interviews with government officials, company insiders, alleged victims, and internal documents, this article details how Huiwang helped expand Asia's online fraud industry into a multi-billion dollar behemoth.

“Huiwang is like Amazon for criminals,” said Ngo Minh Hieu, a cyber threat investigator and former hacker who is studying the conglomerate’s online footprint. “I’m shocked by the way their business is organized and the range of their products.” Ngo’s conclusion echoes the views of some regulators.

The ever-changing operating model

Huiwang's corporate history is remarkably opaque. Archived webpages indicate it was founded in Cambodia in 2014, but Hong Kong records show it was only registered there in 2018. It appears to have never made public financial disclosures and lacks employees or office space. Essentially, it is a shell company operating a network of affiliated companies. These branches often have overlapping directorships, but the relationships between the various divisions are unclear.

The US Treasury Department specifically named three entities, alleging their role in helping criminal organizations move illicit funds: Huione Pay, the cryptocurrency exchange Huione Crypto, and the online trading platform operator Haowang Guarantee (formerly Huiwang Guarantee). The Treasury stated that these three entities are "substantially identical" to their parent company. In May of this year, the Treasury announced plans to completely exclude Huiwang from the US financial system, noting that its clients included transnational criminal organizations and the North Korean hacker group known as the Lazarus Group. The Treasury stated that the risks posed by Huiwang's association with illicit actors and transactions were "further exacerbated by the lack of effective anti-money laundering/know your customer (AML/KYC) policies and procedures."

Other countries are also stepping up their crackdowns. Thailand, which borders Cambodia, announced in June that it was investigating Huiwang Group for allegedly handling funds from illegal gambling and fraud. In the business sector, the instant messaging app Telegram has shut down dozens of Huiwang-related chat groups. A spokesperson for stablecoin issuer Tether said it had frozen nearly $30 million in USDT in wallets associated with Haowang Guarantee, adding that the company would take immediate action if law enforcement flagged additional wallets linked to Haowang Guarantee.

These actions have had some public repercussions. According to the Central Bank of Cambodia, both Haowang Guarantee and Huione Crypto have announced their closures, and Huiwang Payment was liquidated in June. In a statement to Bloomberg, the National Bank of Cambodia stated that Huiwang Payment's license had been revoked for "serious violations of applicable regulations" and that it had been ordered to close its offices and cease all operations, a process completed on June 19th. However, three weeks after seemingly ceasing operations, Huiwang Payment stated in an emailed statement to Bloomberg that it is "committed to constructive engagement with U.S. officials and other authorities" to promote a safe and transparent financial system. In its public response to the U.S. Treasury, Huiwang Payment stated that it is "working diligently to address compliance issues and implement remedial measures."

While these entities have historically claimed direct links to each other (Huiwang Payment’s older website described itself as “derived from Huiwang Group”; late last year, Haowang Guarantee cited Huiwang Group as one of its “strategic partners and shareholders” in a social media post), no independent entity has publicly acknowledged any connection to Huiwang Group.

But online activity and two people familiar with the business operations said the three units appeared to be continuing to operate in some form, circumventing disruption and regulatory pressure by changing their names or directing customers to affiliated companies.

For example, in the weeks following Haowang Guarantee's closure announcement, cryptocurrency trading volume associated with Huiwang entities identified by blockchain analytics firm Chainalysis actually increased. A large Haowang Guarantee Telegram group remained publicly accessible and active, with administrators directing clients to Tudou Guarantee. According to statements from both companies, Haowang Guarantee recently acquired a 30% stake in the platform.

Tudou Guarantee does not have a public email or phone number. Customer service representatives on its Telegram account said no one could respond to media inquiries. Haowang Guarantee declined an interview request, stating that it has ceased operations and is not affiliated with any Huiwang entity. The company has previously denied any role in facilitating cybercrime. A Telegram spokesperson said, "We evaluate reports on a case-by-case basis and firmly oppose blanket bans," adding that the app is committed to protecting user privacy and financial autonomy.

On Huione Crypto's website, a chatbot guides customers to register with a new service provider called Kex. Kex is registered in the British Virgin Islands and could not be reached. A person familiar with the matter, who requested anonymity for security reasons, said Kex is run by former Huione Crypto employees. Ngo added that Kex's custom website template is the same as Huione Crypto's. Bloomberg's emails to both Huione Crypto and Kex's official email addresses bounced.

The continued existence of the Huiwang Enterprise Group highlights the difficulty of shutting down decentralized markets, as well as the resilience of its structure and its ability to find workarounds. Internal documents reveal that its so-called "money mules" (those responsible for laundering money) have targeted victims in at least 12 countries. Corporate documents indicate that some Huiwang units have branches in Poland, Canada, and Japan.

"When complex criminal financial networks truly take root, public shutdowns are often just cosmetic," said Andrew Fierman, head of national security analysis at Chainalysis. The U.S. Treasury Department, drawing on the company's research, concluded that Huiwang was a "significant conduit for money launderers." "The real infrastructure—their money laundering pipelines—continues to operate beneath the surface, processing billions of dollars unimpeded."

Hidden Core

Within Huiwang, this infrastructure resides in a mysterious department called "Huione International Pay." According to two people familiar with the matter, who spoke on the condition of anonymity for security reasons, this department serves as the primary hub for facilitating fraudulent operations. Company documents reviewed by Bloomberg and the two people indicate that, in addition to managing online criminal marketplaces on messaging apps like Telegram, employees directly connect scammers with money mules and collect fees for doing so.

Huione International Payment employees, reportedly working on the second floor of Huione Payment's headquarters in Phnom Penh, used aliases internally and helped establish connections between money laundering networks. Documents reviewed by Bloomberg News contain detailed accounting records for thousands of victims defrauded by various groups using the Huione International Payment service. While verifying every incident is nearly impossible, Bloomberg News has compared some details and identifying information with cases currently underway in US courts.

Huiwang Payment stated that it has no connection with Huiwang International Payment and is unaware of the entity or individual referred to by that name. A May report by the US Financial Crimes Enforcement Network (FinCEN) stated that Huiwang International Payment was "part of Huiwang Payment" and facilitated "transactions related to money laundering activities" on behalf of Haowang Guarantee.

Explosive growth in the industry

Cybercrime existed long before personal computers became commonplace, arguably dating back to the 1830s, when a pair of French brothers exploited an optical telegraph system to gain early access to Paris stock market data. However, cyber extortion campaigns truly exploded in the 2010s, with much of the activity originating from new scam rings in Southeast Asian countries like Cambodia, Myanmar, and Laos, which began defrauding victims worldwide.

Many of the parks are run by Chinese-led criminal gangs and staffed by trafficked individuals who are forced to defraud victims in countries such as the United States, Germany, and Japan. In many cases, targets are tricked into participating in fake cryptocurrency investment schemes or sham romances, known as "pig-killing schemes."

The cyber fraud industry is growing rapidly. Chainalysis data shows that revenue from "pig-killing" scams will surge nearly 40% in 2024 compared to the previous year. As the industry expands, law enforcement officials worldwide are increasingly asking: How do criminal kingpins acquire the tools (such as fake passports, malware, facial recognition software, and money mules) to achieve such rapid growth? The answer lies in a new wave of online marketplaces. Unlike Western platforms like Silk Road, which required users to overcome technical barriers to access, these new platforms operate openly.

Many of the thousands of Telegram groups managed by Huiwang appear innocuous, functioning roughly like classified pages for currency exchange or real estate. But according to analysts at the United Nations Office on Drugs and Crime, who track the platform, the atmosphere on Huiwang Guarantee took a darker turn after the shutdown of an underground market in Myanmar called "Fully Light Guarantee" (with no known connection to Huiwang). Anonymous users began using more jargon in their posts that hinted at illegal transactions, and user ads became less circumspect about their illicit intentions. Most ads were written in Chinese, suggesting that the primary clientele was not Cambodian.

While China’s Ministry of Foreign Affairs did not directly comment on Huiwang, it said China is actively conducting law enforcement and security cooperation with neighboring countries, including Cambodia, and will continue to deepen international law enforcement cooperation to combat cross-border crimes such as cyber fraud.

One ad from 2023 reviewed by Bloomberg News peddles counterfeit RMB that can pass through currency detectors. Others promote smuggled iPhones, hacked computers, or offer services to unlock frozen bank accounts. Several ads directly peddle products related to the scam industry: using Chinese terms like "killing pigs," selling services to create fake cryptocurrency investment websites, and promoting the use of electric batons and tear gas to control "escaped dogs," an apparent reference to the abuse of trafficked workers. Most ads request payment in cryptocurrency.

“The collapse of Quanguang Guarantee became a major catalyst for other trading platforms,” said John Wojcik, a former threat analyst at the United Nations Office on Drugs and Crime. “Huiwang Guarantee went from a few thousand users to tens of thousands and hundreds of thousands of users almost overnight,” as former Quanguang Guarantee users sought alternative platforms.

As Huiwang Guarantee's influence grew, blockchain researchers began digging deeper, attempting to estimate its true size. Elliptic, one of the leading research firms, released a report in January concluding that at least $24 billion flowed through Huiwang Guarantee and the cryptocurrency wallets used by its merchants. TRM Labs, a blockchain intelligence firm, put the estimate even higher, at $81 billion. Either estimate implies that Huiwang Guarantee's scale far surpassed its largest predecessor, the Russian-run "Hydra Market," which was shut down by US and German officials.

 Data source: Elliptic

“They’re several times larger than any comparable platform,” says Tom Robinson, chief scientist at Elliptic.

In a February statement, Haowang Guarantee denied any role in facilitating cybercrime and said all operations in its Telegram groups were provided by third parties.

Complex operations

Bloomberg News reviewed selected internal documents from Huiwang International Payment from 2022 to 2023, primarily written in Chinese, documenting thousands of victims and tens of millions of dollars in transactions. The documents reveal that employees were directly involved in monitoring transactions and resolving disputes, and that the platform regularly took commissions from transactions. The documents also reveal Huiwang International Payment's deep involvement in operations, even extending large lines of credit to high-performing money laundering rings.

One document is a multi-page manual compiled by Huiwang International's payment transaction department, outlining the rules for filling out logs for "customers" (i.e., victims) in the United States, Europe, and Australia. The 2022 report describes how to handle risks ranging from "minor to severe," including when victims report an incident to the police or when a money mule is detained by authorities. The manual instructs users to change a column in the log to "Person arrested" and "report immediately to their manager or regional head."

 Screenshot of a document compiled by Huiwang International’s payment transaction department, showing the rules for filling in logs for victims (referred to as “customers”).

The documents use a coding system to track money mules and scammers, demonstrating their reach and sophistication. Money launderers are categorized by a number prefixed with "X." Scammers are broadly grouped by target region: EZ3 refers to groups focused on European victims; US26 refers to groups targeting the United States. Huiwang International Payment also records victim information, sometimes even storing their bank account details. Operations targeting Taiwan are extremely detailed, including concocted justifications for the calls. In one case, for example, it was written as "bulk ordering pet food." Harris Chen, a prosecutor specializing in cybercrime investigations in Taiwan, said he was able to match details in the documents to at least two money laundering convictions in Taiwan.

Bloomberg matched details on several individuals in the document with information from investigations led by the FBI and the Secret Service, which has jurisdiction over financial crimes and protects the president.

This includes the case of Daren Li, a dual citizen of China and Saint Kitts and Nevis, who pleaded guilty in the United States to laundering over $73 million through a cryptocurrency investment scam. US officials seized his phone and allege that he communicated with accomplices on Telegram using the username "KG71777." Huiwang International payment documents contain not only records of that username but also his WhatsApp account. The documents indicate that Li earned approximately 9% commissions from these transactions. (Huiwang does not appear in public court documents in the case.)

One of the victims mentioned in the logs is US resident Shashi Iyer. US court documents reveal that in late 2022, Iyer received a strange notification on his phone: "You have been automatically added to a Telegram group." When he inquired with the administrator, they explained that the group was for investors interested in options contracts on cryptocurrency trading platforms operated by a Boston-based financial services firm. Iyer frequently searched for investment opportunities in Telegram groups, and, lured by promises of 50% to 95% returns, he decided to give it a try.

“It was a honey trap,” he said in an interview.

After nearly doubling his money and successfully withdrawing it, Iyer was invited to join a small Telegram group reserved for high-stakes investors and invested approximately $40,000. When he tried to cash out, he discovered the investment company didn't exist and reported the case to the US government. Last year, the US Secret Service filed a civil lawsuit in Tennessee on behalf of victims, including Iyer (Huiwang was not named), which ultimately resulted in a court order for the partial return of funds.

Court documents show that victims collectively transferred millions of dollars to shell company accounts at Evolve Bank & Trust in Memphis. A spokesman for Evolve Bank & Trust declined to comment on the case but stressed that the firm is "fully committed to maintaining the highest standards of compliance, financial integrity, and anti-money laundering controls."

Huiwang International Payment's logs record information about Iyer and two other Tennessee victims, down to the wire transfer timestamp, bank account number, and the number of the money laundering gang responsible for them: X3.

Circumventing censorship

Limited records of Huiwang's Cambodian operations, including Huiwang Payment and Haowang Guarantee, reveal that they are jointly led by Chinese managers and local influential figures, a common symbiotic relationship in Cambodia. In recent years, a massive influx of Chinese capital has transformed the country. Driving through Phnom Penh today, many construction sites display Chinese signs. According to a former employee, Mandarin is more frequently heard in Huiwang Payment's offices than Khmer, Cambodia's primary language.

Hun To, once listed in Cambodia's business registry as a director of the now-defunct Huiwang Payment, is a cousin of Cambodian Prime Minister Hun Manet. Hun To's home in Phnom Penh resembles a fortress, surrounded by thick concrete walls and netting suspended above the ground, perhaps to prevent the escape of a flock of introduced hornbills. According to local media reports, years ago, during the Australian investigation known as Operation Ilipango, officials suspected him of smuggling drugs using timber. He denied the allegations and was ultimately not charged. The Australian Criminal Intelligence Commission stated it could not assist with inquiries.

Contacts to Hun To via email addresses associated with the three companies where he served as a director went unanswered. The Office of the Cabinet, led by the Cambodian Prime Minister, also did not respond to requests for comment. Hun To has consistently denied involvement in online fraud, and there is no indication that he was aware of Huiwang International Payment's operations.

 Huiwang's affiliated companies, source: U.S. Treasury Department, company filings, and Bloomberg reports

Huione Crypto's Polish-registered owner, He Yanming, is listed in Cambodia's commercial registry as a director of Panda Commercial Bank Plc, the country's main financial institution. Hun To and Li Xiong, who previously served on the boards of at least four Huione companies, were members of the bank's board until their resignations in October.

Requests for comment through email addresses associated with other companies where Mr. Li and Mr. He Yanming serve as directors went unanswered. There is no indication that either had prior knowledge of the alleged illegal activities within the conglomerate. Panda Bank also did not respond to requests for comment.

Foreign officials familiar with the conglomerate say Huiwang's operations faced little scrutiny within Cambodia. However, last September, the Central Bank of Cambodia revoked Huiwang Payment's license. Months later, when the news became public, customers flocked to the company's main office in Phnom Penh to withdraw their funds, prompting Huiwang Payment to temporarily raise the interest rate on all USDT deposits from 2% to 7.3%.

But the panic was a minor incident. The company soon announced on a social media account that it would move its payment and blockchain services to Japan and Canada, countries where Huiwang units previously held operating licenses.

Japan's financial regulator declined to comment on whether any Huione branches were under investigation, but said the conglomerate did not have a valid payment services license. Erica Constant, a spokeswoman for Canada's financial regulator, said Huione Payment's registration as a money service provider in Canada expired at the end of 2023. She declined to comment on whether law enforcement had shared intelligence about the company with her agency. Recently, reporters went to Huione Crypto's office address in Poland - a four-story apartment building in a leafy residential area in Warsaw. The person on the other end of the intercom said it was a "virtual office." When the reporter identified himself, the other party hung up the phone. Poland's virtual currency regulator did not respond to a request for comment.

According to two people familiar with the matter, Huiwang Payment continued operating under the name "HPay" after the Central Bank of Cambodia took action. HPay was registered in Cambodia in October of last year, according to the Cambodian Commercial Registry. Its website lists its headquarters as being located in the same building as a Panda Bank branch. HPay did not respond to requests for comment.

Even if the U.S. Treasury Department attempts to exclude Huiwang from the U.S. financial system, the threat may not be as great as it appears. Generally speaking, online fraud does not require physical proximity, and money launderers are skilled at transferring funds through money mule accounts.

Huiwang has another layer of protection: its own currency.

Historically, many transactions were conducted in USDT. But after Tether began freezing suspicious wallets using Huiwang, Huione Crypto launched its own stablecoin, USDH, last year.

A statement archived on Huiwang’s official website stated that USDH is “not subject to traditional regulatory constraints” and “ensures that user assets will not be arbitrarily frozen.”

Chen Yanyu, a Taiwanese cybercrime scholar who has spent months in Cambodia speaking with alleged money launderers, fraudsters and their ringleaders, said this interconnected web of interests has mastered various workarounds, whether exploiting loopholes in Cambodia's financial system or taking advantage of favorable regulations in other countries.

“Cybercrime is deeply embedded in the workings of global capitalism, plundering resources from around the world,” Chen Yanyu said. “It cannot be easily dismantled.”