Cambodia Huiwang, the "super hub" of encryption black market.

Written by: Kai Schultz, Bloomberg

Compiled by: Luffy, Foresight News

New advertisement alerts are coming one after another. Want counterfeit money? Money laundering services? Hacking techniques? As long as you understand Chinese and the slang—"Liao Zhu" refers to a person holding stolen funds or bank information, and "Gou Tui" refers to scam park employees—everything, even more, is sold in the corners of the world's largest illegal goods trading market.

It's not difficult to find it. Relevant information is mainly published in the public chat room operated by Huione Group. This Cambodian enterprise group is well-known in the local Chinese-speaking community, famous for selling insurance, currency exchange, and financial services. Its online banking department, "Huione Pay," claims to be "Cambodia's Alipay." Restaurants and corner shops are everywhere with red stickers printed with Huione QR codes, allowing people to make payments by scanning them.

But the full suite of services offered by Huiwang's companies is actually much more murky. Despite repeated denials of involvement in any criminal activity, the U.S. Treasury Department said the U.S. Treasury Department laundered at least $4 billion of the proceeds of fraud and cryptocurrency theft.

This article reveals in detail how Huiwang has helped the Asian online scam industry expand into a multi-billion dollar behemoth, based on more than 20 interviews with government officials, company insiders, and purported victims, as well as internal documents.

"Huiwang is like the Amazon of criminals," said cyber threat investigator and former hacker Ngo Minh Hieu, who is studying the online footprint of this corporate group. "The way they organize their business and the range of products they offer shocked me." Ngo's conclusions align with the views of some regulatory agencies.

The constantly evolving operational model

The corporate history of Huiwang is extremely opaque. Archived web pages show that it was established in Cambodia in 2014, but Hong Kong records indicate that it was only registered locally in 2018. It appears to have never made public financial disclosures and has no employees or office space. Essentially, it is merely a shell of a network of affiliated companies. The directors of these branches often overlap, but the relationships between the departments are unclear.

The U.S. Treasury Department has specifically named three entities, stating that they have played a role in helping criminal groups move illicit funds: Huione Pay, the cryptocurrency exchange Huione Crypto, and the online trading platform operator Haowang Guarantee (formerly known as Huione Guarantee). The Treasury Department stated that these three entities are "essentially the same" as their parent company. In May of this year, the U.S. Treasury announced plans to completely exclude Huione from the U.S. financial system, while noting that Huione's clients include multinational criminal organizations and North Korean hackers known as the "Lazarus Group." The Treasury stated that "the risks associated with Huione's connections to illegal actors and transactions are further exacerbated due to a lack of effective anti-money laundering/customer identification (AML/KYC) policies and procedures."

Other countries are also stepping up containment. Thailand, which borders Cambodia, announced in June that it was investigating Huiwang Group for allegedly handling funds derived from illegal gambling and fraud. In the business sector, instant messaging app Telegram has shut down dozens of Huiwang-related chat groups. A spokesperson for stablecoin issuer Tether said it had frozen nearly $30 million in USDT in wallets associated with the Good Want Guarantee, adding that the company would take immediate action if law enforcement flagged more wallets linked to the Good Want Guarantee.

These measures have already had some public impact. According to the Central Bank of Cambodia, Hao Wang Guarantee and Huione Crypto have both announced closures, and Huiwang Payment was also liquidated in June. The National Bank of Cambodia stated in a declaration to Bloomberg that Huiwang Payment's license was revoked due to "serious violations of applicable regulations," and it has been ordered to close its offices and cease all operations, a process that was fully completed on June 19. However, seemingly three weeks after ceasing operations, Huiwang Payment stated in an email declaration to Bloomberg that it is "committed to constructive engagement with U.S. officials and other authorities" to promote the safety and transparency of the financial system. In a public response to the U.S. Department of the Treasury, Huiwang Payment stated that it is "working hard to resolve compliance issues and take remedial measures."

Although these entities have historically claimed direct connections with each other (the old version of the Huiwang Payment website stated it "originated from the Huiwang Group"; at the end of last year, Haowang Guarantee claimed in a social media post that Huiwang Group was one of its "strategic partners and shareholders"), currently no independent entity has publicly acknowledged any association with the Huiwang Group.

But network activities and two individuals familiar with the business operations indicate that these three departments seem to continue operating in some form, circumventing disruptions and regulatory pressure by changing names or directing customers to affiliated companies.

For example, in the weeks following the announcement of the closure of Haowang Guarantee, the cryptocurrency trading volume associated with the Huiwang entity identified by the blockchain analysis company Chainalysis actually increased. A large Haowang Guarantee group on Telegram is still publicly accessible and remains active, while the administrators are also directing customers to "Tudou Guarantee." According to statements from both companies, Haowang Guarantee has recently acquired a 30% stake in the platform.

Tudou Guarantee does not have a public email or phone number. Its customer service staff on Telegram said no one could respond to media questions. Haowang Guaranty declined the interview request, saying it had ceased operations and was not associated with any Huiwang entity. The company has previously denied any role in aiding in cybercrime. A Telegram spokesperson said, "We evaluate reports on a case-by-case basis and strongly oppose blanket bans," adding that the app is committed to protecting user privacy and financial autonomy.

On the website of Huione Crypto, a chatbot guides customers to register a new service provider called Kex. Kex is registered in the British Virgin Islands and cannot be contacted. A knowledgeable source, who wished to remain anonymous for security reasons, stated that Kex is operated by former employees of Huione Crypto. Ngo added that Kex's customized website template is the same as that of Huione Crypto. Emails sent to the official mailboxes of Huione Crypto and Kex were returned.

The continuous existence of Huiwang Group highlights the difficulty of shutting down decentralized markets, as well as the resilience of the Huiwang structure and the group's ability to find alternative solutions. Internal documents show that its so-called "money mules" (people responsible for laundering money) have targeted victims in at least 12 countries. Corporate documents indicate that some departments of Huiwang have branches in Poland, Canada, and Japan.

"When complex criminal financial networks take root, public closures are often just a superficial act," said Andrew Fierman, the Director of National Security Analysis at Chainalysis. The U.S. Treasury Department drew on the company's research and concluded that Huobi is "an important channel for money launderers." "The real infrastructure (their money laundering pipelines) continues to operate beneath the surface, processing billions of dollars smoothly."

The Hidden Core

Within Huione, this infrastructure is located in a mysterious department called "Huione International Pay." According to two anonymous sources (for security reasons), this department is the main operation hub for daily assistance in fraud activities. Company documents seen by Bloomberg and these two individuals indicate that, in addition to managing online crime markets on instant messaging apps like Telegram, employees also directly connect scammers with money mules and charge fees.

It is reported that employees of Huion International Payment once worked on the second floor of the Huion Payment headquarters in Phnom Penh, using aliases internally and assisting in establishing connections between money launderers' networks. Documents seen by Bloomberg contain detailed accounting records of thousands of victims, who were defrauded by different gangs using the Huione International Pay service. While it is nearly impossible to verify every incident, Bloomberg has cross-referenced some details and identity information with cases currently being heard in U.S. courts.

Huiwang Payment stated that it has no affiliation with Huiwang International Payment and is unaware of the entity or individual referred to by that name. The U.S. Financial Crimes Enforcement Network reported in May that Huiwang International Payment is "a part of Huiwang Payment" and facilitated "transactions related to money laundering activities" for Haowang Guarantee.

Explosive growth in the industry

Cybercrime existed even before the popularization of personal computers, and it can be said to have originated in the 1930s: at that time, a pair of French brothers took advantage of the optical telegraph system to gain early access to stock market data in Paris. However, it was not until the 2010s that cyber extortion truly exploded, with many activities originating from emerging scam hubs in Southeast Asian countries such as Cambodia, Myanmar, and Laos, which began to defraud victims around the world.

Many parks are operated by criminal groups led by Chinese, and the staff are trafficked individuals who are forced to scam victims in countries such as the United States, Germany, and Japan. In many cases, the targets are deceived into participating in fraudulent cryptocurrency investment schemes or fake romantic relationships, known as "pig butchering."

The growth of the telecom fraud industry is rapid. Data from Chainalysis shows that in 2024, the revenue from "pig butchering" scams surged nearly 40% compared to the previous year. As the industry expands, global law enforcement officials have more questions: how do crime bosses acquire tools (such as fake passports, malware, facial recognition software, money mules) to achieve such rapid growth? The answer is a new batch of online trading markets. Unlike Western platforms like "Silk Road" that require users to overcome technical barriers to access, these new platforms operate in plain sight.

In the Telegram groups managed by Huiwang (numbering in the thousands), many appear innocuous, serving functions similar to classified ads for currency exchange or real estate transactions. However, analysts from the United Nations Office on Drugs and Crime have noted that after the closure of an underground market in Myanmar named "Fully Light Guarantee" (which has no known ties to Huiwang), the atmosphere on Huiwang Guarantee has turned dark. Anonymous users have started using more coded language in posts that suggest illegal transactions, and user advertisements no longer make an effort to conceal illegal intentions. Most advertisements are written in Chinese, indicating that the primary clientele is not Cambodian.

Although the Chinese Ministry of Foreign Affairs has not directly commented on Huizhong, it stated that China is actively conducting law enforcement and security cooperation with neighboring countries, including Cambodia, and will continue to deepen international law enforcement cooperation to combat cross-border crimes such as online fraud.

An advertisement reviewed by Bloomberg in 2023 sold counterfeit RMB that could pass through cash machines. Other ads promoted smuggled iPhones, hacked computers, or offered services to unfreeze bank accounts. Several ads directly sold products related to the scam industry: using Chinese terms such as "killing pigs," selling services for fake cryptocurrency investment websites, and promoting the use of electric batons and tear gas to control "fleeing dogs," which clearly refers to the abuse of trafficked workers. Most ads required payment in cryptocurrency.

"The collapse of the fully collateralized platform has become a major catalyst for other trading platforms," said John Wojcik, a former threat analyst at the United Nations Office on Drugs and Crime. "Huiwang's user base grew from thousands to tens of thousands, even hundreds of thousands almost overnight," as former users of the fully collateralized platform were looking for alternatives.

As the influence of Huibang Guarantee expands, blockchain investigators are delving deeper to try to estimate its true scale. One of the largest investigative firms, Elliptic, released a research report in January concluding that at least $24 billion has flowed through the cryptocurrency wallets used by Huibang Guarantee and its merchants. The estimates from blockchain intelligence company TRM Labs are even higher, reaching $81 billion. Regardless of the estimate, it indicates that Huibang Guarantee's scale far exceeds that of its largest predecessor — the Russia-operated "Hydra Market," which was shut down by U.S. and German officials.

Data Source: Elliptic

"They are several times larger than any other similar platform," said Tom Robinson, Chief Scientist at Elliptic.

Hao Wang Guaranty denied playing any role in assisting cybercrime in its statement in February and stated that all business in its Telegram group is provided by third parties.

Complex operations

Bloomberg reviewed some internal documents of Huiliang International Payment from 2022 to 2023, which are mainly written in Chinese and record thousands of victims and tens of millions of dollars in transactions. The documents show that employees were directly involved in monitoring transactions and handling disputes, and the platform regularly took commissions from the transactions. The documents also indicate that Huiliang International Payment was deeply involved in operations, even providing large credit limits to high-performing money laundering teams.

One of the documents is a multi-page manual prepared by the International Payment Transaction Department of Huiwang, which outlines the rules for filling out logs for "customers" (i.e., victims) in the United States, Europe, and Australia. This 2022 report describes how to handle risks "ranging from minor to severe," including situations when victims report to the police or when money mules are detained by authorities. The manual states to change a certain column in the log to "person arrested" and to "immediately report to the manager or regional head."

A screenshot of a document written by the International Payment Transaction Department of Huiwang, showing the rules for the victim (referred to as "customer") to fill out the log.

The files use a coding system to track money mules and scammers, revealing their reach and sophistication. Money launderers are classified with an "X" prefix followed by a numeric number. Scammers are broadly grouped by target region: EZ3 refers to gangs focused on victims in Europe; US26 refers to gangs directed against the United States. Huione International Payments also records victims' information and sometimes even stores their bank account details. Records of operations in Taiwan are extremely detailed, including justification notes created by scammers for the cable compilation. For example, in one case, it says "order pet food in bulk". Harris Chen, Taiwan's prosecutor specializing in cybercrime investigations, said he was able to match the details in the documents to at least two money laundering convictions in Taiwan.

Bloomberg matched detailed information about multiple individuals in the documents with information from the investigation led by the FBI and the Secret Service (responsible for financial crime jurisdiction and protection of the president).

This includes the case of Daren Li, who holds dual citizenship in China and Saint Kitts and Nevis, and admitted to laundering over $73 million through a cryptocurrency investment scam in the United States. U.S. officials seized his phone, claiming he communicated with accomplices on Telegram under the nickname "KG71777." The documents from Huibang International Payment not only record this username but also his WhatsApp account. The documents show that Li earned about 9% in commissions from this. (Huibang is not mentioned in the public court documents of the case.)

One of the victims mentioned in the logs is U.S. resident Shashi Iyer. U.S. court documents reveal that at the end of 2022, Iyer received a strange notification on his phone: you have been automatically added to a Telegram group. When he asked the administrator for the reason, they stated that the group was for investors interested in cryptocurrency trading options contracts for a certain financial services company in Boston. Iyer often looked for investment opportunities in Telegram groups, and tempted by promises of profits ranging from 50% to 95%, he decided to give it a try.

"That's a honey trap," he said in an interview.

After his funds nearly doubled and he smoothly withdrew them, Iyer was invited to join a small Telegram group limited to high-cap investors, where he invested about $40,000. When he tried to cash out, he found that the investment company did not exist at all, so he reported it to the U.S. government. The U.S. Secret Service filed a civil lawsuit in Tennessee last year for victims including Iyer (Huiwang was not mentioned), and the court ultimately ordered a partial refund of the funds.

Court documents show that the victim transferred millions of dollars to shell company accounts of Memphis Evolve Bank Trust. A spokesperson for Evolve Bank Trust declined to comment on the case but emphasized that the institution "is fully committed to maintaining the highest standards of compliance, financial integrity, and anti-money laundering controls."

The logs of Huiwang International Payments recorded the information of Iyer and two other victims from Tennessee, precise to the wire transfer timestamp, bank account number, and the number of the money laundering gang responsible for them: X3.

Avoid censorship

The limited records of WayOne's operations in Cambodia, including WayOne Payments and Good Want Guarantees, show that they are led by Chinese executives and local powerhouses, a common symbiotic relationship in Cambodia. In recent years, a large influx of Chinese capital has poured into the country, transforming the country. Driving through Phnom Penh these days, many construction sites have Chinese signs. According to a former employee, Mandarin is heard more frequently in Huiwang's offices than Khmer, Cambodia's main language.

Hun To was listed as a director of the now-dissolved Huibang Payment at the Commercial Registry of Cambodia, and he is a cousin of Cambodian Prime Minister Hun Manet. Hun To's home in Phnom Penh resembles a fortress, surrounded by thick concrete walls, with nets hung above the ground, possibly to prevent a group of foreign hornbills from escaping. According to local media, years ago in the Australian "Operation Illypango" investigation, officials suspected him of smuggling drugs using timber transport. He denied the allegations and was ultimately not prosecuted. The Australian Criminal Intelligence Commission stated that it could not assist in providing relevant inquiries.

The reporter contacted him through the affiliated email of three companies where Hun To serves as a director, but received no response. The cabinet office led by the Prime Minister of Cambodia also did not respond to the request for comment. Hun To has consistently denied his business involvement in online fraud, and there is no evidence to suggest that he is aware of the operations of Huiwang International Payment.

Associated enterprises of Huiwang, source: U.S. Department of the Treasury, company documents, and Bloomberg reports.

He Yanming, the owner of Huione Crypto registered in Poland, is listed in the Cambodian Commercial Registry as a director of Panda Commercial Bank Plc, the country's main financial institution. Hun To and Li Xiong, who served on the board of directors of at least four companies at Huiwang, were members of the bank's board of directors until they resigned last October.

The reporter requested comments through the associated email of other companies where Li Xiong and He Yanming serve as directors, but received no response. There is no indication that the two were aware of the so-called illegal activities within the corporate group prior. Panda Bank also did not respond to the request for comments.

According to foreign officials of the enterprise group, Huibang's business has not been subjected to much scrutiny within Cambodia. However, last September, the National Bank of Cambodia revoked the license of Huibang Payment. A few months later, when the news became public, customers flocked to the company's main office in Phnom Penh to withdraw their funds, and Huibang Payment subsequently temporarily raised the interest rate on all USDT deposits from 2% to 7.3%.

But this panic was just a minor episode. The company quickly announced on a social media account that it would move its payment and blockchain services to Japan and Canada, where its subsidiary had previously held licenses to operate.

Japan's financial regulatory agency declined to comment on whether any branches of Huion have been investigated, but stated that the corporate group does not hold a valid payment service license. Erica Constant, a spokesperson for the Canadian financial regulatory agency, noted that Huion Pay's registration as a currency service provider in Canada expired at the end of 2023. She refused to comment on whether law enforcement has shared any intelligence about the company with her agency. Recently, a reporter visited the office address of Huione Crypto in Poland — a four-story apartment building in a tree-lined residential area of Warsaw. The person on the intercom said it was a "virtual office." After the reporter identified themselves, the other party hung up. The Polish virtual currency regulatory agency did not respond to requests for comment.

According to two informed sources, HPay continues to operate under the name "HPay" after the Central Bank of Cambodia took action. According to information from the Cambodian business registry, HPay was registered in the country in October last year, and its official website shows that its headquarters is located in the same building as a branch of Panda Bank. HPay did not respond to requests for comment.

Even if the U.S. Treasury attempts to exclude Huineng from the U.S. financial system, its threat may not be as significant as it appears. Generally speaking, online fraud does not require physical distance, and money launderers are skilled at transferring funds through money mule accounts.

Huiwang has another layer of protection: its own currency.

Historically, many transactions were conducted using USDT. However, after Tether began freezing suspicious wallets using Huobi, Huione Crypto launched its own stablecoin USDH last year.

The Huiwang official website archive statement claims that USDH "is not subject to traditional regulatory constraints" and "ensures that user assets will not be arbitrarily frozen."

Chen Yanyu, a Taiwanese scholar on cybercrime, spent months in Cambodia talking to alleged money launderers, fraudsters and their ringleaders. She said this network of interconnected interests has mastered various workarounds, whether it is exploiting loopholes in Cambodia's financial system or relying on favorable regulations in other countries.

"Cybercrime has been deeply embedded in the operation of global capitalism, plundering resources from all over the world," said Chen Yanyu, "it cannot be easily dismantled."