The $24 Billion Underground River: How Crypto's Largest Criminal Marketplace Was Brought Down

April 1, 2026. Phnom Penh International Airport.

A handcuffed man was hooded with a black sack by Chinese special police and shoved aboard a China Southern Airlines flight. Hours later, the plane touched down somewhere in China. The officers pulled off the hood, revealing a pale, exhausted face.

His name was Li Xiong, Chairman of Huione Group and the most trusted lieutenant of Chen Zhi, founder of Prince Group. During the years Li oversaw Huione, his name was inescapable in Phnom Penh's Chinese community. Red QR codes stamped with the Huione Pay logo lined street-corner shops; restaurant owners used them to collect payments; casinos settled accounts through them. Huione Pay called itself "Cambodia's Alipay," a label designed to sound harmless.

But that was only the tip of the iceberg.

Beneath the surface lay a $24 billion underground financial empire, a criminal service supermarket stitched together from thousands of Telegram groups, a black market five times larger than Hydra, the legendary dark web marketplace, and three times larger than FTX at its peak.

Its name: Huione Guarantee.

Li Xiong's arrest came exactly 84 days after Prince Group founder Chen Zhi was extradited to China. Together, the two arrests marked the formal end of the largest money laundering empire in cryptocurrency history.

The Dark Rise of a Fujian Teenager

To understand Huione Guarantee, you must first understand the man behind it.

Chen Zhi was born in 1987 in Xiao'ao Town, Lianjiang County, Fujian Province, a coastal settlement facing the Matsu Islands across the strait. His family was unremarkable, modestly middle-class at best by local standards. Chen dropped out of junior high after the second year, leaving formal education at fifteen or sixteen. His classroom moved from school desks to internet cafés.

Around 2005, internet cafés along Fujian's coast were booming, and they doubled as incubators for China's first generation of cybercriminals. Chen was among them. He pulled together a small crew of classmates and made money running private servers for the online game Legend of Mir 2, cracking official servers, and selling stolen user data. The work straddled legal gray zones, but the margins were fat. Private gaming servers became his first real payday.

A fellow townsman later recalled that Chen also dealt in personal data, ran matchmaking sites, and built social platforms for gamers. If it made money on the internet, legal or otherwise, he was in.

Around 2010, Chen left Lianjiang with roughly RMB 500,000 (approximately USD 70,000) in illicit proceeds.

His destination: Cambodia.

Dream-Building in Phnom Penh

In 2011, Phnom Penh was still a frontier city. Chinese capital had only just begun trickling into Southeast Asia, and Cambodia's real estate market was untouched territory. Chen saw the opening.

Rather than competing with major developers for prime lots, he snapped up cheap land on the city's outskirts and threw up low-cost housing and shopfronts. The playbook was simple: low capital, fast turnover. It was tailor-made for a sharp-nosed speculator working with limited funds.

In 2014, Chen paid USD 250,000 for Cambodian investment immigration and obtained citizenship. The "Fujian internet café kid" vanished. In his place stood "Vincent Chen Zhi," Cambodian-Chinese entrepreneur.

In 2015, Prince Holding Group was officially founded.

What followed was vertigo-inducing. Prince Group's signage went up across downtown Phnom Penh as the business ballooned beyond real estate into banking, insurance, telecommunications, retail, and tourism. Prince Plaza Shopping Mall became a city landmark. Prince Bank received its formal license in 2018. Chen even launched the Prince Foundation, a high-profile charitable arm with donations totaling over USD 16 million, a textbook exercise in reputation laundering that cast him as a "respected entrepreneur and philanthropist."

Political connections were the machine's most essential lubricant. Chen reportedly spent USD 20 million hosting Prime Minister Hun Sen's 68th birthday banquet, packing the room with foreign diplomats. He received royal appointments as advisor to Interior Minister Sar Kheng, National Assembly President Heng Samrin, Prime Minister Hun Sen, and his successor Hun Manet. In 2020, he was bestowed the title of "Duke" and issued a diplomatic passport.

On the streets of Phnom Penh, more than a third of all Rolls-Royces belonged to Prince Group. Chen traveled with bodyguards and rode in a Rolls-Royce himself. Someone who met him offered this description: short, about 5'6", with a prominent forehead and a thick Fujian accent. His eyes carried "a certain ruthlessness."

But beneath the gloss, Prince Group's real profit engine ran on an entirely different kind of business.

The Fraud Factory

Starting in 2015, Chen built at least ten walled-off industrial compounds across Cambodia.

Ringed by high walls and barbed wire, the compounds were sealed to outsiders. Thousands of workers from China, Vietnam, Myanmar, Indonesia, and elsewhere were lured in by job ads promising high-paying IT positions. Once they stepped through the gates, their passports were confiscated and their phones placed under surveillance. They became disposable tools in telecom fraud operations.

A U.S. Department of Justice indictment laid bare the operational details: Prince Group's fraud syndicates controlled millions of phone numbers and ran "phone farms," large-scale call centers, across multiple compounds. Two facilities alone deployed 1,250 handsets and managed roughly 76,000 social media accounts. Internal Prince Group documents coached staff on building fabricated romantic relationships with victims and recommended "avoiding excessively attractive female profile photos" to appear more believable.

The scheme is known as the "pig-butchering scam." First, operatives assume fake identities and cultivate trust and emotional bonds with targets, the "fattening" phase. Then they steer victims into pouring real money onto counterfeit investment platforms, the "slaughter."

Chen personally oversaw these fraud bases. In his ledgers, profits were explicitly categorized as "pig-butchering," broken down by responsible floor and building. His standing order for workers who resisted: "Beatings are fine, just don't kill them."

Elliptic, a blockchain analytics firm, even discovered ads within the compounds' Telegram groups selling electric-shock ankle restraints designed to confine workers.

Money from the scams flowed in a steady stream from victims' bank accounts into Prince Group's underground coffers. But the money was dirty and could not enter the formal financial system.

It needed a river to wash it clean.

That river was Huione.

The Dark Web's Amazon

In 2021, Huione Guarantee quietly went live on Telegram.

On its face, the positioning looked legitimate: a transaction escrow service for real estate and used cars. Buyers sent payment to a Huione Guarantee bot; sellers delivered the goods; buyers confirmed receipt; Huione released the funds and took a commission. The mechanics were unremarkable, a standard escrow model.

But it did not take long for the "merchandise" on the platform to change entirely.

Money laundering services became the core category. Within Huione Guarantee's Telegram groups, vendors advertised openly: "Accepting dirty funds, disbursing clean ones." The jargon was specialized. "Material owners" held stolen funds or compromised bank credentials. "Dog pushers" were the frontline fraud workers. "Brick-moving" was slang for the intermediary work of laundering cash.

A typical laundering cycle worked like this: a fraud ring ran a pig-butchering scam and collected the proceeds, then handed them off to intermediaries on Huione Guarantee. Those intermediaries routed the money through a network of "money mules," shell accounts scattered across a dozen or more countries, before returning the funds to the fraud ring as USDT stablecoins. Intermediaries and mules each took a cut.

The entire process ran like a precision-engineered industrial assembly line.

But Huione Guarantee sold far more than laundering services. Its merchants offered scam scripts, fake website development, AI face-swapping tools, databases of trafficked individuals' personal information, forged national ID documents, and Starlink satellite terminals for compound communications. Virtually every crime-enabling tool imaginable was available for purchase.

Huione Guarantee was a fully priced criminal supermarket, and Telegram groups were its shelves.

By mid-2024, when Elliptic first exposed the platform, its transaction volume had already surpassed USD 11 billion. By early 2025, that figure had more than doubled to USD 24 billion. The platform maintained 9,289 active public groups on Telegram, with over 900,000 registered users.

For perspective: Hydra, the largest dark web marketplace in history, operated for six full years and generated just USD 5 billion in total volume. Huione Guarantee hit five times that in under four years.

Internal documents from Huione International Payment covering 2022 to 2023, obtained by Bloomberg, recorded thousands of victims and tens of millions of dollars in transactions. The documents showed that Huione employees directly monitored trades and mediated disputes. The platform routinely skimmed commissions and even extended large credit lines to "top-performing money laundering teams."

In Phnom Penh, Huione International Payment occupied the second floor of the Huione Pay headquarters, a glass-and-concrete building flanked at its entrance by two panda statues. Staff worked under aliases. One department handled liaison with fraud operators, another monitored Telegram channels, and a third tracked money mule accounts spread across more than a dozen countries.

When Even USDT Wasn't Safe Enough

The most alarming aspect of the Huione empire was not its scale but its speed of evolution.

In July 2024, Tether froze USD 29.62 million in USDT held in a Huione Pay wallet. The trigger: the wallet had received funds linked to the North Korean hacking group Lazarus. Blockchain investigator ZachXBT further traced USD 35 million stolen from Japan's DMM exchange to Huione Pay addresses.

The USDT freeze was an existential threat.

USDT runs on blockchains, but it is fundamentally centralized. Tether can freeze any address's USDT on command at law enforcement's request. For a money laundering empire whose lifeblood was USDT, this was a hand around the throat.

Huione's response caught the entire industry off guard.

In September 2024, Huione Group launched its own dollar-pegged stablecoin: USDH. The official tagline was brazen: "Avoid common freezing and transfer restrictions associated with traditional digital currencies" and "Unconstrained by traditional regulatory authorities." In plain terms: they built a USDT that nobody could freeze.

USDH was just the opening move. Huione quickly rolled out its own blockchain, Huione Chain (also called Xone Chain), its own crypto exchange, Huione Crypto, and its own messaging app, ChatMe, assembling a complete, self-contained digital underworld.

It even attempted to raise capital through an ICO, issuing a native token called "HC."

The logic behind the sequence was chillingly coherent: if Tether could choke off USDT, build an unfreezable stablecoin; if Telegram could ban channels, build your own messaging platform; if existing blockchains could be traced, launch your own chain.

The Siege

They miscalculated.

In July 2024, Elliptic published its first investigative report on Huione Guarantee, detonating like a bomb across the global regulatory landscape.

Huione Guarantee immediately rebranded as "Haowang Guarantee" (loosely, "Good Fortune Guarantee"), attempting to sever ties with the Huione name. Huione Pay scrubbed its website of pages describing Huione Guarantee as a "subsidiary." Yet Haowang Guarantee itself admitted on social media that Huione Group remained its "strategic partner and shareholder."

On May 1, 2025, the U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) formally designated Huione Group a "Primary Money Laundering Concern," announcing plans to cut it off from the U.S. financial system entirely. FinCEN's report named three Huione entities specifically, Huione Pay, Huione Crypto, and Haowang Guarantee, calling them "functionally indistinguishable" from the parent company.

That same month, Telegram acted.

On May 13, Telegram banned over 3,000 Huione-linked accounts and channels for violating its Terms of Service. Within 48 hours, Haowang Guarantee posted a shutdown notice: "All NFTs and groups have been banned." It announced the cessation of all operations.

The empire appeared to have collapsed. But Huione proved astonishingly resilient.

In the weeks after the shutdown, blockchain analytics firm Chainalysis found that cryptocurrency volumes tied to Huione entities actually rose. Haowang Guarantee funneled users to a new platform called "Tudou Guarantee" (Potato Guarantee), claiming it had acquired a 30% stake. Haowang also invested in Tudou Guarantee, effectively reincarnating its operations under a fresh shell. It even launched its standalone messaging app, ChatMe, in a bid to sever its dependence on Telegram entirely.

But the heaviest blow was still to come.

On October 14, 2025, the U.S. Department of Justice and Treasury jointly announced criminal charges against Prince Group founder Chen Zhi, issued a global arrest warrant, and seized 127,271 bitcoins held under his name, valued at approximately USD 15 billion. It was the largest single seizure of crypto assets in U.S. judicial history. Simultaneously, the Treasury placed 146 individuals and entities tied to Prince Group on its sanctions list. The same day, the UK froze Chen's 19 London properties and all other assets held in Britain.

Cambodia's GDP in 2024 totaled roughly USD 46 billion. The bitcoin seized from Prince Group alone equaled one-third of the country's entire economic output.

The Collapse

The domino effect of sanctions hit faster than anyone expected.

Late on the night of December 1, 2025, Huione Pay issued an abrupt announcement: citing "massive, concentrated withdrawal demands from millions of users," it was activating a "Deferred Redemption Plan." All physical branches nationwide suspended operations immediately, with user funds locked until January 5, 2026, at the latest.

Lines formed across Phnom Penh overnight.

Bitrace's audit data revealed that after processing its final withdrawal on December 1, Huione Pay held only roughly USD 990,000 in USDT on-chain. Its Ethereum operations had run dry as early as October. Its TRON operations spent November repeatedly consolidating hot-wallet funds to cover withdrawals before being completely drained around November 28. Daily USDT outflows cratered from USD 41.83 million at the start of the month to USD 7.17 million.

Huione Pay, the self-proclaimed "Cambodia's Alipay," became an empty shell overnight.

Tens of thousands of Chinese merchants in Cambodia found their savings trapped inside a dying platform. To this day, groups of Huione users continue organizing through social media to protest at Cambodia's National Bank, so far without meaningful result.

In December 2025, Cambodian authorities revoked Chen Zhi's citizenship, citing "acquisition of nationality through improper means."

On January 7, 2026, Chen was extradited to China by Cambodian authorities.

In January 2026, Tudou Guarantee, a Huione affiliate, returned USD 130 million in USDT before reportedly shutting down.

On April 1, 2026, Li Xiong was extradited to China.

With that, the full lifecycle of this empire came to a close: born in a Lianjiang internet café, gilded through Phnom Penh real estate, scaled on Telegram, laundered through USDT, and fattened on pig-butchering scams.

The Underground River Never Dies

The story of Huione Guarantee is over. The business model it proved out is not.

Shortly after Haowang Guarantee announced its shutdown, Elliptic exposed another Telegram-based black market: Xinbi Guarantee. Active since 2022, it has facilitated at least USD 8.4 billion in illicit transactions and claims over 230,000 users. Registered in Colorado, Xinbi Guarantee's vendors offer an identical menu: money laundering, forged documents, stolen personal data. It is a near-exact replica of Huione Guarantee.

A United Nations Office on Drugs and Crime report estimates that annual profits from organized cybercrime networks in Southeast Asia now approach USD 40 billion. Cryptocurrencies and underground banking channels allow these networks to move money rapidly, while Telegram-style messaging platforms supply the low-cost, high-efficiency infrastructure that holds it all together.

Chen Yanyu, a Taiwanese scholar of cybercrime, spent months in Cambodia interviewing money launderers, scammers, and syndicate leaders. Her conclusion is blunt: "Cybercrime is deeply embedded in the mechanics of global capitalism, extracting resources from every corner of the world. It will not be easily dismantled."

The $24 billion underground river has been cut off, at least on the surface. But the riverbed remains. The upstream sources still flow. The downstream demand persists.

Huione fell. But the world's shadow economy still needs somewhere to turn dirty money clean. The next Huione may already be growing quietly inside some Telegram channel.

Sources: Elliptic Research Reports, U.S. Treasury FinCEN Notices, U.S. Department of Justice Indictments, Bloomberg Investigations, Caixin Media Reports, Jiemian News Reports, Bitrace On-Chain Analytics

If you find this helpful, feel free to follow us for future updates. ❤

• X : @blockflow_news
• Telegram: t.me/blockflownews