Cambodian scam giant handled $49 billion in crypto transactions since 2021, researchers say

A notorious online marketplace allegedly tied to cyber scam operations and linked to the family ruling Cambodia has processed more than $49 billion in cryptocurrency transactions since 2021, according to a new report. 

Blockchain analysis firm Chainalysis published its mid-year crypto crime update on Thursday and spotlighted Huione Guarantee, an online marketplace tied to the Cambodian conglomerate Huione Group.

In July, blockchain security firm Elliptic exposed the platform as a key player in the now industrial-scale pig-butchering economy — serving as a “guarantor or escrow provider for all transactions.”

Chainalysis built upon that research and discovered that the platform is a far larger player than previously understood. Huione Guarantee is a marketplace that connects buyers and sellers by providing Telegram handles as points of contact. The platform says it is a neutral party and does not verify the legitimacy of the goods advertised. 

The researchers said there are thousands of Telegram groups advertising on Huione Guarantee, many of which “likely have ties to criminal enterprises operating within the region.”

“On-chain analysis reveals that Huione Pay was active on Ethereum, with more than $1.9 billion in total inflows, and on TRON, with more than $47 billion in inflows,” they said.

“Many merchants on Huione Guarantee put little effort into masking their activities, advertising the types of services they look for using thinly-veiled code words.” 

Chainalysis found hundreds of examples of transfers between Huione Pay and parties considered illicit or risky. They said Huione has received and sent funds to accounts previously tied by researchers to scams, stolen funds, sanctioned Russian exchange Garantex, fraud shops, child sexual abuse material, casinos and more. 

Chainalysis found transactions with wallets connected to well-known scam compounds in Myanmar and dozens of other entities known to be involved in illicit activities across Southeast Asia. 

“These networks’ use of Huione Guarantee showcases that the service has facilitated activity not just with the scammers and fraudsters themselves, but the criminally-affiliated networks behind them,” they said. 

Some posts on the platform have offered access to facial recognition systems and tools that can be used to run pig butchering operations or Ponzi schemes.

Chainalysis said it focused on Huione Guarantee because it is a “nexus” for an array of cybercriminals.

The parent company Huione Group offers legitimate services but blockchain data has repeatedly shown that the company’s subsidiaries are deeply involved in the ecosystem of pig butchering operations that continue to operate in Southeast Asia.

Elliptic noted that one of the directors of Huione Pay is Hun To — a cousin of Cambodian prime minister Hun Manet notorious for longstanding ties to heroin trafficking, money laundering, Chinese organized crime and scam compounds. 

Cyber scams innovate faster

The Chainalysis report also tracked a range of other cryptocurrency trends related to cyber scams, noting that criminals continue to evolve and adapt to law enforcement efforts. 

Criminal groups are now able to regenerate scam tools in shorter durations and continue to maintain concurring smaller, simultaneous campaigns. 

Chainalysis said one thing that stood out most was the number of wallets created in 2024 that became active, indicating surges in new scams. 

About 43% of scam inflows went to wallets that became active this year, a record according to Chainalysis. The next highest year was 2022, when 29.9% of the criminal inflows went to wallets that became active that year. 

But one of the largest wallets associated with scam activity consolidates funds from many scams operating out of KK Park — one of the most notorious pig butchering operations in Myanmar on the border with Thailand. 

The country’s ongoing civil war has allowed criminal gangs to flourish in unregulated border areas — so much so that China’s government has had to step in and force the military junta to take action. 

The wallet connected to KK Park was first identified in 2022 and so far in 2024, more than $100 million was sent to it. Chainalysis said the funds “could have come both from scam victims and from ransom payments submitted by families attempting to save their trafficked family members.”

“Additionally, it is important to note that scam operations coming out of KK Park and similar compounds are prolific when it comes to adapting their off-chain scam presence, frequently purchasing seasoned Facebook, Tinder, and Match.com profiles from China-based services for use in their campaigns,” they explained. 

Much of the money earned from these scam operations is then laundered through centralized exchanges like Huione Guarantee.