Crypto Exchanges Exposed to $1B in Huione-linked USDT outflows

Major centralized exchanges (CEXs) have been exposed to nearly $1 billion in USDt transfers linked to wallets associated with Huione since its illicit marketplace was supposedly shut down, according to new data from Global Ledger.

On May 1, the US Financial Crimes Enforcement Network (FinCEN) designated Huione as a primary money laundering concern under the PATRIOT Act. Since then, forensics experts have been divided on the extent of the platform’s shutdown.

Global Ledger said it observed $10.13 billion in Tether USDt (USDT) transactions on Tron and $219 million on Ethereum in Huione-linked wallets between May 1 and June 17, in a research report shared exclusively with Cointelegraph. $942.9 million ultimately flowed into CEXs.

Yury Serov, investigations lead at the Swiss blockchain analytics firm, told Cointelegraph that activity from Huione-linked wallets indicates continued exposure to major exchanges, though often through indirect routes.

“Huione-associated funds may be routed via nested service providers, OTC desks or layered transactions that obscure the original source,” Serov said. “While these methods can conceal direct exchange interactions, the underlying movement patterns still lead to major centralized exchanges, suggesting continued operational use.”

Huione’s Polish registration and new stealth website

FinCEN’s designation prohibits US financial institutions from opening or maintaining correspondent accounts for the controversial conglomerate based in Cambodia and registered in Hong Kong.

Huione has been accused of serving as a transnational fraud and money laundering platform used by cybercrime groups, including North Korea’s state-sponsored Lazarus Group and networks engaged in “pig butchering” scams. Blockchain analytics firm Elliptic has linked the group’s operations to Cambodia’s ruling Hun family.

The group operates at least three known subsidiaries:

• Huione Guarantee, a Telegram-based illicit market platform

• Huione Pay, a crypto and fiat payments service

• Huione Crypto, a centralized exchange.

Huione Crypto registered in Poland in mid-2023 but primarily operates out of Cambodia, according to FinCEN. As of July 8, 2025, it remains listed on Poland’s business register.

Global Ledger said the Poland-registered entity is clearly part of the broader Huione structure, citing both naming and licensing links as well as wallet activity.

“Based on our analysis, we can confirm that the blockchain infrastructure utilizing the Poland-registered entity operates under the wider Huione Group’s operational structure, which includes Huione Pay,” said Serov. “The transaction flows involving the Polish VASP cannot be separated from those of other Huione subsidiaries, as the wallet infrastructure is interlinked.”

Related: FATF’s crypto checklist hints at the next regulatory crackdown

Multiple Huione-related websites and social channels have gone offline since the FinCEN action but have reappeared under new domains. 

One such site, Super-exchange.co, remained accessible as of July 8 and displayed a notice stating that Huione’s crypto operations and related services would be suspended as of June 30, 2025. Despite the notice, the site remains functional.

Experts divided on Huione’s shutdown

Huione Guarantee was one of the most closely watched scam-enabling platforms under the Cambodian conglomerate Huione Group. The Chinese-language marketplace, hosted on Telegram, facilitated the sale of illicit goods and services, including stolen data and the laundering of scam proceeds. It has been described as the largest darknet market ever, with more than $24 billion in transaction volume.

On May 13, Huione Guarantee — then operating under the name Haowang Guarantee — announced it would suspend operations following a crackdown on its Telegram channels. In the same message, it directed users to an alternative marketplace called Tudou, in which Huione reportedly holds a 30% stake.

Related: Garantex successor moves $1.66B through crypto exchanges: Global Ledger

Despite the shutdown, activity around Huione-linked services has not uniformly declined. In a June report, New York-based blockchain analytics firm Chainalysis observed increased activity connected to Huione’s marketplace operations.

However, this view is contested. Elliptic claims Huione Guarantee’s activity has essentially ceased.

“Some researchers have incorrectly conflated Huione Guarantee with other Huione group businesses, most notably Huione Pay, a large payments business with brick-and-mortar outlets across Cambodia that also accepts cryptocurrencies,” Elliptic said.

“Huione Pay and Huione Guarantee were engaged in very different activities, with distinct crypto wallet infrastructure. By analyzing blockchain transactions at a more granular level it is clear that, although Huione Pay continues to transact high volumes, Huione Guarantee’s transactions have effectively ceased.”

Elliptic also noted that the closure of Huione Guarantee has led to the rise of at least 30 new illicit marketplaces attempting to fill the gap it left behind.

Huione’s activity shows darknet market shutdowns rarely spell the end

The proliferation of new marketplaces following Huione Guarantee’s collapse mirrors what occurred after the fall of Hydra Market, once the dominant darknet platform. 

Chainalysis identified Hydra as the highest-earning darknet market of 2022 despite its April shutdown that year following sanctions from the US Treasury’s Office of Foreign Assets Control (OFAC). Like Hydra, Huione’s closure has triggered the rapid emergence of successor markets catering to users seeking alternative illicit channels.

The takedown of an illicit service rarely results in an immediate halt to criminal activity. In many cases, services reemerge under new branding or continue in stealth mode.

Garantex, a Russia-linked crypto exchange sanctioned alongside Hydra by the OFAC in 2022 and later by the European Union in 2025, reportedly rebranded as Grinex and continued facilitating fund transfers. As of May 30, blockchain intelligence firm Global Ledger identified at least $1.66 billion flowing from Grinex-linked wallets into centralized exchanges.

Similarly, eXch, a crypto swapping service with no Know Your Customer (KYC) requirements, announced its shutdown after German authorities seized its servers and crypto assets. But according to TRM Labs, the service quietly resumed operations in stealth despite the public takedown.

In Huione’s case, the group appears to remain active through indirect channels. It reportedly holds a 30% stake in Tudou, now considered the leading successor to the Huione Guarantee marketplace. Wallet activity linked to Huione Pay and its crypto exchange services also shows that the group has not disappeared from the blockchain landscape.

Magazine: Bitcoin vs. stablecoins showdown looms as GENIUS Act nears