www.elliptic.co Open in urlscan Pro
199.60.103.29  Public Scan

URL: https://www.elliptic.co/blog/cyber-scam-marketplace
Submission: On December 18 via api from UA — Scanned from PL

Form analysis 2 forms found in the DOM

/hs-search-results

<form action="/hs-search-results" data-hs-cf-bound="true">
  <input type="text" class="hs-search-field__input" name="term" autocomplete="off" aria-label="Search" placeholder="Search on Website">
  <button class="button green search-btn" aria-label="Search">Go</button>
</form>

POST https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/3883533/780a3447-f4c3-449a-bb1d-7a6b70a8b828

<form id="hsForm_780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
  action="https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/3883533/780a3447-f4c3-449a-bb1d-7a6b70a8b828"
  class="hs-form-private hsForm_780a3447-f4c3-449a-bb1d-7a6b70a8b828 hs-form-780a3447-f4c3-449a-bb1d-7a6b70a8b828 hs-form-780a3447-f4c3-449a-bb1d-7a6b70a8b828_324a38c0-d388-4863-a547-893d125dba31 hs-form stacked hs-custom-form"
  target="target_iframe_780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" data-instance-id="324a38c0-d388-4863-a547-893d125dba31" data-form-id="780a3447-f4c3-449a-bb1d-7a6b70a8b828" data-portal-id="3883533"
  data-test-id="hsForm_780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" data-hs-cf-bound="true">
  <fieldset class="form-columns-2">
    <div class="hs_firstname hs-firstname hs-fieldtype-text field hs-form-field"><label id="label-firstname-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="" placeholder="Enter your First name"
        for="firstname-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424"><span>First name</span><span class="hs-form-required">*</span></label>
      <legend class="hs-field-desc" style="display: none;"></legend>
      <div class="input"><input id="firstname-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" name="firstname" required="" placeholder="" type="text" class="hs-input" inputmode="text" autocomplete="given-name" value=""></div>
    </div>
    <div class="hs_lastname hs-lastname hs-fieldtype-text field hs-form-field"><label id="label-lastname-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="" placeholder="Enter your Last name"
        for="lastname-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424"><span>Last name</span><span class="hs-form-required">*</span></label>
      <legend class="hs-field-desc" style="display: none;"></legend>
      <div class="input"><input id="lastname-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" name="lastname" required="" placeholder="" type="text" class="hs-input" inputmode="text" autocomplete="family-name" value=""></div>
    </div>
  </fieldset>
  <fieldset class="form-columns-2">
    <div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="" placeholder="Enter your Email"
        for="email-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424"><span>Email</span><span class="hs-form-required">*</span></label>
      <legend class="hs-field-desc" style="display: none;"></legend>
      <div class="input"><input id="email-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" name="email" required="" placeholder="" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""></div>
    </div>
    <div class="hs_company hs-company hs-fieldtype-text field hs-form-field"><label id="label-company-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="" placeholder="Enter your Company name"
        for="company-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424"><span>Company name</span></label>
      <legend class="hs-field-desc" style="display: none;"></legend>
      <div class="input"><input id="company-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" name="company" placeholder="" type="text" class="hs-input" inputmode="text" autocomplete="organization" value=""></div>
    </div>
  </fieldset>
  <fieldset class="form-columns-1">
    <div class="hs_interest hs-interest hs-fieldtype-checkbox field hs-form-field"><label id="label-interest-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="" placeholder="Enter your I'm interested in"
        for="interest-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424"><span>I'm interested in</span></label>
      <legend class="hs-field-desc" style="display: none;"></legend>
      <div class="input">
        <ul role="checkbox" class="inputs-list multi-container">
          <li class="hs-form-checkbox" role="checkbox"><label for="interest0-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="hs-form-checkbox-display"><input id="interest0-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="hs-input" type="checkbox"
                name="interest" value="Crypto Regulations"><span>Crypto Regulatory Affairs</span></label></li>
          <li class="hs-form-checkbox" role="checkbox"><label for="interest1-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="hs-form-checkbox-display"><input id="interest1-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="hs-input" type="checkbox"
                name="interest" value="Off The Chain"><span>Off The Chain</span></label></li>
          <li class="hs-form-checkbox" role="checkbox"><label for="interest2-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="hs-form-checkbox-display"><input id="interest2-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="hs-input" type="checkbox"
                name="interest" value="Crypto Crime"><span>Crypto Crime Watch</span></label></li>
          <li class="hs-form-checkbox" role="checkbox"><label for="interest3-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="hs-form-checkbox-display"><input id="interest3-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="hs-input" type="checkbox"
                name="interest" value="Sanctions Newsletter"><span>Sanctions Alert</span></label></li>
        </ul>
      </div>
    </div>
  </fieldset>
  <fieldset class="form-columns-1">
    <div class="legal-consent-container">
      <div>
        <div class="hs-dependent-field">
          <div class="hs_LEGAL_CONSENT.subscription_type_431353751 hs-LEGAL_CONSENT.subscription_type_431353751 hs-fieldtype-booleancheckbox field hs-form-field">
            <legend class="hs-field-desc" style="display: none;"></legend>
            <div class="input">
              <ul class="inputs-list" required="">
                <li class="hs-form-booleancheckbox"><label for="LEGAL_CONSENT.subscription_type_431353751-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="hs-form-booleancheckbox-display"><input
                      id="LEGAL_CONSENT.subscription_type_431353751-780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" class="hs-input" type="checkbox" name="LEGAL_CONSENT.subscription_type_431353751" value="true"><span>
                      <p>Yes, I would like to hear from Elliptic when new <strong>research</strong>, <strong>thought</strong> <strong>leadership</strong>, <strong>product</strong> <strong>updates</strong> and <strong>event</strong> invitations are
                        available.</p><span class="hs-form-required">*</span>
                    </span></label></li>
              </ul>
            </div>
          </div>
        </div>
        <legend class="hs-field-desc checkbox-desc" style="display: none;"></legend>
      </div>
      <div class="hs-richtext">
        <p>You can update or unsubscribe from these communications at any time. For more information please review our <a href="https://www.elliptic.co/privacy-policy" target="_blank" rel="noopener">Privacy Policy</a>.</p>
      </div>
      <div class="hs-richtext">
        <p>By clicking submit , you consent to allow Elliptic to store and process the personal information submitted above to provide you the content requested.</p>
      </div>
    </div>
  </fieldset>
  <div class="hs_submit hs-submit">
    <div class="hs-field-desc" style="display: none;"></div>
    <div class="actions"><input type="submit" class="hs-button primary large" value="Subscribe"></div>
  </div><input name="hs_context" type="hidden"
    value="{&quot;embedAtTimestamp&quot;:&quot;1734534474832&quot;,&quot;formDefinitionUpdatedAt&quot;:&quot;1729164444926&quot;,&quot;lang&quot;:&quot;en&quot;,&quot;legalConsentOptions&quot;:&quot;{\&quot;communicationConsentCheckboxes\&quot;:[{\&quot;communicationTypeId\&quot;:431353751,\&quot;label\&quot;:\&quot;<p>Yes, I would like to hear from Elliptic when new <strong>research</strong>, <strong>thought</strong> <strong>leadership</strong>, <strong>product</strong> <strong>updates</strong> and <strong>event</strong> invitations are available.</p>\&quot;,\&quot;required\&quot;:true}],\&quot;legitimateInterestLegalBasis\&quot;:\&quot;LEGITIMATE_INTEREST_PQL\&quot;,\&quot;processingConsentType\&quot;:\&quot;IMPLICIT\&quot;,\&quot;processingConsentText\&quot;:\&quot;<p>By clicking submit , you consent to allow Elliptic to store and process the personal information submitted above to provide you the content requested.</p>\&quot;,\&quot;processingConsentCheckboxLabel\&quot;:\&quot;I agree to allow Elliptic to store and process my personal data.\&quot;,\&quot;privacyPolicyText\&quot;:\&quot;<p>You can update or unsubscribe from these communications at any time. For more information please review our <a href=\\\&quot;https://www.elliptic.co/privacy-policy\\\&quot; target=\\\&quot;_blank\\\&quot; rel=\\\&quot;noopener\\\&quot;>Privacy Policy</a>.</p>\&quot;,\&quot;isLegitimateInterest\&quot;:false}&quot;,&quot;clonedFromForm&quot;:&quot;e5f8335a-a347-494e-9df1-19cea662a060&quot;,&quot;userAgent&quot;:&quot;Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36&quot;,&quot;pageTitle&quot;:&quot;Huione Guarantee: The multi-billion dollar marketplace used by online scammers&quot;,&quot;pageUrl&quot;:&quot;https://www.elliptic.co/blog/cyber-scam-marketplace&quot;,&quot;pageId&quot;:&quot;172479533854&quot;,&quot;isHubSpotCmsGeneratedPage&quot;:true,&quot;canonicalUrl&quot;:&quot;https://www.elliptic.co/blog/cyber-scam-marketplace&quot;,&quot;contentType&quot;:&quot;blog-post&quot;,&quot;hutk&quot;:&quot;a59dd0a4d8a929297712b14437bd91f4&quot;,&quot;__hsfp&quot;:2144302614,&quot;__hssc&quot;:&quot;267712218.1.1734534475824&quot;,&quot;__hstc&quot;:&quot;267712218.a59dd0a4d8a929297712b14437bd91f4.1734534475824.1734534475824.1734534475824.1&quot;,&quot;formTarget&quot;:&quot;#hs_form_target_form_268900633&quot;,&quot;formInstanceId&quot;:&quot;8424&quot;,&quot;rawInlineMessage&quot;:&quot;Thanks for submitting the form.&quot;,&quot;hsFormKey&quot;:&quot;1db464c9b26d390e1c086f7e1352bbb2&quot;,&quot;pageName&quot;:&quot;Huione Guarantee: The multi-billion dollar marketplace used by online scammers&quot;,&quot;boolCheckBoxFields&quot;:&quot;LEGAL_CONSENT.subscription_type_431353751&quot;,&quot;rumScriptExecuteTime&quot;:690.3000001907349,&quot;rumTotalRequestTime&quot;:978.5,&quot;rumTotalRenderTime&quot;:998.3000001907349,&quot;rumServiceResponseTime&quot;:288.19999980926514,&quot;rumFormRenderTime&quot;:19.800000190734863,&quot;connectionType&quot;:&quot;4g&quot;,&quot;firstContentfulPaint&quot;:0,&quot;largestContentfulPaint&quot;:0,&quot;locale&quot;:&quot;en&quot;,&quot;timestamp&quot;:1734534475978,&quot;originalEmbedContext&quot;:{&quot;portalId&quot;:&quot;3883533&quot;,&quot;formId&quot;:&quot;780a3447-f4c3-449a-bb1d-7a6b70a8b828&quot;,&quot;region&quot;:&quot;na1&quot;,&quot;target&quot;:&quot;#hs_form_target_form_268900633&quot;,&quot;isBuilder&quot;:false,&quot;isTestPage&quot;:false,&quot;isPreview&quot;:false,&quot;formInstanceId&quot;:&quot;8424&quot;,&quot;formsBaseUrl&quot;:&quot;/_hcms/forms&quot;,&quot;css&quot;:&quot;&quot;,&quot;inlineMessage&quot;:&quot;Thanks for submitting the form.&quot;,&quot;isMobileResponsive&quot;:true,&quot;rawInlineMessage&quot;:&quot;Thanks for submitting the form.&quot;,&quot;hsFormKey&quot;:&quot;1db464c9b26d390e1c086f7e1352bbb2&quot;,&quot;pageName&quot;:&quot;Huione Guarantee: The multi-billion dollar marketplace used by online scammers&quot;,&quot;pageId&quot;:&quot;172479533854&quot;,&quot;contentType&quot;:&quot;blog-post&quot;,&quot;formData&quot;:{&quot;cssClass&quot;:&quot;hs-form stacked hs-custom-form&quot;},&quot;isCMSModuleEmbed&quot;:true},&quot;correlationId&quot;:&quot;324a38c0-d388-4863-a547-893d125dba31&quot;,&quot;renderedFieldsIds&quot;:[&quot;firstname&quot;,&quot;lastname&quot;,&quot;email&quot;,&quot;company&quot;,&quot;interest&quot;,&quot;LEGAL_CONSENT.subscription_type_431353751&quot;],&quot;captchaStatus&quot;:&quot;NOT_APPLICABLE&quot;,&quot;emailResubscribeStatus&quot;:&quot;NOT_APPLICABLE&quot;,&quot;isInsideCrossOriginFrame&quot;:false,&quot;source&quot;:&quot;forms-embed-1.6926&quot;,&quot;sourceName&quot;:&quot;forms-embed&quot;,&quot;sourceVersion&quot;:&quot;1.6926&quot;,&quot;sourceVersionMajor&quot;:&quot;1&quot;,&quot;sourceVersionMinor&quot;:&quot;6926&quot;,&quot;allPageIds&quot;:{&quot;embedContextPageId&quot;:&quot;172479533854&quot;,&quot;analyticsPageId&quot;:&quot;172479533854&quot;,&quot;contentPageId&quot;:172479533854,&quot;contentAnalyticsPageId&quot;:&quot;172479533854&quot;},&quot;_debug_embedLogLines&quot;:[{&quot;clientTimestamp&quot;:1734534474974,&quot;level&quot;:&quot;INFO&quot;,&quot;message&quot;:&quot;Retrieved customer callbacks used on embed context: [\&quot;getExtraMetaDataBeforeSubmit\&quot;]&quot;},{&quot;clientTimestamp&quot;:1734534474974,&quot;level&quot;:&quot;INFO&quot;,&quot;message&quot;:&quot;Retrieved pageContext values which may be overriden by the embed context: {\&quot;pageTitle\&quot;:\&quot;Huione Guarantee: The multi-billion dollar marketplace used by online scammers\&quot;,\&quot;pageUrl\&quot;:\&quot;https://www.elliptic.co/blog/cyber-scam-marketplace\&quot;,\&quot;userAgent\&quot;:\&quot;Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\&quot;,\&quot;pageId\&quot;:\&quot;172479533854\&quot;,\&quot;contentAnalyticsPageId\&quot;:\&quot;172479533854\&quot;,\&quot;contentPageId\&quot;:172479533854,\&quot;isHubSpotCmsGeneratedPage\&quot;:true}&quot;},{&quot;clientTimestamp&quot;:1734534474975,&quot;level&quot;:&quot;INFO&quot;,&quot;message&quot;:&quot;Retrieved countryCode property from normalized embed definition response: \&quot;PL\&quot;&quot;},{&quot;clientTimestamp&quot;:1734534475826,&quot;level&quot;:&quot;INFO&quot;,&quot;message&quot;:&quot;Retrieved analytics values from API response which may be overriden by the embed context: {\&quot;hutk\&quot;:\&quot;a59dd0a4d8a929297712b14437bd91f4\&quot;,\&quot;canonicalUrl\&quot;:\&quot;https://www.elliptic.co/blog/cyber-scam-marketplace\&quot;,\&quot;contentType\&quot;:\&quot;blog-post\&quot;,\&quot;pageId\&quot;:\&quot;172479533854\&quot;}&quot;}]}"><iframe
    name="target_iframe_780a3447-f4c3-449a-bb1d-7a6b70a8b828_8424" style="display: none;"></iframe>
</form>

Text Content

This website stores cookies on your computer. These cookies are used to improve
your website and provide more personalized services to you, both on this website
and through other media. To find out more about the cookies we use, see our
Privacy Policy.

Accept Decline

 * Solutions
   
   
   PRODUCTS
   
    * Wallet Screening
    * Transaction Monitoring
    * Crypto Investigations
    * VASP Screening
    * Holistic Screening
    * Ecosystem Monitoring
   
   
   SERVICES
   
    * Learning
    * Professional Services
   
   
   RESOURCES
   
    * Developer Portal
    * Knowledge Hub
 * Who We Help
   
   
   OUR CUSTOMERS
   
    * Crypto Businesses
    * Financial Institutions
    * Regulators
    * Law Enforcement
   
   
   RESOURCES & SUPPORT
   
    * Customer Success
    * Customer Stories
 * News & Insights
   
   
   INSIGHTS
   
    * Research & Analysis
    * Resources
    * Education
   
   
   EVENTS & WEBINARS
   
    * Upcoming & On-Demand
   
   
   NEWSLETTERS
   
    * Subscribe
 * About
   
   
   CAREERS & CULTURE
   
    * We Are Hiring!
    * Life at Elliptic
    * People of Elliptic
   
   
   ABOUT ELLIPTIC
   
    * Who We Are
    * Meet the Team
    * Media Center
    * Contact Us
   
   
   PARTNERS
   
    * Partner Program
    * Partner Application
    * Our Partners
   
   
   SECURITY
   
    * Data Protection & Policies

Schedule demo Sign In English
 * English
 * Japanese (日本)

Go


HUIONE GUARANTEE: THE MULTI-BILLION DOLLAR MARKETPLACE USED BY ONLINE SCAMMERS

ELLIPTIC RESEARCH

10 July, 2024

 * 
 * 
 * 
 * 

 * Huione Guarantee is an online marketplace that has become widely used by scam
   operators in South East Asia, including those involved in so-called “pig
   butchering”. Merchants on the platform offer technology, data and money
   laundering services, and have engaged in transactions totaling at least $11
   billion.
   
   
 * Huione Guarantee is part of Huione Group, a Cambodian conglomerate with links
   to Cambodia’s ruling Hun family.
   
   
 * Our research indicates that another Huione business is actively involved in
   laundering proceeds of scams from around the world. 
   
   
 * Elliptic customers are able to protect themselves against exposure to this
   activity through the use of our cryptoasset transaction screening and
   investigative solutions.

 

Online scams have led to tens of billions of dollars being stolen from millions
of victims across the world. Perhaps most well known are the so-called pig
butchering scams, where fraudsters develop relationships with victims and
eventually persuade them to invest in sham investment schemes. Others involve
ponzi schemes, impersonation of family members and sextortion.

According to a recent US Institute of Peace report, many of these scams are
perpetrated by transnational organized crime groups originating from China and
operating out of “scam compounds” across South East Asia, especially Myanmar,
Laos and Cambodia. A range of factors have led to the proliferation and success
of these criminal groups, including regional conflict, corruption and the growth
of lawless “special economic zones”.

(LEFT) A SCAM COMPOUND IN SIHANOUKVILLE, CAMBODIA, WHERE AUTHORITIES SAID THEY
FOUND EVIDENCE OF HUMAN TRAFFICKING, KIDNAPPING AND TORTURE (SOURCE). (RIGHT) A
SCAM COMPOUND WORKER IS BEATEN WITH AN ELECTRIC BATON (SOURCE).

 

Those being defrauded are not the only victims. Reports suggest that scam
compounds commonly resemble prisons, acting as both workplaces and accommodation
blocks and surrounded by tall barbed wire fences and actively patrolled by
security guards. They are estimated to house hundreds of thousands of workers,
many of whom have been effectively enslaved. Lured by the promise of highly-paid
work, young men and women from China, Vietnam, the Philippines, and many other
countries have been trafficked into the region and forced to carry out the scams
 Reportedly held against their will and subjected to torture, some of these
forced workers resort to suicide or die in suspicious circumstances.

The scale of these cyber scam operations has increased dramatically over the
past five years. This may partly be due to the emergence of merchants providing
money laundering services, as well as software, data and telecoms equipment, all
of which enable scammers to operate more efficiently and expand their reach.


HUIONE GUARANTEE

Elliptic researchers have shed light on a huge Chinese-language ecosystem and
marketplace known as Huione Guarantee (“汇旺担保”). It is made up of a network of
thousands of instant messaging app channels, each run by a different merchant.
Huione Guarantee operates the platform and acts as a guarantor or escrow
provider for all transactions, helping to prevent fraud. Payments are advertised
as being accepted primarily in the USDT stablecoin, but payment apps and bank
transfers are also used. The transparency of cryptoassets allows us to track and
monitor many of the stablecoin payments - something that is not possible with
the other payment methods.



HUIONE GUARANTEE CLAIMS THAT IT “DOES NOT PARTICIPATE IN NOR UNDERSTAND THE
SPECIFIC BUSINESS OF CUSTOMERS” AND CANNOT VERIFY THE “ORIGIN OF FUNDS OR GOODS”

 

Despite its active involvement in transactions, Huione Guarantee claims to be a
neutral platform with no responsibility for what is being sold. It was
established in 2021, purportedly as a marketplace for legitimate goods including
real estate and cars. However the majority of the goods and services on offer
today appear to be targeted squarely at cyber scam operators.

The largest category of merchants operating on Huione Guarantee are those
offering to move and exchange money. Many of the merchants explicitly offer
money laundering services, including accepting payments from victims around the
world, transferring it across borders and converting it to other assets
including cash, stablecoins, and to Chinese payment apps. Most specify the types
of fraud proceeds that they are willing to launder, based on the perceived risk
of having the funds frozen by financial institutions or law enforcement.



(TOP) A HUIONE GUARANTEE MERCHANT OFFERS TO LAUNDER PROCEEDS OF FRAUD INCLUDING
PIG BUTCHERING SCAMS. (BOTTOM) ANOTHER MERCHANT SPECIALIZES IN THE LAUNDERING OF
SEXTORTION SCAMS (“SE敲” - TRANSLATED HERE AS “SE KNOCK”)

 

Another category of merchants offer software and web development services. This
includes the creation of scam crypto investment websites of the type used in
“pig butchering” scams, designed to lure victims to deposit cryptocurrency,
which is then stolen. Personal data including contact details, telecoms
equipment and “AI face changing” software are also available for purchase, used
by scammers to target and communicate with victims. 



HUIONE GUARANTEE MERCHANTS OFFERING WEB DEVELOPMENT OF CRYPTOCURRENCY INVESTMENT
SITES OF THE TYPE USED IN PIG BUTCHERING SCAMS (LEFT), PERSONAL DATA OF
INDIVIDUALS AROUND THE WORLD FOR TARGETING BY SCAMMERS (MIDDLE) AND AI FACE
CHANGING SOFTWARE ADVERTISED FOR USE IN SCAMS (RIGHT).

 

Various other scam-enabling products and services are available, including
equipment apparently used by scam compound operators to imprison and torture
their workers. Our researchers identified advertisements for tear gas, electric
batons and electronic shackles that give an electric shock if the wearer leaves
a predetermined area. The merchants refer to “preventing escapers” and
controlling “runaway dogs”. Those working within the scam compounds are commonly
referred to as “dogs” or “dog pushers”.

ADVERTISEMENTS ON HUIONE GUARANTEE FOR ELECTRIC SHOCK SHACKLES (LEFT) AND
ELECTRIC BATONS (RIGHT), WHICH THE MERCHANTS SUGGEST ARE TO BE USED ON SCAM
COMPOUND WORKERS.

 

In contrast to non-crypto payment methods used on these platforms, which do not
benefit from the transparency of the blockchain, investigators and compliance
teams are able to proactively detect and disrupt USDT payments by using
blockchain analytics. This protects them from exposure to this crime type and
ultimately deprives the scammers from revenue. It also offers insights into the
scale of transaction flows.

Elliptic’s analysis shows that cryptocurrency wallets used by Huione Guarantee
and its merchants have received over $11 billion since 2021. The total figure is
likely to be higher as there is significant turnover of merchants, and
information on their cryptocurrency wallets is not always available.

Not all of these transactions can be definitively linked to fraud or other
illicit activity, since that would require perfect knowledge of users’ source of
funds or intended use of the products purchased. However, the nature of the
products and services advertised by these merchants and their open willingness
to facilitate scams, provide very strong indications that the vast majority of
these payments relate to illicit activity. Manual analysis of thousands of
messages across the Huione Guarantee platform has provided us with overwhelming
evidence that its predominant role is to act as an illicit marketplace.

VALUE OF USDT RECEIVED BY CRYPTOCURRENCY WALLETS KNOWN TO BE USED BY HUIONE
GUARANTEE AND ITS MERCHANTS. THESE FIGURES SHOULD BE CONSIDERED AS LOWER BOUNDS
OF THE TRUE VOLUME OF TRANSACTIONS ON THE PLATFORM.


HUIONE GROUP

Huione Guarantee has many of the characteristics of a darknet marketplace;
however, it is operated by a large Cambodian conglomerate: Huione Group. The
group operates a payments and foreign exchange business, Huione Pay, and has
interests in insurance, airlines and real estate. Huione Guarantee appears to be
closely linked to Huione Pay, being featured prominently on the latter’s website
(this page was removed from the Huione Pay website shortly after the publication
of this article).

One of the directors of Huione Pay is Hun To, a cousin of the current Cambodian
prime minister, Hun Manet. Hun To has reportedly been suspected of heroin
trafficking and money laundering by Australian Police. He has also been linked
to Chinese organized crime and a scam compound.

Our findings indicate that Huione Group not only facilitates cyber scams by
operating the Huione Guarantee marketplace, but also suggest that one of its
subsidiaries is actively involved in laundering proceeds of these scams. Huione
International Payments, part of Huione Pay, acts as a merchant on Huione
Guarantee, offering to handle the proceeds of scams from around the world. When
discussing funds from the US, Huione International Payments offers to accept
proceeds of “fine chat”, which refers to a category of scam that includes pig
butchering, as well as proceeds of other types of fraud. In one recent
discussion in its chat group, a representative1 of Huione International Payments
appears to agree to handle $2 million originating from fraud, in return for a
fee of 10.5%.



A HUIONE GUARANTEE USER ASKS FOR HELP LAUNDERING $2 MILLION FROM A “QUICK KILL”
I.E. A SCAM. A REPRESENTATIVE OF HUIONE INTERNATIONAL PAYMENTS, PART OF HUIONE
PAY, RESPONDS AND CLARIFIES THAT THEIR SERVICE IS OPERATED BY HUIONE.


COMBATING THE ILLICIT USE OF CRYPTOASSETS

The value of cryptocurrency received by Huione Guarantee and its merchants, and
the type of goods and services offered, suggest that it is a key enabler of
cyber scam operators in South East Asia. Our evidence also indicates that Huione
International Payments (part of Huione Pay) is actively involved in laundering
the proceeds of scams from around the world.

Following our investigations, hundreds of cryptocurrency addresses controlled by
Huione companies and used by merchants operating on Huione Guarantee have been
labeled in Elliptic’s tools.

Exchanges and other businesses receiving cryptoassets can screen these
transactions for links to Huione-related wallets, helping to ensure that these
funds cannot be laundered further. Stablecoin operators can also work to block
this abuse of their cryptoassets through these wallets.

Law enforcement can also use our investigation tools to trace these payments and
pursue those responsible for these scams. Crypto is a weak point of those scams
that make use of it, which can be used to help bring those responsible to
justice.

 

Contact us if you would like to learn more about how to protect your business
from exposure to this entity.

 

 

1 This representative is listed as an official customer service agent of Huione
International Payments, by the admins of both the official Huione Pay chat group
and the official Huione Group chat group. 
 
[A note on translation: automated translation tools were used to translate the
text in the images from the original Chinese, however a native speaker ensured
that there was no misinterpretation of the intended meaning of this text. The
translation of "汇旺" was changed to "Huione" in one image, for consistency.]

Featured APAC Crypto Crime

Found this interesting? Share to your network.

 * 
 * 
 * 
 * 

ELLIPTIC RESEARCH

The latest deep-dives and data-driven analysis from our Research team covering
their own investigations, as-its-happening monitoring of hacks and thefts, and
more.


DISCLAIMER

This blog is provided for general informational purposes only. By using the
blog, you agree that the information on this blog does not constitute legal,
financial or any other form of professional advice. No relationship is created
with you, nor any duty of care assumed to you, when you use this blog. The blog
is not a substitute for obtaining any legal, financial or any other form of
professional advice from a suitably qualified and licensed advisor. The
information on this blog may be changed without notice and is not guaranteed to
be complete, accurate, correct or up-to-date.


GET THE LATEST INSIGHTS IN YOUR INBOX

First name*

Last name*

Email*

Company name

I'm interested in
 * Crypto Regulatory Affairs
 * Off The Chain
 * Crypto Crime Watch
 * Sanctions Alert

 * Yes, I would like to hear from Elliptic when new research, thought
   leadership, product updates and event invitations are available.
   
   *

You can update or unsubscribe from these communications at any time. For more
information please review our Privacy Policy.

By clicking submit , you consent to allow Elliptic to store and process the
personal information submitted above to provide you the content requested.


 * London
 * New York
 * Singapore
 * Tokyo
 * UAE

   SOLUTIONS

 * Wallet Screening
 * Transaction Monitoring
 * VASP Screening
 * Crypto Investigations
 * Holistic Screening
 * Entity Due Diligence
 * Ecosystem Monitoring

   SERVICES

 * Professional Services
 * Learning & Education
 * Customer Success

   CUSTOMERS

 * Our Customers
 * Crypto Businesses
 * Financial Instituions
 * Law Enforcement
 * Regulators

   NEWS & INSIGHTS

 * Research & Analysis
 * Resources
 * Education
 * Events & Webinars

   ABOUT

 * Who We Are
 * Careers
 * Media Center
 * Partners
 * Security
 * Contact Us
 * Identify & Report Scams

©2024 Copyright Elliptic. Elliptic Enterprises Limited. Registered in England
and Wales (number 8458210). VAT registration number 171021261.

Privacy Policy