Huione Linked Wallets Transfer $942.9 Million USDt to CEXs Despite FinCEN Designation

Major centralized exchanges (CEXs) have been exposed to nearly $1 billion in USDt transfers linked to wallets associated with Huione since its illicit marketplace was supposedly shut down. This revelation comes from new data provided by Global Ledger, which highlights the ongoing activity of Huione-linked wallets despite the US Financial Crimes Enforcement Network (FinCEN) designation on May 1. The designation under the PATRIOT Act aimed to prohibit US financial institutions from maintaining correspondent accounts for Huione, a conglomerate based in Cambodia and registered in China Hong Kong.

According to Global Ledger, between May 1 and June 17, $10.13 billion in Tether USDt (USDT) transactions were observed on Tron and $219 million on Ethereum in Huione-linked wallets. Out of this, $942.9 million ultimately flowed into CEXs. This activity indicates that Huione-associated funds may be routed through various indirect channels, including nested service providers, OTC desks, or layered transactions that obscure the original source. While these methods can conceal direct exchange interactions, the underlying movement patterns still lead to major centralized exchanges, suggesting continued operational use.

Huione has been accused of serving as a transnational fraud and money laundering platform used by cybercrime groups. The group operates at least three known subsidiaries: Huione Guarantee, a Telegram-based illicit market platform; Huione Pay, a crypto and fiat payments service; and Huione Crypto, a centralized exchange. Huione Crypto registered in Poland in mid-2023 but primarily operates out of Cambodia. As of July 8, 2025, it remains listed on Poland’s business register. Global Ledger confirmed that the Poland-registered entity is part of the broader Huione structure, citing both naming and licensing links as well as wallet activity.

Multiple Huione-related websites and social channels have gone offline since the FinCEN action but have reappeared under new domains. One such site, Super-exchange.co, remained accessible as of July 8 and displayed a notice stating that Huione’s crypto operations and related services would be suspended as of June 30, 2025. Despite the notice, the site remains functional, indicating that Huione’s activities continue in some form.

Experts are divided on the extent of Huione’s shutdown. Huione Guarantee, one of the most closely watched scam-enabling platforms, was described as the largest darknet market ever, with more than $24 billion in transaction volume. On May 13, Huione Guarantee announced it would suspend operations following a crackdown on its Telegram channels and directed users to an alternative marketplace called Tudou, in which Huione reportedly holds a 30% stake. Despite the shutdown, activity around Huione-linked services has not uniformly declined. In a June report, a blockchain analytics firm observed increased activity connected to Huione’s marketplace operations. However, this view is contested by Elliptic, which claims Huione Guarantee’s activity has essentially ceased.

Elliptic noted that the closure of Huione Guarantee has led to the rise of at least 30 new illicit marketplaces attempting to fill the gap it left behind. The proliferation of new marketplaces following Huione Guarantee’s collapse mirrors what occurred after the fall of Hydra Market, once the dominant darknet platform. The takedown of an illicit service rarely results in an immediate halt to criminal activity. In many cases, services reemerge under new branding or continue in stealth mode. In Huione’s case, the group appears to remain active through indirect channels, with wallet activity linked to Huione Pay and its crypto exchange services showing that the group has not disappeared from the blockchain landscape.