Written by: Xiaobing, Deep Tide TechFlow
Phnom Penh International Airport, April 1, 2026.
A handcuffed man was hooded by Chinese special police and pushed onto a China Southern Airlines passenger plane. Several hours later, the plane landed somewhere in China, and the special police removed the hood, revealing a pale and tired face.
His name is Li Xiong, chairman of Huiwang Group, and the most important right-hand man of Chen Zhi, founder of Prince Group. During the years he was in charge of Huiwang, his name was known to everyone in the Phnom Penh Chinese community. Small shops on the street displayed Huiwang Payment's red QR code, which restaurant owners used to collect payments and casinos used to settle accounts. Huiwang Payment called itself "Cambodia's Alipay," which sounded harmless.
But this is only the tip of the iceberg.
Beneath the surface lies a $24 billion underground financial empire. A criminal service marketplace woven from thousands of Telegram groups. An illegal market five times larger than Hydra, the king of the dark web, and three times larger than FTX at its peak.
Its name is Huiwang Guarantee.
Li Xiong's arrest comes exactly 84 days after Chen Zhi, founder of the Prince Group, was extradited back to China. The successive arrests of these two individuals mark the official end of one of the largest money laundering empires in cryptocurrency history.
The Black Rise of a Fujian Teenager
To understand Huiwang Guarantee, you must first understand the person behind it.
Chen Zhi was born in 1987 in Xiao'ao Town, Lianjiang County, Fujian Province. This small coastal town faces the Matsu Islands across the water to the east. Chen's family was of modest means, with an economic level that was below average in the local area. Chen Zhi dropped out of school after finishing the second year of junior high school, and at the age of fifteen or sixteen, his "classroom" moved from the classroom to an internet cafe.
Around 2005, internet cafes along the Fujian coast experienced explosive growth, providing a glimpse into the dark side of China's internet industry for a group of teenagers. Chen Zhi was one of them. He and a few classmates formed a small team, making a living by setting up private servers for the game "Legend of Mir," cracking official servers, and reselling user information. These businesses operated in a legal gray area at the time, but were highly profitable. The private game servers became his first pot of gold for accumulating wealth.
His fellow villagers later recalled that Chen Zhi had also been involved in data trading, running dating websites, and gaming-based social networking sites. In short, he did anything that could make money online, regardless of whether it was legal or not.
Around 2010, Chen Zhi left Lianjiang with approximately 500,000 yuan in embezzled funds.
Destination: Cambodia.
Phnom Penh Dream
In 2011, Phnom Penh was still a city in its nascent stages of development. Chinese capital was just beginning to flow into Southeast Asia, and Cambodia's real estate market was a blue ocean. Chen Zhi seized this opportunity.
Instead of competing with major developers for prime land, he bought land at low prices in the suburbs of Phnom Penh and built small houses and shops. This approach is low-cost and quick-turnover, making it ideal for a speculator with limited funds but a keen sense of opportunity.
In 2014, Chen Zhi spent $250,000 to obtain Cambodian citizenship through investment immigration. From then on, his identity as the "Fujian internet cafe boy" was completely erased, and he became known as "Cambodian Chinese entrepreneur Vincent Chen Zhi".
In 2015, Prince Holding Group was officially established.
The subsequent pace was dazzling. The Prince Group's signboard rose in downtown Phnom Penh, and its business rapidly expanded from real estate to banking, insurance, telecommunications, retail, and tourism. Its Prince Square shopping mall became a Phnom Penh landmark, and Prince Bank obtained its official license in 2018. Chen Zhi even established the Prince Foundation, engaging in high-profile philanthropy with donations exceeding US$16 million, perfectly cultivating the image of a "highly respected entrepreneur and philanthropist."
Political connections are the most crucial lubricant in this machine. Chen Zhi once spent $20 million to host a 68th birthday banquet for then-Cambodian Prime Minister Hun Sen, inviting ambassadors from various countries to grace the occasion. He subsequently received royal appointments, serving as an advisor to Interior Minister Shao Kheng, National Assembly President Heng Samrin, Prime Minister Hun Sen, and his successor Hun Manet. In 2020, he was granted the title of "Duke" and received a diplomatic passport.
On the streets of Phnom Penh, more than a third of the Rolls-Royces belong to the Prince Group. Chen Zhi himself travels with bodyguards, and his car is a Rolls-Royce. Someone who has seen him described him as: short, about 1.68 meters tall, with a large forehead, a Fujian accent, and a ruthless look in his eyes.
Beneath this glamorous surface, the real profit engine of the Prince Group is another kind of business.
Fraud Factory
Since 2015, Chen Zhi has built at least 10 enclosed parks throughout Cambodia.
These industrial parks are surrounded by high walls and barbed wire, preventing outsiders from entering. Thousands of cross-border workers from countries such as China, Vietnam, Myanmar, and Indonesia are lured in by recruitment advertisements promising high-paying IT jobs. Once they step through the park gates, their passports are confiscated, their mobile phones are monitored, and they become "tools" for telecom fraud.
The U.S. Department of Justice indictment revealed the operational details of these parks: Prince Group's fraud ring controlled millions of cell phone numbers and established "phone farm" style call centers across multiple parks. Two of these locations were equipped with 1,250 cell phones and controlled approximately 76,000 social media accounts. Prince Group internal documents even instructed employees on how to cultivate fake intimate relationships with victims and advised against using overly beautiful female profile pictures to increase credibility.
This is what's known as a "pig butchering scam." First, the scammer uses a fake identity to build trust and emotional connection with the victim, "raising the pig"; then, they lure the victim into investing real money on a fake investment platform, "butchering the pig."
Chen Zhi himself was directly involved in managing these fraudulent operations. In his ledgers, profits were explicitly marked as "pig slaughter," with detailed information on the floors and buildings he was responsible for in each project. His instructions to resisting workers were four words: "You can beat them, but don't kill them."
Crypto analytics firm Elliptic even found advertisements for the sale of electric shock shackles used to restrain workers in the campus's Telegram groups.
The money earned from the fraud flowed continuously from the victims' bank accounts into the Prince Group's underground vaults. But this money was "dirty" and could not directly enter the formal financial system.
They need a river to "wash" them.
This river is Huiwang.
Dark Web version of Taobao
In 2021, Huione Guarantee quietly launched on Telegram.
Its initial positioning seemed normal: a transaction guarantee platform for real estate and used cars. Buyers paid a bot through Huiwang Guarantee; after the seller delivered the goods, the buyer confirmed receipt, and Huiwang then released the money to the seller, taking a commission in the process. Essentially, it was Taobao's "confirm receipt" model.
But soon, the "goods" traded on this platform changed.
Money laundering services have become the core category. In Huiwang Guarantee's Telegram group, businesses openly advertise: receiving dirty money and disbursing clean funds. In the industry jargon, people who hold illicit funds or bank information are called "data holders," low-level employees in fraud parks are called "dog pushers," and the work of money laundering middlemen is called "bricklaying."
A typical money laundering process goes like this: A fraud gang obtains money through a "pig butchering" scam and hands the money over to an intermediary on Huiwang Guarantee. The intermediary then uses a network of "money mules"—shell accounts spread across more than a dozen countries—to transfer the funds layer by layer, ultimately returning them to the fraud gang in the form of USDT stablecoin. Both the intermediary and the money mules take a commission.
The entire process is like a precisely operating industrial assembly line.
Huiwang Guarantee doesn't just sell money laundering services. Its merchants also offer: fraud scripts, fake website development, AI face-swapping technology, databases of personal information of trafficked persons, citizen information from various countries, Starlink satellite equipment (used for communications in fraud parks), and almost every criminal tool you can think of can be bought here.
Huiwang Guarantee is a criminal supermarket with clearly marked prices, and Telegram groups are its shelves.
By mid-2024, when Elliptic first launched the platform, its trading volume had exceeded $11 billion. By early 2025, that figure had more than doubled to $24 billion. There were as many as 9,289 active Huiwang Guarantee public groups on Telegram, with over 900,000 registered users.
To make a comparison: Hydra, the largest dark web marketplace in history, operated for six years and its total transaction volume was only $5 billion. Huiwang Guarantee achieved five times that in less than four years.
Internal documents from 2022 to 2023 obtained by Bloomberg from Huiwang International Payments document thousands of victims and tens of millions of dollars in transactions. The documents show that Huiwang employees were directly involved in monitoring transactions and handling disputes, the platform regularly extracted commissions from transactions, and even provided "large credit lines to high-performing money laundering teams."
In Phnom Penh, Huiwang International Payments' offices are located on the second floor of the Huiwang Payments headquarters building. This glass and concrete structure has two panda statues standing at the entrance. Employees upstairs use aliases; one department handles communication with scammers, another monitors Telegram channels, and yet another tracks money mule accounts distributed across more than a dozen countries.
When USDT is not secure enough
What is truly astonishing about the Huiwang Empire is not its size, but its speed of evolution.
In July 2024, Tether froze 29.62 million USDT in a Huiwang Payment wallet. The reason for the freeze was that the wallet received stolen funds linked to the North Korean hacking group Lazarus Group. Chain detective ZachXBT further discovered that $35 million in stolen funds from the Japanese DMM exchange also ultimately flowed into Huiwang Payment's address.
The freezing of USDT poses a life-or-death threat to Huiwang.
Although USDT operates on a blockchain, it is inherently centralized. Tether can cooperate with law enforcement agencies to freeze USDT in any address with a single click. For a money laundering empire whose lifeblood is USDT, this is tantamount to having its throat held by someone else.
Huiwang's response has drawn attention from the entire industry.
In September 2024, Huiwang Group launched its own USD stablecoin, USDH. Its official promotional slogan was almost arrogantly direct: "Avoiding the freezing and transfer restrictions common in traditional cryptocurrencies," and "Not subject to the restrictions of traditional regulatory agencies." In layman's terms: We've created a USDT that can't be frozen.
USDH was just the beginning. Huione then launched its own blockchain, Huione Chain (also known as Xone Chain), its own cryptocurrency exchange, Huione Crypto, and its own messaging app, ChatMe, creating a complete, self-sufficient digital dark kingdom.
It even attempted to raise funds through an ICO, issuing a blockchain-native token called "HC".
The logic behind this operation is frighteningly clear: if USDT's lifeline is held by Tether, then create your own stablecoin that no one can freeze; if Telegram can ban groups, then create your own messaging app; if existing blockchains can be traced, then build your own chain.
Encirclement and Suppression
But they were wrong.
In July 2024, Elliptic released its first investigation report on Huiwang Guarantee, which was like a bomb thrown into the view of global regulators.
Huiwang Guarantee quickly changed its name to "Haowang Guarantee" in an attempt to distance itself from the Huiwang Group. Huiwang Payment's official website also removed the page describing Huiwang Guarantee as a "subsidiary." However, Haowang Guarantee itself acknowledged on social media that the Huiwang Group remains its "strategic partner and shareholder."
On May 1, 2025, the U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) officially designated Huione Group as a “primary money laundering risk entity” and announced plans to completely exclude it from the U.S. financial system. FinCEN’s report specifically named three entities within Huione Group—Huione Payment, Huione Crypto, and Haowang Guarantee—claiming they were “essentially the same thing” as their parent company.
That same month, Telegram made its move.
On May 13, Telegram banned over 3,000 accounts and channels related to Huiwang for "violation of terms of service." Within 48 hours, Haowang Guarantee issued a notice of cessation of operations, stating that "all NFTs and groups have been banned" and announcing the cessation of all business.
The empire seemed to have collapsed. But Huiwang demonstrated remarkable resilience.
In the weeks following the shutdown, blockchain analytics firm Chainalysis found that cryptocurrency trading volume associated with the Huiwang entity actually increased. Haowang Guarantee directed users to a new platform called "Tudou Guarantee," claiming to have acquired a 30% stake. Haowang also invested in Tudou Guarantee, effectively rebranding its business. It even developed its own independent messaging app, ChatMe, attempting to completely break free from its dependence on Telegram.
But even bigger blows were yet to come.
On October 14, 2025, the U.S. Department of Justice and the Treasury Department jointly announced criminal charges against Chen Zhi, founder of Prince Group, issued a global arrest warrant, and seized 127,271 bitcoins under his name, worth approximately $15 billion at the time. This set a record for the largest single seizure of crypto assets in U.S. judicial history. Simultaneously, the U.S. Treasury Department added 146 individuals and entities associated with Prince Group to its sanctions list. On the same day, the UK froze 19 properties in London and all of Chen Zhi's assets in the UK.
Cambodia's GDP in 2024 was approximately US$46 billion. The amount of Bitcoin seized by the United States from Prince Edward Island in a single transaction was equivalent to one-third of the country's GDP.
collapse
The ripple effects of the sanctions came faster than anyone anticipated.
Late at night on December 1, 2025, Huiwang Payment suddenly issued an announcement: due to "millions of users rushing to withdraw funds", the platform launched the "Deferred Payment Plan", offline stores across the country suspended operations, and user funds were locked until January 5, 2026 at the latest.
Long queues instantly formed on the streets of Phnom Penh.
Bitrace's audit data shows that after processing its last withdrawal on December 1st, Huiwang Payment had only about 990,000 USDT remaining on its blockchain. Its Ethereum business had already exhausted its balance in October, and its Tron business repeatedly pooled funds from hot wallets in November to cope with withdrawals, but was ultimately completely drained around November 28th. Daily USDT outflows plummeted from 41.83 million at the beginning of the month to 7.17 million.
Huiwang Payment, which called itself "Cambodia's Alipay," became an empty shell overnight.
Tens of thousands of Chinese businesspeople in Cambodia have had their lives and fortunes locked up on a dying platform. Until recently, several Huiwang users spontaneously gathered through social media groups to go to the National Bank of Cambodia to demand repayment, but so far, they have made no substantial progress.
In December 2025, Cambodia revoked Chen Zhi's Cambodian citizenship on the grounds that he had "obtained citizenship through improper means".
On January 7, 2026, Chen Zhi was extradited back to China by Cambodian authorities.
In January 2026, Tudou Guarantee, a subsidiary of Huiwang, returned $130 million USDT and then appeared to shut down operations.
On April 1, 2026, Li Xiong was extradited back to China.
Thus, this vast empire, which started in an internet cafe in Lianjiang, Fujian, was gilded by real estate in Phnom Penh, expanded through Telegram, laundered money with USDT, and fattened itself with "pig butchering scams," has come to the end of its entire sinful life cycle.
The Dark River Never Dies
The story of Huiwang Guarantee has come to an end. But its proven business model is not over.
Shortly after Goodwin Guarantee announced its closure, Elliptic exposed another Telegram black market, "Xinbi Guarantee," which had facilitated at least $8.4 billion in illicit transactions since 2022 and had over 230,000 users. Registered in Colorado, USA, Xinbi Guarantee's merchant operations also included money laundering, document forgery, and personal information databases, making it almost a carbon copy of Goodwin Guarantee.
A report by the United Nations Office on Drugs and Crime indicates that organized cybercrime in Southeast Asia generates nearly $40 billion in annual profits. Cryptocurrencies and underground banking channels help these criminal networks launder money quickly, while Telegram-like instant messaging platforms provide them with a low-cost, highly efficient criminal infrastructure.
Taiwanese scholar Chen Yanyu, who studies cybercrime, spent several months in Cambodia speaking with money launderers, fraudsters, and their ringleaders. Her conclusion is chilling and sobering: "Cybercrime is deeply embedded in the operation of global capitalism, plundering resources from all over the world. It cannot be easily dismantled."
The $24 billion underground river has been ostensibly cut off. But the riverbed remains, the upstream water source remains, and the downstream demand remains.
Huiwang has fallen, but the shadowy side of this world still needs a place where dirty money can be cleaned up. The next Huiwang may already be quietly growing in some Telegram channel.
References: Elliptic research report, U.S. Treasury Department FinCEN announcement, U.S. Department of Justice indictment, Bloomberg investigation, Caixin report, Jiemian News report, Bitrace on-chain data analysis.
