The “Phantom” on the Chain: Huiwang Payment Behind the Circulation of Over 55 Billion USDT

HuionePay under scrutiny: The platform is suspected of facilitating fraudulent fund transfers, particularly through USDT transactions on the TRON chain, drawing regulatory attention amid global efforts to combat online fraud and money laundering.
Massive USDT transactions:
- Total withdrawals: 57.2 billion USDT
- Total deposits: 54.5 billion USDT
- Net outflow of 2.77 billion USDT, indicating significant fund movement.
Key activity peaks:
- July 8, 2024: First major peak with over 1 billion USDT in deposits/withdrawals.
- March & May 2025: Withdrawals nearing/exceeding 1.1 billion USDT.
Transaction trends:
- Withdrawal transactions peaked at 150,000/day in May 2025, showing "high-frequency" activity.
- Deposit transactions grew steadily to 140,000/day, with stable user engagement.
User growth:
- Active deposit addresses rose from <30,000 to >80,000 (Jan 2024–June 2025), though growth slowed.
Top addresses:
- Withdrawals: Top 3 addresses moved 1.9 billion USDT combined, with ties to sanctioned entities and trading platforms.
- Deposits: Address 4 alone received 1.665 billion USDT, linked to Haowang Guarantee (formerly Huiwang Guarantee).
Activity patterns:
- Withdrawals concentrated at UTC 01:00–16:00 (peak: 07:00–13:00).
- Deposits mainly occurred at UTC 03:00–10:00, overlapping withdrawal windows.
Regulatory actions:
- USDT freezes (e.g., 29.62 million USDT in July 2024).
- U.S. proposed banning proxy services for Huione Group (May 2025), labeling it a "cybercriminal hub."
- UNODC tied Huione to $24 billion in crypto fraud (May 2025).
- Telegram banned related channels, citing $8.4 billion in suspicious transactions. Haowang Guarantee ceased operations shortly after.

Author:Lisa

Editor: Liz

Data Statistics: SlowMist AML Team

As the global fight against online fraud, underground payment networks and illegal cross-border money laundering continues to intensify, a platform called HuionePay has attracted great attention from regulators. The platform is suspected of being used to receive, transfer and withdraw fraudulent funds, especially by frequently performing on-chain operations on the TRON chain through USDT.

In order to further reveal its on-chain behavioral characteristics, SlowMist built the Dune data statistics panel based on the on-chain anti-money laundering and tracking tool MistTrack and on-chain public data, and on this basis conducted an in-depth analysis of HuionePay's USDT deposit and withdrawal behavior on the TRON chain.

Note: The data time range of this article is from January 1, 2024 to June 23, 2025, and the data comes from the data statistics panel produced by SlowMist: https://dune.com/misttrack/huionepay-data.

On-chain fund flow

HuionePay total deposit and withdrawal amount (Sum)

Total withdrawal amount: 57,246,854,379 USDT
Total deposits: 54,475,887,524 USDT

The deposit and withdrawal amounts both exceeded 50 billion USDT, indicating that HuionePay has continued to have a large amount of capital inflows and outflows in the past year and a half, and the withdrawal amount has always been higher than the deposit amount. The difference between the two is as high as 2.771 billion USDT, which has a more obvious "net outflow of funds" feature.

Weekly Fund Movement (Value Statis)

The chart data shows that the capital flow on the HuionePay platform remains active and peaks at the following three time points:

July 8, 2024: The first significant peak occurs, with both deposits and withdrawals exceeding 1 billion USDT.
March and May 2025: Two withdrawal amounts approached or exceeded 1.1 billion USDT.

Deposit/Withdrawal Transaction Count (Tx Count)

Data shows that the number of withdrawal transactions has been increasing in a step-by-step manner since February 2024, reaching a peak on May 12, 2025, with nearly 150,000 transactions per day, showing the characteristics of "high-frequency withdrawals."

In comparison, although the number of deposit transactions increased overall, the fluctuations were small, and the number of deposits also steadily increased to nearly 140,000 transactions per day, and the overall user activity did not decline significantly.

In addition, the peak withdrawal amounts in March and May 2025 were accompanied by a simultaneous increase in the number of transactions, and the two peaks almost overlapped.

User Conduct

Number of access users (Users)

Since the beginning of 2024, the number of active deposit addresses of HuionePay on the TRON chain has increased from less than 30,000 to more than 80,000, showing a steady growth trend. It should be noted that the chart data is deduplicated by address, that is, the deposit address can be roughly regarded as the number of users, while the withdrawal address may be a user-defined receiving address and cannot be equated with the actual user. The continued growth in the number of deposit addresses shows that the platform is still attracting new users, but the growth rate is slowing down.

Active Addresses

Top 3 withdrawal addresses

We used the on-chain anti-money laundering and tracking tool MistTrack to analyze that the withdrawal behavior of the HuionePay platform showed a certain degree of "fund concentration" characteristics. Among them, the top three withdrawal addresses are as follows:

Address 1 — TWS84SZ2GE2EgyZDCrfVuEJXpoXYuBxteS — 816 million USDT
Address 2 — T9yFi9yxwBUjMbHwBFKDdwFdBwvzUAqBfR — 580 million USDT
Address 3 — TTSSC4TEYtQMAMURND6i1FPYaaBJMGY4ed — 512 million USDT

The earliest transactions of the above addresses can be traced back to 2023. They have been active for a long time and have rich on-chain traces.

Address 1 not only withdraws money from multiple HuionePay hot wallets, but also interacts with addresses marked as "OFAC Sanctions", "Theft", and "BingX Exploiter" by MistTrack:

Address 2 is suspected to be the wallet address controlled by Haowang Guarantee (formerly Huiwang Guarantee) platform.

Address 3 interacts with multiple trading platforms:

Top 3 deposit addresses

Address 4 — TL8TBpubVzBr1UWPXBXU8Pci5ZAip9SwEf — 1.665 billion USDT
Address 5 — TPEpdLYtHr8cN1Jbwf6CGNB9Ppho7L2otr — 449 million USDT
Address 6 — TM1zzNDZD2DPASbKcgdVoTYhfmYgtfwx9R — 436 million USDT

Among them, the deposit of address 4 is as high as 1.6 billion USDT, which is 1.3 times the highest withdrawal amount of the address. The earliest transaction can be traced back to 2022. It is suspected to be a wallet address controlled by the Haowang Guarantee (formerly Huiwang Guarantee) platform. In addition, address 5 and address 6 are suspected to be hot wallet addresses of a certain platform.

Active time

We randomly selected 10 common addresses for deposits and withdrawals on HuionePay, and counted their operation time (UTC) as shown in the following figure:

The withdrawal transactions of the selected addresses are mainly concentrated in UTC time 01:00 – 16:00, of which 07:00 – 13:00 is the high-frequency period. Some addresses, such as TUXsppberDuVqQmNN5mnxg4pJ3HU9YtCEw, have a sudden increase in transactions from 02:00 to 03:00. Some withdrawal addresses have almost no transactions from 15:00 to 00:00 the next day.

The deposit operations of the selected addresses are mainly concentrated in UTC time 03:00 – 10:00, which partially overlaps with the active period of the withdrawal address. Among them, the deposit addresses TRAA9R9151eE522crrxQgQTr9WGVRubmou and TEdVW72PWcJ9Fwmw3w9uSBTLK6rjRUM1GJ showed stable fund deposit behavior from 03:00 to 09:00.

International Regulatory Updates

A series of recent international regulatory and law enforcement developments have heightened attention on HuionePay:

On July 14, 2024, Bitrace stated that Tether had frozen the address TNVaKW related to Huione, with an amount of up to 29.62 million USDT. The address was suspected to be a wallet for guarantee-related operations.
On May 2, 2025, the U.S. Treasury Department's Financial Crimes Enforcement Network (FinCEN) proposed to prohibit U.S. financial institutions from providing proxy account services to Cambodia-based Huione Group. The U.S. Treasury Secretary called Huione "the preferred market for cybercriminals" and the platforms involved include Huione Pay, Huione Crypto and Haowang Guarantee.
On May 8, 2025, the United Nations Office on Drugs and Crime (UNODC) pointed out in its report that Huione Guarantee has become part of Southeast Asia’s “industrialized cyber fraud ecosystem,” and its platform has received more than $24 billion in crypto funds.
On May 14, 2025, Elliptic reported that Telegram had banned thousands of crypto crime channels related to "Xinbi Guarantee" and that the platform processed over $8.4 billion in suspicious transactions, making it the largest crypto black market alongside Huione Group.
On May 15, 2025, Haowang Guarantee (formerly Huiwang Guarantee) announced on its official website that it would officially cease operations due to being blocked by Telegram.

Last words

HuionePay's fund flow, transaction frequency, and active addresses on the TRON chain provide basic data support for further understanding of its on-chain activities.