Documents and insiders have revealed the inner workings of one of the world's largest money laundering networks.

Authors: Selam Gebrekidan & Joy Dong

Selam Gebrekidan is an investigative reporter for The New York Times based in Hong Kong.

Chang W. Lee is a photographer for The New York Times with 30 years of experience covering events around the world, currently based in Seoul.

Translation by: Deep Tide TechFlow

Every few weeks, the night sky in Cambodia is lit up by fireworks. Scammers set off these fireworks to celebrate their latest "big score" schemes.

As the fireworks burst in the sky, someone's life savings may have already vanished. Victims may have fallen into a fake online romance scam or invested in a fraudulent cryptocurrency exchange. Regardless of the form of the scam, the money has disappeared without a trace, entangled in a complex money laundering network that circulates billions of dollars at a dizzying speed.

The FBI, the Chinese Ministry of Public Security, Interpol, and other agencies have attempted to crack down on these scammers. They are often active on social media and dating apps, luring people into fake financial schemes or other scams. Telecom companies have blocked phone numbers, and banks have issued multiple warnings.

However, this industry continues to thrive, with highly efficient money laundering operations behind it. Unwary victims around the world lose hundreds of billions of dollars each year, and this money must be "cleaned" to obscure its criminal origins and ultimately flow into the legitimate economy. This money laundering system is like a hydra; when governments strike it down in one place, it reemerges in another.

This underground world is subtly present in Cambodia's capital, Phnom Penh, which is one of the hubs for money launderers globally. In the coastal city of Sihanoukville, the situation is even more pronounced, as it is a notorious haven for scammers. Scammers operate their schemes from call centers, which are often located in heavily guarded buildings or the upper floors of unfinished skyscrapers. Meanwhile, at seaside restaurants, money launderers and other criminals enjoy spicy Chinese food while conducting transactions.

In March of this year, outside the Golden Sun Sky Casino & Hotel in Sihanoukville, Cambodia, UK and US authorities have linked this casino to online fraud and human trafficking.

We obtained a batch of documents that can be seen as a "money laundering manual." At the same time, we interviewed nearly six scammers and their money laundering accomplices. These documents do not point to a specific scam or victim but reveal a method of illegal fund transfer that is almost unstoppable.

From The New York Times

For criminals, money launderers are as crucial as the getaway driver in a bank robbery. Without them, the proceeds of crime cannot be cashed out.

Once a scammer successfully gets a victim to hand over their savings, they need to quickly transfer the funds from one account to another, from one country to another, before the victim realizes they have been scammed and alerts the bank or police.

Ultimately, the money becomes "clean"—almost impossible to trace back to the original scam.

So how is all this accomplished?

Tracing this lead, we unexpectedly discovered that it is related to a Cambodian financial giant called "Huione Group."

This is not a small workshop hidden in an alley, secretly "cleaning dirty money." Huione Group is a well-known company operating legally in Southeast Asia, with branches in other parts of the world. Its QR code payment system is widespread in Cambodia, allowing consumers to pay bills in hotels, restaurants, and supermarkets. Huione's advertisements are found along major highways, and its financial services cover banking and insurance.

However, Huione Group (pronounced "Hu-WAY-wahn") consists of multiple affiliated companies, not all of which are legitimate. According to documents and two anonymous individuals with direct knowledge of its operations, part of the group's business offers customized money laundering services. These two insiders requested anonymity due to concerns for their safety. The company did not respond to any requests for comment regarding these allegations.

Another affiliated company openly operates an online black market that connects criminals and money launderers. While the exact scale of this market is nearly impossible to measure, the analytics firm Elliptic has linked it to $26.8 billion worth of cryptocurrency transactions since 2021. Due to the extreme opacity of the industry, distinguishing between legitimate and illegitimate transactions is challenging, but Elliptic points out that this black market is one of the largest illegal internet markets globally.

Notably, a cousin of Cambodia's Prime Minister, Hun To, is a director of one of Huione Group's subsidiaries.

Research by a scammer, a money launderer, and analytics firms Elliptic and Chainalysis on its cryptocurrency transactions indicates that Huione Group's clients include large criminal organizations, such as a gang in Myanmar that profits by exploiting victims of human trafficking.

Huione Group (Huione) consists of multiple affiliated companies, one of which, Huione Pay, is headquartered in Phnom Penh, Cambodia.

However, this money laundering network operates with impunity. To date, the organization has never been targeted by any government sanctions. Although the cryptocurrency company Tether has frozen some of the group's accounts at the request of unspecified law enforcement agencies, and the messaging app Telegram has shut down some of its channels, these measures have not had a lasting impact.

Here is a detailed explanation of how it operates:

Imagine you are a scammer who has defrauded people of their life savings. You need a way to transfer these funds out of the world, and for that, you need a "middleman."

The so-called middleman is a trusted intermediary who can help you safely transfer the ill-gotten gains to their destination. A good middleman has a global network of members known as "money mules," who can complete fund transfers within hours.

A money mule can be an individual or a shell company that controls local bank accounts or cryptocurrency wallets.

Once you find a middleman, they will deposit the funds into an escrow account, ensuring that they do not run off with the money during the transfer process.

Now, you are ready to start your scam.

Suppose you successfully trick someone into transferring you $40,000.

Step 1: As the scam mastermind, you reach an agreement with the middleman. In the case of a scam in the US, the middleman typically demands a 15% cut as their and the money mule's fee.

Step 2: The middleman finds a suitable money mule and arranges the transaction for you.

Step 3: The middleman sends you the bank account or cryptocurrency wallet information of the money mule, which you then provide to the victim.

Step 4: The victim transfers $40,000 into the money mule's account.

Step 5: The money mule transfers the funds from one account to another, ultimately converting it into cryptocurrency.

Step 6: Finally, the money mule takes a portion as a service fee and hands the remaining amount to the middleman. The middleman deducts their fee and then gives you the remaining $34,000.

In this way, the entire money laundering chain is completed, and the funds become nearly untraceable, allowing the scam to proceed smoothly.

"Brick Moving" Business

Huione Group profits at every step of the process.

First, one of its subsidiaries (which was still recently known as "Huione Guarantee") operates a marketplace where scammers can find middlemen. Middlemen are crucial in this system, and their work is so mechanically repetitive that, according to anthropologist Yanyu Chen, who studies money laundering behavior in Cambodia, the Chinese refer to this behavior as "moving bricks."

This online marketplace consists of thousands of Telegram chat groups.

Some branches of Huione Pay also promote currency exchange services, including conversions between Tether and US dollars.

In these Telegram channels, anonymous users post advertisements for money laundering services in almost unabashed language. These posts are public, and anyone with the Telegram app can see them. Some vendors also sell stolen personal data, applications for impersonation, and other services crucial to scammers.

One channel called "Demand and Supply" has over 400,000 users, with hundreds of messages daily, including advertisements for money laundering services. After we sent inquiries to Huione Group and other relevant parties at the end of February, Telegram stated that it had deleted the channel. However, another similar channel quickly emerged, attracting about 250,000 members within a week.

Huione Guarantee did not respond to multiple requests for comment but denied any connection to the financial group Huione Group. The company even changed its name last October to remove "Huione" from its title. However, it told customers on Telegram that Huione Group remains one of its "strategic partners and shareholders."

Secondly, this marketplace platform provides guarantees for money laundering transactions. Why? Because the saying "there's honor among thieves" does not apply here, and scammers can deceive each other. To prove their credibility, middlemen and money mules need to pay a deposit to Huione Guarantee, which is held in escrow. This assures scammers that no one will run off with the money (or if someone does, that person will lose their deposit).

The price of money laundering is determined by the type of crime involved in obtaining the funds. For example, scams impersonating government officials are more expensive because victims are more likely to report them to the police or notify their banks.

Geographical location also affects the cost of money laundering. In China, laundering fees can reach up to 60% of the illicit funds. This is due to China's tightened financial controls since 2020, which have led to nationwide crackdowns resulting in thousands of arrests and the freezing of significant amounts of money.

China and Cambodia have reached a cooperation agreement to jointly conduct law enforcement actions, which have led to the arrest of several criminals; however, most of those arrested are low-level offenders. These measures have not had a substantial impact on the fraud and money laundering industry.

Although the transactions of middlemen are conducted privately, the groups themselves are also profiting. They make money by selling advertisements in public groups, charging maintenance fees for private groups, and taking small commissions from transactions. Most transactions are priced in Tether cryptocurrency, but some are also conducted in cash, gold, or bank transfers. (Even last year, this market issued its own cryptocurrency.)

The market denies any connection to criminal activities in disclaimers posted on its website and Telegram channels. One post states, "All business in public groups is provided by third-party merchants and is unrelated to Huione Guarantee."

Thirdly, another subsidiary of Huione Group, "Huione International Pay," is more directly involved in money laundering activities. According to internal company documents and two individuals familiar with its operations, Huione International Pay itself acts as a middleman.

These documents and insiders reveal that Huione International Pay operates with the efficiency of a legitimate professional bank. Its headquarters is located in a glass and concrete building in Phnom Penh, where two panda statues stand at the entrance.

According to two individuals familiar with its operations, Huione International Pay conducts business within the group's headquarters in Phnom Penh.

One internal department is dedicated to providing customer relationship services for scammers and other illegal actors; another department monitors Telegram channels; and a third department tracks money mule accounts distributed across at least a dozen countries, as indicated by the internal documents we reviewed.

Huione's companies operate under a "legitimate facade" in countries with "extremely lax or almost nonexistent regulations." John Wojcik, a threat analyst at the UN Office on Drugs and Crime (UNODC), stated that Huione Group's complex and opaque ownership structure poses challenges for targeted law enforcement actions.

However, he also pointed out that even if Huione were shut down, other operators would quickly take its place.

"We have already seen competitors actively positioning themselves," Wojcik said.

The National Bank of Cambodia, which is responsible for regulating financial institutions, stated that the government is committed to ensuring "the security and transparency of financial transactions." At the same time, the government is working to comply with international anti-money laundering recommendations.

The National Bank also stated that Huione's payment services (the QR code payment system) failed to meet renewal requirements, and its relevant licenses in Cambodia were not renewed. In response, Huione quickly announced plans to register its business in Japan and Canada.

Tracking Money Mules

Money mules are those responsible for operating bank accounts and digital wallets.

According to Elad Fouks, an expert at Chainalysis responsible for monitoring on-chain fraud, some money mules open bank accounts using false identities, and advancements in artificial intelligence have made identity forgery easier.

Money mules will spread out deposits and withdrawals to reduce the risk of being noticed by banks. For example, transactions under $10,000 typically do not attract attention. Accounts and virtual wallets used for money laundering are mostly active for only a few weeks or months.

However, the real risk is not with the middlemen or scammers, but with these money mules. They are the ones most likely to be caught.

A case in a US court revealed the specific mechanics of this operation. The main defendant, Daren Li, operated a money mule network, registering 74 shell companies in the US to launder nearly $80 million. These companies opened accounts at institutions like Bank of America. When victims transferred funds into these accounts, the money was quickly moved to a bank in the Bahamas. Subsequently, these funds were used to purchase Tether cryptocurrency held on the Binance exchange.

Within days, these funds would be transferred to another virtual wallet.

According to records we reviewed, Daren Li had collaborated with Huione International Pay for money laundering activities. However, the FBI and Secret Service declined to confirm this connection. Daren Li pleaded guilty to conspiracy to commit money laundering last November.

Payday

Imagine again that you are the mastermind of a scam group. Something has gone wrong: your money mule has been arrested; the bank has frozen their account; or they may have absconded with the funds.

In these situations, your middleman will intervene to mediate the dispute.

If it is the money mule's fault, the middleman will help you retrieve the deposits from the escrow account and return them to you. If no one is to blame, these losses will be considered part of the operating costs.

But if everything goes smoothly, you will have your "payday," usually paid in Tether. You can exchange this Tether for US dollars through a casino or Huione's payment company.

UK authorities have stated that a building near the Golden Sun Sky Casino & Hotel in Sihanoukville once housed large-scale scam operations.

You can use these funds to pay your employees' salaries.

Today, scam operations mimic the operational models of professional institutions, with marketing, sales, and human resources departments employing thousands of people. Often, many employees are actually victims of human trafficking, forced to scam distant targets. Some scam organizations even replicate the company town model of the 19th century, only paying wages after employees complete a work season. Before that, employees can only spend on company credit.

These wages, in turn, nourish restaurants, casinos, and brothels within the closed-off areas where the scammers operate, profiting significantly from the employees who are deprived of their freedom.

Additionally, the payroll includes attractive models hired to participate in video calls to entice victims to part with their money. Some of these models even use AI face-swapping technology.

Like others, scammers also need to pay rent—not only for living but also for "protection."

Moreover, behind-the-scenes services for scams also require payment, and many services can be purchased through Huione's "market." Scammers pay software developers to create websites that mimic investment platforms. They need internet and computer infrastructure. They also pay thieves to steal potential victims' personal data, including national ID numbers, credit card information, location data, and even detailed records of previous hotel stays.

Some funds flow to dealers selling luxury cars, while others are used to purchase real estate in places like London and Dubai.

Of course, a portion of the funds is also used to buy fireworks.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。