The New York Times: Unveiling the Money Laundering Empire in Cambodia, the Hidden Assembly Line Behind the Crypto Scam

Original Title: 《The Scammer's Manual: How to Launder Money and Get Away With It》

Authors: Selam Gebrekidan & Joy Dong

Translation: Deep Tide TechFlow

Every few weeks, the night sky in Cambodia is lit up by fireworks. Scammers set off these fireworks to celebrate their latest "big score" schemes.

As the fireworks burst in the sky, someone's life savings may have already vanished. Victims might have fallen into a fake online romance scam or invested in a phony cryptocurrency exchange. Regardless of the form of the scam, the money has disappeared without a trace, entangled in a complex money laundering network that circulates billions of dollars at a dizzying pace.

The FBI, the Chinese Ministry of Public Security, Interpol, and other agencies have attempted to crack down on these scammers. They are typically active on social media and dating apps, luring people into fake financial schemes or other scams. Telecom companies have blocked phone numbers, and banks have issued multiple warnings.

However, this industry remains resilient, with highly efficient money laundering operations behind it. Unwary victims around the world lose hundreds of billions of dollars each year, and this money must be "cleaned" to obscure its criminal origins and ultimately flow into the legitimate economy. This money laundering system is like a hydra; when governments strike it down in one place, it reemerges in another.

This underground world is subtly present in Cambodia's capital, Phnom Penh, which is one of the global hubs for money launderers. In the coastal city of Sihanoukville, the phenomenon is even more pronounced, as it is a notorious haven for scammers. Scammers operate their schemes from call centers, often located in heavily guarded buildings or the upper floors of unfinished high-rises. Meanwhile, at seaside restaurants, money launderers and other criminals enjoy spicy Chinese food while conducting transactions.

In March of this year, outside the Golden Sun Sky Casino & Hotel in Sihanoukville, Cambodian authorities have linked this casino to online scams and human trafficking.

We obtained a batch of documents that can be seen as a "money laundering manual." At the same time, we interviewed nearly six scammers and their money laundering accomplices. These documents do not point to a specific scam or victim but reveal a method of illegal fund transfer that is almost unstoppable.

From The New York Times

For criminals, money launderers are as crucial as getaway drivers in bank heists. Without them, the proceeds of crime cannot be cashed out.

Once a scammer successfully tricks a victim into handing over their savings, they need to quickly transfer the funds from one account to another, from one country to another, before the victim realizes they have been scammed and alerts the bank or police.

Ultimately, the money becomes "clean"—almost impossible to trace back to the original scam.

So, how is all this accomplished?

Tracing this lead, we unexpectedly discovered that it is related to a Cambodian financial giant called "Huione Group."

This is not a small workshop hidden in an alley, secretly "cleaning dirty money." Huione Group is a well-known enterprise operating legally across Southeast Asia, with branches in other parts of the world. Its QR code payment system is ubiquitous in Cambodia, allowing consumers to pay bills in hotels, restaurants, and supermarkets. Huione's advertisements are plastered along major highways, and its financial services encompass banking and insurance.

However, Huione Group (pronounced "Hu-WAY-wahn") consists of multiple affiliated companies, not all of which are legitimate. According to documents and two anonymous individuals with direct knowledge of its operations, a portion of the group's business offers customized money laundering services. These two insiders requested anonymity due to concerns for their safety. The company did not respond to any requests for comment regarding these allegations.

Another affiliated company openly operates an online black market that connects criminals and money launderers. While the exact scale of this market is nearly impossible to measure, the analytics firm Elliptic has linked it to $26.8 billion worth of cryptocurrency transactions since 2021. Due to the extreme opacity of the industry, distinguishing between legitimate and illegitimate transactions is challenging, but Elliptic points out that this black market is one of the largest illegal internet markets globally.

Notably, a cousin of the Cambodian Prime Minister, Hun To, is a director of one of Huione Group's subsidiaries.

According to a scammer, a money launderer, and research by analytics firms Elliptic and Chainalysis on its cryptocurrency transactions, Huione Group's clients include large criminal organizations, such as a gang in Myanmar that profits by exploiting victims of human trafficking.

Huione Group consists of multiple affiliated companies, one of which, Huione Pay, is headquartered in Phnom Penh, Cambodia.

However, this money laundering network operates with impunity. To date, the organization has never been the target of any government sanctions. Although the cryptocurrency company Tether has frozen some of the group's accounts at the request of unspecified law enforcement agencies, and the messaging app Telegram has shut down some of its channels, these measures have not had a lasting impact.

Here’s a detailed explanation of how it operates:

Imagine you are a scammer who has defrauded people of their life savings. You need a way to transfer this money out of the world, and for that, you need a "middleman."

The middleman is a trusted intermediary who can help you safely transfer the ill-gotten gains to their destination. A good middleman has a global network of members known as "money mules," who can complete fund transfers within hours.

A money mule can be an individual or a shell company controlling local bank accounts or cryptocurrency wallets.

Once you find a middleman, they will deposit the funds into an escrow account, ensuring they do not run off with the money during the transfer process.

Now, you are ready to start your scam.

Suppose you successfully trick someone into transferring you $40,000.

Step 1: As the scam mastermind, you reach an agreement with the middleman. In the case of a scam in the U.S., the middleman typically asks for 15% of the proceeds as their fee and that of the money mule.

Step 2: The middleman finds a suitable money mule and arranges the transaction for you.

Step 3: The middleman sends you the bank account or cryptocurrency wallet information of the money mule, which you then provide to the victim.

Step 4: The victim transfers $40,000 into the money mule's account.

Step 5: The money mule transfers the funds from one account to another, ultimately converting it into cryptocurrency.

Step 6: Finally, the money mule takes a portion as a service fee and hands the remaining amount to the middleman. The middleman deducts their fee and then gives you the remaining $34,000.

In this way, the entire money laundering chain is completed, and the funds become nearly untraceable, allowing the scam to proceed smoothly.

"Brick Moving" Business

Huione Group profits at every step of the process.

First, one of its subsidiaries (until recently known as "Huione Guarantee") operates a marketplace where scammers can find middlemen. Middlemen are crucial in this system, and their work is so mechanically repetitive that, according to anthropologist Yanyu Chen, who studies money laundering in Cambodia, the Chinese refer to this behavior as "moving bricks."

This online marketplace consists of thousands of Telegram chat groups.

Some branches of Huione Pay also promote currency exchange services, including conversions between Tether and the U.S. dollar.

In these Telegram channels, anonymous users post advertisements for money laundering services in almost unvarnished language. These posts are public, and anyone with the Telegram app can see them. Some vendors even sell stolen personal data, applications for impersonating others, and other services crucial to scammers.

One channel called "Demand and Supply" has over 400,000 users, with hundreds of messages daily, including advertisements for money laundering services. After we sent inquiries to Huione Group and other related parties at the end of February, Telegram stated that it had deleted the channel. However, another similar channel quickly emerged, attracting about 250,000 members within a week.

Huione Guarantee did not respond to multiple requests for comment but denied any connection to the financial group Huione Group. The company even changed its name last October to remove "Huione" from its title. However, it informed customers on Telegram that Huione Group remains one of its "strategic partners and shareholders."

Second, this marketplace provides guarantees for money laundering transactions. Why? Because the saying "there's honor among thieves" does not apply here, and scammers can cheat each other. To prove their credibility, middlemen and money mules must pay a deposit to Huione Guarantee, which is held in escrow. This assures scammers that no one will run off with the money (or if someone does, that person will lose their deposit).

The price of laundering money is determined by the type of crime involved in acquiring the funds. For example, scams impersonating government officials cost more because victims are more likely to report to the police or notify their banks.

Geography also affects the price of laundering money. In China, laundering fees can reach up to 60% of the illicit funds. This is because, since 2020, China has tightened capital controls and launched nationwide crackdowns, arresting thousands and freezing large amounts of money.

China and Cambodia have reached a cooperation agreement to jointly conduct law enforcement actions, leading to the arrest of several criminals, but most of those arrested are low-level offenders. These measures have not had a substantial impact on the scam and money laundering industry.

Although the transactions of middlemen are conducted privately, the groups themselves are also profiting. They make money by selling advertisements in public groups, charging maintenance fees for private groups, and taking small commissions from transactions. Most transactions are priced in Tether cryptocurrency, but some are conducted in cash, gold, or bank transfers. (Even last year, this marketplace issued its own cryptocurrency.)

The marketplace denies any connection to criminal activity in disclaimers posted on its website and Telegram channel. One post states: "All business in public groups is provided by third-party vendors and is unrelated to Huione Guarantee."

Third, another subsidiary of Huione Group, Huione International Pay, is more directly involved in money laundering activities. According to internal company documents and two individuals familiar with its operations, Huione International Pay itself acts as a middleman.

These documents and insiders reveal that Huione International Pay operates with the efficiency of a legitimate professional bank. Its headquarters is located in a glass and concrete building in Phnom Penh, where two panda statues stand at the entrance.

According to two individuals familiar with its operations, Huione International Pay conducts business within the group's headquarters in Phnom Penh.

One internal department is dedicated to providing customer relationship services for scammers and other illegal actors; another department monitors Telegram channels; and a third department tracks money mule accounts spread across at least a dozen countries, according to information from internal documents we reviewed.

Huione's companies operate under the "legal guise" in countries with "extremely lax or almost nonexistent regulations." John Wojcik, a threat analyst at the UN Office on Drugs and Crime (UNODC), states that Huione Group's complex and opaque ownership structure poses challenges for targeted law enforcement actions.

But he also points out that even if Huione were shut down, other operators would quickly take its place.

"We have already seen competitors actively positioning themselves," Wojcik said.

The National Bank of Cambodia, which is responsible for regulating financial institutions, states that the government is committed to ensuring "the safety and transparency of financial transactions." At the same time, the government is working to comply with international anti-money laundering recommendations.

The National Bank also stated that Huione's payment services (the QR code payment system) failed to meet renewal requirements, and its relevant licenses in Cambodia were not renewed. In response, Huione quickly announced plans to register its business in Japan and Canada.

Tracking Money Mules

Money mules are those responsible for operating bank accounts and digital wallets.

According to Elad Fouks, an expert at Chainalysis responsible for monitoring on-chain fraud, some money mules open bank accounts using false identities, and advancements in artificial intelligence have made identity forgery easier.

Money mules spread out deposits and withdrawals to reduce the risk of attracting the bank's attention. For example, transactions under $10,000 typically do not raise suspicion. Accounts and virtual wallets used for money laundering are mostly active for only a few weeks or months.

However, the real risk lies not with the middlemen or scammers, but with the money mules themselves. They are the ones most likely to be caught.

A case in a U.S. court revealed the specific mechanics of this operation. The main defendant, Daren Li, operated a money mule network, registering 74 shell companies in the U.S. to launder nearly $80 million. These companies opened accounts at institutions like Bank of America. When victims transferred funds into these accounts, the money was quickly moved to a bank in the Bahamas. Subsequently, these funds were used to purchase Tether cryptocurrency held on the Binance exchange.

Within days, these funds would be transferred to another virtual wallet.

According to records we reviewed, Daren Li collaborated with Huione International Pay for money laundering activities. However, the FBI and Secret Service declined to confirm this connection. Daren Li pleaded guilty to conspiracy to commit money laundering last November.

Payday

Imagine again that you are the mastermind of a scam group. Something has gone wrong: your money mule has been arrested; the bank has frozen their account; or they may have run off with the money.

In these situations, your middleman will intervene to mediate the dispute.

If it is the money mule's fault, the middleman will help you retrieve the deposit from the escrow account and return it to you. If no one is to blame, these losses will be considered part of the operating costs.

But if everything goes smoothly, you will welcome "payday," usually paid in Tether. You can exchange this Tether for U.S. dollars through a casino or Huione's payment company.

British authorities have stated that a large-scale scam operation once operated in buildings near the Golden Sun Sky Casino & Hotel in Sihanoukville.

You can use these funds to pay your employees' salaries.

Today, scam operations mimic the operational models of professional institutions, with marketing, sales, and human resources departments, employing thousands of people. Often, many employees are actually victims of human trafficking, forced to scam distant targets. Some scam organizations even imitate the company town model of the 19th century, only paying wages after employees complete a work season. Before that, employees can only spend on company credit.

These wages, in turn, nourish restaurants, casinos, and brothels within the closed area where the scammers operate, profiting handsomely from the employees who are deprived of their freedom.

Additionally, the scammers' payroll includes attractive models hired to participate in video calls to entice victims to part with their money. Some of these models even use AI face-swapping technology.

Like others, scammers also need to pay rent—not only for living but also for "protection."

Moreover, behind-the-scenes services for scams also require payment, and many services can be purchased through Huione's "market." Scammers pay software developers to create websites that mimic investment platforms. They need internet and computer infrastructure. They also pay thieves to steal potential victims' personal data, including national ID numbers, credit card information, location data, and even detailed records of previous hotel stays.

Some funds flow to dealers selling luxury cars, while others are used to purchase real estate in places like London and Dubai.

Of course, some funds are also used to buy fireworks.