Huione Guarantee: $11B USDT Marketplace and the AML Obligations It Creates

A Cambodian-linked online marketplace called Huione Guarantee has processed at least $11 billion in USDT since 2021, functioning as what blockchain researchers describe as the operational backbone of cyber scam networks across Southeast Asia. For compliance officers, auditors, and accounting firms that handle digital asset transaction flows, this is not a distant enforcement story. It is a live exposure risk with direct implications for transaction screening, suspicious activity reporting, and client onboarding.

What Huione Guarantee Is and How It Operates

Structure and ownership

Huione Guarantee is a Chinese-language marketplace built across a network of thousands of instant messaging channels, each run by a separate merchant. It sits within Huione Group, a Cambodian conglomerate with reported ties to Cambodia's ruling Hun family. The platform was established in 2021, originally presented as a venue for legitimate commerce including real estate and vehicles. Blockchain researchers at Elliptic now assess that the majority of goods and services offered through it are aimed directly at cyber scam operators.

The platform acts as a guarantor or escrow provider for transactions between merchants and buyers, keeping itself nominally at arm's length from the substance of what is being traded. Its stated position is that it does not participate in or scrutinise the specific business of its merchants and cannot verify the origin of funds. Regulators and enforcement agencies are unlikely to find that position persuasive given the volume of evidence to the contrary.

Payment rails and the USDT angle

Payments on Huione Guarantee are advertised primarily in USDT, though mobile payment apps and conventional bank transfers are also used. The use of the USDT stablecoin is significant for compliance purposes: unlike cash or payment app flows, stablecoin transactions leave an on-chain record that can be traced, screened, and flagged. This is precisely why blockchain analytics can quantify the platform's volume at a lower bound of $11 billion, a figure that likely understates reality given the high turnover of merchants and gaps in wallet attribution.

The Product Catalogue: What Merchants Are Selling

Money laundering as a listed service

The largest category of merchants on the platform offers money movement and exchange services. Many advertise money laundering explicitly, stating the types of fraud proceeds they will handle based on their assessment of how likely the funds are to be frozen by financial institutions or law enforcement. Services include receiving victim payments from jurisdictions around the world, cross-border transfers, and conversion to cash, stablecoins, or Chinese payment platforms.

This is not informal or implied. Merchants openly list pig-butchering scam proceeds, sextortion proceeds, and other fraud typologies as accepted inputs. That level of explicit advertising tells compliance teams something critical: counterparties transacting with these merchants know what they are buying into.

Scam infrastructure and data

A second merchant category offers software and web development services, including the construction of fraudulent cryptocurrency investment websites used in pig-butchering operations, designed to convince victims to deposit funds that are then stolen. Personal data, telecoms equipment, and AI-driven face-changing software are also listed, tools used to target and deceive victims at scale.

Coercion equipment

Researchers also identified advertisements for equipment consistent with physical coercion of workers inside scam compounds: tear gas, electric batons, and electronic shackles that deliver a shock if a worker leaves a defined perimeter. The language used by merchants references preventing workers from escaping. This connects the platform directly to human trafficking and forced labour in addition to financial crime.

The Scam Compound Context: Why Scale Matters

Cyber scam operations of this type have grown substantially over the past five years. Transnational organised crime groups, many originating from China and operating across Myanmar, Laos, and Cambodia, run what amount to prison-like compounds housing hundreds of thousands of workers. People from across Southeast Asia, China, Vietnam, and other countries have been trafficked into these facilities under the guise of legitimate employment offers and then forced to carry out scams against victims globally.

The emergence of marketplace infrastructure like Huione Guarantee is a significant factor in that growth. By providing readily accessible money laundering, technology, and data services, the platform lowers the operational barriers for criminal groups and allows them to scale more rapidly than would otherwise be possible. An $11 billion transaction volume is the quantified result of that dynamic.

For context on Huione Group's broader financial crime footprint and the specific risks posed by its own stablecoin, USDH, see our earlier briefing on Huione Group and the USDH stablecoin risk.

Compliance and Accounting Implications for Firms

Transaction screening and wallet exposure

Cryptocurrency wallets associated with Huione Guarantee and its merchant network have received at least $11 billion in USDT. Any regulated firm, exchange, custodian, payment processor, or accounting practice managing digital asset flows needs to confirm that its blockchain analytics capability covers these wallet clusters. If your transaction screening provider has not flagged Huione Guarantee-linked addresses as high-risk, that is a gap worth investigating now.

The transparency of on-chain USDT flows is, in this context, an advantage. Unlike the platform's fiat and mobile payment rails, stablecoin transactions can be screened proactively. Firms that rely solely on name-based or entity-level screening without wallet-level analysis will miss a material portion of the exposure. For firms evaluating the data quality of their analytics providers, our piece on blockchain analytics data quality due diligence sets out the questions worth asking.

Suspicious activity reporting obligations

Where a firm identifies a transaction that touches wallets associated with Huione Guarantee, the threshold question is whether a SAR or equivalent suspicious activity report is required. Given the public research record on this platform, including the explicit advertising of money laundering services and the volume of documented flows, it would be difficult to argue that a transaction involving these addresses does not meet the reasonable grounds threshold in most AML regimes, whether under FinCEN rules in the US, the Proceeds of Crime Act in the UK, or AMLD frameworks in the EU.

Firms operating in OFAC-regulated jurisdictions should also be tracking any sanctions designations that emerge from US Treasury actions targeting this network. See our coverage of OFAC SDN cryptocurrency address compliance priorities for the procedural framework that applies when designated addresses are identified.

Client onboarding and counterparty risk

For accounting firms and auditors with clients active in digital asset markets, the Huione Guarantee exposure raises a client risk question, not just a transaction screening one. If a client's on-chain history includes interactions with wallet clusters tied to this marketplace, that needs to be surfaced, documented, and assessed within your existing client risk framework. Crypto accounting software used to reconcile client books should be generating alerts or flags when wallet addresses match known illicit clusters. If it is not, the reconciliation process is incomplete from an AML standpoint.

This is also relevant to the selection and configuration of digital asset accounting software used by compliance-sensitive clients. Wallet-level attribution and risk labelling are not optional features in this environment. They are part of what makes a reconciliation audit-ready.

Jurisdictional reach

Huione Guarantee's merchant base and victim pool are global. US persons, EU-based exchanges, and firms operating under MiCA all have exposure vectors. The platform's Cambodian base does not insulate counterparties in regulated jurisdictions from their own AML obligations when they transact with wallet addresses linked to it. Geography of the platform operator is irrelevant to the obligations of a Frankfurt-based custodian or a New York-based accounting firm reconciling a client's USDT holdings.

What Firms Should Do Now

Immediate steps

First, confirm with your blockchain analytics provider that Huione Guarantee wallet clusters are covered in your screening ruleset and that risk scores reflect the public research record. Second, review any existing client portfolios or transaction histories for interactions with these addresses. Third, assess whether any flagged transactions meet your SAR filing threshold under the applicable regime. Fourth, document the review. In an enforcement context, the documented process matters as much as the outcome.

Accounting practices using crypto bookkeeping software to manage client digital asset records should verify that the software's data sources include up-to-date illicit wallet attribution. A reconciliation that is technically complete but blind to counterparty risk is not sufficient for clients operating in regulated environments.

Source: Elliptic