PHNOM PENH / WASHINGTON – December 7, 2025
Huione Pay – the digital payments arm of Cambodia’s Huione Group and a key node in a vast scam-driven financial ecosystem – has frozen withdrawals and halted business after a bank run by panicked users, closing what blockchain analysts have called the world’s largest illicit online marketplace. [1]
The shutdown, announced on December 1 and scheduled to last until January 5, 2026, follows a year of escalating U.S., U.K. and regional sanctions against Huione Group over allegations that it laundered billions in proceeds from crypto scams and North Korean cyber heists. [2]
As of December 7, 2025, thousands of customers remain locked out of their funds, while Cambodia’s central bank scrambles to contain the fallout and international regulators tout the collapse as a milestone in the fight against scam-driven cybercrime. [3]
A bank run, frozen withdrawals and a controversial “deferred payment” plan
The immediate crisis began when Huione Pay – which had recently rebranded some branches as “H‑Pay” – posted a notice titled “Huione Deferred Payment Plan” at its Phnom Penh headquarters on December 1. [4]
According to reporting by local outlet CamboJA and specialist AML publications:
- Huione Pay suspended withdrawals and said branches would remain closed until January 5, 2026.
- The company blamed a “sudden run” on user funds and “short-term liquidity pressures” for the freeze. [5]
- Queues of customers in the thousands formed outside branches in Phnom Penh and Sihanoukville as users tried – and failed – to pull their money out. [6]
The notice offered users two controversial options instead of immediate cash withdrawals: [7]
- An 18‑month “high-yield” product
- Users could lock in their funds for 18 months.
- Principal would be repaid at the end, with monthly interest payments advertised at around 18%.
- Slow-release withdrawals
- Users who chose not to convert would face a waiting period, with only a small percentage of their balance released each month over many months into 2026.
For many account holders who were being paid in USDT (Tether) through Huione’s system, that is effectively a forced, long-term investment into a sanctioned financial network. One Huione user told CamboJA that exchanges converting their USDT to cash had suddenly begun taking cuts of up to 50% on withdrawals, compounding the shock. [8]
Blockchain-tracing firm Bitrace separately reported that by December 2, on-chain balances linked to Huione Pay had dwindled to around 990,000 USDT, and that after the afternoon of December 1 “small” user withdrawals stopped entirely. Remaining funds appeared to be consolidated into large transfers instead of being paid out to ordinary customers. [9]
Central bank steps in: what Huione customers are being told now
On December 5, the National Bank of Cambodia (NBC) acknowledged the growing panic and issued an unusual public notice directed at Huione Pay’s customers. [10]
According to Cambodianess:
- NBC called on users who could not withdraw their money to visit the central bank’s offices in Phnom Penh’s Sen Sok district between December 8 and 19, bringing identification and supporting documents.
- The regulator reiterated that Huione Pay’s license had already been revoked in 2024 and that the company had entered liquidation in mid‑2025, even though some of its services continued operating under the H‑Pay brand.
- NBC also warned the public to avoid transactions involving crypto assets that lack licenses from Cambodian authorities, in a clear reference to Huione’s heavy use of USDT and other cryptocurrencies.
The notice stops short of guaranteeing full reimbursement, but suggests the central bank is compiling a formal list of creditors – a process that could feed into ongoing liquidation and supervisory proceedings.
From “largest illicit online marketplace” to enforcement test case
To understand why the collapse of Huione Pay matters far beyond Cambodia, it helps to look at the network behind it.
Huione Group and Huione Guarantee: a one‑stop crime marketplace
Huione Pay is part of Huione Group, a Phnom Penh–based conglomerate whose subsidiaries also include: [11]
- Huione Guarantee – a Chinese‑language escrow and “guarantee” service run almost entirely via Telegram channels.
- Huione Crypto – a crypto exchange.
- Other financial and real‑estate businesses integrated into what investigators say is a “grey‑black” money network.
In January 2025, blockchain analytics firm Elliptic described Huione Guarantee as the “largest illicit online marketplace” ever observed, with at least $24 billion in transactions tied to scam infrastructure, stolen data, deepfakes, money‑laundering services and online gambling bots. [12]
Later estimates put total crypto flows handled by Huione‑linked entities at up to $98 billion since 2014, combining both licit and illicit activity. [13]
When messaging platform Telegram finally blocked Huione Guarantee and a sister marketplace, Xinbi Guarantee, in May 2025, Reuters reported that the two black markets had jointly facilitated more than $35 billion in transactions – several times more than famous dark‑web markets like Silk Road. [14]
Despite that takedown, the key payment rails – notably Huione Pay and Huione Crypto – continued to function, making Huione Pay’s sudden operational freeze the most direct blow yet to the network’s real‑world financial infrastructure. [15]
How U.S., U.K. and South Korean sanctions boxed Huione in
FinCEN: Huione laundered at least $4 billion in illicit funds
On May 1, 2025, the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) formally identified Huione Group as a “financial institution of primary money laundering concern” and proposed cutting it off from the U.S. financial system under Section 311 of the USA PATRIOT Act. [16]
In findings later repeated in an October final rule and Treasury press release, FinCEN concluded that, between August 2021 and January 2025, Huione Group: [17]
- Laundered at least $4 billion in illicit proceeds, including:
- $37 million from North Korean cyber heists,
- $36 million from crypto investment scams (including “pig‑butchering” romance scams), and
- $300 million from other cyberfraud.
- Acted as a “critical node” for Southeast Asian scam syndicates relying on virtual currency.
The October 14 final rule severed Huione from the U.S. banking system, prohibiting covered financial institutions from maintaining correspondent accounts for Huione Group or processing transactions that involve it, even indirectly. [18]
Joint crackdown with the U.K. and a record crypto seizure
That same day, Washington and London announced what U.S. officials called the largest ever joint action against Southeast Asia–based online scam networks. The campaign: [19]
- Sanctioned 146 individuals and entities linked to Cambodia’s Prince Group, led by tycoon Chen Zhi, designated as a transnational criminal organization.
- Finalized the rule cutting Huione Group off from U.S. dollar clearing.
- Was accompanied by a U.S. Department of Justice move to seize roughly $15–16 billion in bitcoin linked to scam operations – a record‑breaking crypto confiscation.
While Huione Group and Prince Group are formally separate, investigative reporting and corporate records show overlapping personnel, shared infrastructure in Cambodia’s scam compounds and similar reliance on trafficked workers forced to run online fraud schemes. [20]
South Korea and private-sector choke points
Sanctions pressure did not stop there. In late 2025:
- South Korea joined the U.S. and U.K. in sanctioning Huione Group and Prince Group, citing the death of a South Korean national in a scam compound and the scale of losses to Korean victims. [21]
- The major Korean exchange Upbit froze more than 200 accounts linked to Huione, cutting off a key liquidity channel. [22]
As global watchdogs blacklisted Huione addresses and major exchanges implemented risk controls, Huione’s access to both fiat and crypto rails narrowed dramatically – setting the stage for a classic confidence crisis once users rushed for the exits.
Rebranding as H‑Pay and the Panda Bank connection
Even as sanctions mounted, Huione’s payments business attempted to reinvent itself.
In late November, CamboJA reported that Huione Pay’s headquarters and Phnom Penh branches had rebranded as “H‑Pay”, with new signage and a fresh corporate entity incorporated in October 2024. [23]
Key details from that investigation include:
- The H‑Pay office shares a building and visual branding cues with Panda Commercial Bank, including panda statues at the entrance.
- Corporate records showed overlapping directors and links between H‑Pay, Huione Group entities and Panda Bank, though several individuals named as H‑Pay directors told reporters they were unaware of their roles or denied involvement.
- Huione Pay’s banking license had already been revoked by the National Bank of Cambodia in March 2025 for “noncompliance of regulations,” but staff told customers they should download the H‑Pay app to continue accessing services. [24]
The rebrand raised concerns that Huione was attempting to sidestep sanctions and regulatory restrictions by funneling the same activities through a fresh‑faced entity, while maintaining links to politically connected banking partners.
Cambodia’s uncomfortable spotlight in the era of the “scam state”
The Huione saga is unfolding against a broader regional backdrop that experts have dubbed the rise of the “scam state” – where industrial‑scale online fraud becomes a major economic engine and embeds itself inside state institutions. [25]
Recent UN‑backed and independent research cited by the Guardian suggests:
- Scam compounds in Mekong countries generated an estimated $44 billion a year by late 2024 – roughly 40% of the formal economies in parts of the region. [26]
- Hundreds of thousands of people have been trafficked into scam centres across Myanmar, Cambodia and Laos, where they are forced to run “pig‑butchering” and other online cons, often under conditions involving torture and slavery. [27]
Huione Group is repeatedly cited in these reports as one of the most important financial arteries of this system, providing escrow, payments, stablecoins and infrastructure for scammers who primarily operate via messaging apps and crypto rails. [28]
What Huione says – and what regulators concluded
Huione Group has previously pushed back against some of these allegations.
- When Reuters reported in 2024 that a wallet used by North Korea’s Lazarus Group had sent crypto through Huione Pay, the company said it had not known it was “indirectly” receiving hacked funds and argued that the sending wallet was outside its control. [29]
- After RFA first reported that Huione Pay had lost its banking license in March 2025, Huione argued that its business model did not require such a license and accused critics of misunderstanding its operations. [30]
However, FinCEN’s final rule notes that, despite public acknowledgements of compliance weaknesses, U.S. regulators found “no meaningful AML/KYC program” at Huione Group, even after the initial warning in May 2025. [31]
Chainalysis and Elliptic likewise argue that Huione’s structure – combining a Telegram‑based criminal marketplace with lightly regulated payment and exchange businesses – was engineered to launder and move criminal proceeds at scale, not merely to provide neutral financial services. [32]
Huione Group has not issued a detailed public statement responding to the December bank run and shutdown of Huione Pay. International and local journalists report that attempts to obtain fresh comment from company representatives have gone unanswered. [33]
What happens next for Huione users and the wider crypto ecosystem?
For now, three overlapping processes are underway:
- Customer claims and potential recovery in Cambodia
- NBC’s call for Huione Pay users to register at its offices between December 8–19 is the clearest signal yet that Cambodian authorities are treating the platform’s collapse as a systemic consumer‑protection and regulatory issue. [34]
- It remains unclear whether users will recover their funds in full, especially those whose money was held in USDT or routed via offshore exchanges.
- Ongoing international enforcement
- The U.S. Section 311 special measure against Huione Group is already in force, and Treasury officials have hinted that more actions against associated networks are likely as investigators trace flows routed through Huione’s web of shell companies and crypto addresses. [35]
- Redesign of scam infrastructure
- Analysts expect scammers to migrate to alternative platforms and payment rails, just as they did when Huione Guarantee and Xinbi Guarantee were removed from Telegram. But shutting down what Elliptic calls the largest scam infrastructure ever seen has significantly raised costs and risks for those networks. [36]
For victims worldwide – from retirees in the United States to young professionals in South Korea and Europe – the collapse of Huione Pay is a rare moment of accountability in a booming fraud economy. But it is also a reminder that as long as scam compounds, coerced labour and lightly regulated crypto channels persist across Southeast Asia, new Huiones are likely to rise to replace the old ones.
Quick FAQ
What is Huione Pay?
Huione Pay is (or was) the digital payments arm of Cambodia’s Huione Group, offering cross‑border transfers, currency exchange and stablecoin‑based services, heavily used by Chinese‑speaking communities in Southeast Asia. Regulators say it acted as a key settlement layer for online scam operations. [37]
Why did Huione Pay shut down?
The platform suspended operations on December 1, 2025, after a wave of withdrawal requests triggered a bank‑run‑style liquidity crunch in the wake of severe U.S., U.K. and South Korean sanctions, as well as the loss of its Cambodian banking license. [38]
How much illicit money is Huione alleged to have handled?
FinCEN says Huione Group laundered at least $4 billion in clearly illicit proceeds between 2021 and 2025, while Elliptic estimates that Huione‑linked entities processed up to $98 billion in total crypto flows since 2014, much of it tied to scams and cybercrime. [39]
What can Huione Pay customers do now?
NBC has instructed affected users to register their claims in person at its Sen Sok office from December 8 to 19, 2025, bringing ID and relevant documents. Beyond that, customers will need to follow official communications from the central bank and any court‑supervised liquidation process; independent financial or legal advice may be appropriate in individual cases. [40]
References
1. cambojanews.com, 2. home.treasury.gov, 3. cambodianess.com, 4. cambojanews.com, 5. cambojanews.com, 6. cambojanews.com, 7. cambojanews.com, 8. cambojanews.com, 9. blog.bitrace.io, 10. cambodianess.com, 11. en.wikipedia.org, 12. www.elliptic.co, 13. www.coindesk.com, 14. www.reuters.com, 15. www.chainalysis.com, 16. www.fincen.gov, 17. www.fincen.gov, 18. www.fincen.gov, 19. home.treasury.gov, 20. www.theguardian.com, 21. cambojanews.com, 22. whale-alert.io, 23. cambojanews.com, 24. cambojanews.com, 25. www.theguardian.com, 26. www.theguardian.com, 27. www.theguardian.com, 28. en.wikipedia.org, 29. www.reuters.com, 30. www.rfa.org, 31. www.federalregister.gov, 32. www.chainalysis.com, 33. whale-alert.io, 34. cambodianess.com, 35. www.fincen.gov, 36. www.reuters.com, 37. en.wikipedia.org, 38. cambojanews.com, 39. home.treasury.gov, 40. cambodianess.com
