Add Category
A multi-billion-dollar online marketplace linked to Cambodia's ruling family is allegedly being used to sell equipment to and launder money for the online scam industry — with Australians among those in the crosshairs.
Cambodia is a major hotspot for South-East Asia's online scam epidemic, with industrial-scale operations being run by Chinese criminal syndicates out of fortified multi-level office buildings, often using forced labour lured from as far afield as South Asia and Africa.
The scams include everything from "pig butchering" romance/finance scams, to sextortion, impersonation of family members and authorities, task scams, fake investment schemes and more.
UK cryptocurrency analysts Elliptic published a report earlier this month revealing that sellers on the Huione Guarantee platform were advertising equipment including electric shock shackles, tear gas and electric batons along with digital products like AI face-changing software and databases of individuals' personal data.
The listing for the shackles, which shock wearers if they leave a designated area, said they were "specialised for all kinds of runaway dogs".
The report said the largest category of listings, however, was those offering to move and exchange money.
"Many of the merchants explicitly offer money laundering services, including accepting payments from victims around the world, transferring it across borders and converting it to other assets including cash, [cryptocurrency] stablecoins, and to Chinese payment apps," the report said.
"Most specify the types of fraud proceeds that they are willing to launder, based on the perceived risk of having the funds frozen by financial institutions or law enforcement."
In the wake of the report, millions of dollars worth of cryptocurrency in one of Huione's digital wallets was frozen following a request from law enforcement.
Huione admits "detention equipment" has been advertised for sale on the platform and "hidden users may commit fraud and money laundering through loopholes in the rules".
However, it argues that such items could have legal purposes and that the vast majority of its users are "game clients".
More than $US11 billion received
Part of the Cambodian conglomerate Huione Group, Huione Guarantee acts as an intermediary between buyers and sellers, providing guarantor or escrow services in which it holds the funds until each has fulfilled their obligations.
Established in 2021 ostensibly to facilitate the sale of things like cars and real estate, the Chinese-language platform consists of a website linked to a network of channels run by merchants on the encrypted instant messaging app Telegram. Some of the channels are publicly accessible while others require permission from a channel administrator.
Payments are mostly in USDT, a "stablecoin" cryptocurrency pegged to the US dollar, but payment apps and bank transfers are also used.
The transparency of cryptocurrencies allows analysts such as Elliptic to track and monitor many of the stablecoin payments.
Elliptic said its analysis found that cryptocurrency wallets used by Huione Guarantee and its merchants had received at least $US11 billion ($16.81 billion) since 2021.
According to Elliptic, the majority of listings "appear to be targeted squarely at cyber scam operators".
"Manual analysis of thousands of messages across the Huione Guarantee platform has provided us with overwhelming evidence that its predominant role is to act as an illicit marketplace," Elliptic said in the report.
The ABC's attempts to verify the allegations found the listings were so full of jargon and code words as to be largely incomprehensible even to Chinese speakers.
However, terms such as "fine chat" (a category of scam that includes pig butchering), and "points running" (a method of money laundering) were common.
Some of the listings were linked to Australia.
A channel run by a merchant called "Blue Whale Global Data Source" included listings for databases of Australians' details such as bank accounts.
An Elliptic spokesperson told the ABC that researchers had seen references in Huione Guarantee listings to specific scam victims in Australia and bank accounts/payments apps used to collect money from these victims.
They said some appeared to be related to pig butchering scams.
"We believe the Australian authorities should take this extremely seriously," they said.
"This marketplace is facilitating scam operators who have targeted Australian citizens."
Links to Cambodia's ruling family
Huione Guarantee is linked to Cambodia's ruling family through Prime Minister Hun Manet's cousin Hun To.
Hun To is a director of several companies in the Huione Group including Huione Pay, a prominent financial services company described on its website as "Alipay in Cambodia".
Huione Guarantee was until recently featured on Huione Pay's website as one of its services but mentions of the platform were deleted following the release of Elliptic's report. Mentions of Huione Group have also been deleted from the Huione Guarantee site.
The ABC is not suggesting that Hun To, who owns a house in Melbourne and is married to an Australian, is aware of or responsible for the goods and services being advertised on the Huione Guarantee platform.
In late 2022 he launched defamation proceedings against The Australian and Qatar-based Al Jazeera over articles and a documentary that linked him to the online scam slavery industry.
According to court documents, Hun To's lawyers blame the media outlets for the Department of Home Affairs declining to renew his Resident Return Visa, which he requires to enter Australia from Cambodia, and the ostracism of his children at school in Melbourne.
The case has not yet been fully heard.
However, on July 9, the day before the release of Elliptic's report, The Australian published a "clarification" and pulled its article from the news outlet's website.
The clarification said The Australian did not intend to make "serious allegations" that Hun To "was linked to human trafficking, cyber scams and drug importation" and "accepts his denials of such conduct".
There is no indication Al Jazeera has agreed to any out-of-court settlement.
Neither The Australian nor Al Jazeera responded to requests for comment from the ABC.
The ABC approached Hun To for comment via his Australian solicitor but did not receive a response.
No responsibility for goods or services
Huione claims to have no responsibility for any of the goods or services offered on the Huione Guarantee platform.
A prominent disclaimer of the front page of its website says it "does not participate in nor understand the specific business of customers".
"As the guarantor, we are only responsible for one party receiving the goods and the other party receiving the money. As for the origin of funds or goods, Huione cannot verify or guarantee it."
The disclaimer adds: "If there is a problem with the source of funds or goods or the purchased goods are used for illegal activities, the company will not bear joint and several liability."
'Not necessarily human trafficking'
A statement posted to the Huione Guarantee website after the publication of Elliptic's report said advertisements for "detention equipment" accounted for "less than 0.01 per cent" of the thousands of listings on the site.
The statement pointed out that the sale of such equipment was "not necessarily human trafficking, it may also be used for public security interrogation".
A further statement to the ABC said that Huione Group was a legal enterprise regulated by the Cambodian government.
It said that "90 per cent of guaranteed clients are game clients".
"In an era when cryptocurrencies are so popular, a large number of games use cryptocurrencies for transactions," the statement said.
Huione did not explain what was meant by "game clients".
"During the process of development, 3 per cent of bad users were also captured, and we handled them through manual detection.
"However, because our services are all public, covering Asia, Europe and America, and the privacy attributes of cryptocurrency are superimposed, our KYC [know your customer] capabilities are now seriously insufficient.
"Therefore, some hidden users may commit fraud and money laundering through loopholes in the rules, which is also a challenge faced by many banks in various regions around the world!
"Any financial enterprise that wants to develop healthily that lasts for long, will have to try to avoid the inflow of bad funds.
"We have been working hard to do these things for our own development, we will strengthen and upgrade our regulatory policies and provide users with KYC capabilities through KYT's [know your transactions] technical analysis.
"While serving users well, we will try our best to combat money laundering and fraud."
"We have deleted the posts about selling illegal equipment mentioned by Elliptic," the statement added and noted the company was cooperating with Elliptic to "let them help us with high-risk [cryptocurrency] address identification'.
Chou Bun Eng, permanent vice-chair of Cambodia's National Committee for Counter Trafficking, told US-funded news service Radio Free Asia the report's claims were baseless and intentionally tarnished Cambodia's reputation.
'Effectively an illicit marketplace'
A report released earlier this year by the United States Institute for Peace (USIP), an independent institute founded by US Congress, estimated online scam operations in Cambodia brought in more than $US12.5 billion ($18.7 billion) annually — equivalent to about half the country's formal GDP.
Those working to combat the online scam industry say they were already aware of Huione Guarantee before Elliptic's report.
United Nations Office on Drugs and Crime deputy regional representative for South-East Asia and the Pacific Benedikt Hofmann said Huione was significant as one of the largest cryptocurrency payment services in the Asia-Pacific region and also because of its exposure to a range of high-value cyber scam and money-laundering incidents.
"It is really a good example of how different types of criminality converge around these platforms, and the role they play in South-East Asia's organised crime ecosystem," Mr Hofmann said.
"The [Elliptic] report in many ways reflects what we are seeing in the region, and this is only the tip of the iceberg.
"We are seeing a number of very similar platforms emerging … offering money laundering and underground banking services in online marketplaces which serve as interfaces for different types of criminality.
He said the report could help other countries that are struggling to understand the role platforms like Huione play in the wider organised crime context.
"It also really highlights the importance of effective threat analysis and sharing of intelligence to more rapidly detect and respond to emerging vulnerabilities," he said.
Jacob Sims, a transnational crime and modern slavery expert, said trafficking victims, scam victims, and activists in the space had referred to Huione Guarantee as a tech platform leveraged heavily by the syndicates.
"It is effectively an illicit marketplace for the goods and services needed to launder proceeds from scamming," he said.
"I've heard it referenced by victims in that regard during interviews seeking testimony on how the scam operations work.
"It is also notable that the government's propagandist arms began running interference for Huione within hours of the report being released."
Cryptocurrency frozen
Following the release of Elliptic's report, the cryptocurrency company Tether froze $US29.62 million worth of its stablecoin USDT in one of Huione's cryptocurrency wallets.
A Tether spokesperson told cybersecurity publication Recorded Future News the funds were "associated with activities allegedly linked to fraudulent and transnational criminal operations".
"This action was initiated based on a direct request from law enforcement, underscoring our commitment to collaboration with authorities worldwide," they said.
Tether did not specify which country's law enforcement had made the request.
Reuters also reported that cryptocurrency analysts had tracked cryptocurrency worth more than $US150,000 moving from a digital wallet used by North Korean hacking outfit Lazarus to Huione Pay between June 2023 and February this year.
The cryptocurrency was sent to Huione Pay from an anonymous digital wallet that, according to two blockchain analysts, was used by Lazarus hackers to deposit funds stolen from three crypto companies in June and July last year, mostly via phishing attacks.
Huione Pay's board said in a statement to Reuters the company had not known it "received funds indirectly" from the hacks.
The wallet that sent the funds was not under its management, Huione said.
Huione Pay declined to specify why it had received funds from the wallet or to provide details of its compliance policies.
The company told Reuters Hun To's directorship did not include day-to-day oversight of its operations.
Huione did not respond to the ABC's questions about the cryptocurrency transfers.
Response from authorities
Mr Hofmann said UNODC worked with countries in the region to understand the "regional threat environment" and develop responses.
"Platforms like Huione are increasingly in the focus of these efforts, given their central role in the ecosystem," he said.
"The proliferation of underground crypto service providers is a massive problem and most governments in the region are struggling to regulate them effectively.
"In this case, looking at enforcing regulatory limitations on payment companies to engage in cryptocurrency services would probably be a good first step."
The National Bank of Cambodia (NBC) said in a statement to Reuters that payments firms such as Huione were not allowed to deal or trade any cryptocurrencies and digital assets.
In 2018, it said the ban sought to avoid investment losses due to crypto's volatility, cybercrime and the anonymity of the technology "which may cause risks of money laundering and financing of terrorism".
The NBC told Reuters it "would not hesitate to impose any corrective measures" against Huione, without saying if such action was planned.