Author: Lisa
Editor: Liz
Data Statistics: SlowMist AML Team
With the global crackdown on online fraud, underground payment networks, and illegal cross-border money laundering activities continuing to intensify, the platform known as HuionePay has attracted heightened regulatory scrutiny. The platform is suspected of being used for the receipt, transfer, and withdrawal of fraudulently obtained funds, especially through frequent on-chain operations using USDT on the TRON chain.
To further uncover its on-chain behavior characteristics, SlowMist built a Dune data statistics panel based on the on-chain anti-money laundering and tracking tool MistTrack and publicly available on-chain data, and conducted an in-depth analysis of HuionePay's USDT deposit and withdrawal behavior on the TRON chain.
Note: The data time range for this article is from January 1, 2024, to June 23, 2025, with data sourced from the statistics panel created by SlowMist (https://dune.com/misttrack/huionepay-data).
On-chain Fund Flow
Total Deposit and Withdrawal Amounts of HuionePay (Sum)
Total Withdrawal Amount: 57,246,854,379 USDT
Total Deposit Amount: 54,475,887,524 USDT
Both deposits and withdrawals exceed 50 billion USDT, indicating that HuionePay has sustained significant inflows and outflows of funds over the past year and a half, with withdrawal amounts consistently higher than deposit amounts, resulting in a net outflow of 2.771 billion USDT, demonstrating a clear ‘net capital outflow’ characteristic.
Weekly Fund Movement (Value Statistics)
Chart data shows that the flow of funds on the HuionePay platform remains active, with peaks occurring at the following three time points:
On July 8, 2024: A significant peak first appeared, with both deposits and withdrawals exceeding 1 billion USDT.
In March and May 2025: Two instances of withdrawal amounts approached or exceeded 1.1 billion USDT.
Deposit/Withdrawal Transaction Count (Tx Count)
Data shows that the number of withdrawal transactions has been rising stepwise since February 2024, peaking on May 12, 2025, with nearly 150,000 transactions in a single day, demonstrating a characteristic of 'high-frequency withdrawals'.
In contrast, although the number of deposit transactions has overall increased, the fluctuations have been small, with the number of deposits steadily rising to nearly 140,000 per day, and overall user activity has not significantly declined.
Additionally, the peaks in withdrawal amounts in March and May 2025 were accompanied by a simultaneous increase in transaction counts, with the two peaks nearly overlapping.
User Behavior
Deposit and Withdrawal Users (Users)
Since the beginning of 2024, the number of active deposit addresses on the TRON chain for HuionePay has grown from less than 30,000 to over 80,000, showing a stable growth trend. It should be noted that the chart data is counted by deduplication by address, meaning that deposit addresses can roughly be considered as the number of users, while withdrawal addresses may be user-defined receiving addresses and cannot be equated to actual users. The continuous growth in the number of deposit addresses indicates that the platform continues to attract new users, although the growth rate is showing signs of slowing.
Active Addresses
Top 3 Withdrawal Addresses
We used the on-chain anti-money laundering and tracking tool MistTrack for analysis, revealing certain 'capital concentration' characteristics in the withdrawal behavior of the HuionePay platform. The top three withdrawal addresses are as follows:
Address 1 — TWS84SZ2GE2EgyZDCrfVuEJXpoXYuBxteS — 816 million USDT
Address 2 — T9yFi9yxwBUjMbHwBFKDdwFdBwvzUAqBfR — 580 million USDT
Address 3 — TTSSC4TEYtQMAMURND6i1FPYaaBJMGY4ed — 512 million USDT
The earliest transactions for the above addresses can be traced back to 2023, showing long-term activity with rich on-chain traces.
Address 1 not only withdraws funds from multiple HuionePay hot wallets but also interacts with addresses marked by MistTrack as 'OFAC Sanctions', 'Theft', and 'BingX Exploiter':
Address 2 is suspected to be a wallet address controlled by Haowang Guarantee (formerly Huione Guarantee).
Address 3 interacts with multiple trading platforms:
Top 3 Deposit Addresses
Address 4 — TL8TBpubVzBr1UWPXBXU8Pci5ZAip9SwEf — 1.665 billion USDT
Address 5 — TPEpdLYtHr8cN1Jbwf6CGNB9Ppho7L2otr — 449 million USDT
Address 6 — TM1zzNDZD2DPASbKcgdVoTYhfmYgtfwx9R — 436 million USDT
Among them, the deposits for address 4 reached 1.6 billion USDT, which is 1.3 times the highest withdrawal amount address, with the earliest transaction traceable to 2022, suspected to be a wallet address controlled by Haowang Guarantee (formerly Huione Guarantee). Additionally, addresses 5 and 6 are suspected to be hot wallet addresses for a certain platform.
Active Time
We randomly selected 10 common addresses that made deposits and withdrawals on HuionePay and compiled their operation times (UTC) as shown below:
The selected addresses' withdrawal transactions are mainly concentrated between UTC time 01:00 – 16:00, with a high-frequency period from 07:00 – 13:00. Some addresses, such as TUXsppberDuVqQmNN5mnxg4pJ3HU9YtCEw, experienced a sudden spike in transactions between 02:00 – 03:00. Some withdrawal addresses had almost no transactions between 15:00 and the next day's 00:00.
The selected addresses' deposit operations are mainly concentrated between UTC time 03:00 – 10:00, partially overlapping with the active periods of withdrawal addresses. Among them, deposit addresses TRAA9R9151eE522crrxQgQTr9WGVRubmou and TEdVW72PWcJ9Fwmw3w9uSBTLK6rjRUM1GJ show stable fund inflow behavior from 03:00 – 09:00.
International Regulatory Dynamics Supplement
Recent international regulatory and law enforcement dynamics have intensified scrutiny on HuionePay:
On July 14, 2024, Bitrace reported that Tether froze the address TNVaKW related to Huione, amounting to 29.62 million USDT, which is suspected to be a wallet for guarantee-related operations.
On May 2, 2025, the U.S. Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) proposed banning U.S. financial institutions from providing agency account services to Huione Group, headquartered in Cambodia. The U.S. Treasury Secretary stated that Huione is the 'preferred market for cybercriminals', with involved platforms including Huione Pay, Huione Crypto, and Haowang Guarantee.
On May 8, 2025, the United Nations Office on Drugs and Crime (UNODC) reported that Huione Guarantee has become part of Southeast Asia's 'industrialized ecosystem of online fraud', having received over $24 billion in crypto funds.
On May 14, 2025, Elliptic reported that Telegram banned thousands of cryptocurrency crime channels related to 'Xinbi Guarantee', with the platform handling over $8.4 billion in suspicious transactions, ranking alongside Huione Group as the largest crypto black market.
On May 15, 2025, Haowang Guarantee (formerly Huione Guarantee) announced on its official website that it would officially cease operations due to being banned by Telegram.
Final Thoughts
The flow of funds, transaction frequency, and active addresses of HuionePay on the TRON chain provide foundational data support for further understanding its on-chain activities.