Author: Lisa
Editor: Liz
Data Statistics: SlowMist AML Team
As the global crackdown on online fraud, underground payment networks, and illegal cross-border money laundering activities continues to intensify, the platform named HuionePay has drawn significant regulatory attention. The platform is suspected of being used for receiving, transferring, and cashing out fraudulent funds, especially through frequent on-chain operations using USDT on the TRON chain.
To further reveal its on-chain behavioral characteristics, SlowMist constructed a Dune data statistics panel based on the on-chain anti-money laundering and tracking tool MistTrack and publicly available on-chain data, and conducted an in-depth analysis of HuionePay's USDT deposit and withdrawal behavior on the TRON chain. Note: The data time range for this article is from January 1, 2024, to June 23, 2025, and the data source is from the data statistics panel produced by SlowMist: https://dune.com/misttrack/huionepay-data.
On-chain Capital Flow
Total Deposit and Withdrawal Amounts (Sum) for HuionePay
Total Withdrawal Amount: 57,246,854,379 USDT
Total Deposit Amount: 54,475,887,524 USDT
The amounts deposited and withdrawn exceed 50 billion USDT, showing that HuionePay has sustained a large inflow and outflow of funds over the past year and a half, with withdrawal amounts consistently higher than deposit amounts, resulting in a difference of 2.771 billion USDT, indicating a significant 'net capital outflow' characteristic.
Weekly Capital Trends (Value Statis)
The chart data shows that the capital flow on the HuionePay platform remains active, with peaks occurring at the following three time points:
On July 8, 2024: A significant peak occurs for the first time, with both deposits and withdrawals exceeding 1 billion USDT.
In March and May 2025: Two withdrawal amounts close to or exceeding 1.1 billion USDT.
Deposit / Withdrawal Transaction Count (Tx Count)
Data shows that the number of withdrawal transactions has been rising in a stepwise manner since February 2024, peaking on May 12, 2025, with nearly 150,000 transactions in a single day, displaying characteristics of 'high-frequency withdrawals'.
In contrast, although the overall number of deposit transactions has increased, the fluctuations are small, with the number of deposits steadily growing to nearly 140,000 transactions per day, and overall user activity has not significantly declined.
Moreover, the peaks in withdrawal amounts in March and May 2025 are accompanied by a simultaneous increase in transaction counts, with the two peaks almost overlapping.
User Behavior
Number of Deposit and Withdrawal Users (Users)
Since early 2024, the number of active deposit addresses for HuionePay on the TRON chain has increased from less than 30,000 to over 80,000, showing a steady growth trend. It is important to note that the chart data is counted after deduplication by address, meaning that deposit addresses can roughly be viewed as the number of users, while withdrawal addresses may be user-defined receiving addresses and cannot be equated to actual users. The continuous growth in the number of deposit addresses indicates that the platform continues to attract new users, although the growth rate is showing signs of slowing down.
Active Addresses
Top 3 Withdrawal Addresses
Using the on-chain anti-money laundering and tracking tool MistTrack for analysis, the withdrawal behavior on the HuionePay platform shows a certain degree of 'capital concentration' characteristics. The top three withdrawal addresses are as follows:
Address 1 — TWS84SZ2GE2EgyZDCrfVuEJXpoXYuBxteS — 816 million USDT
Address 2 — T9yFi9yxwBUjMbHwBFKDdwFdBwvzUAqBfR — 580 million USDT
Address 3 — TTSSC4TEYtQMAMURND6i1FPYaaBJMGY4ed — 512 million USDT
The earliest transactions for the above addresses can all be traced back to 2023, remaining active for a long time, with rich on-chain traces.
Address 1 not only withdraws from multiple HuionePay hot wallets but also interacts with addresses marked by MistTrack as 'OFAC Sanctions', 'Theft', and 'BingX Exploiter':
Address 2 is suspected to be a wallet address controlled by Haowang Guarantee (formerly Huione Guarantee).
Address 3 interacts with multiple trading platforms:
Top 3 Deposit Addresses
Address 4 — TL8TBpubVzBr1UWPXBXU8Pci5ZAip9SwEf — 1.665 billion USDT
Address 5 — TPEpdLYtHr8cN1Jbwf6CGNB9Ppho7L2otr — 449 million USDT
Address 6 — TM1zzNDZD2DPASbKcgdVoTYhfmYgtfwx9R — 436 million USDT
Among them, the deposits for address 4 reached as high as 1.6 billion USDT, which is 1.3 times the highest withdrawal amount address, with the earliest transaction traceable to 2022, suspected to be a wallet address controlled by Haowang Guarantee (formerly Huione Guarantee). Additionally, addresses 5 and 6 are suspected to be hot wallet addresses of a certain platform.
Active Time
We randomly selected 10 ordinary addresses that made deposits and withdrawals on HuionePay, and the statistics of their operation times (UTC) are shown in the figure below:
The withdrawal transactions of the selected addresses mainly concentrate between 01:00 and 16:00 UTC, with 07:00 to 13:00 being the high-frequency period. Some addresses, such as TUXsppberDuVqQmNN5mnxg4pJ3HU9YtCEw, show a surge in transactions between 02:00 and 03:00. Some withdrawal addresses have almost no transactions between 15:00 and 00:00 the next day.
The deposit operations of the selected addresses mainly concentrate between 03:00 and 10:00 UTC, overlapping partially with the active periods of withdrawal addresses. Among them, deposit addresses TRAA9R9151eE522crrxQgQTr9WGVRubmou and TEdVW72PWcJ9Fwmw3w9uSBTLK6rjRUM1GJ show stable capital inflow behavior between 03:00 and 09:00.
International Regulatory Dynamics Supplement
Recent international regulatory and enforcement dynamics have intensified scrutiny on HuionePay:
On July 14, 2024, Bitrace stated that Tether froze an address related to Huione, TNVaKW, with an amount as high as 29.62 million USDT, suspected to be a wallet for collateral-related operations.
On May 2, 2025, the U.S. Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) proposed to prohibit U.S. financial institutions from providing agency account services for Huione Group headquartered in Cambodia. The U.S. Treasury Secretary stated that Huione is 'the preferred market for cybercriminals', involving platforms including Huione Pay, Huione Crypto, and Haowang Guarantee.
On May 8, 2025, the United Nations Office on Drugs and Crime (UNODC) noted in its report that Huione Guarantee has become part of Southeast Asia's 'industrialized ecosystem of online fraud', with its platform cumulatively receiving over 24 billion USD in cryptocurrency.
On May 14, 2025, Elliptic reported that Telegram banned thousands of cryptocurrency crime channels related to 'Xinbi Guarantee', with the platform processing over 8.4 billion USD in suspicious transactions, ranking alongside Huione Group as the largest cryptocurrency black market.
On May 15, 2025, Haowang Guarantee (formerly Huione Guarantee) announced on its official website that it would officially cease operations due to being blocked by Telegram.
In conclusion
The capital flow situation, transaction frequency, and active addresses of HuionePay on the TRON chain provide basic data support for further understanding its on-chain activities.
SlowMist's on-chain anti-money laundering system MistTrack has long monitored such on-chain trading patterns and is committed to providing stable and reliable on-chain risk control support and strong AML compliance solutions for trading platforms, enterprises, and regulatory agencies. We recommend that all parties in the industry pay attention to the activities of relevant addresses, continuously track and analyze them using on-chain tools, and work together to build a more compliant and secure cryptocurrency ecosystem.