On-Chain Analysis of HuionePay: Unveiling the Over $55 Billion USDT in Fund Flows

Author: Lisa
Editor: Liz
Data Analysis: SlowMist AML Team

As global efforts to crack down on online scams, underground payment networks, and illicit cross-border money laundering intensify, a platform called HuionePay has come under close regulatory scrutiny. The platform is suspected of being used to receive, transfer, and cash out illicit funds, particularly through frequent on-chain operations involving USDT on the TRON blockchain.

To further uncover HuionePay’s on-chain behavioral patterns, SlowMist utilized its anti-money laundering and tracing tool MistTrack along with public blockchain data to build a Dune Analytics dashboard. Based on this dashboard, we conducted an in-depth analysis of HuionePay’s USDT deposit and withdrawal activities on TRON.

Note: The data in this report spans from January 1, 2024, to June 23, 2025, and is sourced from the dashboard created by SlowMist: https://dune.com/misttrack/huionepay-data.

On-Chain Fund Flow

Total Value of Deposits & Withdrawals (Sum)

• Total Withdrawals: 57,246,854,379 USDT
• Total Deposits: 54,475,887,524 USDT

Both deposit and withdrawal amounts exceed 50 billion USDT, indicating that HuionePay has been handling substantial fund inflows and outflows over the past 18 months. The total withdrawn value surpasses deposits by 2.771 billion USDT, revealing a clear trend of net capital outflow.

Weekly Capital Flow (Value Stats)

The chart shows that fund movements on HuionePay remain highly active, with peak volumes occurring at three notable time points:

• July 8, 2024: First major spike, with both deposits and withdrawals surpassing 1 billion USDT.
• March & May 2025: Withdrawal amounts neared or exceeded 1.1 billion USDT on two occasions.

Deposit / Withdrawal Transaction Count (Tx Count)

Withdrawal transactions have shown a stepwise increase since February 2024, reaching a peak on May 12, 2025, with nearly 150,000 withdrawals in a single day, highlighting a high-frequency withdrawal pattern.

In contrast, while deposit transactions also grew overall, their fluctuations were milder. The number of deposit transactions steadily increased to nearly 140,000 per day, indicating consistently high user activity.

Notably, the March and May 2025 withdrawal peaks were accompanied by a simultaneous surge in transaction count, suggesting strong correlation between volume and activity.

User Behavior

Number of Deposit/Withdrawal Users (Unique Addresses)

Since early 2024, the number of active deposit addresses on TRON linked to HuionePay has grown from under 30,000 to over 80,000, showing a steady upward trend. It’s important to note that deposit address data is deduplicated and can be considered a rough proxy for user count. Withdrawal addresses, however, may reflect user-specified recipient wallets and thus do not directly indicate unique users.

The continued growth of deposit addresses suggests HuionePay is still attracting new users, although at a slowing rate.

Active Addresses

Top 3 Withdrawal Addresses

Using the MistTrack AML tool, we found HuionePay’s withdrawals exhibit a certain degree of capital concentration. The top three withdrawal addresses are:

• Address 1: TWS84SZ2GE2EgyZDCrfVuEJXpoXYuBxteS — 816 million USDT
• Address 2: T9yFi9yxwBUjMbHwBFKDdwFdBwvzUAqBfR — 580 million USDT
• Address 3: TTSSC4TEYtQMAMURND6i1FPYaaBJMGY4ed — 512 million USDT

These addresses have been active since as early as 2023, leaving extensive traces on-chain.

• Address 1 has withdrawn funds from multiple HuionePay hot wallets and has interacted with addresses flagged by MistTrack as associated with OFAC Sanctions, Theft, and the BingX Exploiter.

• Address 2 is suspected to be controlled by the Haowang Guarantee platform (formerly Huione Guarantee).

• Address 3 has interacted with several exchange platforms.

Top 3 Deposit Addresses

• Address 4: TL8TBpubVzBr1UWPXBXU8Pci5ZAip9SwEf — 1.665 billion USDT
• Address 5: TPEpdLYtHr8cN1Jbwf6CGNB9Ppho7L2otr — 449 million USDT
• Address 6: TM1zzNDZD2DPASbKcgdVoTYhfmYgtfwx9R — 436 million USDT

Address 4 has deposited over 1.6 billion USDT — 1.3x the total withdrawn by the highest withdrawal address. Its earliest transaction dates back to 2022 and it is also suspected to be controlled by the Haowang Guarantee platform. Addresses 5 and 6 are suspected to be hot wallets for certain platforms.

Active Hours

We randomly selected 10 regular addresses that conducted both deposits and withdrawals via HuionePay and analyzed their activity time in UTC.

Withdrawal activity mainly occurred between 01:00 and 16:00 UTC, with the 07:00 to 13:00 UTC window being the most active. For instance, the address TUXsppberDuVqQmNN5mnxg4pJ3HU9YtCEw saw a sharp spike in withdrawals between 02:00–03:00 UTC, while several others showed almost no activity from 15:00 to 00:00 UTC.

Deposit activity was concentrated between 03:00 and 10:00 UTC, overlapping partially with withdrawal activity. Some addresses, such as TRAA9R9151eE522crrxQgQTr9WGVRubmou and TEdVW72PWcJ9Fwmw3w9uSBTLK6rjRUM1GJ, showed consistent deposit behavior during 03:00–09:00 UTC.

Supplementary International Regulatory Developments

Recent international enforcement actions have further intensified the spotlight on HuionePay:

• July 14, 2024: Bitrace reported that Tether froze address TNVaKW, suspected of being linked to Huione, with a frozen value of 29.62 million USDT. The address is believed to be used for guarantee-related operations.
• May 2, 2025: The U.S. Department of the Treasury’s FinCEN proposed banning U.S. financial institutions from providing correspondent accounts to Cambodia-based Huione Group. Treasury Secretary Yellen referred to Huione as a “preferred marketplace for cybercriminals,” citing platforms including Huione Pay, Huione Crypto, and Haowang Guarantee.
• May 8, 2025: The United Nations Office on Drugs and Crime (UNODC) stated in a report that Huione Guarantee has become part of Southeast Asia’s “industrialized scam ecosystem,” having received over $24 billion in crypto to date.
• May 14, 2025: Elliptic reported that Telegram banned thousands of crypto-crime-related channels linked to the “Xinbi Guarantee” brand. These channels processed over $8.4 billion in suspicious transactions, placing Huione Group among the largest crypto black markets.
• May 15, 2025: The Haowang Guarantee platform (formerly Huione Guarantee) announced on its official website that it would cease operations following its ban by Telegram.

Final Thoughts

HuionePay’s fund flow patterns, transaction frequency, and active address data on the TRON blockchain offer a valuable foundation for further understanding its on-chain behavior.

SlowMist’s AML solution MistTrack has long been monitoring such transaction patterns, aiming to provide robust and reliable on-chain risk control support and AML compliance tools for exchanges, enterprises, and regulators. We encourage all stakeholders to keep a close eye on these addresses and leverage on-chain analysis tools for continued monitoring, working together to build a more compliant and secure crypto ecosystem.

About SlowMist

SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.

SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.

By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.