In part 1 of our mid-year crime update, we discussed trends related to ransomware and stolen funds. While aggregate illicit on-chain activity declined by nearly 20% year-to-date (YTD), inflows from stolen funds nearly doubled, and annual ransomware payments are on track to be the largest ever in a single year.
Next, we’ll examine the latest trends in crypto scams. On- and off-chain activity shows that scammers are adapting their tactics and conducting shorter, but more lucrative and regenerative campaigns. We’ll discuss a notable scam syndicate — the highest grossing of 2024 so far — that highlights the move away from elaborate ponzi schemes toward more targeted campaigns like pig butchering in recent years.
“Pig butchering scams” are referred to as such for the way bad actors say they “fatten up” their victims to extract the most possible value. This usually involves building a romantic relationship over time with the victim via text message or dating apps until they push them to send money to a fake investment opportunity. In a dark twist, the scammers on the other end of those conversations are often individuals that have been kidnapped, trafficked to Southeast Asia, and forced to work in labor camps housed within large compounds to carry out pig butchering scams.
One remarkable feature of the 2024 scam landscape is how much of the total YTD scam inflows have gone to wallets that became active this year, suggesting a surge in new scams. Notably, 43% of YTD scam inflows have gone to wallets that became active this year. This trend is significant as the next highest year, 2022, saw just 29.9% of total YTD flows go to wallets that became active that year.
Huione Guarantee: The $49 Billion Online Marketplace
Huione Guarantee, an online marketplace tied to the Cambodian conglomerate, Huione Group, has recently been exposed as a significant player in facilitating cybercrimes. Our coverage of the service is much larger than previously reported — we identified that the platform has processed more than $49 billion in cryptocurrency transactions since 2021.
Historically, Huione Group has offered legitimate services, operating as a remittance system for overseas transfers, and providing insurance services. At one point, the company also dabbled in the luxury tourism business. However, its platform, Huione Guarantee, appears heavily used for illicit crypto-based activities, including pig butchering, investment fraud, and money laundering. Huione Guarantee has grown into a large and diverse ecosystem that supports the lucrative pig butchering operations that continue to operate in Southeast Asia.
Huione Guarantee operates as a peer-to-peer (P2P) marketplace that connects buyers and sellers, typically by providing Telegram handles of the contact points, thus facilitating these transactions. In total, there are thousands of Telegram groups advertising or posting communications on Huione Guarantee, each run by different independent merchants or affiliates, many of whom likely have ties to criminal enterprises operating within the region.
On-chain analysis reveals that Huione Pay was active on Ethereum, with more than $1.9 billion in total inflows, and on TRON, with more than $47 billion in inflows. The P2P network that Huione appears to support off-chain also maps on-chain; Huione has received and sent funds to all types of counterparties, including scams, addresses reported as stolen funds, the OFAC-sanctioned Russian exchange Garantex, fraud shops, CSAM, Chinese language gambling sites and casinos, and more.