A major investigative report is shining a seriously unfavorable light on the role that digital assets play in helping ‘pig butchering’ scammers launder their ill-gotten gains.
On November 17, the International Consortium of Investigative Journalists (ICIJ) released a deep-dive called ‘The Coin Laundry,’ an examination of “how the crypto boom minted a shadow economy that thrives on crime—and left a trail of devastated victims.”
The investigation was conducted over a 10-month span by more than 100 journalists from 37 news organizations in 35 countries. These journalists analyzed “tens of thousands of cryptocurrency transactions to expose the global financial flows behind money laundering networks, cyber heists and other criminal enterprises.”
The investigation is broken down into several parts, but we’ll focus mainly on the one involving Huione Guarantee, the Cambodia-based, Chinese-language digital marketplace that was flagged last year as a hub for criminal organizations engaged in pig butchering scams. (Huione rebranded as Haowang Guarantee following its unwelcome media spotlight.)
Huione/Haowang Guarantee has been linked to the larger Huione Group, a conglomerate that includes legitimate operations, such as the Huione Pay payments platform. Huione Group has denied these ties, although an offshoot of Huione Pay (Huione International Payments) has also helped facilitate the laundering of funds stolen from pig butchering victims.
In May, the U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) flagged Huione Group as “a financial institution of primary money laundering concern” and proposed severing Huione Group’s access to the U.S. financial system.
FinCEN followed through on this proposal last month, citing Huione’s role as “a critical node for laundering proceeds of cyber heists carried out by the Democratic People’s Republic of Korea and for transnational criminal organizations in Southeast Asia perpetrating virtual currency investment scams.”
This new rule barring U.S. financial institutions from opening or maintaining a correspondent account for or on behalf of Huione Group took effect on November 17 (coincidentally or not, the same day the ICIJ released its findings).
The ICIJ’s probe focused on pig butchering scammers’ use of digital asset exchanges—including Binance and OKX—to launder their ill-gotten gains.
Binance reached a $4.3 billion settlement with the U.S. Department of Justice (DoJ) in 2023 for violating U.S. anti-money laundering (AML) laws. As part of that settlement, Binance was required to onboard transaction monitors from both FinCEN and the DoJ to ensure the exchange was complying with the law.
But after those monitors were in place, the ICIJ’s analysis shows that “at least $408 million worth of digital currency flowed to Binance accounts from Huione Group” between July 2024 and July 2025.
A Binance spokesperson told the ICIJ that “users who transact with this service are subject to investigation by our compliance department, and appropriate action will be taken if any potential illicit activities are identified.”
However, the spokesperson declined to answer whether Binance had frozen any funds/accounts linked to Huione fund flows. The court-appointed monitors didn’t respond to the ICIJ’s requests for comment.
OKX, which reached a $504 million settlement with the DoJ in February for operating an illegal money transmitting business, was similarly encumbered with transaction oversight by a ‘compliance consultant.’ But the ICIJ reports that “customer accounts at OKX continued to receive hundreds of millions of dollars from Huione, including more than $161 million after” FinCEN slapped Huione with its ‘primary money laundering concern’ tag in May.
OKX told the ICIJ that it “took proactive steps to restrict relevant accounts” before Huione was flagged by FinCEN and that the exchange was working with U.S. authorities on this matter.
For what it’s worth, the ICIJ’s report came just days after the DoJ, Federal Bureau of Investigation (FBI), and U.S. Secret Service announced the formation of a new joint Scam Center Strike Force “to secure America against Southeast Asian cryptocurrency-related fraud and scams.”
Drug money, North Korea, Russia, Russia, Russia
The USDT (Tether) stablecoin plays a key role in Huione’s facilitation of crypto money laundering, as previous reports found USDT accounted for 84% of pig butchering transaction volume. The ICIJ found that Huione “funneled an average of $1 million worth of [USDT] per day to customer accounts at Binance,” with that pace continuing “largely unabated” after FinCEN tagged Huione with the ‘primary concern’ designation.
Another ICIJ finding was that “a Binance-hosted address Treasury has attributed to a money launderer for Mexico’s violent Sinaloa drug cartel received nearly all its funding—more than $700,000—from accounts at” the U.S.-based Coinbase (NASDAQ: COIN) exchange.
Binance didn’t respond to the ICIJ’s questions re this address. Coinbase claimed it was aware of the cartel-linked transactions and “through communications with the U.S. government, it resulted in the wallet address being sanctioned.”
OKX was asked about funds flowing into its exchange from “a notorious ring of Chinese traffickers of fentanyl and other drugs.” OKX said it had “proactively worked with law enforcement on this matter, and was privately thanked for our efforts.”
The ICIJ also flagged the HTX (formerly Huobi) exchange for hosting an account belonging to “a Russian money launderer specializing in moving cryptocurrency for North Korea’s weapons program.” HTX, which is 90% owned by Tron founder Justin Sun, didn’t respond to the ICIJ’s queries.
The U.S.-based Kraken exchange was cited in connection with Operation Destabilize, a U.K.-led action targeting Russian money laundering groups TGR and Smart. TGR principal Elena Chirkinyan used a Kraken account to help “arrange bulk exchanges of cryptocurrency and standard currency” on behalf of “a variety of organized crime groups,” including the Irish cartel Kinahan, which Interpol has linked to at least 20 killings. The Russian networks also assisted ransomware groups and “Russian espionage operations.”
A Kraken spokesperson told the ICIJ that the exchange “continuously monitors individuals, groups, and entities subject to sanctions to ensure full compliance with applicable laws.” The spokesperson added that Kraken cooperates “with law enforcement authorities globally,” including on the TGR-linked wallet in question.
Back to the top ↑
Compliance an afterthought?
The ICIJ quoted a blockchain investigator saying exchanges lack “the same level of rigor” that traditional financial institutions apply when it comes to screening for suspicious transactions. Several former employees said exchanges view compliance as a pure expense and are unwilling to devote sufficient resources to tackle the problem.
A former Coinbase employee was quoted saying transaction volumes flowing through exchanges “are insane.” The ratio of the number of transactions to the number of staff tasked with monitoring those transactions is “100% unbalanced.”
When internal systems at OKX flagged certain transactions as suspicious, a former AML analyst at the exchange said staff were expected to process each alert within a few minutes. The analyst noted that “for crypto, the customers are abundant, so they want quantity over quality, and the agents make a lot of mistakes.”
An ex-Binance staffer said the exchange didn’t provide compliance teams with enough customer account information, including home addresses. The net result was accounts suspected of being linked to criminal activity remained active.
The ICIJ cited a case in which a Minnesota resident lost over $1 million to scammers using Binance. One of the customer accounts Binance shared with Minnesota law enforcement showed the customer had moved over $7 million in USDT in a few months, despite listing their address as a rural Chinese village.
Another Binance account that listed its address as a rural village in Myanmar, where most people cook meals over open fires, handled $2 million in USDT in nine months, 1000x the country’s average annual salary. Neither of these accounts contained information on the customers’ source-of-funds.
Back to the top ↑
Crypto-to-cash desks/couriers
The ICIJ published a separate report ;on ‘crypto-to-cash’ desks, aka retail outlets that allow individuals to send, receive, and exchange cash and tokens (mostly USDT) with little to no customer screening.
While some of the services these companies provide are legitimate, like sending/receiving remittances from foreign workers, their inattention to minor details like customer identity makes them attractive avenues for scammers and money launderers.
The ICIJ’s analysis of wallets from over a dozen cash desks found that “customer accounts at major exchanges, including Binance, Bybit and OKX, are significant senders of large-dollar amounts to these operations that often asked for no client identification.”
In Ukraine, the ICIJ spoke to an individual working in conjunction with local police to sniff out Russian operatives, some of whom are engaged in sabotage efforts, who are funded via tokens. A New York prosecutor added that Ukrainian crypto-to-cash services are often used as endpoints for cash stolen from Russian-speaking Americans.
Canada’s public broadcaster CBC published its own report addressing similar operations in some of Canada’s largest cities. Teaming up with the Toronto Star and the La Presse agency, an undercover journalist wearing a hidden camera was able to collect US$1,900 in USDT just by showing the teller a $5 bill, the serial numbers of which matched those sent to the Ukraine-based 0001k. exchange via Telegram message along with $2,000 in USDT a few hours earlier.
The unspecified storefront, which holds a Canadian money service business license, broke the law by processing a crypto transfer over CDN$1,000 to a customer whose identity hadn’t been verified. Contacted after the transaction, the business claimed a ‘rogue manager’ was responsible, while the manager claimed the cash he handed out was his own and “earned legally.”
A La Presse reporter was told by 0001k representatives that they could collect up to $1,000,000 from locations in Montreal after sending USDT to the exchange’s crypto wallet. No identification was sought from the reporter inquiring about the limits.
The ICIJ also flagged crypto-to-cash courier services that use messaging apps like Telegram. Customers can receive cash for their tokens without having to leave the comfort of their homes while retaining relative anonymity.
One ICIJ staffer set up an anonymous Telegram account to deal with two different courier services that offered cash drop-offs in major U.S. cities. One of these services, 60Sek, has been linked to Russia’s financial system by blockchain analysts Chainalysis.
0001k offers deliveries to cities in the U.S. and Canada, despite not having the required money transmitting licenses. Chainalysis estimates 0001k has received over $14.8 billion in crypto transfers since August 2022.
Back to the top ↑
60 Minutes not letting up on Trump’s pardon of CZ
The fallout from the ICIJ report will be interesting, given that Binance is seeking to convince the U.S. Treasury to recall its transaction monitors, despite the 2023 settlement giving them the authority to oversee Binance’s AML compliance for five years.
In April, the Wall Street Journal reported that Binance execs had met with Treasury officials to see if they might ‘remove the monitorship or reduce its duration and scope.’ The Journal claimed Binance staff were said to be ‘discussing changes to its anti-money-laundering controls that were viewed by some employees as an effort to loosen its checks on riskier customers.’
That same month, the DoJ’s Binance monitor was told to stand down when the department paused its corporate monitorships as part of an ‘informal review’ of its activities.
The ICIJ’s report came just one day after 60 Minutes ran a segment on President Trump’s controversial pardon of Binance founder Changpeng ‘CZ’ Zhao, who spent four months in a U.S. prison after pleading guilty to violating the Bank Secrecy Act as part of Binance’s 2023 settlement. Trump defended the pardon in a previous 60 Minutes interview, although he claimed not to know who CZ was.
Sunday’s 60 Minutes episode focused on the intersection of CZ, Binance, and the Trump-linked decentralized finance (DeFi) platform World Liberty Financial (WLF). There’s been considerable speculation about a $2 billion stake that a UAE government-run investment fund took in Binance this summer, and the fact that the deal was conducted not in cash but in the USD1 stablecoin, from which WLF stands to benefit by up to $80 million in annual interest on the U.S. Treasury bills backing USD1.
While acknowledging that there was no confirmed quid pro quo in this $2 billion deal, 60 Minutes was nonetheless able to find many academics and former government figures casting a critical eye on the deal and CZ’s pardon that followed not long after.
Last week, CZ gave an interview to Fox News in which he was asked if Binance’s ties to WLF are the reason he got a pardon. CZ called this claim “categorically false information.” CZ also said he doesn’t have “any business relationship with any of the sons of President Trump” and there are “no business relationships between me and Binance and [WLF].”
WLF’s attorneys told 60 Minutes that the company “has never contacted the president” about CZ and WLF “did not play a role” in CZ’s pardon.
A new wrinkle opened on this front over the weekend, as CZ was asked on X whether Binance would seek a refund of the $4.3 billion penalty it paid in 2023 now that CZ has been pardoned. In his reply, CZ called this a “delicate question,” citing his appreciation of his pardon, and the need for “a balance in asking for more vs ‘what is fair’ vs appreciate what you got already.”
However, CZ then said that if Binance were to get its billions back, “we will be investing that in America anyway, to show our appreciation.” CZ added that Binance “haven’t asked [for a refund] yet, I think,” adding a two-hands prayer emoji.
Back to the top ↑
Watch: Bringing the Metanet to life with Teranode