Stablecoins and OTC brokers

As of August 2026: FinCEN's Huione rule took effect November 17, 2025; in June 2026 DOJ announced seizure of Huione backend infrastructure and FinCEN proposed extending the rule to H-Pay Service PLC. Chen Zhi remains a fugitive and the $15 billion forfeiture case is pending.

Also called: USDT laundering · guarantee marketplaces.

What are stablecoins and OTC brokers in money laundering?

The biggest change in criminal finance over the past decade is not a new crime; it is a new rail. Dollar-pegged stablecoins, above all Tether’s USDT running on the Tron blockchain, have become the default way large criminal economies move value: fast, cheap, denominated in dollars, and available to anyone with a phone. TRM Labs’ analysis of 2024 found Tron hosting roughly 58% of all illicit crypto volume, with USDT the dominant stablecoin for illicit flows, a share that fell sharply in 2025 as enforcement bit, but that made “USDT on Tron” a synonym for the criminal dollar for several years.

Stablecoins solve the launderer’s volatility problem (a token pegged to the dollar doesn’t lose a third of its value mid-scheme the way bitcoin can), but they don’t, by themselves, produce spendable money. That is the job of the other half of this technique: over-the-counter (OTC) brokers who trade crypto for cash outside any regulated exchange, and guarantee marketplaces (escrowed, Telegram-based bazaars, run at industrial scale from Southeast Asia) where laundering itself is the product for sale. The largest, Cambodia’s Huione Guarantee (later renamed Haowang Guarantee), sat inside a conglomerate that FinCEN says laundered at least $4 billion in illicit proceeds between August 2021 and January 2025, including North Korean heist funds and the revenue of “pig-butchering” investment scams.

Together the pieces form a complete pipeline: scam or hack proceeds become USDT, USDT moves at internet speed through layering hops, and a broker somewhere converts it into cash, goods, or bank balances that carry no crypto history at all.

How does the stablecoin-to-cash pipeline work?

1. Proceeds arrive as crypto. A pig-butchering victim wires money to a mule account or buys crypto directly and sends it to the scammers; a hacker’s haul is swapped toward stablecoins. Fraud proceeds were never cash, so this doubles as placement: the money’s first entry into a financial system.
2. Consolidate into USDT on Tron. Victim deposits from many sources converge through layers of wallets into large stablecoin positions. Speed matters: the tokens are freezable, so they are split and moved before issuers or exchanges can react.
3. List through a guarantee marketplace. The syndicate’s finance team finds a counterparty through an escrowed marketplace: vendors openly advertising cash-out, currency exchange, and laundering services, with the platform holding deposits and arbitrating disputes so criminals can safely trade with criminals they’ve never met.
4. The OTC broker converts. A broker takes the USDT and delivers value in whatever form the client needs (local cash, bank transfers through controlled accounts, or goods), settling off-chain, off-exchange, and outside any KYC regime.
5. Clean value returns. What comes back has no on-chain link to the victims. From here it behaves like any laundered money: real estate, businesses, luxury goods.

Why do stablecoins and OTC brokers work?

The rail is genuinely better than what it replaced. Hawala-style value transfer required trusted networks built over generations; a guarantee marketplace manufactures that trust with escrow, letting strangers transact at scale: the same problem hawala and the Black Market Peso Exchange solved socially, now solved with software. Settlement is global and instant. Value is dollar-stable. And the conversion points, the OTC brokers, sit in jurisdictions where enforcement is weak, corrupt, or, as US prosecutors allege of Cambodia’s Prince Group, where the criminal enterprise has cultivated official protection.

There is also a scale mismatch. The scam-compound economy of Southeast Asia industrialized online fraud: thousands of workers, many themselves trafficked and forced to scam, generating billions in victim deposits annually. That volume needs a laundering infrastructure of matching industrial capacity, and marketplaces like Huione Guarantee supplied it as a service: any vendor, any syndicate, one escrow.

The structural weakness is unusual for a laundering technique: the rail has an owner. Unlike bitcoin, USDT is issued by a company that can freeze any address at the contract level. Every dollar of illicit value held in USDT is one court order (or one issuer decision) away from being stranded. Criminal networks accept that risk because speed usually wins, but it hands defenders a kill switch no other channel offers.

Huione and Prince Group: cutting off the biggest laundromat

In May 2025, FinCEN made a rare move: it named Cambodia-based Huione Group a financial institution of “primary money laundering concern” under Section 311 of the USA PATRIOT Act: the designation reserved for institutions so compromised they must be cut off from the US financial system entirely. FinCEN’s finding said Huione’s ecosystem (the Haowang Guarantee marketplace, Huione Pay, and Huione Crypto) had laundered at least $4 billion between August 2021 and January 2025, including proceeds of North Korean heists and pig-butchering scams. The final rule, published October 16, 2025 and effective November 17, 2025, banned US financial institutions from maintaining correspondent accounts for Huione, severing its access to dollars.

Then came the sharper strike. On October 14, 2025, prosecutors in the Eastern District of New York unsealed an indictment against Chen Zhi, founder and chairman of Cambodia’s Prince Holding Group, charging wire fraud and money laundering conspiracies built on forced-labor scam compounds: facilities where trafficked workers were compelled to run pig-butchering scripts against victims worldwide. Alongside the indictment, DOJ filed a civil forfeiture action against 127,271 bitcoin valued at more than $15 billion: the largest forfeiture action in US history. The same day, OFAC and the UK sanctioned 146 individuals and entities in the Prince network, the largest such action ever taken against Southeast Asian cyber-scam operations.

As of August 2026, the bitcoin sits in US custody and Chen Zhi does not: he remains a fugitive. The pressure has continued around him: OFAC added 9 individuals and 26 entities to the Prince designations in June 2026, and in the same month DOJ announced the seizure of backend infrastructure Huione used for its laundering services, while FinCEN moved to extend the Section 311 rule to H-Pay Service PLC, a successor vehicle. The pattern is the lesson: designate the institution, indict the owner, seize the treasury, then chase the rebrands.

How stablecoin laundering gets caught

The issuer’s kill switch. Because USDT can be frozen at the contract level, the fastest enforcement tool in crypto is a message to Tether. The T3 Financial Crime Unit (Tether, TRON, and TRM Labs, launched in September 2024) formalized this: TRM traces, TRON provides network visibility, and Tether freezes, within about 24 hours of a law-enforcement request. T3 passed $100 million frozen by January 2025 and more than $450 million by May 2026, across 23 jurisdictions; Tether’s lifetime freezes are reported in the range of $3.3 billion to over $4.4 billion. The detection race is now measured in hours: funds that linger in USDT get caught, which is why sophisticated launderers treat stablecoins as an edge asset and do their mid-route hops elsewhere.

Naming the institutions. Section 311 designations, OFAC sanctions on brokers and marketplaces, and correspondent-banking cutoffs attack the conversion layer rather than the tokens. Once Huione was designated, every bank and VASP in the dollar system became obligated to treat exposure to it, however indirect, as reportable risk.

Analytics at industrial scale. Guarantee marketplaces run on-chain, which means their escrow wallets, vendor clusters, and settlement patterns are mappable. Elliptic’s and TRM’s tracking of Huione Guarantee turned a Telegram bazaar into a labeled dataset; exposure to those clusters now trips alarms at exchanges worldwide, and the same tracing underpinned the $15 billion Prince Group forfeiture.

The fiat edge. Cash settled by an OTC broker still has to enter a bank somewhere, and there it meets the classic toolkit: money mules, funnel accounts, and structuring patterns that AML systems have hunted for forty years. The rail is new; the choke points at either end are not.

First published August 28, 2026 · Last updated August 28, 2026 · Legal statuses current as of August 2026