The cryptocurrency company Tether has frozen more than 29 million of its stablecoins reportedly connected to a massive Cambodian online marketplace offering up services for so-called pig butchering scams. 

Researchers from Elliptic last week pulled back the curtain on Huione Guarantee, documenting how the online marketplace has become a critical ecosystem for cybercriminal operations in Southeast Asia. Merchants across thousands of instant messaging channels sell money laundering services, deepfake technology, stolen data and even equipment like shackles for restraining trafficked workers, with Huione acting as a guarantor for all transactions. Over three years, the researchers tracked $11 billion in transactions on the platform they believe to be connected to scams.

Most of those transactions are in the form of USDT, or Tether, a stablecoin pegged to the U.S. dollar that has increasingly been singled out as the currency of choice for cybercrime in Southeast Asia.

On Sunday, the blockchain analysis company Bitrace linked an address on the TRON platform, whose funds had been frozen the day before, to Huione Group, the conglomerate that owns Huione Guarantee. The wallet contained 29.62 million USDT coins.

— Bitrace (@Bitrace_team) July 14, 2024

A Tether spokesperson confirmed to Recorded Future News that the company had frozen the funds, which were “associated with activities allegedly linked to fraudulent and transnational criminal operations.”

“This action was initiated based on a direct request from law enforcement, underscoring our commitment to collaboration with authorities worldwide,” they said. According to Bitrace, immediately after the funds were frozen, Huione Group “once again activated a new business address,” and transferred 114,800 USDC stablecoins from the original TRON wallet.

Earlier this year, a United Nations Office on Drugs and Crime report on transnational crime in Southeast Asia called USDT the “preferred choice for regional cyber fraud operations and money launderers alike due to its stability and the ease, anonymity, and low fees of its transactions.”

Soon after, Tether announced it had “voluntarily” frozen USDT worth $225 million “linked to an international human trafficking syndicate in Southeast Asia responsible for a global ‘pig butchering’ romance scam.”

The scams typically involve a fraudster developing a relationship with a victim on social media, dating sites or messaging platforms and tricking them into making fraudulent investments. Often the people carrying out the scams have been trafficked into compounds by criminal groups, where they are forced to con victims worldwide.

Elliptic’s research into Huione Group has further exposed the industrial scale of cyber scamming in the region, which is often enabled by the ruling elite. According to researchers, a cousin of Cambodian Prime Minister Hun Manet is a director of Huione Pay, a payments and foreign exchange business. 

On Monday, Reuters reported that the North Korean hacking group Lazarus had sent $150,000 from one of its digital wallets to Huione Pay between June 2023 and February 2024. 

According to blockchain analysts cited by Reuters, the funds had likely been stolen from three crypto companies last year, including Atomic Wallet.