← BLACKWIRE Articles

CIPHER Bureau - Investigations

The Empire Falls: Inside the Collapse of Cambodia's $24 Billion Scam Machine

Li Xiong extradited. Chen Zhi in custody. Xinbi sanctioned. The world's largest fraud syndicate is being torn apart - and what's left behind is worse than the crime itself.

By CIPHER Bureau | April 2, 2026 | 12 min read

Phnom Penh, Cambodia - the gleaming capital that sheltered the world's most prolific fraud network for years. Photo: Pexels

On April 1, 2026, a shaven-headed man in handcuffs was escorted off a China Southern Airlines flight at Beijing Capital International Airport. Chinese police flanked him on both sides. State broadcaster CCTV captured every step, broadcasting the footage within hours to a domestic audience of hundreds of millions.

The man was Li Xiong, 41 years old, a Chinese-born national who until recently held Cambodian citizenship and served as chairman of the Huione Group - one of the most consequential financial crime operations in modern history. His extradition from Phnom Penh to Beijing, requested by China's Ministry of Public Security after months of joint investigation with Cambodian authorities, marks the second major scalp in the systematic dismantling of a criminal empire that laundered at least $24 billion through cryptocurrency marketplaces, Telegram escrow services, and a network of fortified compounds where tens of thousands of trafficked workers were held as slaves.

Li is not the kingpin. That title belongs to Chen Zhi, founder of Prince Group, one of Cambodia's largest conglomerates, who was extradited to China in January 2026 after being indicted by US federal prosecutors for directing what Washington called "one of Asia's largest transnational criminal organizations." Li was, in the words of CCTV, "a core member of Chen Zhi's criminal gang" - the man who turned Huione Group into what the US Treasury's Financial Crimes Enforcement Network designated a "primary money-laundering concern," processing over $4 billion in traceable illicit transactions between August 2021 and January 2025 alone.

But the extraditions of Li and Chen are only two data points in a broader collapse that has been accelerating since late 2025 - a collapse that involves US sanctions, UK blacklists, the freezing of billions in cryptocurrency assets, the rescue of thousands of trafficking victims, and a frantic Cambodian government trying to distance itself from a criminal infrastructure that operated in plain sight for years, sometimes directly across the street from the prime minister's residence.

This is the story of how the empire fell. It is also the story of what it built while it stood.

BLACKWIRE infographic: Timeline of the enforcement cascade that dismantled the Prince Group-Huione network.

The Architecture of a $24 Billion Criminal Network

Cryptocurrency - the lubricant that made the entire system possible. Photo: Pexels

To understand why the Li Xiong extradition matters, you need to understand what Huione Group actually was - not the sanitized corporate entity registered in Phnom Penh, but the real machine underneath.

On paper, Huione Group looked like a respectable Southeast Asian financial services company. It operated an online banking arm, a cryptocurrency exchange, a payment processing service called Huione Pay, and an e-commerce marketplace called Huione Guarantee. Its offices sat in central Phnom Penh. Its directors included politically connected Cambodian figures, including Hun To, a relative of Cambodia's ruling family.

In practice, Huione Group was what FinCEN described as a "one-stop shop" for criminals. The operation worked like this: criminal organizations running pig butchering scams - elaborate fraud schemes where victims are "fattened" through fake romantic relationships or investment returns before being slaughtered for their savings - would funnel stolen cryptocurrency through Huione's exchange and payment services. The Huione Guarantee marketplace, operating primarily on Telegram, served as an escrow platform where scammers could purchase everything they needed: stolen personal databases, SIM cards, Starlink satellite internet proxies, fake identity documents, and laundering services that converted dirty cryptocurrency into clean fiat currency.

Between August 2021 and January 2025, FinCEN traced at least $4 billion flowing through Huione's systems. That figure, staggering as it is, represents only what blockchain forensics firms could definitively attribute. The actual volume was almost certainly far higher. Chainalysis, the blockchain analytics firm that worked with both US and UK authorities on the investigation, estimated that Huione Guarantee and its sister platforms processed transactions in the tens of billions.

The money didn't just come from romance scammers in Cambodia. FinCEN's investigation found that criminal actors affiliated with the North Korean government - specifically the Lazarus Group, Pyongyang's elite hacking unit - had "extensively used the Huione Group to launder" stolen cryptocurrency to fund North Korea's ballistic missile programs. FinCEN identified at least $37 million in direct flows from North Korean cyber heists through Huione, including proceeds from the 2023 WazirX exchange hack that saw $220 million stolen from Indian users. The money trail ran from stolen crypto wallets in India through Huione's Cambodian infrastructure and into accounts controlled by North Korean intelligence operatives - a sanctions violation of extraordinary scale.

But Huione was not an island. It was one node - perhaps the most important node - in an interconnected ecosystem of Telegram-based marketplaces that collectively processed a sum that defies easy comprehension.

The Xinbi Connection: $19.9 Billion in the Shadows

Telegram served as the backbone for crypto laundering marketplaces worth tens of billions. Photo: Pexels

On March 26, 2026 - just six days before Li Xiong was put on a plane to Beijing - the United Kingdom's Foreign, Commonwealth and Development Office announced sanctions against Xinbi Guarantee, a Chinese-language online marketplace that had grown to become the largest successor platform to Huione Guarantee after the latter was shut down by FinCEN's designation.

The UK's action was historic: the first time any nation had sanctioned a crypto marketplace under its Global Human Rights sanctions regime. And the numbers explained why. According to Chainalysis data provided to UK authorities, Xinbi Guarantee processed over $19.9 billion in transactions between 2021 and 2025. That is not a typo. Nineteen point nine billion dollars. Through a Telegram marketplace.

Xinbi operated as a peer-to-peer escrow service, essentially the same model as Huione Guarantee but with even broader reach. Vendors on Xinbi offered "Black U" money laundering - the conversion of tainted USDT (Tether stablecoins) into clean cryptocurrency or fiat - alongside unlicensed over-the-counter crypto trades, sales of compromised personal databases, and operational tools for scam compounds. Chainalysis found direct fund flows from pig butchering scams and forced-labor compounds to Xinbi wallet addresses. Vendors frequently cross-listed on Huione Guarantee, Tudou Guarantee, and other platforms, creating a web of interconnected criminal services that proved remarkably resilient to individual platform takedowns.

The UK sanctioned six individuals and four entities alongside Xinbi itself. Among them: Legend Innovation Co., the operator of #8 Park in Cambodia - described by UK officials as the region's largest scam compound, housing up to 20,000 trafficked workers coerced into online fraud under threats of torture. Director Eang Soklim and Thet Li, a Prince Group lieutenant, had their UK assets frozen, including London properties worth millions of pounds. This built on a prior seizure of a 100 million pound office block linked to the network.

FCDO Minister Stephen Doughty stated the rationale plainly: "Our sanctions send a clear message - We will not allow British people to become victims of these dreadful scams or tolerate the awful human rights abuses." Fraud Minister Lord Hanson added that the UK-backed INTERPOL Global Fraud Taskforce was coordinating the international response.

The sanctions worked almost immediately. Following the UK designation, Huione and its rebranded successor Haowang saw transaction volumes fall by nearly 100%, according to TRM Labs. Tudou Guarantee, another linked marketplace, declined by approximately 74% before shutting down entirely. Xinbi attempted to migrate to a standalone app called SafeW and launched its own payment platform, XinbiPay, but the sanctions effectively cut it off from the legitimate cryptocurrency ecosystem.

The Compounds: Where Money Met Human Trafficking

Fortified with barbed wire, high walls, and armed guards - Cambodia's scam compounds held tens of thousands as forced laborers. Photo: Pexels

The financial architecture was sophisticated. The human infrastructure beneath it was medieval.

US federal prosecutors, in their October 2025 indictment of Chen Zhi and Prince Group, described a system where trafficked workers - many of them Chinese, Vietnamese, Indonesian, and Filipino nationals lured by fake job advertisements promising legitimate work - were held in prison-like facilities surrounded by high walls and topped with barbed wire. Inside these compounds, workers were forced to conduct online scams for twelve to sixteen hours a day. Those who resisted were beaten. Those who tried to escape were sold to other compounds. Some disappeared entirely.

The UN Office on Drugs and Crime has documented that organized criminal gangs used casinos, hotels, and fortified compounds across Cambodia, Myanmar, Laos, and the Philippines as operational bases. Cambodia alone hosted dozens of such facilities, with tens of thousands of people working inside them - some willingly, drawn by the promise of high commissions, but many coerced through debt bondage and physical violence.

A February 2026 investigation by The New Humanitarian documented a humanitarian crisis unfolding in the wake of Chen Zhi's January arrest. Thousands of people began fleeing suspected scam sites across Cambodia, many of them foreign nationals with no documents, no money, and nowhere to go. Indonesian nationals who escaped from compounds camped outside their embassy in Phnom Penh with their belongings. Amnesty International spoke to 31 survivors in Cambodia, all recently escaped or released, estimating that thousands had left at least 17 compounds in the early weeks of 2026.

The International Justice Mission, which has worked on forced scamming cases across Southeast Asia, described the operational model: victims are recruited through job platforms, social media, or personal networks; transported across borders, sometimes with legitimate-looking documentation; delivered to compounds where their passports are confiscated; and then forced to work as online scammers, typically running pig butchering schemes targeting victims in the United States, Europe, China, and Japan. The scam proceeds flow upward through layers of management, eventually reaching the financial infrastructure - Huione, Xinbi, and their subsidiaries - where the money is laundered and distributed.

A 2022 ProPublica investigation had already revealed that a large compound in Sihanoukville, Cambodia's coastal gambling hub, stood diagonally across from then-Prime Minister Hun Sen's summer residence. The proximity was not a coincidence. It was a feature of a system where political patronage and criminal enterprise were, at minimum, geographic neighbors and, according to US prosecutors, significantly more intertwined than that.

The O-Smach Resort compound, in Cambodia's northern Oddar Meanchey Province, was designated by the US Treasury in 2024 after repeated rescue operations found victims subjected to forced labor, torture, enslavement, and human trafficking. Two compounds at the site were directly linked to deprivation of liberty, with interventions documented repeatedly between 2022 and 2024 - yet the operations continued for years before any definitive shutdown.

BLACKWIRE infographic: The money pipeline from scam compounds through Huione and Xinbi to North Korean weapons programs.

Chen Zhi: The Kingpin Who Advised the Prime Minister

Chen Zhi and Li Xiong both held Cambodian citizenship - until it was revoked. Photo: Pexels

Chen Zhi, born in China, arrived in Cambodia as a businessman and built Prince Group into one of the country's largest conglomerates. The group's portfolio was staggering in its breadth: real estate development, banking, insurance, telecommunications, media, and hospitality. Prince Holding Group Building stood as a landmark in central Phnom Penh. Chen's face appeared in photographs alongside Cambodia's most powerful political figures.

He served as an adviser to both Cambodian Prime Minister Hun Manet and his father, former Prime Minister Hun Sen - the strongman who ruled Cambodia for nearly four decades before handing power to his son in 2023. Chen had been granted Cambodian citizenship, a privilege typically reserved for individuals with deep ties to the ruling establishment. Photographs released by Prince Group itself showed Chen standing with Hun Sen at the Peace Palace in Phnom Penh as recently as April 2022.

When the US indictment came in October 2025, it alleged that Prince Group was not merely a legitimate business that happened to have criminal subsidiaries. Prosecutors described it as a front - "one of Asia's largest transnational criminal organizations" - with Chen directing the operations of forced labor compounds across Cambodia. The indictment alleged that Chen oversaw a network where Jin Bei, a casino company operating under the Prince Group umbrella, ran scam compounds where trafficked workers were held under duress.

The US and UK imposed sanctions on Chen and Prince Group simultaneously. The UK froze assets worth over one billion pounds globally. Cambodia's response was initially muted, then rapid. In January 2026, Cambodian authorities arrested Chen and extradited him to China. His Cambodian citizenship was revoked by royal decree. Phnom Penh then launched what it called a comprehensive crackdown, pledging to close all online scam centers by the end of April 2026.

Prime Minister Hun Manet told AFP in February 2026 that the government "did not know that he was the kingpin." He insisted that scam centers were destroying Cambodia's economy and reputation. Analysts were less charitable. The Guardian reported in March 2026 that the rise and fall of Prince Group illustrated how the Cambodian state had been "co-opted" by criminal enterprise - a characterization supported by the fact that scam compounds operated openly, sometimes for years, in close proximity to government buildings and with the apparent knowledge, if not active facilitation, of local authorities.

Chen's extradition to China rather than the United States - which had issued the indictment - was itself significant. Beijing has been pushing a narrative of joint Sino-Cambodian law enforcement cooperation, positioning itself as the primary actor in the regional crackdown. A spokesperson for China's foreign ministry declared that "combating online gambling and telecoms fraud is the shared responsibility of the global community" - diplomatic language for a situation where China, the US, and the UK are all competing for jurisdiction over the same criminal network.

The North Korea Thread: From Pig Butchering to Ballistic Missiles

North Korean hackers used crypto laundering services to convert stolen funds into missile program financing. Photo: Pexels

The most geopolitically explosive thread in this story is also the one least discussed in mainstream coverage: the direct pipeline from Cambodian scam infrastructure to North Korean weapons programs.

FinCEN's designation of Huione as a "primary money-laundering concern" in May 2025 specifically cited the group's role in laundering proceeds from cyber heists conducted by the North Korean government. The language was precise and damning: "Criminal actors affiliated with the North Korean government have extensively used the Huione Group to launder stolen cryptocurrency for the benefit of Pyongyang's ballistic missile programmes, in violation of US and international sanctions."

The sums involved were not theoretical. FinCEN documented at least $37 million in direct flows from North Korean cyber heists through Huione's systems. Blockchain analytics traced an additional $36 million from fraud proceeds. But the North Korea connection ran deeper than individual transactions.

Between June 2023 and February 2024, according to blockchain data reviewed by Reuters, Huione Pay received cryptocurrency worth over $150,000 from a digital wallet directly controlled by the Lazarus Group - North Korea's premier hacking outfit, responsible for some of the largest cryptocurrency thefts in history, including the $620 million Ronin Bridge hack in 2022 and the $1.4 billion Bybit exploit in February 2025.

A March 2026 analysis by 38 North, the Johns Hopkins University research program focused on North Korea, documented that a DPRK national closely connected with the Reconnaissance General Bureau - North Korea's military intelligence agency - had worked with Huione Pay between 2022 and 2024 to transfer digital assets and fiat currency. Separately, a Cambodia-based representative of the Saeng Pil Trading Company, a DPRK weapons trading entity subordinate to the RGB, controlled accounts containing partial proceeds from a Lazarus Group hack conducted in March 2022.

The implications are straightforward but terrifying. Money stolen from everyday cryptocurrency users - through pig butchering scams, exchange hacks, and investment fraud - flowed through Cambodian financial infrastructure and into accounts that funded North Korea's nuclear and ballistic missile development. The Huione-Prince Group network was not merely a criminal enterprise. It was, functionally, a sanctions evasion pipeline for a nuclear-armed state.

Chainalysis data provided to UK authorities in the Xinbi sanctions case revealed additional exposure: direct fund flows from the WazirX exchange hack - $220 million stolen from Indian users - to Xinbi wallet addresses, with connections to North Korean laundering infrastructure. The blockchain trails suggest that the Guarantee marketplace ecosystem served as a primary off-ramp for North Korean stolen funds across multiple major heists.

The Crackdown: Window Dressing or Genuine Dismantlement?

Cambodia's pledge to shut all scam compounds by end of April faces deep skepticism from analysts. Photo: Pexels

Cambodia has vowed to close all online scam centers by the end of April 2026. Prime Minister Hun Manet has made this pledge publicly and repeatedly. The law enforcement push following Chen Zhi's arrest has been, by Cambodian standards, dramatic: thousands of people have fled or been released from suspected scam sites. Authorities have raided facilities, revoked citizenships, and made visible gestures of cooperation with Chinese and international investigators.

Analysts remain skeptical. The word used most frequently in coverage of Cambodia's response is "window-dressing." The structural conditions that allowed the scam empire to flourish - weak rule of law, endemic corruption, limited judicial independence, and deep political patronage networks - have not changed. Cambodia's economy, particularly in the coastal city of Sihanoukville, became deeply dependent on Chinese investment that often blurred the line between legitimate business and criminal enterprise. The casinos, special economic zones, and real estate developments that provided cover for scam operations still exist. Many of the mid-level operators who managed individual compounds remain at large.

The humanitarian fallout has been severe. FactRefuge reported in March 2026 that the crackdown itself created a mass homelessness crisis, as thousands of foreign nationals freed from compounds found themselves stranded in Cambodia without documents, money, or consular support. Amnesty International documented that many freed workers were treated not as trafficking victims but as illegal immigrants, facing detention and deportation rather than assistance. The Indonesian embassy in Phnom Penh was overwhelmed by nationals who had escaped compounds and had nowhere else to turn.

The enforcement actions have also created a regulatory displacement problem. When Huione Guarantee was effectively killed by FinCEN's designation, activity migrated to Xinbi, Tudou, and other platforms. When the UK sanctioned Xinbi, volumes briefly collapsed - but Chainalysis researchers noted that the platform had already begun migrating to standalone apps, and new marketplaces were emerging in its wake. The demand side of the equation - victims willing to be scammed, criminals willing to run scams, and states willing to host them - has not been addressed by supply-side enforcement alone.

The broader Southeast Asian scam economy, estimated by the UNODC at tens of billions of dollars annually, extends well beyond Cambodia. Myanmar's Shan State, Laos's Golden Triangle Special Economic Zone, and compounds in the Philippines all remain operational. The Chen Zhi and Li Xiong extraditions removed the apex leadership of one network, but the infrastructure of forced-labor fraud is diffused across multiple countries and hundreds of individual operations.

What Comes Next: The Battle for Jurisdiction and Justice

The fight for jurisdiction - between Washington, Beijing, and Phnom Penh - is far from settled. Photo: Pexels

The extradition of Li Xiong to China rather than the United States - which holds the active indictment against Prince Group and its leadership - is part of a pattern that reveals as much about geopolitics as it does about criminal justice.

China has positioned itself as the lead enforcement actor in the Southeast Asian scam crackdown. Beijing's messaging has been consistent: this is a Chinese-led effort, conducted through bilateral cooperation with Cambodia, serving China's domestic interest in protecting Chinese citizens who are disproportionately victimized by pig butchering and online fraud schemes. The extraditions of Chen Zhi, Li Xiong, and associates Xu Ji Liang and Shao Ji Hui all went to China, not to the United States.

Washington, meanwhile, maintains its indictment and sanctions apparatus. The US has not publicly objected to China receiving the extraditions - the primary goal of disrupting the network is being achieved regardless of which country's courtroom processes the cases. But the jurisdictional dynamic creates a practical problem: Chinese legal proceedings are opaque, and there is no guarantee that the evidence gathered by US investigators will be presented or that the full scope of the criminal enterprise - including the North Korean connection - will be prosecuted.

The UK has carved out its own enforcement lane through the Global Human Rights sanctions regime, targeting the infrastructure layer rather than just individual actors. The Xinbi designation, the #8 Park sanctions, and the asset freezes on London properties demonstrate a strategy focused on choking the financial ecosystem rather than arresting its leaders. This approach, praised by blockchain analytics firms as "infrastructure-centric," is likely to be expanded at the UK's upcoming Illicit Finance Summit in June 2026.

For the trafficking victims, justice remains distant. The workers freed from compounds face an uncertain future. Many cannot return to their home countries without documentation. Others fear retaliation from criminal networks that maintain reach across borders. The legal frameworks in Cambodia, Myanmar, and Laos are ill-equipped to handle trafficking cases of this scale. International organizations have resources to assist hundreds of victims, not tens of thousands.

The cryptocurrency industry faces its own reckoning. The Huione-Xinbi-Tudou ecosystem existed because stablecoins - particularly USDT (Tether) - provided a frictionless, pseudonymous medium for moving billions across borders without touching the traditional banking system. Tether has cooperated with some law enforcement requests to freeze wallets, but the fundamental architecture of blockchain-based payments remains hospitable to criminal enterprise at scale. The 2026 National Risk Assessment published by the US Treasury in March explicitly identified crypto-facilitated laundering through Telegram marketplaces as a known methodology, putting exchanges on notice that failure to act constitutes willful blindness.

Chainalysis, Elliptic, and TRM Labs - the three dominant blockchain forensics firms - all played central roles in tracing the fund flows that enabled the sanctions and indictments. Their analyses demonstrated that blockchain's pseudonymity is not anonymity: with sufficient resources and expertise, every transaction can be traced. But the cat-and-mouse game continues. Criminal operators are already migrating to privacy coins, cross-chain bridges, and decentralized exchanges that are harder to monitor.

The Ledger: By The Numbers

The scale of the Prince Group-Huione-Xinbi criminal ecosystem, assembled from FinCEN filings, Chainalysis data, UK government sanctions documents, US indictments, and UNODC reporting:

• $4 billion+ - Illicit funds laundered through Huione Group alone (Aug 2021 - Jan 2025), per FinCEN
• $19.9 billion - Total transaction volume through Xinbi Guarantee (2021-2025), per Chainalysis
• $37 million - Documented North Korean cyber heist proceeds through Huione, per FinCEN
• $220 million - WazirX exchange hack proceeds traced to Xinbi addresses, per Chainalysis
• $1 billion+ - UK asset freezes related to Prince Group and associated entities
• 20,000+ - Estimated trafficked workers at #8 Park compound alone, per UK FCDO
• 17+ - Compounds from which workers fled in early 2026, per Amnesty International
• 4 - Senior figures extradited: Chen Zhi, Li Xiong, Xu Ji Liang, Shao Ji Hui
• 100% - Drop in Huione/Haowang transaction volumes post-sanctions, per TRM Labs

Combined, the Huione and Xinbi ecosystems alone account for over $24 billion in processed transactions. That figure does not include Tudou Guarantee, BSquare Technology, or the dozens of smaller platforms that fed the network. It does not include the value stolen directly from scam victims. It does not account for the human cost of tens of thousands of trafficking victims held in conditions that the UN describes as modern slavery.

The empire is falling. But the rubble will take years to clear.

CIPHER Bureau reports on corruption, financial crime, and hidden power structures. Sources: Reuters, AFP/Hong Kong Free Press, CNA, TechNadu, Chainalysis, FinCEN, UK FCDO, UNODC, Amnesty International, The New Humanitarian, 38 North, AML Network, ProPublica, Wired. All claims sourced inline.