How ICIJ traced Huione Group funds to major crypto exchanges

An increasing number of governments are starting to shift their investment policies to include digital assets. The largest centralized exchanges, key intermediaries in the cryptocurrency world, process trillions of dollars’ worth of trades every year. There are now hundreds of millions of addresses on some of the most widely used blockchains.

But while cryptocurrency is becoming embedded in the traditional finance system, it has also become central to industrial-scale scam operations, fraud and other crimes. For The Coin Laundry, the latest investigation by the International Consortium of Investigative Journalists with 37 media partners in 35 countries, ICIJ’s data team analyzed tens of thousands of crypto transactions to expose a shadow economy awash with billions of dollars in dirty money.

The craft of tracing illicit crypto flows along public blockchains has advanced significantly. Authorities and blockchain analysts can detect an increasing amount of illicit activity, and cryptocurrency firms can label or freeze addresses owned by criminals. But the sheer volume of transactional activity remains an enormous hurdle for investigators and compliance officers. With blockchain architecture growing more complex, transaction trails can be obfuscated through a range of innovations such as tumbling or mixing (where funds from various sources are commingled), swapping (where one cryptocurrency is automatically swapped for another without collecting user information) and chain-hopping (where the cryptocurrency changes blockchains).

This past April, ICIJ’s data team started talking about what kind of numbers the investigation would require to measure the scale of illicit activity in the crypto industry. Talking with analysts and academics, and reading reports from blockchain analytics firms, it quickly became clear that we’d have to set strict parameters. What kind of activity would we want to look at? What time period would we be reviewing? What was the real-world context for these transactions? And which crypto wallet addresses — the equivalent of bank accounts — would we choose as starting points to trace along the blockchains? We soon found the perfect vehicle to explore these questions in Huione Group.

Tracing is caring

Huione Group, a financial services conglomerate, lies at the nexus of identity theft, human trafficking, scam, fraud and money laundering. As many as 300,000 people are estimated to be working in scam compounds operating from Southeast Asia. On May 1, the U.S. Treasury Department’s anti-money laundering agency, known as FinCEN, singled out Huione Group as a money laundering “concern.” (It has since been severed from the U.S. financial system.) And where was Huione sending its crypto transactions? Centralized crypto exchanges (CEX), the main gatekeepers of crypto trades.

The data team decided to focus our analysis on Huione at one end of the transactions and on centralized exchanges at the other. Two major CEX had pleaded guilty in U.S. federal courts to operating without basic safeguards to prevent money laundering and paid sizable penalties: Binance, the world’s largest exchange, in November 2023 for $4.3 billion; and OKX (formerly known as OKEx), another big exchange, in February of this year for $504 million.

The team pulled numerous datasets from Arkham Intelligence and Tronscan, two free blockchain data sources that provide application programming interfaces (APIs), tools that would allow us to query the platforms’ data directly and at scale. We crafted a methodology using Arkham and Tronscan data that could be replicated by anyone using any tracing tool. Along with these main platforms, we tried other online tools such as Dune, Etherscan and Blockchain.com, and met with several industry experts.

The team used the Python programming language and queried the APIs using the requests library. We crafted scripts to extract data and then cleaned and stored it in PostgreSQL, a free and open-source relational database management system, which was managed using the Django web framework. Bigger datasets were imported directly into the database using the psycopg2 code library.

The Django database interface made it very easy to clean, query, label and export tidy data for the team to share in the Google Sheets spreadsheet application. We also used the Python pandas library to run basic statistics on various queries and then calculated the same statistics directly in Google Sheets.

With the help of experts in cryptocurrency, we sought to assign a total to Huione Group’s illicit activity, using methods that could be replicated. John Griffin, a crypto expert we interviewed, described the approach in one of his papers as designed “not to capture all flows, but to focus on capturing flows that are extremely likely to be controlled by a scammer.” And we think we succeeded.

Trailblazing data journalism

Huione Group has published its crypto addresses in Chinese-language quarterly financial reports. Some addresses listed there transact on the TRON blockchain in tether, a stablecoin whose value is pegged 1-to-1 with the U.S. dollar. Focusing on tether transactions also meant that the data team wouldn’t need to convert crypto values to U.S. dollars. (For more details, here are some answers to frequently asked questions from our investigation.)

We had understood from talking with experts that it was likely those Huione addresses were sending funds to major exchanges. We just needed to calculate the scale. The data team chose cutoff dates in July 2025 in order to look back at transactional activity up to that date. We planned to have a process that would analyze the addresses involved in two “hops.” We aimed to validate that funds were sent from Huione to customer accounts at exchanges, and make it an exercise others could later replicate.

The earliest activity we found for the Huione addresses we looked at was in July and August 2024. In the case of Binance, that gave us about a year of data to review because we were interested in activity after November 2023, when the exchange signed its plea deal with the U.S. Department of Justice. The transactions we examined began months after Binance pledged to improve its anti-money laundering systems. In the case of OKX, the time period we examined  was shorter: from Feb. 24 to July 22 of this year, which gave us nearly five months of potential transactional activity to analyze.

The data team first queried the Arkham API to get transactions sent in tether from those Huione addresses between July 13, 2024, and July 17, 2025. The destination of those funds, we found, were customer accounts at Binance, which were labeled “Binance Deposit” on Arkham. Using that label, we ended up with a universe of several thousand customer accounts. But to calculate exactly how much Huione had sent to Binance over a year, we then needed to check which of those customer accounts could be included in our count. So we moved from hop 1 (transfers from Huione to customer accounts) to hop 2.

In our hop 2 analysis, we assessed how funds moved from the deposit addresses to the large wallets, or “hot wallets,” that crypto exchanges use to pool and manage customer funds. In the case of the Binance analysis, we found that the deposit addresses sent funds to two Binance hot wallets; for OKX, we included the deposit addresses that sent funds to six wallets that were labeled as “OKX hot wallet” in Arkham Intelligence.  Even though the addresses were labeled as hot wallets by Arkham, we further confirmed they were held by the exchanges.

In the case of OKX, our second analysis, out of more than 32,000 deposit addresses that the data team looked at, we excluded dozens that upon further review hadn’t received funds from the Huione addresses we were analyzing. As an additional check, we examined the top counterparties of the OKX and Binance deposit addresses and verified that they mainly sent funds to the six OKX hot wallets and the two Binance hot wallets in the relevant time period.

The data team used a variety of sources to verify that the exchanges actually owned these wallet addresses. A key criterion: The pooled wallets received 99% or more of the funds sent from the deposit wallets. We then cross-checked the addresses’ ownership using Binance’s and OKX’s websites and so-called proof of reserves — datasets that exchanges routinely publish to show they have enough assets to cover customer deposits and accounts. Proof-of-reserves data sometimes includes the addresses that the exchanges own and use to collect clients’ funds. The hop 2 analysis enabled us to confirm how many deposit addresses to include to calculate the transactional activity from hop 1. Our team included in its final count 2,697 deposit addresses for the Binance analysis and 32,384 deposit addresses for the OKX analysis.

We went back to hop 1 and included those deposit addresses and limited the time period under review (July 13, 2024, to July 17, 2025, for Binance; Feb. 24 to July 22, 2025, for OKX). Our analysis of the transactional activity of just three wallet addresses used by Huione Group shows that customer accounts at Binance received at least $408 million in tether from Huione over a little more than a year, an average of $1 million in tether a day, while the company was under the supervision of court-appointed monitors. In the case of OKX customer accounts, they received at least $226 million in tether from Huione over five months — a bit less than $1 million a day.

Our team also calculated a smaller tranche of activity, after May 1, 2025 — when FinCEN labeled Huione Group a “primary money laundering concern.” We discovered that the transactional activity continued unabated in both cases: At least $77 million in tether was sent during that period to customer accounts at Binance, and at least $161 million in tether was sent to customer accounts at OKX.

What we don’t know

Experts told ICIJ that crypto exchanges cannot stop illicit funds from entering their platforms — something the exchanges told us themselves. The exchanges can, however, freeze them internally, flag the addresses, and report on this activity to their regulator through so-called suspicious activity reports. Centralized exchanges’ internal ledgers aren’t visible on blockchains. What happens once the Huione funds arrive in a Binance or OKX institutional wallet that manages customer funds is unknown, but it is unlikely that those were blocked or returned — at least on a scale that would have dampened the fund-flow pattern — since Huione kept sending an average of $1 million in tether a day. Neither exchange directly addressed ICIJ’s questions about the pattern of repeated deposits.

In response to questions about Huione Group transactions, Binance said it is an industry leader in identifying and reacting to suspicious deposits and works closely with global law enforcement.

“Users who transact with this service are subject to investigation by our compliance department, and appropriate action will be taken if any potential illicit activities are identified,” the firm said in a statement. The company stressed that crypto technology does not allow it to block deposits into its system. Binance declined to provide details in response to ICIJ’s questions about whether it froze funds or closed accounts related to the Huione fund flows.

OKX also told ICIJ that it invests heavily in compliance and said it “took proactive steps to restrict relevant accounts” even before the group was labeled a money laundering concern. OKX said it has been working with the U.S. government on the matter, sometimes initiating engagement.

Huione Group didn’t respond to ICIJ’s request for comment.

On Nov. 17, FinCEN’s final rule to formally sever Huione Group from the U.S. financial system  took effect. Banks and other financial institutions covered by this rule are now prohibited from opening or maintaining accounts for the group through correspondent banks outside the U.S.