ICIJ Exposes $600M Crypto Laundering via Huione Group

The International Consortium of Investigative Journalists’ ‘Coin Laundry’ investigation has uncovered recurring illicit-flow patterns across cryptocurrency exchanges, brokers, and crypto-to-cash storefronts. Case files reveal that more than $600 million flowed from Cambodia’s Huione Group into customer accounts at Binance and OKX while both platforms were operating under U.S. enforcement actions and court-appointed monitors. These patterns reflect what investigators describe as ‘shared vulnerabilities and opportunistic networks’ that have formed around common infrastructure and mutual convenience.

The investigation highlights a growing technical gap between what blockchains record and what investigators or platforms can meaningfully process in real time. Transfers routed through anonymous wallets or ‘swappers’ make transaction tracing significantly slower and more resource-intensive, complicating efforts by exchanges and law enforcement to monitor suspicious activity. Former compliance staff at major platforms confirmed these challenges, telling ICIJ they could ‘hardly keep pace with savvy criminals’ exploiting these systemic weaknesses.

One of the most detailed cases involves Huione Group, a Cambodian financial institution designated as a ‘primary money laundering concern’ by the U.S. Treasury in May. Despite this official designation, ICIJ found that Huione continued routing significant volumes of Tether’s stablecoin USDT into customer accounts at Binance and OKX ‘largely unabated.’ Between July 2024 and July 2025, more than $408 million moved from Huione to Binance accounts, including approximately one million dollars per day during July 2025.

This period is particularly significant because Binance remained under two court-appointed monitors following its 2023 plea deal for anti-money-laundering violations. Simultaneously, at least $226 million flowed from Huione into OKX customer accounts between February and July 2025, after OKX had pleaded guilty in the U.S. to operating an unlicensed money transmitter. These substantial flows occurred despite both exchanges being under heightened regulatory scrutiny.

OKX pushed back on the implications of the ICIJ investigation, stating that it ‘welcomes scrutiny’ of how exchanges address illicit finance but rejects the characterization that crypto platforms function as havens for money laundering. A spokesperson told Decrypt that ‘where credible risks are detected, we act quickly, including pausing interactions, blocking transfers, and supporting criminal investigations.’ The exchange emphasized that the flows cited in the ICIJ reports ‘represent a very small fraction’ of overall activity on their platform.

KuCoin, another exchange named in ICIJ’s investigations concerning crypto-to-cash storefronts, shared a statement with Decrypt asserting that it ‘operates a rigorous and continuously evolving AML/CTF program’ aligned with global regulatory expectations. The findings arrive as global regulators continue imposing penalties on exchanges while struggling with uneven enforcement and limited cross-border coordination, creating persistent compliance gaps that illicit actors continue to exploit.

Ari Redbord, a former Treasury Department official and U.S. attorney now serving as global head of policy at blockchain intelligence firm TRM Labs, provided crucial context about the nature of these illicit flows. He told Decrypt that TRM’s research and data shows repeating behavioral patterns in how illicit funds move across services, often involving ‘certain intermediaries, OTC brokers, or cross-chain services.’ Redbord explained that ‘these patterns often reflect common laundering typologies rather than fixed or standardized routing templates.’

According to Redbord, illicit actors frequently exploit the same weak compliance points or high-risk service providers, making flows appear structurally similar even when they’re not centrally coordinated. TRM’s analysis supports the view that laundering activity is networked rather than isolated, with illicit actors and facilitators interacting through ‘overlapping transactional relationships that cross jurisdictions and asset types.’ Some groups, including pig-butchering operations, cartel-linked brokers, and North Korean actors, show more ‘sustained coordination,’ while most others form ‘opportunistic linkages’ built around ‘shared infrastructure or mutual convenience.’

Redbord concluded that ‘the recurring patterns we see are best understood as emergent behavior within an adaptive ecosystem—not a coherent operational structure.’ This characterization helps explain why despite regulatory actions and compliance efforts, illicit networks continue to find ways to move substantial sums through the cryptocurrency ecosystem, adapting to enforcement pressures while exploiting persistent systemic vulnerabilities.