The Money Was Already Gone

The case

The screen said $2,685,315. That was the balance a man in Pennsylvania saw on 20 May 2025 on the trading platform a stranger had given him, according to a federal forfeiture complaint filed in Pittsburgh in January 2026. That same day, when he tried to move part of it to a wallet he controlled, the platform asked for a “withdrawal fee in the amount of $232,000.”

He paid it, prosecutors say, and still could not withdraw. Then the platform’s “customer service” told him his account had been flagged for insider trading and that he “owed an additional fee of $320,000.” He paid part of that and ran out of money. Prosecutors put his loss at about $585,000 — more than half a million dollars.

By then the money he had deposited in May had been gone for weeks. This article follows it. Not the fee — the case’s tracing follows his big deposit — from his account to a private wallet, to a pool of other victims’ money, and then, using two federal affidavits and a run of Treasury actions, to the markets where money like it is laundered and comes out the other side as what those markets call “white funds.”

Nothing here is a conviction. The Pennsylvania case is a civil forfeiture complaint against the coins, not a criminal charge against a person, and it is still open. The findings about Huione Group are regulatory findings; the conduct of the marketplaces is what prosecutors and agents allege. No victim, defendant or official is named.

How did the scam start?

With a text meant for someone else. In February 2025, the complaint says, a message arrived from an unknown number about going to a grandmother’s party. He replied that they had the wrong number. They kept talking. After a few days the conversation moved to an encrypted messaging app, and the woman on the other end gave him a website: a trading platform, she said, where his account would live.

That opening is the one the Treasury’s financial crimes bureau described in its 2023 alert on pig butchering: contact “usually under the guise of accidentally reaching a wrong number.” The complaint lists what the victims it identified had in common, among other things: a misdirected text, a move to an encrypted messaging platform, a fraudulent domain showing bogus profits, an inability to withdraw, and demands for taxes, fines or other amounts before any money could come back.

In April 2025 he sent about $25,000. On 10 May he sent about $242,000. The platform’s balance climbed to about ten times what he had put in. On a screen.

Where does pig butchering money go?

Here is the route, in four stops. The man’s own money covers the first two; federal affidavits about two Telegram markets describe the last two. Nothing in his case ties his money to those markets — the route is a map of how the system works, not a claim about where his coins ended.

1. The account — the victim’s money leaves for a private address, and moves again within the hour.
2. The pool — it is swapped, layered and combined with other victims’ money in one address.
3. The market — a “guarantee” marketplace where criminals buy laundering from each other with escrow.
4. White funds — money that comes out the other side, sold as clean.

Stop one: out within the hour

On 10 May 2025, the complaint says, he sent about 242,209 USDC — a dollar-pegged stablecoin — from his account at a U.S. exchange to an address the scammer provided. It was a private address, not one hosted at an exchange. Then the clock: “Less than one hour later, 230,000 USDC of those funds were transferred” to another address.

So on 20 May, when his screen showed $2.69 million, the deposit had been gone for ten days. The complaint explains what the platform was for: domains like it give victims the illusion that their investments are growing, while the money has already been taken.

The Xinbi affidavit describes this first step in general terms. Its co-affiants — a Secret Service agent and an FBI agent — call it placement: “Criminals use non-custodial, or “private” wallets to initially receive victim funds.” Such wallets, they write, cannot be attributed to anyone by blockchain analysis alone, are simple to create and can take large amounts without extra scrutiny.

Stop two: the pool

From there, prosecutors say, his funds were laundered through a chain of other addresses and converted into a different cryptocurrency. At one point, the complaint says, “650,000 USDC of fraudulent funds was converted into approximately 649,669 USDT” — one dollar-pegged coin into another — and the combined money of several victims moved together.

The chain ended at a single address. “Of that, 5,000,000 USDT was deposited into the address in the span of one week,” the complaint says. When investigators traced the rest of what was in it, working backwards to exchanges that answer U.S. legal process, they found money from at least 19 other victims across the United States. Counting him, prosecutors say, the 20 lost about $18.52 million — far more than the address held.

And one more source. The address, the complaint says, “contained 991,000 USDT from Huione Pay.” Huione Pay is a payment company in Cambodia, part of Huione Group. Where did those coins come from? “Records are unable to be obtained from Huione Pay to identify the source of these funds,” the complaint says. And “cryptocurrency tracing did not identify any legitimate sources of income” in the address.

That is what a pool looks like in a court record: twenty people’s losses and a payment company’s coins in one place, and no legitimate source of income found.

What happened to it. Under a seizure warrant, the stablecoin’s issuer, Tether, “burned the 5,680,000 USDT” and reissued them to the government. That is not the end of the case. The government’s claim to the coins has not been decided: in June 2026 a lawyer asked to appear in the case from outside the district, and on 29 September 2026, according to the court docket, the judge entered an “Order Referring Case to Mediation.” The forfeiture is not final, and nothing in the record says any victim has been paid.

What is a guarantee marketplace?

The third stop is not a wallet. It is a business, and it exists because of a problem criminals have with each other.

The Xinbi affidavit, filed in Washington in September 2026, cites reporting on stories of money launderers “running away with the money.” The fix is a middleman. “These guarantee networks eliminate the risk of the other criminal group simply stealing the money sent to them,” the agents write. Merchants post a security deposit; clients pay; the market holds the money until the job is done.

The Justice Department put it in one sentence when it announced action against Xinbi Guarantee in September: “Xinbi as an organization holds money to be paid to the vendor until the vendors services are complete, to assure the scammers that the vendors will perform the services.” Escrow, for criminals. When Xinbi guarantees a deal, the agents write, it takes “a commission, often 3%, of each transaction processed through Xinbi.”

What was Huione Guarantee?

One of those markets carried the Huione name. On 23 June 2026, the Justice Department announced the seizure of a cloud computing account used by subsidiaries of Huione Group, “a Cambodia-based corporate conglomerate.” According to court documents, it says, the account was used to help operate Huione Guarantee, also known as Haowang Guarantee — renamed in late 2024.

The department alleges that Huione Guarantee operated Telegram channels with discussions of stolen credit card and identity information, “the procurement of individuals for human trafficking schemes,” and “assistance with laundering the proceeds of romance and investment scams,” and that it “also provided escrow services for criminals transacting on its platforms.” The Treasury’s financial crimes bureau, FinCEN, assessed that it dealt in illicit goods and services “in a manner similar to a darknet market but on the open internet.” The same day, the Treasury said the FBI’s San Francisco field office “seized infrastructure used by Huione Group to scam Americans.”

The Treasury adds a link to a group this channel has covered before: Huione was “used by the Prince Group to transfer and consolidate scam-derived assets.” Transfer and consolidate — the same shape as the Pennsylvania pool. But nothing in the Pennsylvania case ties that address to the Prince Group, and the complaint does not say who controlled it.

How much money did Huione receive?

The number most often repeated is four billion dollars, and the wording matters. In its October 2025 final rule cutting Huione Group off from U.S. correspondent banking — the step our earlier piece on how scam networks hide money describes as a bank cut off from the dollar — FinCEN found that “Huione Group has received at least USD 4 billion worth of illicit proceeds, between August 2021 and January 2025.”

Received. It is a regulatory finding under Section 311 of the USA PATRIOT Act, not a criminal conviction. And the rule’s own breakdown, in its note 93, does not say four billion dollars of scam money. The part filed under scams is USD 347,549,705 — about $348 million. The largest share, USD 3,248,510,440, is filed under “Identified Illicit Cyber actors,” and the rule does not break that category down further. Elsewhere it counts at least $36 million in crypto investment scam proceeds and about $300 million from other cyber scams.

The rule also quotes Huione Group itself. In a July 2024 statement, FinCEN notes, the group said “our [Know Your Customer] capabilities are now seriously insufficient.”

What happened after Huione was shut down?

The market moved. This is the part of the record that answers the question the seizure leaves open — if you close one market, where does the money go?

The channel. “On May 13, 2025, Telegram shut down Huione Group’s Telegram channel,” FinCEN wrote in its June 2026 proposal, adding that “there is evidence that Huione Group is creating new channels under different names.”

The market. According to the same document, Haowang Guarantee had announced months earlier that it was buying a stake in “another illicit marketplace, Tudou Guarantee.” After it was reportedly banned from Telegram, Haowang announced it would close — and then, FinCEN says, “began directing its former customers” to Tudou. That is the Treasury’s assessment, based largely on press reports and the market’s own posts.

The payment company. FinCEN says Huione Pay’s license was revoked in March 2025, yet it had “no information confirming that Huione Pay PLC has wholly ceased operations.” A company called H-Pay was licensed in June 2025, and “by November 2025, signs for H-Pay replaced Huione Pay PLC signs.” In December, after what FinCEN, citing reports, calls a “bank run” on H-Pay, customers were told about a “Huione Deferred Payment Plan.” Inside one scam compound, the document says, administrators had declared H-Pay “the mandatory payment platform.” On 10 April 2026, Cambodia’s central bank “reportedly revoked H-Pay’s payment services license.”

The rule that chases the name. FinCEN’s expectation is written into the proposal: the same pattern “will persist with HPay and a future, successor entity.” So the June 2026 proposal would cover “any person that replaces Huione Group by acquiring its assets, in whole or in part, and/or carrying out the affairs of Huione Group under a new name.” Comments closed on 2 August 2026. As of early October 2026 the Federal Register showed no final rule; it is a proposal.

The next market. On 9 September 2026 the Treasury sanctioned Xinbi Guarantee as a transnational criminal organization and said where the business had gone: “Following FinCEN’s listing of Huione Pay … cybercriminals attempted to preserve their operations by transferring their activities to Xinbi Guarantee’s marketplace,” which has offered “substantially similar services to an overlapping customer base.” Since around 2022, the Treasury says, Xinbi’s marketplace “has processed the equivalent of over $24 billion.” Processed, not laundered — the figure covers everything that passed through.

Our article on the scam caller’s script followed money through marketplaces it did not name. The federal affidavit in that case does: it says the scam address transacted directly with Xinbi Guarantee and with “Hawang Guarantee” — its spelling — “an associated entity of cryptocurrency exchange Huione Guarantee.”

The Treasury’s own summary of the pattern: “Transnational criminal organizations increasingly rely on interconnected networks of online marketplaces, payment institutions, virtual asset service providers, and money laundering facilitators.” Shut a channel, and new channels appear. Close a market, and its customers are sent to another. Revoke a license, and new signs go up. Scam money does not disappear. It goes to a market, and when the market is shut, the market moves.

What are “white funds”?

On 7 September 2026, a federal court in Washington authorized the seizure of the Telegram channels hosting Xinbi’s marketplace. The affidavit behind that warrant does not charge anyone. It is the government’s case for the warrant — and the most detailed public description of one of these markets from the inside.

Tiers. Merchants advertise how close to a victim they will stand. “‘First-tier’ card receipt means this merchant is willing to accept the most risk and receive funds directly from a fraud victim.” A “‘Second-tier’” merchant is willing “to receive funds from a ‘first-tier’ account.”

Fleets. “Vehicles, fleets, motorcades, or cars,” the agents write, “are often code-words for bank accounts used to launder illicit funds through money mules.” In one dispute the market itself arbitrated, “the client, a scammer, needed a clean bank account through which to launder funds from a victim,” bought one from a merchant — and the bank closed it when the victim’s money came in.

White funds. Then the last stop. One category of merchants offers what the agents translate as “white fund” currency — money that, they write, will not draw attention from law enforcement or be subject to seizure. “Cybercriminal actors with fraud proceeds are able to send the USDT to these Xinbi merchants and will receive “white fund” currency from the merchant, guaranteed by Xinbi.”

Protection, for a price. One cash-out merchant claimed to be “theoretically guaranteed to be permanently protected,” promising reimbursement if law enforcement acted. The agents’ reading: “offering a guarantee and reimbursement from law enforcement action is a form of admission that criminal funds are commonly processed by this merchant.”

The pace. “Only one Onboarding Address is publicly advertised at one time,” the affidavit says, and the address rotates about every two weeks. “On any given day, these Intermediary Addresses often transfer over ten million dollars’ worth of cryptocurrency.” Since July 2022, the investigators estimate, the public onboarding addresses received over $11 billion — a different measure from the Treasury’s $24 billion, counted on a different basis. One cash-out merchant alone, they write, had “a total incoming volume greater than $330 million” since May 2025.

The victims. Agents traced money from real people to merchants in this market: a man in Virginia who lost about $800,000; a man in Florida who reported a $246,000 loss; a woman in France; and a woman who lost $1.6 million. When she tried to withdraw, the platform demanded a fee. She “was unwilling to sell her condo” to pay it, and the scammers stopped talking to her. The same move as in Pennsylvania: the fee.

What was frozen. On 9 September, the Justice Department said, its Scam Center Strike Force seized two wallets Xinbi used to collect payments for vendors, holding about $12 million, sought restraint of 47 more, and restrained about $52 million in one day — bringing the Strike Force’s total to about $938 million. When our article on how stolen crypto gets frozen was written, that total was $580 million. Restrained is not returned: it means frozen pending court action, and the article on who else is claiming the seized money shows how long the line can be.

How to spot it

A fee to reach your own money. Counter-test: ask whether any legitimate account has ever made you send new money to withdraw old money. The Treasury’s 2023 alert warns that at the end of these schemes “the scammer may demand that the victim pay purported taxes or early withdrawal fees.” Investigators in the Xinbi case wrote that “typically, in this type of scheme, there is no legitimate method for a victim to withdraw his funds.”

A second fee with a new reason. Counter-test: if you paid once and the money still did not come, the next demand — “insider trading,” taxes, verification — is the same scam, not a new problem. In Pennsylvania, prosecutors say, the $232,000 fee was followed by a $320,000 one.

A balance that grows only on the platform’s screen. Counter-test: the number on a website the stranger chose is not money. In Pennsylvania the screen showed about ten times the deposits while the deposit itself had already left.

A wrong-number text that turns into friendship. Counter-test: if a stranger who says they texted the wrong person moves you to an encrypted app and then to a trading site of their choice, stop there. The Pennsylvania complaint lists the misdirected text and the move to an encrypted platform among what its victims had in common.

Pressure to fund it from savings or the house. Counter-test: the Treasury’s alert lists, as a red flag on the victim’s side, people who “liquidate holdings in tax-advantaged accounts or take out home equity lines of credit (HELOC)” to invest. If someone you met by text is steering you toward your retirement account, that is the signal.

What to do if it already happened

Stop paying. No fee in these records released anyone’s money; in Pennsylvania, the first fee was followed by a second.

Report it to the FBI’s Internet Crime Complaint Center at ic3.gov. The Pennsylvania complaint describes the IC3 as “a central hub for reporting suspected Internet-enabled criminal activity,” and the Treasury’s alert tells banks to refer pig butchering victims there. In that case, the 19 other victims were confirmed through FBI interviews and IC3 complaints — reports are how a pool gets found.

Call your bank or exchange right away. The FBI’s 2025 Internet Crime Report says that if you discover a fraudulent transfer, “time is of the essence. Immediately, contact your financial institution and request a recall of the funds,” and, “regardless of the amount lost, file a complaint at www.ic3.gov,” including the full transaction details.

Do not pay anyone to recover it. The same FBI report warns that crypto investment fraud victims “are also targeted in recovery scams, claiming to help recover lost funds,” and lists alerts about fictitious law firms offering to recover funds and about scammers impersonating the IC3 itself. In every case in this article, traced money moved through federal warrants and courts — not through a private company that charged the victim. A recovery offer that starts with a fee is asking for the same thing the platform asked for.

Know what a freeze means. Restrained or seized money is not returned money. Forfeiture takes a court case, and in Pennsylvania that case is still open.

How to not be next

The route in these records is fast and professional: a private wallet within the hour, a pool shared with strangers’ losses, a market that sells trust to criminals and sells “white funds” to anyone who pays. None of the victims in these records could follow it. The one stop a victim controls is the first one — the screen that asks for a fee. If a screen ever asks you to pay to reach your own money, that is where the route can end.

Everything here comes from the public record: a forfeiture complaint and docket from the Western District of Pennsylvania, two seizure-warrant affidavits filed in Washington, D.C., FinCEN’s 2025 final rule and 2026 proposal on Huione Group, Treasury and Justice Department announcements from 2025 and 2026, FinCEN’s 2023 pig butchering alert and the FBI’s 2025 Internet Crime Report. No victim, defendant or official is named; the marketplaces’ conduct is what prosecutors and agents allege, and the Treasury’s findings are regulatory findings, not convictions. To start at the beginning of the scam that feeds this route, read our piece on the pig butchering wrong-number text.