For The Coin Laundry, the latest investigation by the International Consortium of Investigative Journalists with 37 media partners in 35 countries, ICIJ’s data team analyzed tens of thousands of crypto transactions to expose a shadow economy awash with billions of dollars in dirty money. Huione Group, a financial services conglomerate, lies at the nexus of identity theft, human trafficking, scam, fraud and money laundering. On May 1, the U.S. Treasury Department’s anti-money laundering agency, known as FinCEN, singled out Huione Group as a money laundering “concern.” And where was Huione sending its crypto transactions? Centralized crypto exchanges (CEX), the main gatekeepers of crypto trades.
Two major CEX had pleaded guilty in U.S. federal courts to operating without basic safeguards to prevent money laundering and paid sizable penalties: Binance, the world’s largest exchange, in November 2023 for $4.3 billion; and OKX (formerly known as OKEx), another big exchange, in February of this year for $504 million. The team pulled numerous datasets from Arkham Intelligence and Tronscan, two free blockchain data sources that provide application programming interfaces (APIs), tools that would allow us to query the platforms’ data directly and at scale. We crafted a methodology using Arkham and Tronscan data that could be replicated by anyone using any tracing tool.
Along with these main platforms, we tried other online tools such as Dune, Etherscan and Blockchain.com, and met with several industry experts. The team used the Python programming language and queried the APIs using the requests library. We crafted scripts to extract data and then cleaned and stored it in PostgreSQL, a free and open-source relational database management system, which was managed using the Django web framework. Bigger datasets were imported directly into the database using the psycopg2 code library. The Django database interface made it very easy to clean, query, label and export tidy data for the team to share in the Google Sheets spreadsheet application. We also used the Python pandas library to run basic statistics on various queries and then calculated the same statistics directly in Google Sheets.
We sought to assign a total to Huione Group’s illicit activity, using methods that could be replicated. John Griffin, a crypto expert we interviewed, described the approach in one of his papers as designed “not to capture all flows, but to focus on capturing flows that are extremely likely to be controlled by a scammer.” And we think we succeeded.
Huione Group has published its crypto addresses in Chinese-language quarterly financial reports. Some addresses listed there transact on the TRON blockchain in tether, a stablecoin whose value is pegged 1-to-1 with the U.S. dollar. Focusing on tether transactions also means that the data team wouldn’t need to convert crypto values to U.S. dollars. We had understood from talking with experts that it was likely those Huione addresses were sending funds to major exchanges. We just needed to calculate the scale. The data team chose cutoff dates in July 2025 in order to look back at transactional activity up to that date. We planned to have a process that would analyze the addresses involved in two “hops.” We aimed to validate that funds were sent from Huione to customer accounts at exchanges, and make it an exercise others could later replicate. The earliest activity we found for the Huione addresses we looked at was in July and August 2024.
In the case of Binance, that gave us about a year of data to review because we were interested in activity after November 2023, when the exchange signed its plea deal with the U.S. Department of Justice. The transactions we examined began months after Binance pledged to improve its anti-money laundering systems. In the case of OKX, the time period we examined was shorter: from Feb. 24 to July 22 of this year, which gave us nearly five months of potential transactional activity to analyze. The data team first queried the Arkham API to get transactions sent in tether from those Huione addresses between July 13, 2024, and July 17, 2025. The destination of those funds, we found, were customer accounts at Binance, which were labeled “Binance Deposit” on Arkham. Using that label, we ended up with a universe of several thousand customer accounts.
But to calculate exactly how much Huione had sent to Binance over a year, we then needed to check which of those customer accounts could be included in our count. So we moved from hop 1 (transfers from Huione to customer accounts) to hop 2. In our hop 2 analysis, we assessed how funds moved from the deposit addresses to the large wallets, or “hot wallets,” that crypto exchanges use to pool and manage customer funds. In the case of the Binance analysis, we found that the deposit addresses sent funds to two Binance hot wallets; for OKX, we included the deposit addresses that sent funds to six wallets that were labeled as “OKX hot wallet” in Arkham Intelligence. Even though the addresses were labeled as hot wallets by Arkham, we further confirmed they were held by the exchanges. The hop 2 analysis enabled us to confirm how many deposit addresses to include to calculate the transactional activity from hop 1. Our team included in its final count 2,697 deposit addresses for the Binance analysis and 32,384 deposit addresses for the OKX analysis. We went back to hop 1 and included those deposit addresses and limited the time period under review (July 13, 2024, to July 17, 2025, for Binance; Feb. 24 to July 22, 2025, for OKX).
Our analysis of the transactional activity of just three wallet addresses used by Huione Group shows that customer accounts at Binance received at least $408 million in tether from Huione over a little more than a year, an average of $1 million in tether a day, while the company was under the supervision of court-appointed monitors. In the case of OKX customer accounts, they received at least $226 million in tether from Huione over five months — a bit less than $1 million a day. Our team also calculated a smaller tranche of activity, after May 1, 2025 — when FinCEN labeled Huione Group a “primary money laundering concern.” We discovered that the transactional activity continued unabated in both cases: At least $77 million in tether was sent during that period to customer accounts at Binance, and at least $161 million in tether was sent to customer accounts at OKX. On Nov. 17, FinCEN’s final rule to sever Huione Group from the U.S. financial system took effect.
Leave a Reply