Twenty-four billion dollars in the Dark River

Original author: Cake, Deep tide TechFlow

April 1, 2026, Phnom Penh International Airport。

A man in handcuffs was hooded by the Chinese SWAT and pushed onto a Souther passenger plane. A few hours later, the plane landed somewhere in China and the special police took off their hoods and showed a pale and exhausted face。

His name is Yoon Li, Chairman of the Tsaiwan Group, founder of the Princes Group, Chen Zhi's most important arm. During the years of his supervisor, the name was unknown in the Chinese circle of Phnom Penh, the red 2-dimensional code was attached to the street shop where the owner of the restaurant used it for collection and the casino for settlement. He's paying for what he calls a "payable treasure of Cambodia" and sounds harmless。

But it's just the tip of the ice。

Underwater, a $24 billion underground financial empire. A crime service supermarket made up of thousands of Telegram groups. An illegal market five times larger than Hydra, three times larger than the peak of FTX。

It's called the Moo Wang Guarantee。

It's just 84 days since Chen Zhi, the founder of the Princes Group, was sent home. The two men came to justice, declaring the end of the largest money-laundering empire in the history of encrypted currency。

The history of a young Fujian in black

To understand the money transfer guarantee, the person behind it must first be understood。

Chen Zhi, born in 1987 in Xiaoao, Fujian Gang County. This small town by the sea, East and Marjorie Island, is surrounded by water. The Chen family is common and the economic level is below average. Chen Zhi dropped out of school at the end of the second year, and his classroom was moved from class to the Internet cafe at the age of 15。

Before and after 2005, Fujian coastal cybercafes were savagely grown, where a group of teenagers completed the initial enlightenment of the black production of the Chinese Internet. Chen Ji is one of them. He brought together several classmates to form a small team to make a living by building a private suit for the Heat Blood Legend game, cracking up the original server and selling user information. These businesses swam in the legal grey area at the time, but were profitable. The game suit became his first bucket of gold to accumulate wealth。

His fellow inhabitants later recalled that Chen Zhi had also made data sales, launched dating and game dating websites. In any case, he does it whenever it is illegal to make money on the Internet。

Around 2010, Chen Zhi left Liang River with approximately $500,000 in stolen money。

Destination: Cambodia。

The dream of Phnom Penh

Phnom Penh, 2011, is also the first city of chaos. Chinese capital had just begun to flow into South-East Asia, and the real estate market in Cambodia was a blue sea. Chen Zhi grabbed this window。

Instead of looting hot plots with big developers, he bought low-cost land in the outskirts of Phnom Penh to build small houses and shops. This approach, which is low-cost and fast-moving, is well suited to a small but smell-sensitive speculator。

In 2014, a total of $250,000 was spent on Cambodia ' s investment migrants to acquire local nationality. Since then, the status of Fu Jiancheng Teen has been completely erased and replaced by the Cambodian Chinese entrepreneur Vincent Chen Zhi。

In 2015, Prince Holding Group was officially established。

The next velocity is dazzling. The Princely Group brand was erected in the centre of Phnom Penh, and operations rapidly expanded from real estate to banking, insurance, telecommunications, retail, tourism. The Crown Plaza mall under the banner became a Phnom Penh landmark, and the Prince Bank was officially licensed in 2018. Chen Zhi even set up the Prince Foundation, a high-profile charity, with contributions totalling over $16 million, to perfecte the image of "a respected entrepreneur and philanthropist"。

Political relations are the key lubricant of the machine. Chen Zhi spent $20 million on a 68-year-old birthday dinner for then Prime Minister Hun Sen of Cambodia, inviting various countries to host the festival. He was appointed by Royal Decree to serve as adviser to the Minister of the Interior, Huo Ken, the President of the National Assembly, Han Sanlin, Prime Minister Hun Sen and the successor Prime Minister Hun Manai. In 2020, he was awarded the title "Duke" and received a diplomatic passport。

On the streets of Phnom Penh, more than one third of Rolls-Royce belongs to the Crown Prince's Group. Chen Zhi himself, accompanied by a bodyguard and driven by Rolls-Royce. A man who has seen him describes it as:Little guy, about 1.68 meters, brain door, a fuzzy accent, eyes through "a hard-on."。

Under all this glorified surfaces, the Princely Group's real profit engine is another kind of business。

Fraud factory

Starting in 2015, Chen Zhi has built at least 10 closed parks throughout Cambodia。

THESE PARKS ARE SURROUNDED BY WALLS AND BARBED WIRE, WHICH ARE INACCESSIBLE TO OUTSIDERS. THOUSANDS OF CROSS-BORDER WORKERS FROM COUNTRIES SUCH AS CHINA, VIET NAM, MYANMAR AND INDONESIA WERE ATTRACTED TO JOB ADVERTISEMENTS, PROMISING HIGHLY PAID IT JOBS. WHEN THEY ENTER THE GATE OF THE PARK, THEIR PASSPORTS ARE CONFISCATED, THEIR MOBILE PHONES ARE MONITORED, AND THEY BECOME "TOOLMEN" FOR TELECOMMUNICATIONS FRAUD。

Indictments by the United States Department of Justice reveal the details of the operation of the parks: the Princes' Group fraud syndicate has millions of cell phone numbers and has established "telefarm" call centres in several parks. Two of these institutions are equipped with 1250 mobile phones and control about 76,000 social media accounts. The Princely Group's internal documentation even teaches employees how to forge false intimacy with the victims and suggests that "avoid the use of too beautiful a female image" be used to increase credibility。

It's called "killing pigs." First, it builds trust and emotional ties with the victims by false identities; then it induces the victims to put real money and silver into a fake investment platform, "killing pigs"。

Chen Zhi himself was directly involved in the management of the fraud bases. In his books, the profit record was clearly marked as "piggy killing", detailing the floors and buildings for each project. For workers who resist, his command is four words: “may strike, but not kill.”

The encrypted analysis company Elliptic found sales advertisements in the Telegram group in the park that were used to restrain tremors of workers。

The proceeds of fraud continue to flow from the victims ' bank accounts to the Princely Group's underground treasury. But the money is "dirty" and has no direct access to the formal financial system。

They need a river to wash。

This river, it's a hawk。

Dark web

In 2021, Huione Guarantee came online on Telegram。

Its initial positioning appeared to be normal, with a platform for guaranteeing transactions in real estate and used vehicles. The buyer pays the robot that guarantees the money, and when the seller delivers it, the buyer confirms the receipt and then the money is released to the seller. An intermediate commission is charged. It's essentially a "recognizing receipt" model。

But soon, the "goods" traded on this platform changed their taste。

Money-laundering services have become the core category. In the Telegram group, which is guaranteed by the money-transfer, businesses openly advertise: to collect dirty money and to make clean money. Those who hold stolen money or bank information are called the Masters, those who work at the bottom of the fraud park are called the Dog Push, and those who work with money-laundering middlemen are called the Bricks。

A typical money-laundering process is:THE FRAUD SYNDICATE OBTAINED A SUM OF MONEY THROUGH THE PORK KILLER AND GAVE IT TO THE INTERMEDIARY ON THE MONEY TRANSFER GUARANTEE. THROUGH A NETWORK OF "FUND MULES", SHELL ACCOUNTS SPREAD OVER MORE THAN A DOZEN COUNTRIES, THE MIDDLEMEN TURN THE LAYERS OF FUNDS AND EVENTUALLY RETURN THEM TO THE FRAUD SYNDICATE IN THE FORM OF USDT STABILIZATION CURRENCY. INTERMEDIARIES AND FINANCIAL MULES EACH DRAW COMMISSIONS。

The whole process, like a well-functioning industrial stream。

The money-laundering guarantee goes beyond selling money-laundering services. Its merchants also provide fraud kits, fake website development, AI face change technology, personal information databases on trafficked persons, information on national citizenship, Starlink satellite equipment (for the fraud park newsletter), where almost all the crime tools you can think of are available。

The money-transfer guarantee is a clearly priced crime supermarket, and the Telegram group is its shelf。

By mid-2024, when Elliptic first exposed the platform, it had traded over $11 billion. By the beginning of 2025, that figure had more than doubled to $24 billion. There are up to 9289 active groups of money-transfer guarantees on Telegram and over 900,000 registered users。

A comparison: Hydra (Hydra), the largest dark-net market in history, operated for six years with a total turnover of less than $5 billion. It took less than four years, five times more。

Bloomberg received partial internal documentation for the period 2022-2023, recording thousands of victims and tens of millions of dollars in transactions. The documents show that highly mobile workers are directly involved in the monitoring of transactions and the handling of disputes, and that the platform regularly withdraws commissions from transactions and even provides "a substantial credit line to a well-performing money-laundering team"。

In Phnom Penh, the office space paid for by HSBC is located on the second floor of the HSBC. The glass and concrete structures were built with two panda statues standing at the entrance. Staff upstairs work under an alias, with one department responsible for dealing with fraudsters, one department monitoring the Telegram channel and one department tracking money mule accounts in a dozen countries。

WHEN USDT IS NOT SAFE ENOUGH

What is truly shocking about the Moiwan Empire is not its size, but its pace of evolution。

In July 2024, Tether frozen 29,62 million USDTs from a wallet. The reason for the freeze was that the wallet received stolen funds related to the Korean hacker organization Lazarus Group. The chain detective ZachXBT further discovered that the $35 million stolen from the Japanese DMM Exchange had ended up in the money-transfer address。

THE USDT HAS BEEN FROZEN AND IS A THREAT OF SURVIVAL FOR THE MONEY。

Because the USDT operates on a block chain, but it is essentially centralized, Tether is ready to cooperate with law enforcement agencies to freeze USDT at any address. For a money-laundering empire with USDT as its lifeline, it's equivalent to being strangled。

The response from the Qiwan has been industry-wide。

IN SEPTEMBER 2024, MOW GROUP LAUNCHED ITS OWN UNITED STATES DOLLAR STABILIZATION CURRENCY. ITS OFFICIAL MESSAGE IS ALMOST BRAZEN: "TO AVOID THE FREEZING AND TRANSFER RESTRICTIONS THAT ARE COMMON IN TRADITIONAL DIGITAL CURRENCIES" AND "WITHOUT THE RESTRICTIONS OF TRADITIONAL REGULATORY BODIES". TRANSLATION IS: WE BUILT A USDT THAT WON'T BE FROZEN。

USDH just starts. Chatme, a complete, self-sufficient digital black kingdom, was immediately followed by the launch of its own block chain, Huione Chain (also known as the Xone chain), its own encrypted currency exchange, Huione Cripto, its own communications software, Chatme。

IT'S EVEN TRYING TO FINANCE IT THROUGH ICO, ISSUING BLOCK CHAINS OF ORIGINAL HC。

The logic of this operation is very clear: if USDT's throat is squeezed by Tether, make itself a stable currency that no one can freeze; if Telegram can block a group, make a communication software; and if the existing block chain can be traced, make a chain itself。

Round up

But they were wrong。

In July 2024, Elliptic released its first investigation report on the growth guarantee, like a bomb into the eyes of a global regulator。

The Moo Wang guarantee quickly changed its name to Haowang Guarantee and attempted to cut the brand with the Moo Wang Group. The network of officials who paid the money also deleted the page describing the money money bond as a "sub-company". But Hong Kong vouched for its recognition in social media that Moiwan remained its "strategic partner and shareholder"。

On May 1, 2025, the Financial Crimes Enforcement Network (FinCEN) of the United States Department of the Treasury officially designated the Money Laundering Group as the "prior money laundering risk agency" and announced its intention to completely exclude it from the United States financial system. FinCEN's report singled out three entities of the remittance group, namely, the remittance payments, the Huione Cripto and the Hongwang guarantee, stating that they were "in essence one thing" with the parent company。

That same month, Telegram shot it。

On 13 May, Telegram imposed a one-time ban on more than 3000 accounts and channels related to the movement of currency on the grounds of "violation of the terms of service". Within an hour, the boom guarantee issued a stoppage announcement stating that "all NFTs and groups have been banned" and declared all operations closed。

The empire seems to have collapsed. But the boom has shown remarkable resilience。

In the weeks following the stoppage, Chainalysis found that the volume of encrypted money transactions associated with the floating entity did not reverse. The boom guarantee led the user to a new platform called Tudou Guarantee, claiming to have acquired 30 per cent of the shares of the platform. Hong Kong has also entered the potato guarantee, which has led to the rebirth of the business exchange. It even developed independent communication software, Chatme, in an attempt to get rid of the reliance on Telegram。

But the bigger blow is still behind。

On 14 October 2025, the United States Department of Justice and the Department of the Treasury jointly announced the criminal prosecution of Chen Zhi, founder of the Princely Group, the issuance of a global wanted warrant and the confiscation of 127,271 bitcoin in his name, valued at about $15 billion. This has created the highest record of single seizures of encrypted assets in the judicial history of the United States. At the same time, the United States Department of the Treasury has placed 146 individuals and entities associated with the Crown Order on the sanctions list. The same day, the United Kingdom frozen 19 properties and all assets in London。

CAMBODIA ' S TOTAL GDP IN 2024 WAS ABOUT $46 BILLION. THE UNITED STATES CONFISCATED BITCOIN ONCE FROM THE PRINCES' GROUP, EQUIVALENT TO ONE THIRD OF THE COUNTRY'S GDP。

Crash

The chain reaction of sanctions is faster than anyone expected。

Late in the night of 1 December 2025, a flash announcement was issued on the money transfer: the platform launched the Delayed Payment Program due to "Million users crowding" and the national underground store was suspended, with user funds locked up until 5 January 2026。

On the streets of Phnom Penh, a long line of dragons rose。

Audit data from Bitrace show that after the last withdrawal was processed on 1 December, only about 990,000 USDT remained in the chain. Its Ether Workshop business ran out of balance as long ago as October, and the wave field operation was cashed out several times in November, but eventually was completely empty around November 28. The USDT day-to-day scale dropped sharply from 41.83 million at the beginning of the month to 7.177 million。

The money that calls itself "Cambodia pays the treasure" is just a shell overnight。

Tens of thousands of Cambodian merchants' lives have been locked to death on an endangered platform. Until recently, there had been a spontaneous build-up of mobile users through social groups to collect debt from the National Bank of Cambodia, but no substantial progress had been made to date。

In December 2025, the Cambodian side revoked Chen Zhi's Cambodian nationality on the grounds of “improper acquisition of nationality”。

On 7 January 2026, Chen Zhi was deported by the Cambodian side。

IN JANUARY 2026, THE POTATO GUARANTEE UNDER THE FLAG OF THE MOB RETURNED $130 MILLION OF USDT THAT WAS SUSPECTED TO SHUT DOWN OPERATIONS。

On 1 April 2026, Li Hung was deported。

Thus, this vast empire, which began at Fujian Gangcomb, is plating through Phnom Penh, borrowing Telegram for expansion, laundering money through USDT, fattening it with a pig-killer, and has completed its entire criminal life cycle。

The river is not dead

The story of the loan guarantee is over. But the business model that it verified was not over。

Shortly after the Hong Kong Guarantee announced the suspension, Elliptic exposed another Telegram black market, Xinbi Guarantee, which has led to at least $8.4 billion in illegal transactions since 2022, with more than 2330,000 users. The New Currency Guarantee, registered in Colorado, United States, also covers money-laundering, forgery of documents, personal information databases and almost a replica of money-transfer guarantees。

The United Nations Office on Drugs and Crime reported that the annual profits from organized cybercrime in South-East Asia were close to $40 billion. Encrypted money and underground banking channels help these criminal networks to launder money quickly, while Telegram-style instantaneous communication platforms provide them with a cost-effective criminal infrastructure。

Chen Yanyu, an academic in cybercrime in Taiwan, spent months in Cambodia talking to money launderers, fraudsters and their leaders. Her conclusion is cold and sober: "Cybercrime is deeply embedded in global capitalism, plundering resources from around the world. It can't be easily broken."

The 24 billion-dollar dark river was cut off on the surface. However, the riverbeds of the Dark River are still in place, upstream water is in place and downstream demand is still in place。

The world still needs a place where dirty money can be cleaned up. The next wave, perhaps, has grown quietly on a Telegram channel。

References: Elliptic study, US Treasury FinCEN bulletin, US Department of Justice indictment, Bloomberg investigative report, Financial News, interface news, Bitrace chain data analysis