For Brad Thorne, a police detective in Boise, Idaho, a single alphanumeric string symbolizes the dark realm of digital finance that heavily relies on USDT, a well-known cryptocurrency commonly referred to as Tether. This string corresponds to a cryptocurrency wallet address associated with the Huione Group, a Cambodia-based financial organization infamous for extensive money laundering operations. Thorne and his fellow investigators have traced significant amounts of illegal USDT flowing through this address. Tragically, Thorne recounted that a local man recently took his own life after falling victim to scammers who funneled stolen USDT into the same wallet. “It’s the embarrassment, the shame of it all,” lamented Thorne regarding the deceased. “He’d been a community leader his whole life, and I think that was too much for him to handle.”
In recent months, despite U.S. authorities working to cut off Huione from the financial system, the firm’s crypto wallets have continued to transfer enormous amounts of USDT, which is pegged to the U.S. dollar. The Treasury Department has labeled Huione as a significant entity for laundering billions of dollars, involving illicit activities tied to North Korean hackers and organized crime groups involved in human trafficking and large-scale scam operations. As the issuer of USDT tokens, Tether holds considerable influence over the ability to curb or disrupt illicit activities within the cryptocurrency sphere. The firm has the authority to blacklist specific wallet addresses and freeze its tokens to prevent criminals from accessing their proceeds.
Thorne and other specialists express concerns about whether Tether, which boasts an impressive 99% profit margin, should adopt a more proactive stance against criminal activities. “It has destroyed me mentally and financially,” shared Kamlesh Mungekar, a victim of crypto scams.
According to an analysis conducted by experts in blockchain tracing, after U.S. authorities designated Huione as a money laundering operation in May, the wallet address linked to the Idaho victim transmitted an astounding $1.4 billion in USDT within just a few weeks, ending in mid-October. At the request of the International Consortium of Investigative Journalists (ICIJ), blockchain tracing company ChainArgos, along with analysts Yury Serov and Aleks Ring, scrutinized the cryptocurrency transactions associated with this address, all of which are publicly recorded on the blockchain.
Despite Tether being based in El Salvador and not being legally bound to block these funds, Jonathan Reiter, CEO of ChainArgos, stated that the firm still had the capacity to act. Erin West, a former prosecutor and founder of Operation Shamrock, a nonprofit aimed at combating cyber scams, criticized Tether for failing to utilize its influence to prevent its tokens from engaging with the Huione address. “It is reprehensible that Tether would allow such a significant amount of money to flow through a service identified for money laundering,” West remarked to ICIJ. “They should have frozen this.”
Last month, ICIJ published “The Coin Laundry,” a comprehensive investigation conducted in collaboration with 37 media partners, highlighting how key players in the industry equip criminals with the means to launder money obtained through scams, theft, and other illegal activities, while victims often find little recourse for justice. The findings revealed numerous instances of USDT being utilized by criminal organizations, including the notorious Sinaloa cartel and Chinese traffickers dealing in fentanyl and other narcotics.
Stablecoins like USDT operate within a complex legal landscape, often falling into gray areas amid a patchwork of evolving global regulations. In the United States, the recently enacted Genius Act reinforces that stablecoin issuers must adhere to federal regulations aimed at curbing criminal financial activities. Meanwhile, various governments worldwide are still deliberating ways to address the money laundering threats posed by stablecoins.
Tether has publicly asserted its commitment to proactively combatting the misuse of stablecoins. “Tether unequivocally condemns the illegal use of stablecoins and is fully committed to combating illicit activity,” a representative for the firm shared with ICIJ in an email statement. “Tether has a proven track record as the industry leader in collaborating with global law enforcement to halt bad actors.”
However, decisions to freeze cryptocurrency require careful consideration, as such actions could unjustly restrict funds belonging to innocent users or disrupt legitimate business operations. Tether has claimed to perform thorough due diligence on customers to whom it directly sells tokens. Yet, once these tokens enter general circulation and change hands frequently, the company does not monitor every token holder. Nonetheless, Tether still possesses the ability to block USDT transfers through particular wallet addresses, effectively halting the movement of tokens.
Inaction carries its own consequences. On October 8, Kamlesh Mungekar, 54, who lost his life savings to a crypto scam, reached out to Tether support, pleading for the firm to freeze his stolen assets. “Please help me to recover my lifetime of retirement fund,” Mungekar wrote in an email reviewed by ICIJ. Tether responded with sympathy, stating they were “sorry to hear about this unfortunate situation,” but clarified they were “not in a position to determine the validity of these transfers.” The wallet address Mungekar referenced in his email was also directing its USDT into the Huione address linked to Thorne’s investigations of other victims’ funds, as confirmed by four blockchain tracing experts consulted by ICIJ. All of this transpired after the U.S. Treasury Department had designated Huione as a key player in money laundering operations. “This crime has destroyed my retirement savings,” Mungekar lamented in a follow-up email to Tether. “It has destroyed me mentally and financially.”
Tether has established partnerships with significant blockchain analytics firms like Chainalysis to identify and combat illicit activities within the cryptocurrency landscape. These analytics firms specialize in associating wallet addresses with their owners. Without these analytical tools, wallet addresses often appear as anonymous codes on the blockchain. Knowledge of ownership is essential for compliance teams monitoring transactions for any signs of criminal behavior or suspicious activity. Tether possesses the tools necessary to oversee its ecosystem, and CEO Paolo Ardoino emphasized the importance of doing so effectively during a Chainalysis podcast last year, noting their collaboration has successfully identified individuals abusing the system and scamming others through what is known as “pig-butchering” scams.
The term “pig-butchering” refers to elaborate impersonation scams typically orchestrated by organized crime syndicates, which have been closely associated with Huione. ICIJ discovered that the compliance measures employed by Tether, including those from Chainalysis, had already identified the wallet address linked to the Idaho suicide and Mungekar case as belonging to the Huione Group. This indicates that Tether could have recognized that a flagged entity was transferring significant amounts of its tokens, based on the analytical tools they have publicly endorsed. A different blockchain analysis firm, TRM Labs, also confirmed this wallet address as belonging to Huione. However, in response to inquiries regarding the address, Tether stated they “cannot comment on claims made by third-party analytics firms or ongoing law enforcement investigations.” They further clarified that decisions to freeze wallets are made in coordination with relevant law enforcement agencies and not unilaterally based on external labels or speculative claims. “Freezing wallets prematurely during an active investigation can hinder evidence collection and disrupt efforts to dismantle criminal networks,” Tether noted.
In communications to ICIJ, both Chainalysis and TRM Labs reaffirmed their attribution of the wallet address to Huione. Last year, Tether collaborated with TRM Labs and TRON, a significant cryptocurrency network, to create an anti-financial crime alliance, committing to actively assist law enforcement in preventing criminals from utilizing USDT. Recently, this partnership announced that it had successfully frozen more than $300 million in criminal assets worldwide. Justin Sun, founder of the TRON blockchain, highlighted the partnership’s swift success in seizing criminal assets, stating, “If you’re using USDT on TRON for crime, you will be caught.”
The Huione wallet address associated with the victims from Idaho and San Diego began its activity on August 29 of this year, quickly transferring tens of millions of USDT daily, according to ChainArgos. This occurred more than three months after the U.S. Treasury Department labeled Huione as a money laundering entity and suggested blacklisting the group. Even after U.S. authorities announced their intention to formally sever Huione from the U.S. financial system in mid-October, the address continued to receive and send over 65 million USDT, as per ChainArgos’s analysis. The U.S. blacklist only took effect on November 17, after which the wallet has seen minimal activity and has not been frozen for USDT.
Separately, ICIJ’s “Coin Laundry” investigation revealed that between July 2024 and July 2025, various other Huione wallet addresses transferred hundreds of millions of dollars worth of USDT to major cryptocurrency exchanges such as Binance, and from February to July 2025, to the exchange OKX. These funds flowed from Huione into customer accounts at Binance and OKX during a period when both exchanges were under intense scrutiny from U.S. authorities. Tether did not provide answers regarding these transfers.
In the wake of the scam, Mungekar was targeted by fraudsters posing as New Delhi police, claiming Indian authorities were investigating him for money laundering, according to a San Diego police report detailing his case. The scammer threatened that Mungekar’s ability to return to India would be restricted unless he complied, even warning of potential jail time. The scammer guided him through a complex series of actions, including liquidating his retirement accounts, converting those funds into over a million dollars’ worth of cryptocurrency, and sending this crypto to the scammer, based on a report filed by Mungekar with California’s attorney general. “They completely hijacked my brain,” Mungekar expressed to ICIJ. “I was under a lot of stress.”
After obtaining Mungekar’s ether, a popular cryptocurrency, the scammers converted those assets into USDT for stability and transferred them to the TRON blockchain, according to experts who examined the transactions at ICIJ’s request. Subsequently, the funds were deposited into a wallet address that primarily funneled its USDT into the same Huione wallet linked to the Idaho case, as revealed by analysis from four blockchain tracing experts, including Jonathan Williams from OakThorn Investigations and Joshua Cooper-Duckett from CryptoForensic Investigators. Mungekar noted that the scammers urged him to recruit family and friends to invest in the scam as well, which led him to realize something was wrong. He also mentioned that withdrawing his retirement funds triggered substantial tax liabilities he cannot afford. “There are huge penalties,” Mungekar explained. “I don’t know how I will come out of this.” In Idaho, Detective Thorne not only traced victim funds to the same Huione address but also uncovered its involvement in USDT transactions funding fraudulent online platforms that ensnared hundreds of victims. “This is the deeper infrastructure of money laundering,” he asserted.
