According to the report of GMA Integrated News, a local media in the Philippines, and the press conference of the local police (PNP PIO), it is confirmed that Guo Congyuan, a well-known Chinese businessman in the Philippines, and his driver Armani Pabillo were kidnapped in April and brutally killed after his family paid a ransom of up to 26 million yuan.
Bitrace investigators immediately conducted intelligence analysis on the publicly available network information, restored the context of the incident through blockchain tracking, and excavated more related crypto crime incidents based on the Southeast Asian organized crime network intelligence database.
This article aims to disclose and introduce the cryptocurrency money laundering tools used by the kidnapping and extortion gangs in the case.
HuionePay is affiliated to the Cambodian financial entity Huione Group. It is a popular cryptocurrency payment tool in Southeast Asia, supporting the settlement of USD stablecoins on multiple public chains and has a large number of users. Due to the permissionless nature and anonymity of cryptocurrency, this payment tool has been used on a large scale by local organized crime network entities to achieve the purpose of laundering, payment transfer, realization, and storage of stolen money.
Sanlian Life Weekly reported on May 27, 2025:
"The Philippine police revealed that the ransom paid by Guo Congyuan's family... (was) converted into the cryptocurrency USDT (Tether), of whichmost of the amount (a total of more than 1.365 million US dollars, about 75.58 million pesos) has been withdrawn through the Cambodia-based financial platform Huione Pay (Huiwang App) account
."
After Bitrace traversed all HuionePay User address transfer transaction data, it successfully located an Ethereum address that had been used between May 4 and May 7. After further expanding the source of funds for the address, it was found that this kidnapping and extortion gang was also related to another fraud case that Bitrace was investigating. The two cases were linked through a blockchain address located in Cambodia.
This shows that the kidnapping and murder of Guo Congyuan may not be the first crime committed by the gang.
Dollar stablecoin is a cryptocurrency that is distributed on the blockchain by some institutions through real-world asset mortgages, algorithmic control, etc., and its currency value is anchored to the US dollar. With the help of blockchain technology characteristics, the US dollar stablecoin has created a low-cost, high-efficiency, decentralized value circulation system outside the traditional banking system, and is widely used in cross-border payments, value storage, transaction relay and other scenarios.
But at the same time, it is also very easy to be maliciously exploited by criminal gangs. Criminal entities such as online gambling, money laundering, black and gray production transactions, and fraud are widely using US dollar stablecoins, especially Tether USDT, to help carry out upstream crimes and downstream fund laundering.
In this incident, USDT was used to transfer and launder extortion funds.
Further tracing the source of the HuionePay-related funds mentioned above, it was found that they were transferred from the Ethereum network through a cross-chain bridge, and before that, the kidnapping gang had simply transferred and laundered USDT.
The news report mentioned:
“As of May 11, the Anti-Cybercrime Group (ACG) of the Philippine National Police stated that it had discovered US$205,900 (approximately 11.4 million pesos) worth of cryptocurrency abroad and froze it”
And in the link restored by Bitrace, there are indeed several frozen USDT addresses, as follows:
These addresses transferred and laundered more than $1.76 million worth of USDT in the three days after the incident, of which 205,500 USDT were successfully intercepted, which is consistent with the amount in the news report. However, even though the local police have implemented timely on-chain law enforcement, more than $1.4 million of USDT still successfully escaped and flowed into the downstream HuionePay address through the cross-chain bridge.
The behavior of online gambling platforms and their agents providing betting services to gamblers is illegal in some countries or regions and is cracked down on. Such crackdowns include but are not limited to technical demeanor and network supervision of online gambling platform operators, as well as financial supervision and anti-money laundering measures for gamblers. In order to circumvent sanctions from the traditional financial system, a large number of online gambling platforms will access cryptocurrency payment tools, combined with legal currency payment channels based on bank accounts, to provide solutions for gamblers' recharge and withdrawal activities.
Based on the huge capital flow scale of online gambling platforms, a large number of upstream criminal gangs choose to launder funds through online gambling platforms. In this case, the ransom paid by the victim's family was first converted into USDT through the local online gambling platform.
Media reports and the local police press conference on May 6 mentioned:
“The ransom paid by Guo Congyuan’s family was first paid in pesos to the e-wallet accounts of two casino intermediaries - 9 Dynasty Group and White Horse Club. Then part of it was converted into US dollars and then into the cryptocurrency USDT.”
“…the overseas service provider (VASP) has successfully frozen US$79,000 worth of
The investigation shows that the online gambling platform involved transferred USDT worth more than 1.73 million US dollars to the lower-level money laundering address in four days, of which 61,810 USDT were indeed transferred to a well-known centralized trading platform (VASP), and it is suspected that 30,597 USDT ransom was paid (or transferred) through another VASP. The total amount exceeds the 79,800 USDT disclosed by the police, perhaps because some funds have already escaped.
In this vicious crime against the Chinese business community, online gambling platforms and illegal payment platforms played an important role -
Due to their high capital turnover, centralization, and offshore operations, online gambling platforms have formed de facto anonymous cryptocurrency deposit and withdrawal (on/off ramps) channels and mixing platforms, actively or passively providing funds laundering services for upstream criminal entities;
Illegal cryptocurrency payment platforms have become an important tool for money laundering due to their anonymity and cross-border nature. The risks are manifested in complex capital flows, concealed identities, and difficulty in supervision. HuionePay in this case It even refused to provide investigation information to law enforcement officers of other countries on the grounds of "not supporting law enforcement cooperation in countries or regions other than Cambodia".
As one of the important infrastructures of the crypto industry, stablecoins have been widely adopted by such risky entities. According to the "2025 Crypto Crime Report" released by Bitrace, stablecoin transactions related to high-risk activities account for more than 5% of the total transaction volume, posing a huge financial threat to compliant business institutions and ordinary investors.
Web3 institutional operators should be vigilant against this threat, learn more about and comply with local laws and regulations, establish communication channels with regulatory authorities, and establish law enforcement cooperation channels with law enforcement agencies in major countries around the world to prevent business addresses and customer addresses from being contaminated by risky funds.
Two Chinese nationals based in California have been charged with illegally exporting advanced Nvidia AI chips to China by routing shipments through Southeast Asia. Their company, ALX Solutions, allegedly carried out over 20 unlicensed exports and received millions in payments from entities in China.
AnaisBakkt is acquiring nearly 30% of a Japanese textile company to transform it into a bitcoin-focused business called bitcoin.jp. The company aims to integrate digital assets into its operations and corporate treasury.
WeatherlyEthereum treasury firms are buying large amounts of ETH and now hold as much as the new U.S. spot ETFs. Unlike ETFs, these companies can earn staking rewards and use DeFi, making them more attractive to some investors.
AnaisPump.fun has taken back the lead in Solana’s memecoin launchpad race, launching over 23,000 tokens in a day — far ahead of LetsBonk.fun. Meanwhile, launchpads on Base, backed by Coinbase, have overtaken Solana in daily token launches for the first time in two years.
AnaisPig Butchering Scams Explode As WhatsApp Deletes 6.8 Million Accounts In Global Crackdown
WeatherlyDubai and UAE regulators agreed to work together on crypto licences to make rules clearer across the country. Firms licensed in Dubai may soon operate nationwide, but still need to pass joint checks.
AnaisAB DAO announces that AB officially went live on Kraken on August 7, 2025. Users can now deposit AB and place post-only limit orders (orders will not match yet). Full trading will begin on August 8, 2025, when the AB/USD and AB/EUR pairs go live, allowing purchases directly in U.S. dollars and euros.
AlexKraken has added PayPal deposits for US users, letting them move dollars into their trading accounts instantly. The feature supports PayPal balances, linked cards, and bank accounts, with a $7,000 weekly limit.
WeatherlyThe SEC and Ripple have dropped their appeals, ending the long XRP lawsuit and letting the 2023 mixed ruling stand. XRP’s price jumped over 10% after the news, and Ripple will now focus on growing its business and moving forward.
AnaisRipple is buying Canadian payments firm Rail for $200 million to grow its stablecoin business and speed up cross-border payments. The deal is set to close later this year, pending approval from regulators.
Weatherly