Crypto Journalist
Anas Hassan
Crypto Journalist
Anas Hassan
Share
A US-based crypto holder lost $3.05 million worth of XRP after their Ellipal wallet was compromised, with stolen funds traced to money laundering networks linked to Huione, a sanctioned Southeast Asian criminal marketplace.
Blockchain investigator ZachXBT conducted a four-hour analysis revealing that the attacker executed over 120 Ripple-to-Tron conversion orders through Bridgers exchange on October 12, 2025, before consolidating funds on the Tron blockchain.
By October 15, the entire amount had been laundered through over-the-counter desks adjacent to Huione’s illicit ecosystem.
ZachXBT identified the victim’s address as r3cf5***Jjkzc after cross-referencing the theft date and amount from a viral YouTube video.
The victim appears inexperienced and provided insufficient details on how the wallet became compromised beyond confirming user error.
Huione has facilitated laundering billions from pig butchering scams, investment fraud, human trafficking operations, and crypto hacks across Southeast Asia.
The US Treasury recently applied additional restrictions against Huione related to a $15 billion Prince Group seizure and sanctions designation.
Wallet Confusion and Recovery Challenges Expose Industry Gaps
The XRP victim believed they were using Ellipal’s cold wallet product when actually operating a hot wallet, exposing funds to significantly greater risk.
ZachXBT noted this confusion between custodial and non-custodial products is a widespread industry problem, enabling large-scale thefts.
He frequently observes Coinbase support impersonation scams where victims transfer funds from exchange accounts to compromised wallets after social engineering, with some later stating they didn’t understand the difference.
The victim struggled to quickly contact US law enforcement about the theft.
According to the investigator, few agencies possess the qualifications to handle such cases, and endless victim reports mean incidents get overlooked.
Jurisdictions like the US, Netherlands, Singapore, and France generally provide better support, though outcomes depend on case assignments.
Recovery prospects remain extremely low due to delayed reporting to competent private sector parties.
ZachXBT recommends that victims report theft addresses to knowledgeable parties immediately, as otherwise, detecting theft becomes difficult.
Ripple lacks the robust victim support system existing within Bitcoin, Ethereum, Solana, and major EVM chain communities.
ZachXBT attempts to reply to verified thefts, but due to the large volume of over 30 daily requests he receives, he believes that “self-custody is not the right answer for the vast majority of people.”
Huione Network Processes $27 Billion Despite Enforcement Actions
Blockchain analytics firm Elliptic revealed Huione Guarantee and its merchant network received over $27 billion in crypto since 2021, primarily in Tether’s USDT stablecoin.
The Chinese-language marketplace operates through thousands of Telegram channels, with Huione acting as an escrow provider for merchants offering money laundering services, stolen personal data, fake documents, and torture equipment for scam compound workers.
Merchants explicitly advertise willingness to launder proceeds from specific fraud types based on perceived freezing risk.
Huione Guarantee is operated by Huione Group, a Cambodian conglomerate with ties to Cambodia’s ruling Hun family.
One Huione Pay director is Hun To, the cousin of current Prime Minister Hun Manet, who has reportedly been suspected of heroin trafficking and money laundering by Australian police.
Elliptic’s investigation indicates Huione International Payments actively launders scam proceeds globally, with representatives discussing handling $2 million from fraud for 10.5% fees.
Telegram banned thousands of Huione-linked channels and accounts back in May, following Elliptic’s investigation.
However, the criminal ecosystem has shown resilience as Tudou Guarantee immediately absorbed displaced activity after Huione acquired a 30% stake in December 2024.
Tudou’s transaction volumes surged from negligible levels to over 300,000 by mid-June, while smaller platforms like Shuangying tripled to 110,000 transactions.
Chainalysis confirmed Huione’s core crypto processing infrastructure remained operational despite surface disruptions, with the platform migrating to new domains and resuming Telegram presence within weeks.
Elliptic now tracks over 30 active guarantee marketplaces across Southeast Asia, continuing identical criminal services.
For the benefit of victims, ZachXBT has warned that over 95% of recovery companies are predatory operations charging desperate victims large amounts for basic reports with few actionable insights.
