$15 Billion in Bitcoin — Chen Zhi, Huione's Afterlife, and the Geography of Pig Butchering

The 127,271 BTC seized was not Chen Zhi's only criminal proceeds. It was the portion that DOJ could identify, freeze, and forfeit by the close of the investigation. The total economic flow through Prince Holding Group's pig butchering operations, per DOJ filings and adjacent Chainalysis analysis, ran to multiple times the seized amount over the operating window of 2018 to 2025.

The on-chain pattern was consistent. Victims, recruited through dating apps, WhatsApp, WeChat, and LinkedIn "wrong number" openers, were socially engineered into investing on fake trading platforms. Funds — almost exclusively USDT TRC-20 because of TRON's low fees and rapid finality — flowed from victim wallets into a network of compound-controlled deposit addresses. From there, the funds were converted to BTC through OTC desks and laundered through multi-hop chains involving Huione Pay, Xinbi Guarantee, and Tudou Guarantee.

The destination was Chen Zhi's BTC cold-storage cluster — the 25 unhosted wallets that DOJ ultimately froze. The wallets held BTC accumulated over years and represented the Prince Holding Group's long-term reserve.

The forfeiture is the visible portion of the iceberg. The compound network that generated the proceeds operated at $30M/day for years. Tens of billions of dollars in victim losses, of which $15 billion has been recovered to date.

Huione Group was, on paper, a Cambodian financial holding company with banking, payments, insurance, and online marketplace subsidiaries. In practice, two of its subsidiaries — **Huione Pay** and **Huione Guarantee** — were dominant infrastructure for Chinese-language pig butchering and adjacent criminal economies operating across Southeast Asia.

Huione Pay processed USDT transfers between scam compounds, OTC desks, and money launderers, taking a percentage as fee. Huione Guarantee operated as a Telegram-marketplace escrow service for transactions in those criminal economies — scammers buying tools, stolen accounts, deepfake services, and laundering services from one another, with Huione holding the funds in escrow until both sides confirmed delivery.

FinCEN's Section 311 final rule, published in the Federal Register on October 16, 2025 (docket 2025-19571) with effective date November 17, 2025, identified Huione Group as a "primary money laundering concern" and prohibited US financial institutions from maintaining correspondent or payable-through accounts with Huione. The action was not a freeze of Huione's funds — Cambodian authorities would have had to act on that — but a US-jurisdiction severance.

The effect was immediate and large. Huione Group's banking relationships with US-correspondent banks collapsed. Huione customers withdrew funds en masse — a December 2025 bank run on Huione's sanctioned banking subsidiary forced the bank to halt operations. Telegram, which had been the venue for Huione Guarantee, banned both Huione Guarantee and the parallel Xinbi Guarantee channels on May 13, 2025 (in the run-up to the FinCEN finding).

By the end of January 2026, Huione's traditional infrastructure was, in any operational sense, broken.

Criminal infrastructure does not die when one provider is shut down. It migrates to others.

The pig butchering laundering market's migration in 2026 has been mapped by TRM Labs, Elliptic, Recorded Future, and ZachXBT. The destinations:

**SafeW (SafeW Technology Co.)** — Xinbi began promoting SafeW as a Telegram alternative in June 2025. Migration accelerated in January 2026 alongside Tudou Guarantee's closure and Chen Zhi's arrest. SafeW positions itself as a generic peer-to-peer marketplace; in practice, its initial user base is overwhelmingly the displaced criminal economy from Huione/Xinbi.

**XinbiPay (NewPay) Wallet** — Anwen Technology Co. launched XinbiPay as a successor wallet specifically for the Chinese-language criminal economy. The wallet integrates with Telegram bots, supports USDT TRC-20, and operates with minimal KYC.

**Xinbi 2.0** — Xinbi itself rebuilt on Telegram despite the May 2025 ban. The new Xinbi channels are smaller and more transient, but the infrastructure restoration was visible by late 2025.

**Tudou Guarantee** — Halted January 2026 after processing more than $12 billion across its lifetime. Tudou was a parallel guarantee-marketplace operating in Chinese-language criminal channels through 2023–2025. Its halt is the data point that confirms the broader market disruption is real, not just a Huione-specific event.

**Total guarantee-marketplace volume on TRON: $35 billion+** despite the crackdown, per TRM Labs accounting. The category is larger than any single provider; the providers consolidate and reorganize, but the demand persists.

The FinCEN action and Chen Zhi forfeiture are not standalone events. They are part of a broader 2026 enforcement campaign that has included:

**Shunda Park indictment** — April 23, 2026. DOJ unsealed wire-fraud charges against Huang Xingshan ("Ah Zhe") and Jiang Wen Jie ("Jiang Nan"), arrested by Thai authorities on immigration charges. Simultaneously, 503 fake investment websites were seized and $701.96 million in crypto was restrained. The Telegram recruitment channel for the Shunda Park compound (Min Let Pan, Karen State, Myanmar), with 6,000+ followers, was also seized.

**Dubai Operation** — April 29, 2026. Dubai Police arrested 275 suspects from nine fortified compounds. Six defendants — Thet Min Nyi ("Pixy"), Wiliang Awang, Andreas Chandra, Lisa Mariam, plus two fugitives — were charged in the Southern District of California. The Dubai operation demonstrated that compound infrastructure had moved out of Cambodia/Myanmar into more permissive jurisdictions, but that international cooperation extended there too.

**Operation Atlantic** — US Secret Service + UK NCA + Canada — March 2026. Approval-phishing focus, 20,000+ scam wallets identified, $12M frozen, $33M identified, 120+ scam domains seized. Chainalysis was embedded as an intelligence partner at the NCA's London headquarters during the operation.

**Tether T3 Financial Crimes Unit** — assists by freezing USDT TRC-20 across the pig butchering laundering chain. Cumulative T3 freezes hit $450M+ by mid-May 2026. The $61M Tether-assisted DOJ pig butchering seizure in North Carolina in Q1 2026 — the largest single-incident USDT seizure tied to romance fraud — was a T3 case.

**Tether $225M seizure** — Q1 2026. Tether assisted DOJ in a separate $225M seizure tied to pig butchering. Tether received public DOJ acknowledgment.

The compound infrastructure that generates the pig butchering proceeds is concentrated in specific places. Named compounds with documented operations:

**Shunda Park** — Min Let Pan, Karen State, Myanmar. Operated by Karen Border Guard Force-protected Chinese nationals. Seized by Karen National Liberation Army in November 2025; subject of the April 2026 DOJ indictment.

**KK Park** — Karen State, Myanmar. Still owned by Chinese nationals. The Myanmar junta's October 2025 "raid" was characterized by Irrawaddy and local experts as a public-relations exercise — Starlink terminals seized but the compound's protective Border Guard Force structure intact.

**Sihanoukville compound network** — Cambodia. Multiple compounds, varying ownership; Prince Holding Group's flagship compounds were the largest of this cluster.

**Boten, Laos** — Documented in OFAC's March 12, 2026 DPRK IT-worker designations as the operational location for Yun Song Guk and adjacent network — confirming overlap between North Korean IT-worker schemes and Southeast Asian compound infrastructure.

**Dubai compounds** — Surfaced through the April 29 operation. Nine fortified facilities, 275 arrests.

**KK Park / Shwe Kokko / Saixigang / Chinatown** — adjacent Myanmar compounds with documented connections to organized crime networks operating across the Thai-Myanmar border.

The total estimated worker population across documented compounds, per UN Office on Drugs and Crime, exceeds 300,000 trafficked individuals. Per the UNODC's 2025 "Inflection Point" report, total scam losses across East and Southeast Asia compound networks ran $18-37 billion in 2023 alone. Cumulative since 2020, the figure is approximately $75 billion per Operation Shamrock's accounting.

The 2026 pig butchering enforcement environment has generated, in aggregate, a labeled-address dataset of unprecedented breadth. The 21-address OFAC DPRK designation from March, the Tether $344M Iran freeze, the $701.96M Shunda Park restraining, the Operation Atlantic 20,000 scam wallets — each of these contributes addresses, clusters, and entity attribution to the public record.

Sanctuary ingests these designations as `intelligence_flags` entries with categories like `pig_butchering_terminal_2026`, `huione_pay_outflow`, `xinbi_marketplace_node`, `tudou_guarantee_processor`, and `shunda_park_compound`. Cross-chain edge graph (480 edges in production as of May 2026) connects the TRON USDT inflows to BTC laundering hops and to OTC desk consolidation wallets.

The practical product hook is direct: any crypto exchange, OTC desk, or stablecoin issuer that processes USDT TRC-20 deposits at non-trivial volume sees pig butchering-adjacent flow regularly. Sanctuary's screening surfaces these flows pre-credit, with hop depth configurable per integrator. The cost of running the screening is negligible relative to the cost of having a single $50,000 pig butchering deposit traced back to your wallet by law enforcement.

For Telegram bot operators specifically — including Sanctuary's own bot — the screening hook is "this address received funds from a known compound cluster, do not credit." The use case is real: the Sanctuary bot has flagged adjacent flows multiple times per week throughout 2026, with a representative case being a Cambodian-origin USDT TRC-20 deposit pattern that, on screening, surfaced as Critical with `huione_terminal_hop_3` provenance.

The $15 billion forfeiture is the visible portion of the iceberg. The compound infrastructure that generated it is still operating, with the laundering layer migrated to SafeW, XinbiPay, and a half-dozen smaller successors.

For compliance officers in 2026, the operational lesson is structural: pig butchering laundering is now permanent infrastructure, not an episodic threat. The screening pipeline should treat it as such. The address labels are public. The categorization is mature. The cost of running the screening is below noise. The cost of not running it is the next $50,000 USDT deposit that turns out to belong to a Cambodian compound and lands at your venue.

Screen the cluster. The compounds are not going away. The wallets are how you tell.