For Brad Thorne, a police detective in Boise, Idaho, a single string of letters and numbers epitomizes how a sinister digital underworld relies on USDT, a popular cryptocurrency also known as tether. This string represents a cryptocurrency wallet address belonging to the Huione Group, a Cambodia-based financial firm known for large-scale money laundering, where Thorne and other investigators have repeatedly traced huge sums of illicit USDT. Thorne said that one local man recently took his life after losing a large amount of money to scammers who channeled ill-gotten USDT into the same crypto wallet.
“It’s the embarrassment, the shame of it all,” Thorne said of the now-deceased victim. “He’d been a community leader his whole life and I think that was too much for him to take.”
In recent months, even as U.S. authorities moved to sever Huione from the country’s financial system, Huione’s crypto wallets continued to transmit massive sums of USDT, whose value is pegged to the U.S. dollar. The Treasury Department targeted Huione for laundering billions of dollars in illicit proceeds, including for North Korean hackers and organized crime groups engaged in human trafficking and industrial-scale scam operations.
As the issuer of USDT tokens, the crypto firm Tether commands vast power to stop or disrupt criminal activity in cryptocurrency. It can blacklist wallet addresses and freeze its tokens in place to stop bad actors from moving ill-gotten proceeds. Thorne and other experts question whether Tether — which boasts a 99% profit margin — should take a more aggressive approach to tamping down crime.
It has destroyed me mentally and financially.
— Kamlesh Mungekar, a crypto scam victim
An analysis by blockchain tracing experts found that after U.S. authorities called Huione a money laundering entity in May, the Huione wallet address tied to the Idaho death transmitted at least $1.4 billion in USDT over a matter of weeks ending in mid-October. At the International Consortium of Investigative Journalists’ request, crypto tracing firm ChainArgos, as well as analysts Yury Serov and Aleks Ring examined the address’s cryptocurrency transactions, which are recorded on a public ledger known as the blockchain. Based in El Salvador, Tether was under no legal obligation to block these funds, according to Jonathan Reiter, chief executive of ChainArgos.
Still, Erin West, a former prosecutor and founder of Operation Shamrock, a nonprofit focused on stopping cyber scams, said Tether should have used its power to stop its tokens from interacting with the Huione address.
“It is reprehensible that Tether would let so much money flow through a service flagged for money laundering,” West told ICIJ of the flows through Huione. “They should have frozen this.”
Last month, ICIJ released The Coin Laundry, a cross-border investigation with 37 media partners that examines how major industry players provide criminals with the tools to launder the proceeds of scams, theft, and other crimes — while those harmed are left with little hope of justice. The reporting included numerous examples of USDT being used by crime groups, including the Sinaloa cartel, Chinese traffickers of fentanyl and other drugs, and large-scale scam operators.
So-called stablecoins like USDT have operated in a legal gray area, under a patchwork of evolving laws around the world. In the U.S., the recently passed Genius Act affirms that stablecoin issuers operating in the country must comply with federal rules designed to prevent criminals from moving money. Meanwhile, a group of governments around the world is still studying how to address money laundering risks associated with stablecoins.
Tether has publicly said it takes a proactive approach to stopping bad actors from using its tokens. “Tether unequivocally condemns the illegal use of stablecoins and is fully committed to combating illicit activity,” a spokesperson for the firm told ICIJ in an emailed statement. “Tether has a proven track record as the industry leader in working with global law enforcement to stop bad actors.”
The decision to freeze cryptocurrency cannot be made lightly or arbitrarily because such actions could unfairly lock innocent users’ funds or disrupt the activity of legitimate businesses. Tether has said it conducts careful due diligence on customers it directly sells tokens to. But once those tokens enter general circulation and frequently change hands, the firm does not assess every token holder. But Tether can still block USDT from being transmitted through a wallet address and stop tokens from changing hands.
Inaction also has a price. On Oct. 8, a San Diego man named Kamlesh Mungekar, 54, who lost his savings to a crypto scam, emailed Tether customer support begging the firm to freeze his stolen assets. “Please help me to recover my lifetime of retirement fund,” Mungekar said in the email reviewed by ICIJ. Tether responded that it was “sorry to hear about this unfortunate situation,” adding that it was “not in a position to determine the validity of these transfers.”
The crypto wallet address Mungekar had identified in his email to Tether was pouring its USDT into the same Huione address that Thorne had traced other victims’ funds to, according to four blockchain tracing experts ICIJ consulted. All of this happened after the U.S. Treasury Department had called Huione a critical node for money laundering.
“This crime has destroyed my retirement savings,” Mungekar said in a subsequent email to Tether. “It has destroyed me mentally and financially.”
Tether has partnered with major blockchain analytics firms like Chainalysis to identify illicit activity and tackle crypto crime. These analysis firms specialize in telling their users which wallet addresses belong to whom. Without analysis tools, such addresses often appear only as anonymous blocks of code on the blockchain. Ownership information is crucial for compliance departments, which monitor transactions to identify criminal actors and suspicious activity.
Tether has the means to “monitor its ecosystem and we have to do it and we have to do it the best way we can,” Tether CEO Paolo Ardoino said in a Chainalysis podcast last year. He told the Chainalysis host that “we proved also with collaborating with you guys, we could proactively find people … that were abusing the system and trying to scam others through pig-butchering and romance scams.”
“Pig butchering” refers to sophisticated impersonation scams often orchestrated by organized crime groups that have been closely associated with Huione.
ICIJ found that the compliance tools Tether uses, including Chainalysis, had identified the wallet address linked to the Idaho suicide and Mungekgar case as being owned by Huione. This means Tether would have been able to see that an entity flagged for criminal activity was moving vast sums of its token, at least according to the analysis tools Tether has publicly aligned itself with. TRM Labs, another major blockchain analysis firm and partner of Tether, also identified this wallet address as belonging to Huione Group.
But, in response to questions about the same address, Tether said it “cannot comment on claims made by third-party analytics firms or ongoing law enforcement investigations.”
“Decisions to freeze wallets are executed in coordination with law enforcement with jurisdiction and are not made unilaterally based on external labeling or speculative attribution,” Tether added. “Freezing wallets prematurely during an active investigation can impede evidence collection and disrupt efforts to dismantle criminal networks.”
In statements to ICIJ, Chainalysis and TRM Labs both said they stand behind their attribution of the wallet address to Huione.
Last year, Tether joined with TRM Labs and TRON, a large crypto network, to form an anti-financial crime partnership that pledged to proactively work with law enforcement to stop criminals from moving USDT. The effort recently announced it had frozen more than $300 million in criminal assets globally.
The partnership’s “rapid success in freezing criminal assets sends an unmistakable message: if you’re using USDT on TRON for crime, you will be caught,” Justin Sun, founder of the TRON blockchain, said in a press release about the effort.
The Huione wallet address linked to the Idaho and San Diego victims began its activity on Aug. 29 of this year and quickly started moving tens of millions of USDT per day, according to ChainArgos. This was more than three months after the U.S. Treasury Department called Huione a money laundering entity and proposed blacklisting the group. Even after U.S. authorities took the subsequent step of announcing that Huione would be formally severed from the U.S. financial system in mid-October, the address received more than 65 million USDT and sent out more than 65 million USDT , according to an analysis by ChainArgos. The U.S. blacklist did not take effect until Nov. 17. The wallet address now sees only sparse activity and has not been frozen for USDT.
Separately, ICIJ’s Coin Laundry revealed that, between July 2024 and July 2025, several other Huione wallet addresses sent hundreds of millions of dollars’ worth of USDT to the major cryptocurrency exchange Binance, and between February and July 2025 to the exchange OKX. The funds flowed from Huione into customer accounts at Binance and OKX while the two exchanges were under heightened scrutiny from U.S. authorities.
Tether did not respond to questions about these transfers.
GIVE TO HELP US INVESTIGATE!
Help us fight corruption, injustice and inequality with just $25/month.
After contacting him in late September, Mungekar’s scammers posed as New Delhi police who claimed that Indian authorities were investigating him for money laundering, according to a San Diego police report about his case. He said the scammer warned that Mungekar’s ability to travel back to India would be restricted if he did not cooperate and then threatened jail time. The scammer then walked him through an elaborate series of steps: liquidating his retirement accounts, converting those assets into more than a million dollars worth of cryptocurrency, and sending these crypto funds to the scammer, according to a report Mungekar filed with California’s attorney general.
“They completely hijacked my brain,” Mungekar told ICIJ. “I was under a lot of stress.”
Mungekar had paid his scammers in ether, another popular cryptocurrency. Once in possession of Mungekar’s ether, his scammers converted those assets to USDT, a more stable store of value, and moved them to the TRON blockchain, according to experts who analyzed the transactions at ICIJ’s request. Then the funds were deposited into a wallet address that channeled the vast majority of its USDT into the same Huione wallet address also associated with the Idaho death, according to an analysis by four blockchain tracing experts, including Jonathan Williams of OakThorn Investigations and Joshua Cooper-Duckett ofCryptoForensic Investigators.
Mungekar said the scammers encouraged him to get his family and friends to pay into the scam as well. That was when he realized something was amiss. Mungekar said that withdrawing his retirement funds triggered enormous tax bills that he has no ability to pay.
“There are huge penalties,” Mungekar said. “I don’t know how I will come out of this.”
In Idaho, detective Throne not only traced victim funds to the same Huione address, but, when he dug deeper, found it was also involved in USDT payments to fund scammers’ fraudulent web platforms that ensnared hundreds of victims.
“This is the deeper infrastructure of money laundering,” he said.
Contributors: Agustin Armendariz, Miguel Fiandor Gutiérrez
