In April this year, Chinese-Filipino businessman Guo Congyuan and his driver were kidnapped and murdered in the Philippines, despite the family paying a ransom of 26 million yuan. As the investigation deepened, cryptocurrency became a key clue for the police to trace the flow of the ransom.
The Binance Financial Intelligence Unit (Binance FIU) recently revealed that it has assisted the Philippine police in tracking a ransom amounting to 3.75 million US dollars, of which more than 1.365 million US dollars flowed out through a crypto payment platform called HuionePay, eventually ending up in several criminal wallets. These funds were repeatedly split and transferred across chains, forming a highly complex path of crypto laundering.
According to investigations, the victim's family initially handed over the ransom to local casino intermediaries "9 Dynasty Group" and "White Horse Club," which converted the cash into stablecoins like USDT and then transferred it through on-chain wallets. The on-chain tracing platform Bitrace disclosed that this process not only involved illegal gambling platforms but also connected several known fraudulent wallets.
One Ethereum address received 1.365 million USDT between May 4 and May 7 and quickly transferred it to the HuionePay hot wallet. Bitrace confirmed that this address was previously involved in another crypto fraud case involving Chinese citizens, indicating that this criminal gang has the characteristic of reusing on-chain resources across cases.
HuionePay, operated by the Cambodia-based Huione Group, appears to be a legitimate crypto payment platform but has long served as an anonymous settlement channel for underground activities such as gambling, telecom fraud, and high-interest loans. On May 27, Philippine media reported that the police found that this platform's associated addresses received most of the ransom from the Guo Congyuan case, but HuionePay refused to assist in the investigation, hindering international judicial cooperation.
As of May 11, the Philippine National Police Anti-Cybercrime Group (ACG) stated that about 206,000 US dollars in crypto assets had been frozen, but more than 1.4 million US dollars had already flowed out of control, entering HuionePay and its downstream wallets.
Gambling platforms and stablecoins form the core channels of underground finance
This case further reveals the key role of crypto gambling platforms in the ransom laundering chain. Due to regular regulatory blockades faced by illegal gambling, these platforms commonly introduce stablecoins like USDT as settlement mediums and facilitate rapid fiat conversion through casino intermediaries, significantly lowering the threshold for money laundering.
According to an official report on May 6, within four days after the incident, two gambling platforms involved transferred a total of 1.73 million US dollars in USDT to downstream addresses, some of which were transferred to VASPs (Virtual Asset Service Providers), and some were suspected to continue being used for payments or to cover tracks. The police only froze a small portion of the total funds, indicating that a large amount of the illicit money had successfully "detached from the chain" and entered anonymous address pools.
The risk of "contamination" in the crypto sphere is increasing
Bitrace analysis believes that USDT and other stablecoins, as high-frequency laundering mediums in this case, have become standard tools for on-chain black industries. With the assistance of illegal platforms like HuionePay, the fund transfer process features anonymity, cross-border nature, and difficulty in tracking, greatly challenging regulatory capabilities.
The "2025 Crypto Crime Report" points out that the use of stablecoins in high-risk criminal activities has exceeded 5%, indicating that they are transitioning from "neutral tools" to "high-risk mediums."
The case also highlights the compliance challenges faced by the Web3 industry. Although the involvement of compliant institutions like Binance and Bitrace has effectively blocked some of the illicit funds, the refusal of overseas platforms to cooperate in investigations, judicial collaboration barriers, and technological opposition still make it difficult to completely block the escape channels for illicit funds.
Web3 companies and investors should enhance their risk control awareness and be wary of on-chain contamination risks. Strengthening compliance construction, proactively reporting suspicious transactions, and establishing collaboration mechanisms with key global law enforcement agencies are necessary paths to prevent involvement in black industry chains.
The Guo Congyuan case may just be the tip of the iceberg, and the real "pursuit of the murderer" has just begun.
