Investigation of Centralized Stablecoin Freezing Events: A Case Study of Cambodia's Huibang Group

Centralized stablecoins are managed through smart contracts on blockchain networks, with their value pegged to fiat currencies. In addition to possessing the common characteristics of cryptocurrencies, centralized stablecoins also grant issuers significant operational authority, including the ability to mint, burn, and restrict usage rights for specific addresses.

Such freezing actions are usually triggered by requests from law enforcement agencies or significant security incidents, aiming to prevent illegal activities and protect damaged assets. As the application of centralized stablecoins in the traditional financial system increases, related illegal incidents have also increased, leading to more frequent freezing actions. This has caused considerable negative impact on some Web3 businesses that operate normally but inadvertently receive risky funds, even bringing legal risks.

The following is an analysis of the frozen incident of 29.62 million USDT of the Cambodia Huy Wang Group.

Huiwang Group Overview

Huiwang Group is a large financial group in Cambodia, with businesses covering cryptocurrency wallets, payments, transaction guarantees, insurance, and exchanges. Its core payment and guarantee services heavily utilize USDT. According to data from the on-chain risk capital monitoring platform, Huiwang's HuionePay and HuioneGuarantee have over 180,000 official and user addresses, making it the largest-scale cryptocurrency enterprise in the region, with influence spreading across Southeast Asia and even East Asia.

From June 2022 to June 2024, the monthly funding scale of Huibang's related business addresses showed an upward trend, increasing from a low of 1.03 billion USDT to a high of 8.39 billion USDT, with a total funding scale of 102.397 billion USDT over the two years. During the same period, the daily average balance of these addresses remained at 35.68 million USDT.

Due to Southeast Asia being a high-risk area for illegal cryptocurrency activities, the business address of Huiwang has been affected to some extent. Taking one of the core business addresses of HuioneGuarantee as an example, from July 2023 to June 2024, among the total inflow of funds to this address, the proportion of high-risk gambling funds is 1.62%, the proportion of high-risk funds from black and gray market transactions is 15.71%, the proportion of high-risk funds related to money laundering is 2.50%, and the proportion of high-risk funds related to fraud is 0.09%.

Frozen Event Analysis

On July 13, 2024, an address on the TRON network was restricted, and 29.62 million USDT were frozen. Investigations showed that the address completed over 1 billion USDT in transactions just 5 days after its creation, receiving deposits from many addresses marked as HuionePayUser, as well as funds from other official Huion accounts. Therefore, it is confirmed that the address is an official business address of Huion, and the reason for the freeze may be due to the receipt of a large amount of stolen funds.

Further investigation revealed that some assets from a previous hacking incident at a Japanese exchange were exchanged through cross-chain transactions into HuionePay. Specifically, approximately 610 BTC were transferred to other chains via different cross-chain bridges, and then exchanged for about 31.82 million US dollars in stablecoins, of which about 14 million US dollars eventually entered a frozen address.

It is worth noting that, aside from the incidents mentioned above, some of the funds from another exchange theft incident are also related to Huion. In early June 2024, at least 1.05 million USDT involved flowed into HuionePay user addresses and were transferred to multiple official Huion business addresses.

Currently, there is no direct evidence to suggest that this freeze is related to the two security incidents. However, considering that other business addresses of Huiwang were not affected, this at least indicates that this freeze is not targeted at Huiwang Group itself.

Analysis of Fund Flow After Freezing

The frozen 29.63 million USDT accounts for 75% of the reserves of Huiwang, causing certain withdrawal pressure. Analysis shows that 2.5 hours after the freezing event, Huiwang activated a new business address to handle user demands. This address completed transactions of 733 million USDT in a short period, but no obvious anomalies were found.

Analysis of the counterparties for transactions to the new address found that among the top ten counterparties by capital inflow, two Huifang guarantee business addresses collectively transferred in 88 million USDT, accounting for 23.64% of the total inflow. Among the top ten counterparties by capital outflow, three Huifang guarantee business addresses collectively received 28 million USDT, accounting for 7.76% of the total outflow.

This indicates that after the freezing event, Huiwang experienced a large-scale outflow of funds, but the official promptly replenished the reserves from other business addresses, able to meet the users' withdrawal needs.