Crypto Gambling, Payment Platforms Tied to Kidnap-Murder of Chinese-Filipino Businessman
According to reports from Philippine media outlet GMA Integrated News and statements from the local police (PNP PIO), Chinese-Filipino businessman Guo Congyuan and his driver, Amani Pabilo, were kidnapped in April. Tragically, after their family paid a ransom amounting to 26 million RMB, they were murdered.
Bitrace investigators promptly conducted intelligence analysis on publicly available online information, reconstructing the event timeline through blockchain tracing. Leveraging the Southeast Asian organized crime intelligence database, uncovered additional crypto-related criminal activities linked to the case.
This article aims to disclose and introduce the cryptocurrency laundering tools used by the kidnapping and extortion gang involved in the case.
HuionePay: A Cryptocurrency Payment Tool Exploited in the Case.
HuionePay, operated by Cambodia-based financial entity Huione Group, is a widely used cryptocurrency payment platform in Southeast Asia. It facilitates multi-chain stablecoin settlements in USD, serving a large user base. Due to the permissionless nature and anonymity of cryptocurrency transactions, this platform has been extensively exploited by local organized crime networks for laundering illicit funds, facilitating transfers, cashing out, and storage.
According to a May 27, 2025 report by Sanlian Life Weekly:
"Philippine police disclosed that the ransom paid by Guo Congyuan’s family was converted into USDT (Tether). A significant portion—totaling over $1.365 million USD (approximately 75.58 million PHP)—was withdrawn through HuionePay accounts linked to a financial platform in Cambodia."
Following an exhaustive review of all HuionePay User address transaction records, Bitrace investigators successfully identified an Ethereum address that received and transferred $1.365 million USD worth of USDT between May 4 and May 7, directing the funds to a HuionePay hot wallet address.
Upon further tracing of the fund sources linked to this address, investigators uncovered a connection between the kidnapping and extortion gang and another fraud case currently under investigation by Bitrace. Both incidents are tied to a blockchain address located in Cambodia, establishing a link between the two criminal activities.
This finding suggests that the kidnapping and murder of Guo Congyuan may not have been the gang’s first criminal act.
USD Stablecoins: A Decentralized Double-Edged Sword
USD stablecoins are cryptocurrencies issued on the blockchain by certain institutions through real-world asset collateralization and algorithmic controls, maintaining a value pegged to the U.S. dollar. Leveraging blockchain technology, these stablecoins create a low-cost, high-efficiency, decentralized value transfer system outside the traditional banking framework. They are widely used for cross-border payments, value storage, and transaction mediation.
However, their decentralized nature also makes them highly susceptible to exploitation by criminal networks. Gambling operations, money laundering, illicit trades, and fraudsters increasingly rely on USD stablecoins—particularly Tether (USDT)—to facilitate both upstream criminal activities and downstream fund laundering.
In this case, USDT was explicitly used to transfer and clean ransom payments.
Further tracing of the HuionePay-related funds revealed that they had been bridged across chains from the Ethereum network. Prior to this transfer, the kidnapping gang had engaged in simple movements and laundering of USDT.
A news report stated:
"As of May 11, the Philippine National Police Anti-Cybercrime Group (ACG) disclosed that they had identified and frozen $205,900 worth of cryptocurrency (approximately 11.4 million PHP) in offshore accounts."
Bitrace's reconstructed transaction flow confirms the presence of several frozen USDT addresses, listed below:
In the three days following the incident, these addresses collectively transferred and laundered over $1.76 million USDworth of USDT. Of this amount, $205,500 USDT was successfully intercepted—matching the figure reported in news coverage. However, despite the Philippine authorities executing swift on-chain enforcement, more than $1.4 million USD in USDTmanaged to evade capture, ultimately flowing through a cross-chain bridge into downstream HuionePay addresses.
Cryptocurrency Gambling Platforms: A Hotbed for Money Laundering
Online gambling platforms and their agents provide betting services to gamblers, which, in certain countries or regions, are considered illegal and subject to enforcement actions. These measures include technical disruptions and regulatory oversight targeting platform operators, as well as financial monitoring and anti-money laundering (AML) initiatives aimed at individual gamblers. To evade sanctions imposed by traditional financial institutions, many gambling platforms integrate cryptocurrency payment tools alongside fiat payment channels linked to bank accounts. This hybrid approach enables gamblers to deposit and withdraw funds more efficiently while bypassing traditional financial scrutiny.
Due to the large-scale financial flows within gambling platforms, numerous upstream criminal organizations choose these platforms as vehicles for laundering illicit funds. In this case, the ransom paid by the victim's family underwent its first conversion through local gambling platforms using USDT.
A May 6 press briefing by authorities and media reports noted:
"Guo Congyuan’s family initially paid the ransom in pesos to two casino intermediaries—9 Dynasty Group and White Horse Club—via their e-wallet accounts. Part of the funds were then converted into U.S. dollars before being exchanged for cryptocurrency, specifically USDT."
"An offshore Virtual Asset Service Provider (VASP) successfully froze $79,000 USD (approximately 4.379 million PHP) in account funds."
Utilizing its threat intelligence database, Bitrace conducted an in-depth investigation into transaction activities involving addresses associated with 9 Dynasty Group and White Horse Club during the crime period. By tracing downstream laundering routes, investigators successfully mapped and reconstructed the initial USDT transfer path.
Investigations reveal that over $1.73 million USD worth of USDT was transferred by the gambling platform over four days to lower-tier laundering addresses. Within these transactions, 61,810 USDT was sent to a well-known centralized Virtual Asset Service Provider (VASP), while an additional 30,597 USDT—likely part of the ransom—was either paid through or moved via another VASP. The total sum of these transactions exceeds the 79,800 USDT disclosed by law enforcement, suggesting that a portion of the funds may have successfully evaded seizure.
Risky Stablecoins are Threatening the Crypto Community
In this violent crime targeting the Chinese business community, gambling platforms and illegal payment servicesplayed a crucial role：
Due to their high turnover speed, centralized structure, and offshore operations, gambling platforms have effectively become anonymous cryptocurrency on/off ramps and mixing services. Whether intentionally or inadvertently, they provide money laundering channels for upstream criminal entities.
Illegal cryptocurrency payment platforms, due to their anonymity and cross-border functionality, have become crucial tools for money laundering. The associated risks include complex financial flows, concealed identities, and significant regulatory challenges. In this case, HuionePay explicitly refused to cooperate with foreign law enforcement, citing its policy of "not supporting investigative collaboration outside Cambodia."
Stablecoins, as a fundamental infrastructure of the crypto industry, have been widely adopted by high-risk entities. According to Bitrace's 2025 Crypto Crime Report, transactions involving stablecoins in high-risk activities now account for more than 5% of total transaction volume, posing a significant financial threat to compliant enterprises and retail investors.
Web3 institutions should remain vigilant against these risks by deepening their understanding of local laws and regulations, establishing communication channels with regulators, and cooperating with law enforcement agencies in major jurisdictions worldwide. Strengthening enforcement collaboration will help prevent business and customer addresses from being contaminated by illicit funds.
Reference：
PNP names 2 casino junket operators who allegedly received Anson Que ransom
Press Briefing | May 5, 2025
https://www.youtube.com/watch?v=YgUUzxRTmos
Why do crimes of kidnapping Chinese people occur frequently in the Philippines? A well-known Chinese businessman was torn apart.
https://mp.weixin.qq.com/s/koeJqSSDD8EmCZ8B-e9DNw
Contact us:
Website: www.bitrace.io
Email: bd@bitrace.io
Twitter: @Bitrace_team
LinkedIn：@bitrace tech
