Report: Online cybercriminal marketplace is part of Cambodian conglomerate

Computer analytics firm Elliptic says Huione Guarantee has handled US$11 billion in transactions since 2021.

An online marketplace widely used by cybercriminals in Southeast Asia is part of a Cambodian conglomerate that has links to the family of Senate President Hun Sen, according to a report from London-based computer analytics firm Elliptic.

The July 10 report from Elliptic said that Huione Guarantee's online marketplace has acted as a clearinghouse for criminal groups – many of which operate in special economic zones in Cambodia and Myanmar.

Huione Guarantee has handled transactions totaling at least US$11 billion since 2021 from merchants who offer technology, data and money laundering services, Elliptic said.

Some of the merchants conduct “pig butchering” scams, in which victims are lured into putting large sums of money into phony investment schemes, the report said. Those performing the scams are often also victims held against their will and forced to find people to dupe using various online platforms.

Not all of the $11 billion could be traced to illegal transactions, but evidence shows “very strong indications” that most of the payments stemmed from illicit activity, Elliptic’s report said.

“Many of the merchants explicitly offer money laundering services, including accepting payments from victims around the world, transferring it across borders and converting it to other assets including cash, stablecoins [a form of cryptocurrency], and to Chinese payment apps,” Elliptic said.

Huione Guarantee is part of Huione Group, a Phnom Penh-based financial conglomerate that includes Hun To – the nephew of Hun Sen and a cousin of Prime Minister Hun Manet – as a director for one of its units.

ENG_KHM_CYBERCRIME_07122024.2.jpg
Barbed wire fences are seen outside a shuttered Great Wall Park compound where Cambodian authorities said they had recovered evidence of human trafficking, kidnapping and torture during raids on suspected cybercrime compounds in the coastal city of Sihanoukville, Cambodia, Sept. 21, 2022. (Cindy Liu/Reuters)

The conglomerate was founded in 2014 as a company providing luxury services, including helicopter leasing and hotel reservations, according to its website. It now has interests in insurance, real estate and airlines.

RFA was unable to reach government spokesman Pen Bona or the spokesman for the government’s anti-corruption unit, Soy Chanvichet, for comment on Elliptic’s report. Attempts to reach Hun To were also unsuccessful.

‘We need to clean our house’

Ministry of Interior spokesman Touch Sokhak refused to comment on the report. But he added that the government follows the law, regardless of someone’s status or connections.

“We don’t think of the suspects’ affiliations or their influences or power,” he told Radio Free Asia. “As previously stated by leaders, we will implement the law. We need to clean our house,” he said.

On Monday, Reuters reported that Huione received cryptocurrency worth more than US$150,000 from a digital wallet used by Lazarus, a North Korean hacking outfit – a possible glimpse to how Lazarus has laundered funds in Southeast Asia.

The crypto was received between June 2023 and February 2024, according to blockchain data reviewed by Reuters.

Huione declined to specify to Reuters why it had received funds from the wallet. The company said Hun To’s directorship doesn’t include day-to-day oversight of its operations.

Cambodia's central bank said in a statement to Reuters that payments firms like Huione are prohibited from dealing or trading cryptocurrencies and digital assets.

The National Bank of Cambodia, or NBC, said in 2018 that the ban was put in place to avoid investment losses due to the volatility of cryptocurrency, cybercrime and the anonymity of the technology “which may cause risks of money laundering and financing of terrorism.”

The NBC said in Monday’s statement to Reuters that it wouldn’t “hesitate to impose any corrective measures” against Huione. The statement didn’t say if such an action was planned.

The central bank added that it was drafting regulations to punish the use of cryptocurrency for fraud, money laundering, cybersecurity threats and other illegal activities, according to Reuters.

Cambodia’s international reputation

Elliptic’s revelations may further deter international investors from doing business in Cambodia, according to Soeung Sengkaruna, a former spokesman for human rights group Adhoc. They could also put international aid and preferential tariffs at risk, he said.

“It affects both the economy and the reputation of the country on the international stage,” he told Radio Free Asia. “The news will come to them that Cambodia is a country full of crime, and that there is a connection to the country's leaders.”

It was already well-known that powerful Cambodians are involved in money laundering and drug trafficking, but the Elliptic report still reflects poorly on the country’s image, legal scholar Vorn Chanlot said.

Top officials should acknowledge the reality of the problem and work toward a solution based on the principles of integrity, transparency and the rule of law to restore the trust of the international community and foreign investors, he said.

“If it is found that the rulers and businessmen close to the rulers have committed crimes, then all of them must be held accountable before the law,” he said.

RFA also was unable to reach Ministry of Interior secretary of state Chou Bun Eng to ask about the Elliptic report. Chou Bun Eng also serves as the permanent vice-chair for the government’s anti-human trafficking committee.

Translated by Yun Samean. Edited by Matt Reed.