TL;DR:
- Blocksec uncovered a $1.6 billion Ponzi scheme that moved funds through USDT on the TRON network over 16 months.
- The VerilyHK platform posed as a legitimate health technology company to attract investors and conceal its illegal structure.
- Funds flowed to addresses linked to Huione Group, previously identified as a key node in crypto money laundering.
Blockchain security firm Blocksec revealed a Ponzi scheme that moved at least $1.6 billion in USDT on the TRON network over 16 months, between October 2024 and February 2026. The investigation, based on on-chain analysis, identified a set of interconnected wallets organized in multiple functional layers: fund collection addresses, intermediaries, payment channels, and a shared liquidation point on exchanges.
The scheme operated under the guise of VerilyHK, a platform that presented itself as a health technology group headquartered in Hong Kong. Its name deliberately evoked Verily Life Sciences, an Alphabet subsidiary, to project legitimacy. VerilyHK claimed to operate in artificial intelligence applied to healthcare, big data analytics, and medical devices, though none of those activities were real.
Blocksec Exposes the Anatomy of the Scam
The wallet structure used by VerilyHK is quite complex. The scheme rotated at least 15 collection addresses, divided into eight distinct generations that succeeded one another throughout the active period. Over time, the volume processed grew steadily until the last generation of wallets moved $900 million in less than four months. Blocksec cautions that not all of that volume represents funds directly taken from users, as some transfers may be internal recycling transactions.
The report originated from a victim who reported losses and provided the deposit and payment addresses, which made it possible to trace the entire network. Without that intervention, the scheme would have continued operating undetected by Blocksec.
Huione Group: The Link Responsible for Asset Laundering
Blocksec’s on-chain analysis also exposed connections to Huione Group, the Cambodian custody service previously linked to multiple hacks and laundering schemes. In this case, the Ponzi’s central hub reportedly processed around $4.6 million with addresses associated with Huione, while additional deposits of $4.2 million and $1.5 million were made directly to two of the group’s wallets.
This finding aligns with prior investigations that had identified Huione as recurring laundering infrastructure within the illicit crypto ecosystem.
USDT currently exceeds 86 billion tokens in circulation on the TRON network and more than 73 million active wallets. The network processes around 34 million daily transactions, close to its all-time high.
