Illicit Liquidity as Battlespace: Rethinking Finance in Asymmetric Conflict

Inside the Digital Architecture Powering Proxy Warfare and State-Linked Crime

Executive Summary

Illicit liquidity has emerged as the hidden scaffolding of modern conflict – a decentralized architecture enabling covert influence, conflict financing, and strategic evasion on a global scale. This report examines the continued operation of Huione, a Chinese-language criminal marketplace that facilitates large-scale financial laundering across Southeast Asia, despite public claims of shutdown. It further explores digital laundering tools more broadly, building toward a working typology. Leveraging encrypted messaging apps and informal financial networks, Huione enables the movement of billions of dollars in illicit funds through fiat-to-stablecoin conversions, card transfers, and in-person cash exchanges–critical infrastructure for state-aligned criminal actors, proxy networks, and scam-industrial complexes.

While often treated as a cybercrime or compliance issue, Huione and networks like it reflect a new reality: decentralized financial platforms now function as logistics and influence infrastructure in irregular conflict.

This article argues that the U.S. and its allies should view this laundering ecosystem not just as a criminal threat, but as a strategic enabler of adversarial statecraft. Without a shift in how threat finance is integrated into operational planning, on-chain laundering infrastructure like Huione will continue to outpace enforcement, undermine deterrence, and fuel irregular conflict below the threshold of war.

Introduction

Starting in early 2024, blockchain analysts began tracing a set of suspicious transactions flowing out of Shwe Kokko–a lawless border town in Myanmar known for its Chinese-backed casinos and scam compounds. The money trail wound through obscure stablecoin swaps, informal brokers, and encrypted Telegram channels before disappearing into the digital void. According to open-source intelligence, the proceeds, originating from online fraud and forced labor, are ultimately linked to the financial wing of the Karen National Army (KNA), a militia currently engaged in armed resistance against Myanmar’s military regime.

This case is not an isolated one. Across the globe, armed groups exploit digital finance to fund their operations, evade sanctions, and project influence across borders. From Yemen’s Houthi rebels trading sanctioned Iranian oil with Chinese refineries, to Southeast Asian insurgents laundering vast sums in proceeds from brutally exploitative scam centers, evidence suggests militant groups increasingly launder their illicit gains through informal online networks. One such network is Huione, which has laundered billions of dollars through its highly resilient, decentralized digital infrastructure.

Huione Guarantee, a subsidiary of Huione Group, is a loosely organized network of Chinese‑language Telegram channels and informal money brokers, operating out of Cambodia. It facilitates high-volume laundering through stablecoins, escrow-like “guarantee” services, gift-card conversions, and direct fiat exchanges. Among its top executives is Hun To, a cousin of Cambodian President Hun Manet–one of Beijing’s most reliable allies in the region. Despite public claims of a shutdown in May, Huione continues to function as a critical backend for scam compounds, sanctioned actors, and gray market networks.

Illicit finance is no longer a secondary enabler of conflict–it has become strategic terrain. Until military and intelligence planning fully integrates the financial dimension, adversaries will continue to weaponize liquidity with little resistance.

Legacy vs. Reality: Why Conventional CTF Tools Are Failing

For decades, counter-threat finance (CTF) operations have relied on a core set of tools: Suspicious Activity Reports(SARs), wire transfer tracing, and international cooperation through systems like SWIFT. These models assume that most illicit finance flows through formal institutions—banks, remittance services, and regulated money transmitters. But this assumption is increasingly outdated.

Today, insurgent groups, proxy forces, and transnational criminal networks operate in a parallel financial ecosystem—one designed to avoid the very systems traditional CTF tools are built to monitor.

Instead of wire transfers, these actors use stablecoins–digital tokens pegged to fiat currencies and moved easily across borders without banks. Instead of formal remittance services, they rely on informal brokers, often functioning as over-the-counter intermediaries, embedded in ethnic, linguistic, or diaspora networks. And instead of SWIFT messages, they communicate through encrypted apps like Telegram and WeChat, where entire money-laundering marketplaces function out of public view.

Virtual economies–such as those embedded in scam centers, in-game asset markets, and social media monetization—have become viable sources of revenue and platforms for money movement. These systems allow for peer-to-peer value transfer, rapid obfuscation, and low enforcement visibility, especially when shielded by weak regulatory regimes or state complicity.

Most CTF frameworks are not designed to detect or disrupt financial flows that evade the banking system. And even when red flags are triggered, enforcement often stops at jurisdictional boundaries. By contrast, platforms like Huione Guarantee operate within a legal gray zone–unlicensed in most of the jurisdictions they touch but are tolerated or even protected within their host countries.

https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/Opportunities-Challenges-of-New-Technologies-for-AML-CFT.pdf?utm_source=chatgpt.comThe result is a growing enforcement gap. State and non-state actors alike are learning to operate in spaces where sanctions carry less relevance, banking oversight is minimal, and enforcement agencies lack both visibility and jurisdiction. Without a shift in how CTF is conceptualized and deployed, these alternative systems will continue to grow–fueling insurgency, proxy warfare– in addition to advanced criminality–far beyond their points of origin.

Case Study Cluster: Illicit Liquidity in Action

Illicit finance is now a primary enabler of armed groups operating in strategic gray zones. Whether through Huione or possibly through equivalent broker-mediated platforms, these actors rely on decentralized laundering infrastructure that overlaps with Chinese regulatory and economic ecosystems–providing both operational funding and resilience. Here are a few examples where the Huione case provides direct evidence of use, and where further research is needed to determine the nature of laundering pathways.

Ansar Allah (AKA: The Houthis), Yemen

• A May 2025 Elliptic investigation linked $39 million in illicit flows to Houthi-controlled wallets via Huione-affiliated OTC brokers operating in Yemen and Southeast Asia.
• In parallel, the Houthis have sold Iranian oil to Chinese “teapot” refineries in Shandong—allowing for off-the-books revenue outside U.S. Treasury control.
• The Houthis’ may have laundered these illicit oil proceeds through Huione-style stablecoin conversions, anonymized brokers, and encrypted cash channels.
• The Houthis channel their illicit proceeds into ballistic missile development, drone programs, and influence operations, making illicit liquidity a critical pillar of Houthi capability.

Karen National Army (KNA), Myanmar

• 2025 U.S. Treasury sanctions confirm that the KNA facilitated and profited from scam compounds in Shwe Kokko tied to forced labor, trafficking, and cybercrime.
• Sanctioned shortly after Huione, the KNA is a likely–but not publicly confirmed—user of these or similar laundering channels.
• The KNA operates in territory influenced by China-tied real estate and criminal enterprises, making it structurally embedded in a transnational gray zone economy.
• As with other conflict-linked criminal profit streams, illicit funds flowing through KNA-controlled scam operations are likely channeled into weapons, militia pay, and territorial control–similar to broader patterns documented in United National Office on Drugs and Crime (UNODC)/Global Initiative against Transnational Organized Crime (GI-TOC) analysis.

Myanmar National Democratic Alliance (MNDAA, AKA: Kokang Army), Myanmar

• The Myanmar National Democratic Alliance Army, composed of Mandarin-speaking ethnic Han Chinese, operates along the China-Myanmar border and maintains long-standing ties to Yunnan’s informal trade and finance ecosystems.
• The MNDAA has operated and protected scam compounds in Kokang, including in Laukkai, where cyber fraud targeting overseas victims has been widespread. These operations positioned the group within a broader ecosystem of illicit finance, logistics, and trafficking networks along the China-Myanmar border—though the mechanisms used to launder proceeds remain opaque.
• The MNDAA has participated in Chinese-brokered ceasefires, benefited from border gate openings and infrastructure access, and aligned rhetorically with Beijing’s regional narrative.
• While no confirmed link to Huione has been documented, MNDAA’s involvement in the scam compound ecosystem and operational alignment with Yunnan’s gray finance routes make it a plausible participant in this emerging gray finance ecosystem.

Shared Strategic Profile

• Each group operates near or within China’s shadow financial sphere
• Each has benefited–directly or indirectly–from China’s regulatory fragmentation or tolerance of illicit flows
• All use illicit finance not just for survival, but for the projection of asymmetric power

The Illicit Liquidity Complex: A Working Typology

Over the past five years, digital laundering tools have coalesced into a loosely connected ecosystem. Armed groups, sanctioned regimes, and criminal syndicates now operate within a shared financial domain. This domain is best described as an Illicit Liquidity Complex.

The Illicit Liquidity Complex does not operate as a single platform or network. It functions as an ecosystem of loosely affiliated brokers, laundering channels, and pseudo-legitimate financial services. These components collectively enable high-speed, low-visibility liquidity transfer across borders. The system’s effectiveness stems not from technical sophistication. It derives from structural fragmentation, operational adaptability, and regulatory absence.

Core Components

• Informal Stablecoin Brokers: Middlemen who convert crypto to fiat and back—usually by communicating on Telegram or WeChat—without know-your-customer (KYC) protocols, often tied to language or diaspora trust networks.
• Shadow Financial Rails: Infrastructure that moves value without touching the banking system: OTC desks, Telegram-based escrow services–often automated or managed anonymously, in-person swaps, gift card laundering, and multiple wallet hops.
• Pseudo-Legitimate Platforms: Exchanges, fintech front ends, or “payment services” that provide a compliant façade while facilitating high-volume laundering behind the scenes (Ex, Huione).
• Social Monetization Layers: Streaming apps, fake shops, and in-game tipping tools that convert scam earnings into surface-level income—popular among scam syndicates and hybrid operators.

The convergence of state-backed threats and informal financial systems makes this multifaceted ecosystem especially dangerous. State-aligned militias, cybercriminals, and sanctioned entities now use the same rails – or closely related ones. The same Huione-linked broker might move funds for a scam ring one day and a sanctioned militant group the next. This ecosystem is no longer merely a criminal concern; it is a form of financial infrastructure – built for plausible deniability, speed, and resilience. Its growth is outpacing what traditional enforcement can track.

Toward a Strategic Response

Confronting the Illicit Liquidity Complex will require more than conventional financial enforcement. Traditional counter-threat finance methods—built around SARs and bank-led compliance–fail to engage the architecture of decentralized, broker-mediated laundering networks. A coherent response must address both tactical intervention and strategic adaptation across military, regulatory, and intelligence domains.

Tactical Responses

• Map financial enablers in active and emerging conflict zones. Conventional tools do not capture the movement of funds that never enter formal institutions. Field-level analysts and signal intelligence (SIGINT) operators must track informal stablecoin brokers, peer-to-peer transactions, and escrow services that exist entirely outside the banking system. Mapping should prioritize network structures and chokepoints–not just endpoints.

• Target and disrupt laundering infrastructure. Focused action against digital escrow providers, laundering-as-a-service platforms like Huione, and OTC brokers can have a disproportionate impact. These entities perform functional roles similar to tunnels, supply caches, or encrypted communications. Their removal degrades adversarial force projection and financial resilience.

Strategic Shifts

• Embed financial mapping in counterinsurgency (COIN) and hybrid warfare doctrine. Financial networks must be treated as terrain. This includes embedding forensic financial analysis into campaign planning, target development, and stability operations. Doctrinal integration should treat laundering infrastructure as both a logistics system and a narrative engine.

• Partner with blockchain analytics firms and adjacent platforms. Blockchain firms possess tools to trace stablecoin movement, cross-chain swaps, and laundering loops. Partnerships with these firms–along with digital platforms vulnerable to abuse (e.g., gaming economies, social streaming networks)–will expand visibility into high-velocity, low-signature financial flows.

• Build multi-jurisdictional regulatory frameworks

Financial fragmentation remains one of the greatest enablers of illicit liquidity. Ireland and the EU have moved toward tighter regulation of stablecoin flows and informal brokers through Markets in Crypto Assets Regulation (MiCAR). Such frameworks should be expanded and adapted to other high-risk environments, including Southeast Asia, the Gulf, and Central Asia.

Conclusion: Mapping the Unseen Battlespace

Illicit liquidity now constitutes core terrain in modern conflict. Armed groups, proxy actors, and sanctioned states no longer rely on traditional banking or formal remittance channels. They exploit decentralized laundering infrastructure—composed of stablecoin brokers, escrow bots, and regionally protected financial corridors—to finance operations, sustain logistics, and wage narrative warfare.

Platforms like Huione are not peripheral or purely criminal. They function as tactical assets–digital equivalents of tunnels, weapons caches, or encrypted communications. These systems enable recruitment through economic incentives, fund weapons acquisition, and sustain political influence across borders. Their continued operation erodes deterrence and complicates battlefield intelligence.

Failure to identify, map, and degrade these systems will cede initiative in conflicts that remain below the threshold of war. The architecture behind illicit liquidity functions as enemy infrastructure and must be treated as such, with its operators prioritized as strategic targets. Without this shift, irregular actors will continue to weaponize liquidity–transforming stablecoins and informal brokers into engines of asymmetric power.