A Second Front, and a Name We Didn't Expect: Tracing WORLDPAYRMB's Infrastructure to Huione

We said we'd keep watching

When we published our investigation into WORLDPAYRMB's USDT laundering pipeline, we ended on a promise: if new connections surfaced, we'd follow up. One did, almost immediately, and it led somewhere much bigger than a second copycat channel.

A different brand, the same playbook

ZyPay-China-India Payments is a small Telegram channel, 569 subscribers, created in July 2026. On the surface it looks unrelated to WORLDPAYRMB: different name, different staff, different bank list. But the moment we looked at its actual content, the resemblance was immediate. A pinned post titled "Stock Fund Account List" (the same fund-by-criminal-origin categorization WORLDPAYRMB uses), the same bank types (Axis Neo Corporate, Bandhan, AU, RBL, CBI), and a rotating cast of four named staff accounts (Andy, Carl, Ari, Alan) running day-to-day operations under handles like @zypay111 and @zypay777.

We pulled the channel's message history and found two real, named business bank accounts showing the same fan-out signature we'd already documented: HOTEL SUPREME (Central Bank of India) and SRI VENKATESHWARA TECHNOLOGIES PVT LTD (Hyderabad), the latter processing 4,499 NEFT transactions in a single day. We also found something we didn't expect to be able to get: a screenshot of an internal transaction, timestamped to the minute, that matched a transaction we had independently pulled from the blockchain, same two wallets, same amount, same second. The channel's own "proof of work" photos and the public ledger are describing the same event: THLhhjvTNeLYbVFwHb3WKG7rnQt59a3L37 sending 1,440 USDT to TJkWJnY3ucZuAiyHzs1iKHFwpk7CWksSLV, the channel's own collection wallet, internally labeled "Account 01" in its screenshots.

Mapping the wallets behind ZyPay's activity turned up a tight, five-node mesh: TJkWJnY3ucZuAiyHzs1iKHFwpk7CWksSLV, THLhhjvTNeLYbVFwHb3WKG7rnQt59a3L37, and three others, all transacting directly with each other in nearly every possible direction. That's the same interconnection pattern as the original cluster, just smaller.

Then we followed the money one hop further out, and that's where this stopped being a story about a second channel.

Two wallets that predate both operations

Mapping ZyPay's mesh outward turned up two much larger wallets sitting behind it: TVhNNCWSoRMhxWoEjLeHZJjk1BEAkoKpyX, with $13.4 million in lifetime USDT volume, active since May 2024; and TNBMSmrN1g7MFdSbtTWc8MfGkMZMWEypnA, with $73.1 million in lifetime volume, active since August 2022. Both show the identical near-zero-balance signature as every wallet in this investigation so far, on tens of millions of dollars of combined throughput, and both are still transacting today.

Neither of these wallets is specific to ZyPay. Both existed for one to three years before ZyPay's channel was even created. That rules out the simplest explanation (a copycat operation reusing infrastructure) and points to something more structural: a small set of established intermediary wallets that multiple, independently-branded retail operations draw on over time, the way separate storefronts might all use the same underground supplier without being the same business.

One of these two wallets closes the loop directly. Checking its own top counterparties, we found a transfer of $145,604 across 37 transactions from TFcS1kz4ZxaecZDJDybqoZf75oBisdwh39, the hub wallet at the center of our original WORLDPAYRMB investigation, one hop out from the operation's advertised target wallet, TL8VMS73Y4sapNBR1mCvs336HczWT6HQpX. Verified by address, not by resemblance. The infrastructure behind the channel we wrote about last week is the same infrastructure now surfacing behind a second, unrelated-looking front.

The name behind the liquidity

We checked what actually funds these two wallets. Both draw the majority of their exchange-sourced deposits from a single platform: Huione Pay.

• The smaller hub: 77% of its exchange deposits ($186,000 of $243,000) came from Huione.
• The larger, older hub: 61% of its exchange deposits ($812,000 of $1.33 million) came from Huione.

Huione is not a generic exchange. In May 2025, the US Treasury's Financial Crimes Enforcement Network designated Huione Group a "primary money laundering concern" under Section 311 of the USA PATRIOT Act, a rule that, if finalized, would bar US financial institutions from any correspondent relationship with the group. Chainalysis has estimated Huione enabled up to $70 billion in crypto money laundering. Treasury's own findings tie Huione directly to the Prince Group, a transnational criminal organization behind large-scale romance and investment ("pig-butchering") scams targeting Americans, and to more than $4 billion in laundered proceeds between August 2021 and January 2025, including funds linked to North Korean state cyber activity. The FBI seized Huione's cloud infrastructure this year in an operation to dismantle its scam marketplace.

We want to be precise about what this does and doesn't establish. A wallet receiving funds that passed through Huione does not mean the wallet's operators are the same people running Huione, or that every dollar in these two hub wallets is traceable to a specific scam victim. What it does establish is that the liquidity underlying both WORLDPAYRMB and ZyPay's operations flows substantially through a platform the US government has formally identified as central to global crypto money laundering and pig-butchering proceeds specifically, the exact category ("stock fund") both channels' own rate cards separately advertise pricing for.

Both hubs went dark in the same week

Checking the full transaction history of both wallets turned up one more detail. The smaller hub's last activity was June 6, 2026. The larger hub's last activity was between June 2 and June 6, 2026, the same narrow window. Two wallets, different ages, different scales, both active for years, both stopping within days of each other.

We don't know what caused this. It could be routine infrastructure rotation, a response to enforcement pressure elsewhere in the Huione ecosystem (the FBI's cloud seizure and Treasury's rule both landed in this general period), or something unrelated to either. We're noting it because it's the kind of pattern worth watching rather than explaining away, and because a hub going quiet doesn't mean the operation does: WORLDPAYRMB and ZyPay were both still posting and both still moving smaller-scale money after that date.

What we're confident about, and what we're not

As with the original piece, everything here comes from three independently checkable sources: on-chain TRON/USDT-TRC20 data, the channels' own Telegram content, and, for the Huione connection, wallet-level exchange-flow data cross-referenced against the US Treasury's own public findings about Huione Group. We are not naming the individual staff accounts running ZyPay beyond the pseudonyms they use publicly, and we have not identified who controls the two hub wallets.

What we can say with confidence: two differently-branded, independently-staffed retail operations, launched roughly a year apart, share underlying wallet infrastructure that predates both of them; that infrastructure is substantially funded through Huione, a platform the US government has formally linked to billions of dollars in scam-proceeds laundering; and one of the shared hubs has a direct, verified financial link back to TFcS1kz4ZxaecZDJDybqoZf75oBisdwh39 and, one hop further, the original target wallet, TL8VMS73Y4sapNBR1mCvs336HczWT6HQpX.

We'll keep watching this cluster, including whatever comes back online where these two hubs went quiet.

CoinCandid tracks and publishes on-chain wallet cluster analysis using Dune Analytics, Bitquery, OSINT, and open blockchain data. Methodology available on request.