VerilyHK presents itself externally as a legitimate Hong Kong health tech investment platform. The name itself raises red flags for reputation mining: one is Verily Life Sciences, a precision health company under Alphabet, specializing in AI-driven healthcare and medical devices; the other is an A-share listed environmental engineering firm (stock code 300190), with no connection to health tech or cryptocurrencies. VerilyHK’s website copy claims expertise in AI health, big data analytics, and medical devices—virtually plagiarizing the public positioning of the genuine Verily. Its marketing narrative has continuously evolved—from immunotherapy cell treatments and portable ECG devices to AI health, health credit systems, data asset tokenization—and even falsely asserts it holds Hong Kong SFC licenses No. 4 (Securities Advisory) and No. 9 (Asset Management).

Caption: Snapshot from Wayback Machine showing verilyhk.com's "About Us" page claiming to deliver health management solutions via AI, big data, and medical devices

In April 2025, He Shan District government issued a risk warning explicitly identifying the project as exhibiting “clear characteristics of pyramid schemes and illegal fundraising,” heavily reliant on “overseas cryptocurrency trading.” By late April 2025, multiple anti-fraud monitoring platforms raised collapse alerts. The platform ceased operations in February 2026.

With approximately $1.6 billion in on-chain transaction volume, VerilyHK’s scale far exceeds that of other crypto Ponzi schemes previously pursued by regulatory authorities, including Forsage ($300 million, SEC lawsuit) and NovaTech ($650 million, SEC litigation). Yet, to date, no public on-chain analysis has dissected this crypto-enabled criminal operation.

This report does not rely on prior public warnings. All findings presented here are derived exclusively from on-chain analysis of TRON USDT stablecoin fund flows associated with the platform, layer-by-layer reconstructing the true internal infrastructure.

Starting Point

The investigation began with two TRON addresses provided by a victim: one deposit address and one withdrawal address. Tracing their interconnection revealed not a single path, but an entire multi-tiered, multi-generational fund routing network.

Receiving Layer: 8 Generations of Hot Wallets Rotated Over 16 Months

VerilyHK did not rely on fixed receiving addresses. It utilized at least 15 addresses organized into 8 distinct generations, rotated strictly chronologically over a 16-month period from October 2024 to February 2026.

These addresses were not operated in parallel. They formed a relay chain: each generation’s end date precisely aligned with the next generation’s start date. This day-level handoff pattern repeated across all 8 transitions. Beyond timing, adjacent generations shared over 65% of their deposit address networks, confirming they were operated by the same entity—only rotating wallets.

Transaction volume processed per generation increased dramatically over time. Early generations handled tens of millions of dollars monthly, but by the sixth generation, volumes reached hundreds of millions. The final generation processed over $900 million within less than four months. Cumulative transaction volume across all generations totals approximately $1.6 billion.

However, these figures should be treated as upper-bound references, not net user deposits. They stem from full graph aggregation, including potential internal transfers. In a Ponzi structure, user payouts may be reinvested, causing the same funds to be counted multiple times in the receiving layer. The explosive growth in later stages likely reflects both real expansion and intensifying internal fund recycling.

Caption: Receiving layer timeline showing transaction volume rising from $3 million to $906 million across 8 generations

Intermediate Layer: 79 Transit Addresses Converging to Known Hubs

Funds exiting the receiving hot wallets did not flow directly to withdrawal layers. Instead, they passed through 79 intermediate transit addresses, each with minimal incoming sources, numerous outgoing destinations, and near-zero net balance. Over 80% of the routed funds ultimately converged into a small number of identified withdrawal channel hubs.

Caption: Intermediate layer flow: funds from receiving hot wallets routed through transit addresses to identified withdrawal hubs

While most funds flowed toward the withdrawal layer, one node stood out. A cross-generational hub received funds from 75% of intermediate addresses, spanning six of eight receiving generations, accumulating around $240 million. Yet its downstream structure clearly differed from recognized withdrawal channels.

On-chain tracing revealed direct financial linkages between this hub and multiple wallet addresses belonging to the Huione Group. Huione is a Cambodian financial conglomerate blacklisted by U.S. FinCEN, prohibited from accessing the U.S. financial system. On the inbound side, at least four Huione hot wallets transferred approximately $4.6 million via a chain of intermediate addresses (minimum five hops) into this hub. On the outbound side, the hub directly sent funds to at least two Huione group deposit addresses—$4,200 and $1.5 million respectively.

The fund flow between this cross-generational hub and Huione indicates that VerilyHK’s routing infrastructure likely leveraged Huione’s network as a money laundering conduit. This aligns with FinCEN’s designation: Huione is a “key node in virtual currency investment fraud money laundering operations.”

Caption: Fund flows between cross-generational hub and sanctioned Huione Group hot wallets and deposit addresses

Withdrawal Layer: From Paired Channels to Shared Exchange Exit

The withdrawal-side generational structure mirrors that of the receiving layer. Three generations of withdrawal addresses were identified, with total withdrawal volume totaling approximately $1.1 billion. As with the receiving layer, generational transitions occurred down to the second: on-chain timestamps show the second-generation channel ceased and the third-generation channel initiated at the exact same moment. This pattern is nearly impossible to explain otherwise—only consistent with a pre-programmed switch orchestrated by the same operational team.

Within each generation, the architecture followed a consistent pattern: dedicated bridge addresses first aggregated funds from the intermediate layer, then forwarded them to a pair of parallel withdrawal channels—one primary, one secondary. The launch times of each pair differed by minutes, and stop times by seconds, yet one channel consistently processed significantly higher volume than the other. This “bridge → paired withdrawal” structure repeated across all three generations, proving it was a designed infrastructure, not ad hoc wallet creation.

Caption: Withdrawal layer showing 3 generations of paired channels, each with largely independent downstream networks, converging at a shared exchange exit

Examining the third-generation paired channels reveals the degree of separation more clearly. One channel processed roughly 2.6 times the volume of the other. Comparing the top 100 largest downstream counterparties for both channels yielded a **zero** overlap rate. Despite being fed by the same upstream source and operating simultaneously, they ran entirely independent downstream distribution networks.

The only shared element was the final exit. In their smaller downstream transactions, both lines exhibited identical patterns: funds passed through hundreds of thousands of one-time-use addresses (each with nearly one incoming and one outgoing transaction), ultimately funneling into a single major centralized exchange (CEX) hot wallet. Even here, the intermediary deposit addresses for the two lines were almost entirely independent—out of ~60,000 addresses, only 9 were shared, resembling two separate pipelines feeding into the same exchange. On-chain data confirms funds entered the exchange’s processing pipeline, but cannot identify the underlying user accounts behind these deposits.

Overview: Four-Tier Funnel

Synthesizing all findings, VerilyHK’s on-chain fund routing architecture forms a clear four-stage funnel: highly decentralized front-end, highly concentrated middle, again decentralized withdrawal layer, and final exit through a centralized exchange.

Caption: VerilyHK’s four-tier funnel architecture—deposit layer, receiving layer, intermediate layer, bridge layer, dual-channel withdrawal, exchange exit

Most striking is the massive transaction volume (cumulative ~$1.6 billion in on-chain fund flow) combined with the precision of the underlying infrastructure: day-level generational handoffs, paired withdrawal channels with largely independent downstream networks, and hundreds of thousands of one-time addresses converging into a shared exchange hot wallet.

For exchange compliance teams, the structural features documented here provide actionable heuristic indicators—especially the pattern of hundreds of thousands of one-time deposit addresses funneling into a single hot wallet. For investigators and regulators, this layered architecture demonstrates why tracking illicit funds requires moving beyond individual transactions to reconstruct the complete network topology.