VerilyHK presents itself externally as a legitimate Hong Kong health tech investment platform. The name itself raises red flags for reputation mining: one is Verily Life Sciences, a precision health company under Alphabet, specializing in AI-driven healthcare and medical devices; the other is an A-share listed environmental engineering firm (stock code 300190), with no connection to health tech or cryptocurrency. VerilyHK’s website copy claims expertise in AI health, big data analytics, and medical devices—virtually plagiarizing the public positioning of the genuine Verily. Its marketing narrative has also evolved constantly—from immune cell therapy and portable ECG devices to AI health, health credit systems, data asset tokenization—and even falsely asserts it holds Hong Kong SFC licenses No. 4 (Securities Advisory) and No. 9 (Asset Management).

Caption: Snapshot from Wayback Machine showing verilyhk.com's "About Us" page claiming to deliver health management solutions via AI, big data, and medical devices

In April 2025, Heishan District government issued a risk warning explicitly identifying the project as exhibiting “clear characteristics of pyramid schemes and illegal fundraising,” relying on “overseas cryptocurrency trading.” By late April 2025, multiple anti-fraud monitoring platforms raised collapse alerts. The platform ceased operations in February 2026.

With approximately $1.6 billion in on-chain transaction volume, VerilyHK’s scale far exceeds that of other crypto Ponzi schemes previously pursued by regulators, including Forsage ($300 million, SEC lawsuit) and NovaTech ($650 million, SEC litigation). Yet, to date, no public on-chain analysis has dissected this crypto-enabled criminal operation.

This report does not rely on prior public warnings. All findings presented here are derived exclusively from on-chain analysis of TRON USDT stablecoin fund flows associated with the platform, reconstructing its internal infrastructure layer by layer.

Starting Point

The investigation began with two TRON addresses provided by a victim: one for deposits, one for withdrawals. Tracing the relationship between them revealed not a single path, but an entire multi-layered, multi-generational fund routing network.

Receiving Layer: 8 Generations of Hot Wallets Rotated Over 16 Months

VerilyHK did not rely on fixed receiving addresses. It utilized at least 15 addresses organized into 8 distinct generations, rotated in strict chronological order over 16 months from October 2024 to February 2026.

These addresses were not run in parallel. They formed a relay chain: the end date of each generation precisely aligned with the start date of the next. This day-level handoff pattern repeated across all 8 transitions. Beyond timing, adjacent generations shared over 65% of their deposit address networks, confirming they were operated by the same entity—merely rotating wallets.

Transaction volume per generation increased sharply over time. Early generations processed tens of millions USD monthly, but by the sixth generation, volumes reached hundreds of millions. The final generation processed over $900 million in less than four months. Cumulative transaction volume across all generations totals approximately $1.6 billion.

However, these figures should be treated as upper-bound estimates, not net user deposits. They reflect aggregated full-graph flows, including potential internal transfers. In a Ponzi structure, user payouts may be reinvested, causing the same funds to be counted multiple times in the receiving layer. The explosive growth in later stages likely reflects both real inflows and intensifying internal capital recycling.

Caption: Receiving layer timeline showing transaction volume escalating from $3 million to $906 million across 8 generations

Intermediate Layer: 79 Transit Addresses Converging to Known Hubs

Funds exiting the receiving hot wallets did not flow directly to withdrawal layers. Instead, they passed through 79 intermediate transit addresses, each receiving minimal inputs but distributing to numerous outputs, with near-zero net balance. Over 80% of flowing funds ultimately converged into a small number of identified withdrawal channel hubs.

Caption: Intermediate layer flow: funds routed from receiving hot wallets through transit addresses to recognized withdrawal hubs

While most funds flowed toward the withdrawal layer, one node stood out. A cross-generational hub received funds from 75% of intermediate addresses, spanning six of eight receiving generations, accumulating approximately $240 million. However, its downstream structure clearly differed from known withdrawal channels.

On-chain tracing revealed direct financial links between this hub and multiple wallet addresses belonging to the Huione Group. Huione is a Cambodian financial conglomerate blacklisted by U.S. FinCEN from accessing the American financial system. On the inbound side, at least four Huione hot wallets transferred roughly $4.6 million via a chain of intermediate addresses (minimum five hops) to this hub. On the outbound side, the hub directly sent funds to at least two Huione recharge addresses—$4,200 and $1.5 million respectively.

This cross-generational flow between VerilyHK and Huione indicates that VerilyHK’s fund routing infrastructure may have leveraged Huione’s network as a money laundering conduit. This aligns with FinCEN’s designation: Huione is a “key node in virtual currency investment fraud money laundering.”

Caption: Fund flows between cross-generational hub and sanctioned Huione Group hot wallets and recharge addresses

Withdrawal Layer: From Paired Channels to Shared Exchange Exit

The withdrawal-side generational structure mirrors that of the receiving side. Three generations of withdrawal addresses were identified, totaling approximately $1.1 billion in outbound volume. As with the receiving layer, generational transitions occurred with second-level precision: blockchain timestamps show Generation 2 ceasing and Generation 3 activating simultaneously. This pattern defies alternative explanations and can only be attributed to a pre-planned switch orchestrated by the same operational team.

Within each generation, the architecture followed a consistent pattern: dedicated bridge addresses first aggregated funds from the intermediate layer, then forwarded them to a pair of parallel withdrawal channels—one primary, one secondary. Each pair started minutes apart and ended seconds apart, yet one channel consistently handled significantly more volume than the other. This “bridge → paired withdrawal” structure appeared across all three generations, confirming it was designed infrastructure, not ad hoc wallet creation.

Caption: Withdrawal layer showing 3 generations of paired channels, each with largely independent downstream networks, ultimately converging at a shared exchange exit

Examining the third-generation paired channels reveals a higher degree of separation. One channel processed approximately 2.6 times more volume than the other. Comparing the top 100 downstream counterparties by transaction size, overlap was zero. Despite being fed from the same upstream source and operating concurrently, they maintained completely independent downstream distribution networks.

The only point of true convergence lies in the final exit. Both lines exhibited identical patterns in small-value downstream transactions: funds passed through hundreds of thousands of one-time addresses (each with nearly one incoming and one outgoing transaction), ultimately funneling into a single major centralized exchange (CEX) hot wallet. Even here, the intermediary recharge addresses for the two streams were nearly entirely independent—only 9 shared among ~60,000 addresses, like two separate pipelines feeding into the same exchange. On-chain data confirms funds entered the exchange’s processing pipeline, but cannot identify the underlying user accounts behind these recharges.

Full Picture: Four-Layer Funnel

Synthesizing all findings, VerilyHK’s on-chain fund routing architecture forms a clear four-stage funnel: highly dispersed front-end, highly centralized middle, again dispersed withdrawal layer, and final exit via a shared exchange.

Caption: VerilyHK’s four-layer funnel architecture — Deposit layer, Receiving layer, Intermediate layer, Bridge layer, Dual-channel withdrawal, Exchange exit

The most striking feature is the massive transaction volume (~$1.6 billion in on-chain fund flow) combined with the sophistication of the underlying infrastructure: day-level generational handoffs, paired withdrawal channels with largely independent downstream networks, and hundreds of thousands of one-time addresses funneling into a shared CEX hot wallet.

For exchange compliance teams, the structural patterns documented herein provide actionable heuristic indicators—especially the concentration of hundreds of thousands of one-time deposit addresses into a single hot wallet. For investigators and regulators, this layered architecture demonstrates why tracking illicit funds requires moving beyond individual transactions to reconstruct the complete network topology.