According to Web3 security company Beosin, the address that was frozen by TEDA yesterday at the beginning of TNVaK was the hot wallet address that was being used on the day of Huiwang payment. Huiwang Group includes three criminal businesses including Huiwang Guarantee, Huiwang Payment, and Huiwang Online Gambling. Beosin conducts flow analysis and address database comparison of Huiwang Group addresses from the chain (Beosin's risk address database marks more than 100,000 addresses related to Huiwang officials, users, merchants, etc.), involving Huiwang guarantees and Huiwang online gambling business addresses. After the hot wallet address of Huiwang Payment was frozen yesterday, Huiwang Group urgently enabled a new hot wallet address starting with TQuFS to handle the withdrawal of Huiwang Payment users. The flow of virtual currency on the chain shows that after enabling the new hot wallet address for a period of time, Huiwang Payment was withdrawn by a large number of its users. In order to avoid the appearance of the run phenomenon, Huiwang Group called a large amount of funds from the address TYCDk. After Beosin traced the origin of its virtual currency, it was found that its source was suspected to be from external and some mainstream centralized exchanges. It is unknown whether Huiwang Group was able to resolve the run caused by the freeze of TEDA this time.