Huione Crypto Laundering Network Seized by DOJ

The U.S. Justice Department has seized a cloud computing account tied to subsidiaries of the Huione Group, a Cambodia-based conglomerate prosecutors describe as one of the most consequential criminal financial networks ever uncovered. The account hosted core backend infrastructure that allowed billions of dollars in crypto fraud proceeds to move through the system undetected.

At a Glance

• The Justice Department seized a cloud computing account used by Huione Group subsidiaries to process fraud proceeds.
• Huione Guarantee, the group's Telegram-based marketplace, has been described by blockchain analysts as the largest illicit online marketplace ever, surpassing Silk Road.
• Americans reported more than $7.2 billion in losses from crypto investment fraud to the FBI in 2025, part of over $20 billion in total cybercrime losses.
• The Treasury's FinCEN had already severed Huione from the U.S. financial system last October, citing money laundering tied to crypto fraud and North Korean cyber heists.
• The case is part of Operation Riptide, an FBI campaign targeting fraud infrastructure.

What the Seized Infrastructure Actually Did

Court documents lay out a specific technical picture. The cloud account provided operational backbone for Huione Guarantee, also known as Haowang Guarantee, a Telegram-based marketplace where vendors traded stolen card and identity data, malware-derived proceeds, and money laundering services tailored to romance and investment scams. The platform also ran escrow services enabling criminals, including professional money launderers, to transact in cryptocurrency with some assurance of counterparty reliability.

Assistant Attorney General A. Tysen Duva of the Criminal Division described the account as a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed, much of it, he said, stolen through Southeast Asian scam centers. The seizure, announced Tuesday, is the most direct technical strike yet against Huione's operating capacity.

Blockchain analytics firms Chainalysis and Elliptic, along with Google's cybercrime team, assisted investigators. The case was developed by the FBI's San Francisco field office and IRS Criminal Investigation under the umbrella of Operation Riptide.

Huione Guarantee: Scale and Context

Blockchain analysts have placed Huione Guarantee at the top of a grim leaderboard. By their assessment, it eclipsed dark web predecessors including Silk Road to become the largest illicit online marketplace ever documented. The platform processed proceeds from what regulators broadly call pig butchering scams, long-running investment fraud operations that systematically cultivate victims before draining their accounts.

Telegram banned Huione Guarantee's channels in May 2025, forcing the platform offline. Successor markets filled the gap quickly, a pattern consistent with how such ecosystems have responded to enforcement pressure historically. Huione itself has shown a similar capacity to adapt: the group launched its own stablecoin, USDH, and shifted activity to affiliated platforms as scrutiny increased.

A Year of Escalating Pressure

Tuesday's seizure is the latest move in a sustained campaign. Last October, the Treasury Department's Financial Crimes Enforcement Network issued a final rule designating Huione a primary money laundering concern, effectively cutting it off from the U.S. financial system. The designation cited Huione's role in laundering proceeds from crypto investment fraud and funds stolen by North Korean state-linked hackers.

On Tuesday, FinCEN moved to extend that designation to H-Pay Service PLC, a successor entity, specifically to prevent the group from routing around the existing ban through a rebranded vehicle. That kind of anticipatory enforcement reflects how regulators have learned to track Huione's restructuring moves in near real time.

The Fraud Numbers Behind the Case

The scale of losses gives the prosecution its broader significance. According to the FBI's Internet Crime Complaint Center, Americans reported more than $7.2 billion in losses attributable to crypto investment fraud alone in 2025. Total cybercrime losses for the year exceeded $20 billion, a 26 percent increase over the prior year. Pig butchering operations, the category most closely associated with Huione's infrastructure, account for a substantial portion of that figure.

These are reported losses only. Victim underreporting in fraud cases is well documented, which means the true exposure is almost certainly larger. The concentration of scam center activity in Southeast Asia, particularly in regions with limited rule of law, has made supply-side enforcement difficult and has kept demand for laundering infrastructure high.

Frequently Asked Questions

What is the Huione Group?

Huione Group is a Cambodia-based conglomerate whose subsidiaries have been accused by U.S. authorities of laundering billions of dollars in proceeds from crypto investment fraud, romance scams, and North Korean cyber heists. The Treasury Department designated it a primary money laundering concern in October 2024.

What was Huione Guarantee?

Huione Guarantee, also known as Haowang Guarantee, was a Telegram-based marketplace where criminals could buy stolen financial data, access malware proceeds, and arrange money laundering services. Blockchain analysts described it as the largest illicit online marketplace ever documented. Telegram shut its channels down in May 2025.

What is Operation Riptide?

Operation Riptide is an FBI campaign focused on dismantling the technical and financial infrastructure behind large-scale online fraud. The Huione seizure is one action within that broader effort, which involves coordination between the FBI, IRS Criminal Investigation, and private blockchain analytics firms.

What is USDH?

USDH is a stablecoin launched by Huione Group as enforcement pressure on its existing operations increased. It is one of several moves the group has made to maintain financial infrastructure as regulators and law enforcement have restricted its access to conventional channels.

Where the Case Stands

The seizure of the cloud account removes a layer of technical capability from Huione's network, but the group's track record of regrouping means the action is unlikely to be the last word. FinCEN's extension of its designation to H-Pay Service PLC signals that regulators are watching for exactly that kind of pivot. What the prosecution has built, over the course of more than a year, is a layered record connecting infrastructure, financial flows, and specific entities, the kind of evidentiary foundation that tends to support further action.