DOJ Seizes Huione Infrastructure Linked to Billions in Crypto Laundering

In brief

The U.S. Justice Department seized a cloud computing account that hosted backend infrastructure for subsidiaries of Cambodia’s Huione Group, which it called “one of the world’s most prolific criminal marketplaces.”
Prosecutors say the account helped run Huione Guarantee, a Telegram marketplace that brokered stolen data, laundering services, and tools for Southeast Asian scam operations.
On the same day, FinCEN moved to extend its existing ban on Huione to a successor entity, H-Pay Service PLC, to stop the group skirting U.S. restrictions.

U.S. authorities have struck at the technical backbone of what they call one of the most prolific criminal marketplaces ever to operate online.

The Justice Department on Tuesday announced the seizure of a cloud computing account used by subsidiaries of the Huione Group, a Cambodia-based conglomerate accused of helping to launder billions of dollars in proceeds from crypto investment fraud and cyber scams. The account hosted “backend infrastructure” for those subsidiaries, prosecutors said, letting criminals move and conceal funds before converting them into the banking system undetected.

Today, the Justice Department announced the seizure of a cloud computing account used by subsidiaries of the Huione Group, a Cambodia-based corporate conglomerate.
“Today’s seizure strikes a blow against one of the world’s most prolific criminal marketplaces,” said @AAGDuva.… pic.twitter.com/p1bnoCgExB
— Criminal Division (@DOJCrimDiv) June 23, 2026

“Today’s seizure strikes a blow against one of the world’s most prolific criminal marketplaces,” said Assistant Attorney General A. Tysen Duva of the department’s Criminal Division. The account served as “a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed,” he said, “much of it stolen through Southeast Asian scam centers.”

According to court documents, the account helped operate Huione Guarantee, also known as Haowang Guarantee, a Telegram-based marketplace where vendors traded stolen card and identity data, malware proceeds, and laundering services for romance and investment scams. It also ran escrow services to help criminals, including money launderers, transact in crypto.

Blockchain analysts have described Huione Guarantee as the largest illicit online marketplace ever, eclipsing dark-web forebears like Silk Road. Telegram banned its channels in May 2025, forcing it to shut down, though successor markets quickly emerged to fill the gap.

The seizure caps a year of crackdowns on Huione. Last October, the Treasury’s Financial Crimes Enforcement Network issued a final rule severing Huione from the U.S. financial system as a “primary money laundering concern,” citing its role in laundering crypto-fraud proceeds and funds from North Korean cyber heists. On Tuesday, FinCEN moved to extend that rule to a successor, H-Pay Service PLC, to guard against the group evading the ban.

Crypto-related fraud keeps climbing. Americans reported more than $7.2 billion in losses from crypto investment fraud alone to the FBI’s Internet Crime Complaint Center in 2025, part of over $20 billion in total cybercrime losses last year, a 26% jump.

The case, investigated by the FBI’s San Francisco field office and IRS Criminal Investigation, is part of Operation Riptide, an FBI campaign targeting the infrastructure behind online fraud. The department credited blockchain analytics firms Chainalysis and Elliptic, along with Google’s cybercrime team, with assisting.

Huione has proved adept at regrouping in the face of pressure from law enforcement, launching its own stablecoin, USDH, and shifting activity to affiliated platforms as enforcement has tightened.