Patrick Romero
The U.S. Justice Department has seized a cloud computing account tied to the Huione Group, a Cambodia-based conglomerate that prosecutors say helped launder billions of dollars in proceeds from crypto fraud and cyberscams. The action targets what blockchain analysts have called the largest illicit online marketplace ever to operate.
At a Glance
- Justice Department seized a cloud account hosting backend infrastructure for Huione Group subsidiaries
- The account supported Huione Guarantee, a Telegram marketplace for stolen data, malware proceeds, and crypto laundering
- Americans reported more than $7.2 billion in losses from crypto investment fraud to the FBI in 2025
- Treasury's FinCEN had already cut Huione off from the U.S. financial system last October
- The case is part of Operation Riptide, an FBI campaign targeting online fraud infrastructure
What the Seized Account Actually Did
According to court documents, the cloud account hosted backend infrastructure used by Huione subsidiaries to move and conceal criminal funds before routing them into the conventional banking system. Assistant Attorney General A. Tysen Duva, of the department's Criminal Division, described it as "a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed, much of it stolen through Southeast Asian scam centers."
The account was central to Huione Guarantee, also known as Haowang Guarantee, a Telegram-based marketplace where vendors traded stolen card and identity data, malware proceeds, and laundering services tied to romance and investment scams. The platform also ran escrow services that let money launderers and other criminals transact in cryptocurrency with some degree of protection.
Blockchain analysts had previously labeled Huione Guarantee the largest illicit online marketplace ever documented, surpassing dark web predecessors including Silk Road. Telegram banned its channels in May 2025, forcing a shutdown, though successor markets moved quickly to fill the void.
A Year of Escalating Pressure
Tuesday's seizure is the sharpest action yet in a sustained campaign against the group. Last October, the Treasury Department's Financial Crimes Enforcement Network issued a final rule designating Huione a "primary money laundering concern" and effectively severing it from the U.S. financial system. FinCEN cited the group's role in laundering proceeds from crypto fraud and from North Korean state-sponsored cyber heists.
On the same day as the cloud seizure, FinCEN moved to extend that designation to H-Pay Service PLC, a successor entity, specifically to prevent Huione from sidestepping the original ban through a rebranded operation.
Huione has shown a consistent ability to adapt. The group launched its own stablecoin, USDH, and has shifted activity to affiliated platforms as each enforcement action has tightened the noose around its existing infrastructure.
The Broader Fraud Crisis
The timing of the action reflects how severe crypto fraud losses have become. Americans filed reports with the FBI's Internet Crime Complaint Center showing more than $7.2 billion in losses from crypto investment fraud alone in 2025. That figure sits inside a larger total of over $20 billion in cybercrime losses last year, a 26 percent jump from the prior year.
The investigation was led by the FBI's San Francisco field office and IRS Criminal Investigation as part of Operation Riptide, the FBI's broader campaign against online fraud infrastructure. Blockchain analytics companies Chainalysis and Elliptic, along with Google's cybercrime team, assisted in the case.
Frequently Asked Questions
What is the Huione Group?
Huione Group is a Cambodia-based conglomerate that U.S. authorities say operated infrastructure used to launder billions of dollars in proceeds from crypto investment fraud and cyberscams. Its subsidiary Huione Guarantee was identified by blockchain analysts as the largest illicit online marketplace on record.
What was Huione Guarantee?
Huione Guarantee, also called Haowang Guarantee, was a Telegram-based marketplace where criminal vendors traded stolen identity and card data, malware proceeds, and money laundering services. It also offered escrow services for crypto transactions between criminals. Telegram banned its channels in May 2025.
What is Operation Riptide?
Operation Riptide is an FBI campaign focused on dismantling the technical infrastructure that enables large-scale online fraud. The Huione cloud account seizure is one action within that broader initiative.
How much have Americans lost to crypto fraud?
The FBI's Internet Crime Complaint Center recorded more than $7.2 billion in reported losses from crypto investment fraud in 2025, part of a total cybercrime loss figure exceeding $20 billion for the year.
What Comes Next for Huione
Huione has proven difficult to permanently shut down. The group has responded to each enforcement action by launching new platforms and financial instruments, including its own stablecoin. With FinCEN now moving to extend its ban to H-Pay Service PLC, regulators appear to be tracking the group's evasion attempts in real time. Whether Tuesday's seizure materially disrupts operations, or simply prompts another round of restructuring, will likely become clear in the months ahead.
