DOJ Seizes Huione Crypto Laundering Network

The U.S. Justice Department's seizure of a cloud computing account tied to the Huione Group puts a concrete number on the scale of the threat: blockchain analysts classify Huione Guarantee as the largest illicit online marketplace ever documented, moving billions in proceeds from crypto investment fraud and surpassing even Silk Road in volume.

At a Glance

• DOJ seized a cloud account hosting backend infrastructure for Huione Group subsidiaries, including Huione Guarantee.
• Americans reported more than $7.2 billion in losses from crypto investment fraud alone to the FBI in 2025, part of over $20 billion in total cybercrime losses, a 26% year over year increase.
• Treasury's FinCEN had already cut Huione off from the U.S. financial system in October 2024 as a primary money laundering concern.
• FinCEN moved Tuesday to extend that ban to successor entity H-Pay Service PLC.
• The case is part of Operation Riptide, the FBI's ongoing campaign against online fraud infrastructure.

What the Seized Account Actually Did

Court documents describe the cloud account as the operational core for Huione Guarantee, also known as Haowang Guarantee, a Telegram-based marketplace where vendors openly traded stolen card and identity data, malware proceeds, and money laundering services. The platform also ran escrow services denominated in crypto, giving criminal counterparties, including professional money launderers, a trusted settlement mechanism.

Assistant Attorney General A. Tysen Duva of the DOJ's Criminal Division called the account "a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed, much of it stolen through Southeast Asian scam centers." The infrastructure let illicit funds move through the system and convert into the banking sector without triggering detection.

Telegram banned Huione Guarantee's channels in May 2025, effectively shutting down that specific marketplace. Successor platforms emerged quickly, a pattern regulators have noted repeatedly with high-volume illicit networks.

Scale: Bigger Than Silk Road

Blockchain analytics firms Chainalysis and Elliptic both contributed to the investigation, and their prior research had already flagged Huione Guarantee as the single largest illicit online marketplace on record, eclipsing the dark web's most notorious predecessors. The Cambodia-based Huione Group conglomerate is accused of laundering proceeds not only from crypto investment fraud but also from North Korean state-sponsored cyber heists, giving the operation an unusually broad threat profile.

The FBI's 2025 Internet Crime Complaint Center data frames the wider damage. Crypto investment fraud alone accounted for $7.2 billion in reported U.S. losses last year. Total cybercrime losses exceeded $20 billion, a 26% jump over the prior year. Those figures almost certainly understate actual harm given persistent underreporting.

A Year of Escalating Enforcement

Tuesday's cloud seizure is the latest in a sequence of actions targeting Huione specifically. Last October, the Treasury Department's Financial Crimes Enforcement Network issued a final rule under Section 311 of the USA PATRIOT Act, severing the group from the U.S. financial system by designating it a primary money laundering concern. The cited conduct included laundering proceeds from crypto fraud and from North Korean cyber operations.

The group has not sat still. It launched its own stablecoin, USDH, and has shifted activity to affiliated platforms each time enforcement pressure has tightened. That adaptability prompted FinCEN's move this week to extend the existing ban to H-Pay Service PLC, a successor entity, specifically to prevent the group from sidestepping the original designation through a rebranding.

The investigation was run by the FBI's San Francisco field office and IRS Criminal Investigation, operating under the Operation Riptide umbrella, which targets the technical and financial infrastructure enabling large-scale online fraud rather than pursuing individual perpetrators alone. Google's cybercrime team also provided assistance.

Why Infrastructure Takedowns Matter More Than Arrests

Prosecuting individual scammers is difficult when they operate from jurisdictions with limited U.S. extradition agreements. Targeting infrastructure, the cloud accounts, the Telegram channels, the stablecoins, cuts at the operational capacity of the ecosystem regardless of where the human operators sit. The Huione case illustrates both the strength and the limitation of that approach: each infrastructure action forces costly adaptation, but a well-resourced conglomerate can rebuild faster than enforcement can move.

The $20 billion cybercrime loss figure for 2025 makes the stakes measurable. Even a sustained infrastructure campaign has not bent that curve yet. Whether the combination of FinCEN designations, DOJ seizures, blockchain analytics partnerships, and platform bans can do so remains the central policy question hanging over this enforcement cycle.

Frequently Asked Questions

What is Huione Guarantee and why was it significant?

Huione Guarantee, also known as Haowang Guarantee, was a Telegram-based marketplace operated by subsidiaries of the Cambodia-based Huione Group. Blockchain analysts described it as the largest illicit online marketplace ever documented, facilitating trades in stolen data, malware proceeds, and crypto-based laundering services for romance and investment scam networks.

What did the DOJ actually seize?

The Justice Department seized a cloud computing account that hosted backend infrastructure for Huione Group subsidiaries. That infrastructure enabled criminals to transfer, move, and conceal fraud proceeds before converting them into the conventional banking system.

How does the FinCEN designation affect Huione's operations?

A Section 311 designation as a primary money laundering concern effectively bars U.S. financial institutions from processing transactions involving the designated entity. FinCEN extended the rule to Huione's successor entity H-Pay Service PLC on the same day as the DOJ seizure to close a potential evasion route.

What is Operation Riptide?

Operation Riptide is an FBI campaign focused on dismantling the technical and financial infrastructure that underpins large-scale online fraud, rather than targeting only individual perpetrators. The Huione investigation, run out of the FBI's San Francisco field office alongside IRS Criminal Investigation, falls under that initiative.

Enforcement Momentum and What Comes Next

The coordination visible in Tuesday's actions, a DOJ infrastructure seizure timed alongside a FinCEN rule extension, reflects a more integrated federal approach than earlier crypto enforcement cycles. Chainalysis and Elliptic's involvement signals that blockchain tracing is now a standard investigative tool rather than an afterthought. The open question is whether Huione's demonstrated ability to regroup, new stablecoin, new platforms, new corporate wrappers, will outpace the speed at which that enforcement coalition can act.