U.S. Justice Department Seizes Cloud Account of 'Prolific Criminal Marketplace' Huione Group
Quick Look
- Justice Department seized a cloud computing account used by Cambodia's Huione Group, described as a major criminal marketplace, for hosting infrastructure supporting crypto fraud and cyber scams.
- FinCEN also extended its ban to a successor entity, H-Pay Service PLC, to prevent evasion of U.S. financial restrictions.
AI-generated summary
Why It Matters
The seizure of Huione Group's cloud account follows a year of crackdowns, including FinCEN severing Huione from the U.S. financial system last October. This action is part of Operation Riptide, an FBI campaign targeting online fraud infrastructure.
The U.S. Justice Department seized a cloud computing account that hosted backend infrastructure for subsidiaries of Cambodia's Huione Group, which it called "one of the world's most prolific criminal marketplaces."
Prosecutors say the account helped run Huione Guarantee, a Telegram marketplace that brokered stolen data, laundering services, and tools for Southeast Asian scam operations.
On the same day, FinCEN moved to extend its existing ban on Huione to a successor entity, H-Pay Service PLC, to stop the group skirting U.S. restrictions.
U.S. authorities have struck at the technical backbone of what they call one of the most prolific criminal marketplaces ever to operate online.
The Justice Department on Tuesday announced the seizure of a cloud computing account used by subsidiaries of the Huione Group, a Cambodia-based conglomerate accused of helping to launder billions of dollars in proceeds from crypto investment fraud and cyber scams. The account hosted "backend infrastructure" for those subsidiaries, prosecutors said, letting criminals move and conceal funds before converting them into the banking system undetected.
"Today's seizure strikes a blow against one of the world's most prolific criminal marketplaces," said Assistant Attorney General A. Tysen Duva of the department's Criminal Division. The account served as "a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed," he said, "much of it stolen through Southeast Asian scam centers."
According to court documents, the account helped operate Huione Guarantee, also known as Haowang Guarantee, a Telegram-based marketplace where vendors traded stolen card and identity data, malware proceeds, and laundering services for romance and investment scams. It also ran escrow services to help criminals, including money launderers, transact in crypto.
Blockchain analysts have described Huione Guarantee as the largest illicit online marketplace ever, eclipsing dark-web forebears like Silk Road. Telegram banned its channels in May 2025, forcing it to shut down, though successor markets quickly emerged to fill the gap.
The seizure caps a year of crackdowns on Huione. Last October, the Treasury's Financial Crimes Enforcemen t Network issued a final rule severing Huione from the U.S. financial system as a "primary money laundering concern," citing its role in laundering crypto-fraud proceeds and funds from North Korean cyber heists. On Tuesday, FinCEN moved to extend that rule to a successor, H-Pay Service PLC, to guard against the group evading the ban.
Crypto-related fraud keeps climbing. Americans reported more than $7.2 billion in losses from crypto investment fraud alone to the FBI's Internet Crime Complaint Center in 2025, part of over $20 billion in total cybercrime losses last year, a 26% jump.
The case, investigated by the FBI's San Francisco field office and IRS Criminal Investigation, is part of Operation Riptide, an FBI campaign targeting the infrastructure behind online fraud. The department credited blockchain analytics firms Chainalysis and Elliptic, along with Google's cybercrime team, with assisting.
