U.S. seizes backend infrastructure used by Huione Group for money laundering services

Today, the U.S. Department of Justice announced the seizure of a cloud computing account used by subsidiaries of the Huione Group, a Cambodia-based corporate conglomerate.

These subsidiaries are alleged to have assisted individuals and organisations in transferring proceeds of cryptocurrency investment frauds, cyber scams, and other criminal activities on cryptocurrency blockchains, thereby allowing the conversion of the proceeds of these schemes into the legitimate banking sector undetected.

The seized account hosted backend infrastructure for the subsidiaries.

According to court documents, the seized account was used to help operate Huione Guarantee, also known as Haowang Guarantee.

Huione Guarantee is alleged to have operated Telegram channels that contained discussions regarding illicit products and/or services, ranging from the sale of stolen credit card and identity information, the fruits of malware-enabled thefts, the procurement of individuals for human trafficking schemes, as well as assistance with laundering the proceeds of romance and investment scams.

Huione Guarantee also provided escrow services for criminals transacting on its platforms, including money launderers, to facilitate transactions. In doing so, Huione Guarantee facilitated the movement of considerable funds stolen by Southeast Asian scam centres.

Law enforcement has consistently traced cyber-enabled fraud proceeds to cryptocurrency addresses associated with the Huione Group, including Huione Guarantee, where the funds were subsequently laundered.

Reports of cyber-enabled fraud involving cryptocurrency continue to increase, with complainants reporting over $7.2 billion in losses to the FBI’s Internet Crime Complaint Centre (IC3) in 2025 due to cryptocurrency investment fraud alone.

“Today’s seizure strikes a blow against one of the world’s most prolific criminal marketplaces,” said assistant attorney general A. Tysen Duva of the Justice Department’s Criminal Division. “The Huione Group used this cloud computing account as part of a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed — much of it stolen through Southeast Asian scam centres. Seizures of these marketplaces are critical in the fight against fraud that affects so many Americans, and to stop avenues for criminal proceeds to be laundered.”

Last October, the Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) issued a final rule severing Huione Group from the U.S. financial system.

In this rule, FinCEN identified the Huione Group as a primary money-laundering concern pursuant to section 311 of the USA Patriot Act, citing its significant role in laundering proceeds from cryptocurrency investment fraud, cyber heists conducted by the Democratic People’s Republic of Korea, and other cyber scams.

FinCEN issued a notice of proposed rulemaking (NPRM) to amend this rule’s definition of the Huione Group to include H-Pay Service PLC, among other changes.

In its NPRM, FinCEN has assessed that H-Pay Service PLC is a component of the Huione Group and of primary money-laundering concern.