DOJ Seizes Huione Crypto (BTC) Laundering Network

The U.S. Justice Department has seized a cloud computing account tied to the Huione Group, a Cambodia-based conglomerate accused of laundering billions of dollars in cryptocurrency fraud proceeds. The action targets the technical infrastructure that prosecutors say allowed criminals to move and conceal funds on a massive scale before those funds entered the conventional banking system.

At a Glance

• The seized account hosted backend infrastructure for Huione Group subsidiaries, including the Telegram-based marketplace Huione Guarantee.
• Blockchain analysts have called Huione Guarantee the largest illicit online marketplace ever, surpassing Silk Road in scale.
• Americans reported more than $7.2 billion in losses from crypto investment fraud to the FBI in 2025, part of over $20 billion in total cybercrime losses, a 26 percent annual jump.
• The case falls under Operation Riptide, an FBI campaign aimed at dismantling the infrastructure behind online fraud.
• Huione has responded to prior crackdowns by launching its own stablecoin, USDH, and migrating activity to affiliated platforms.

What the Seized Account Actually Did

According to court documents filed alongside the announcement, the cloud account operated infrastructure for Huione Guarantee, also known as Haowang Guarantee. The platform ran on Telegram and functioned as a marketplace where vendors bought and sold stolen card data, identity records, malware proceeds, and money laundering services tailored to romance and investment scams. It also provided escrow services so criminals, including professional money launderers, could transact in crypto with a degree of trust between parties.

Assistant Attorney General A. Tysen Duva of the Criminal Division framed the action plainly: the account was "a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed, much of it stolen through Southeast Asian scam centers."

Telegram banned Huione Guarantee's channels in May 2025, effectively forcing a shutdown. Successor markets emerged quickly to fill the void, a pattern that has become familiar in this space.

A Year of Escalating Pressure on Huione

Tuesday's seizure is the latest in a sustained enforcement campaign. Last October, the Treasury Department's Financial Crimes Enforcement Network designated Huione a "primary money laundering concern" and severed it from the U.S. financial system, citing its role in processing proceeds from crypto fraud and from cyberattacks attributed to North Korean state hackers. On the same day as the cloud account seizure, FinCEN moved to extend that designation to a Huione successor entity, H-Pay Service PLC, closing off a potential workaround.

The investigation was conducted by the FBI's San Francisco field office and IRS Criminal Investigation. Blockchain analytics companies Chainalysis and Elliptic, along with Google's cybercrime team, provided assistance. The operation sits within the FBI's broader Operation Riptide, which targets the technical and financial infrastructure that makes large-scale online fraud possible.

The Scale of Crypto Fraud in 2025

The numbers behind this case are striking. The FBI's Internet Crime Complaint Center recorded more than $7.2 billion in losses from crypto investment fraud alone in 2025. Total cybercrime losses across all categories exceeded $20 billion for the year, representing a 26 percent increase over the prior period. Blockchain analysts have described Huione Guarantee as the single largest illicit marketplace ever identified online, eclipsing earlier dark web platforms including Silk Road.

Crypto scams broadly described as "pig butchering," where fraudsters build trust with victims over weeks or months before convincing them to invest in fake platforms, have been a primary driver of these figures. Southeast Asian scam compounds, often staffed by trafficked workers, have been central to that industry.

Huione's Resilience and the USDH Stablecoin

Despite repeated enforcement actions, Huione has shown a consistent ability to adapt. The group launched its own stablecoin, USDH, as regulatory and financial pressure intensified, giving affiliated operators a payment rail less exposed to outside intervention. Activity has shifted to affiliated platforms as each successive crackdown has closed off prior avenues. That pattern is precisely what prompted FinCEN's move against H-Pay Service PLC: authorities are trying to stay ahead of the group's next pivot rather than simply reacting to the one before.

Crypto markets remain highly volatile, and enforcement actions of this kind can introduce sharp, unpredictable price movements in assets connected to implicated platforms, even when the broader market is unaffected.

Frequently Asked Questions

What is Huione Guarantee and why is it significant?

Huione Guarantee, also known as Haowang Guarantee, was a Telegram-based marketplace where criminals traded stolen data, laundering services, and fraud toolkits. Blockchain analysts have described it as the largest illicit online marketplace ever identified, larger in scope than Silk Road.

What is Operation Riptide?

Operation Riptide is an FBI campaign focused on dismantling the technical and financial infrastructure that enables large-scale online fraud. The Huione case is one of several actions conducted under that initiative.

What is USDH?

USDH is a stablecoin launched by Huione as enforcement pressure on the group increased. It was designed to give affiliated operators a payment channel less susceptible to external disruption than conventional banking or mainstream crypto rails.

How large is the crypto fraud problem in the United States?

The FBI's Internet Crime Complaint Center reported more than $7.2 billion in losses from crypto investment fraud in 2025. Total cybercrime losses for the year exceeded $20 billion, a 26 percent increase over the previous year.

Enforcement Keeps Escalating, but So Does the Fraud

The Huione seizure shows how far authorities are willing to go to disrupt illicit crypto infrastructure, targeting cloud accounts and extending financial exclusions to successor entities rather than simply prosecuting individuals. Whether that pace of escalation can outrun the adaptability of the networks involved is the central question hanging over the entire effort.