The U.S. Justice Department has seized a cloud computing account tied to the Huione Group, a Cambodia-based conglomerate that prosecutors say processed billions of dollars in crypto fraud proceeds. The action targets the technical core of what blockchain analysts call the largest illicit online marketplace ever documented.
At a Glance
- DOJ seized cloud infrastructure operated by Huione Group subsidiaries
- The account hosted backend systems for Huione Guarantee, a Telegram-based criminal marketplace
- Americans reported more than $7.2 billion in crypto investment fraud losses to the FBI in 2025
- Treasury's FinCEN had already cut Huione from the U.S. financial system in October 2024
- Operation Riptide, the FBI campaign behind the action, received analytical support from Chainalysis, Elliptic, and Google's cybercrime team
What the Seized Account Actually Did
Court documents describe the cloud account as the operational spine for Huione Guarantee, also known as Haowang Guarantee. The platform ran on Telegram and functioned as a full-service criminal exchange: vendors traded stolen card and identity data, malware proceeds, and money laundering services targeting victims of romance and investment scams. Escrow services built into the platform let participants transact in crypto with a layer of dispute resolution typically associated with legitimate commerce.
Assistant Attorney General A. Tysen Duva called the account "a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed, much of it stolen through Southeast Asian scam centers." The infrastructure let funds move through the system and convert into the banking network without triggering detection.
Scale and Context: Bigger Than Silk Road
Blockchain analysts have placed Huione Guarantee above every dark-web predecessor in terms of illicit transaction volume, including Silk Road. Telegram banned its channels in May 2025, effectively shutting down the marketplace, though successor platforms filled the gap within weeks. That resilience matters because it illustrates a consistent pattern: enforcement pressure displaces activity rather than eliminating it.
Huione has responded to each crackdown with structural adaptation. After Treasury's Financial Crimes Enforcement Network issued a final rule in October 2024 designating Huione a "primary money laundering concern" and severing it from the U.S. financial system, the group launched its own stablecoin, USDH, and migrated activity to affiliated platforms. On Tuesday, FinCEN moved to extend its prohibition to a successor entity, H-Pay Service PLC, specifically to block that evasion route.
The Broader Fraud Numbers
The Huione action lands against a backdrop of accelerating crypto fraud losses. The FBI's Internet Crime Complaint Center recorded more than $7.2 billion in crypto investment fraud losses reported by Americans in 2025, part of a total cybercrime loss figure exceeding $20 billion for the year. That total represents a 26 percent increase year over year. Investment fraud, frequently called pig butchering in law enforcement and industry shorthand, accounts for the largest single category.
The case was investigated by the FBI's San Francisco field office and IRS Criminal Investigation as part of Operation Riptide, a sustained FBI campaign aimed at the infrastructure supporting online fraud networks rather than individual perpetrators. Chainalysis and Elliptic provided blockchain analytics support; Google's cybercrime team also assisted.
Risks and Limits of Infrastructure Seizures
Seizing backend accounts is meaningful but not a terminal blow. Huione's track record shows a group capable of rebuilding quickly, rebranding subsidiaries, and launching new financial instruments to preserve operational continuity. The USDH stablecoin, for instance, was introduced precisely as a tool to reduce dependence on mainstream crypto rails that regulators can monitor or freeze. FinCEN's rapid extension of its rule to H-Pay Service PLC suggests authorities are aware of this dynamic and are trying to stay close to the group's restructuring timeline.
For the broader crypto market, the case underscores the compliance and reputational risks that surround assets or infrastructure with traceable connections to illicit finance. On-chain forensics by firms like Chainalysis and Elliptic have made it increasingly difficult for large-scale laundering operations to stay invisible, but the sheer volume of losses, over $20 billion in total cybercrime in a single year, indicates that deterrence remains incomplete.
Frequently Asked Questions
What is Huione Guarantee?
Huione Guarantee, also known as Haowang Guarantee, was a Telegram-based marketplace where criminal vendors sold stolen financial data, malware services, and crypto laundering tools. Blockchain analysts describe it as the largest illicit online marketplace on record, surpassing Silk Road in documented transaction volume. Telegram banned its channels in May 2025.
What is Operation Riptide?
Operation Riptide is an FBI campaign focused on dismantling the technical and financial infrastructure behind large-scale online fraud, rather than pursuing only end-level perpetrators. The Huione cloud seizure is one action within that broader initiative.
What is USDH?
USDH is a stablecoin launched by Huione as enforcement pressure intensified. It was designed to give the group a payment rail less exposed to mainstream exchange oversight and regulatory monitoring.
How much have Americans lost to crypto fraud?
The FBI's Internet Crime Complaint Center recorded more than $7.2 billion in reported crypto investment fraud losses from Americans in 2025. Total cybercrime losses across all categories exceeded $20 billion for the same period, a 26 percent rise year over year.
Where the Case Goes From Here
FinCEN's simultaneous move against H-Pay Service PLC signals that authorities intend to track Huione's successor entities as they emerge rather than treating the cloud seizure as a closing action. With blockchain analytics firms embedded in the investigation and a formal FBI campaign providing the organizational framework, the pressure on Huione's infrastructure is likely to continue. Whether that translates into lasting disruption depends on how quickly the group's restructuring outpaces enforcement response.
