The Justice Department has seized a cloud computing account tied to subsidiaries of the Huione Group, a Cambodia-based conglomerate prosecutors describe as a financial engine behind billions of dollars in crypto investment fraud and cyber scam proceeds. The move targets what officials call the technological backbone of one of the most prolific criminal marketplaces ever documented.
At a Glance
- DOJ seized a cloud account hosting backend infrastructure for Huione Group subsidiaries
- The account supported Huione Guarantee, a Telegram marketplace blockchain analysts say eclipsed Silk Road in illicit volume
- Americans reported more than $7.2 billion in crypto investment fraud losses to the FBI in 2025, part of over $20 billion in total cybercrime losses
- FinCEN simultaneously moved to extend its money laundering designation to a Huione successor entity, H-Pay Service PLC
- The case is part of Operation Riptide, an FBI campaign targeting fraud infrastructure
What the Seized Account Actually Did
Court documents describe the account as operational infrastructure for Huione Guarantee, also known as Haowang Guarantee. That platform ran on Telegram and functioned as a vendor bazaar: stolen card data, identity credentials, malware proceeds, and laundering services for romance and investment scams all changed hands there. The platform also offered escrow services denominated in crypto, giving criminal buyers and sellers a trust mechanism without ever touching the conventional financial system.
Assistant Attorney General A. Tysen Duva, of the department's Criminal Division, put it bluntly. The account was "a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed," he said, "much of it stolen through Southeast Asian scam centers." Prosecutors argue the infrastructure let criminals move funds and obscure their origins before converting them into the banking system undetected.
Blockchain analytics firms Chainalysis and Elliptic, along with Google's cybercrime team, assisted investigators. The FBI's San Francisco field office and IRS Criminal Investigation led the case.
A Marketplace Bigger Than Silk Road, According to Analysts
The claim that Huione Guarantee surpassed Silk Road as the largest illicit online marketplace on record comes from blockchain analysts, not from prosecutors directly. It deserves scrutiny: measuring illicit marketplace scale is methodologically difficult, and firms like Chainalysis have a commercial interest in emphasizing the severity of threats they help combat. Still, Chainalysis and Elliptic have both documented Huione's transaction flows extensively, and regulators at FinCEN acted on that underlying data when they designated the group last October.
Telegram banned Huione Guarantee's channels in May 2025, forcing the marketplace offline. Successor platforms moved quickly to absorb displaced vendors and users, which is a recurring pattern in the takedown history of dark web markets and a reason enforcement agencies now focus on financial and infrastructure disruption rather than marketplace shutdowns alone.
A Year of Escalating Pressure on Huione
Tuesday's seizure is the latest in a sequence of actions rather than a standalone event. Last October, the Treasury's Financial Crimes Enforcement Network issued a final rule cutting Huione Group off from the U.S. financial system under a "primary money laundering concern" designation, citing its role laundering proceeds from crypto fraud and from North Korean state-sponsored cyber heists. That designation carries significant weight: it bars U.S. financial institutions from maintaining correspondent accounts with the named entity.
On the same day as the cloud account seizure, FinCEN moved to extend that designation to H-Pay Service PLC, a successor entity, an acknowledgment that Huione has actively worked to route around existing sanctions. The group has shown a clear pattern of adaptation: it launched its own stablecoin, USDH, and shifted activity to affiliated platforms as enforcement pressure mounted. Each regulatory action has produced a response, which makes the durability of any single seizure an open question.
The Scale of the Fraud Problem Behind This Case
Context matters here. Americans filed reports with the FBI's Internet Crime Complaint Center documenting more than $7.2 billion in losses from crypto investment fraud alone in 2025. Total cybercrime losses across all categories exceeded $20 billion last year, a 26 percent increase over the prior year. Those figures represent reported losses only; actual losses are almost certainly higher given the well-documented underreporting of fraud victimization.
The Huione Group sits at the intersection of several converging threats: Southeast Asian scam compounds that operate with apparent impunity in jurisdictions with weak rule of law, crypto infrastructure designed to resist tracing, and a marketplace model that scales criminal services the way legitimate platforms scale legitimate ones. Operation Riptide, the FBI campaign under which this case falls, reflects a recognition that taking down individual fraud rings is less effective than dismantling the infrastructure that lets dozens of rings operate simultaneously.
What Remains Unresolved
Seizing a cloud account is a meaningful disruption, but it is not a prosecution, a conviction, or an asset recovery. Huione Group is Cambodia-based, and Cambodia has historically been a difficult jurisdiction for U.S. law enforcement to operate in. No arrests connected to this specific action were announced Tuesday. The group's stablecoin, USDH, remains in circulation, and affiliated platforms continue operating.
FinCEN's extension of its designation to H-Pay Service PLC suggests regulators expect Huione to keep rebranding and restructuring, a cat-and-mouse dynamic that has characterized enforcement against sophisticated money laundering networks for decades. Whether Tuesday's action materially degrades Huione's operational capacity or simply forces another reorganization is a question that will only be answered over the months ahead.
What Comes Next for Crypto Fraud Enforcement
The involvement of Chainalysis and Elliptic alongside Google's cybercrime unit points to where serious crypto crime investigation now lives: in the collaboration between federal agencies, blockchain analytics firms, and major tech platforms. That coalition has real analytical power. It also concentrates significant influence over financial surveillance in private companies whose methodologies are not fully public and whose findings are rarely subjected to adversarial scrutiny in court before enforcement actions occur.
For anyone watching the crypto crime enforcement landscape, Huione's trajectory over the next year will be a meaningful data point. The group has survived a FinCEN designation, a Telegram ban, and now a cloud infrastructure seizure. What it does next, and how quickly, will say a great deal about whether infrastructure-focused enforcement can actually break the operational cycle or merely slow it down.