DOJ Seizes Huione Cloud Account to Disrupt $4B Crypto Laundering

On June 23, the Justice Department seized a cloud computing account that hosted backend infrastructure for Huione Guarantee. That's the Telegram-based marketplace U.S. authorities say has been a hub for crypto laundering and stolen-data trading. The move struck at the technical layer, not just individual wallets or operators.

Huione Guarantee, also called Haowang Guarantee, provided escrow services for criminal actors moving crypto, according to DOJ court filings. In a typical arrangement, a fraud operator would deposit stolen crypto as collateral. The buyer would send payment. Huione would release the assets, taking a fee. The marketplace also traded in stolen financial data and identity credentials. Elliptic previously reported that Huione evolved into a digital finance infrastructure with its own stablecoin, USDH, and activity on Ethereum and BNB Chain. The structure included wallet and exchange-like services, effectively operating as a separate financial network outside regulated compliance systems.

The scale of the operation is large. FinCEN's investigation found Huione-related groups laundered at least $4 billion between August 2021 and January 2025, the agency said. Those flows included proceeds from pig butchering investment scams and North Korea's Lazarus Group. The North Korean connection matters for sanctions enforcement. U.S. agencies have warned that crypto laundering channels can help move funds used to support Pyongyang-linked cyber operations despite international restrictions.

FinCEN has designated Huione a primary money laundering concern under the PATRIOT Act. The Treasury has also sanctioned people and entities linked to Cambodia-based scam centers connected to Huione. The DOJ said blockchain intelligence firms Chainalysis and Elliptic, along with Google's CyberCrime Investigation Team, assisted in the investigation.

Assistant Attorney General A. Tysen Duva of the DOJ Criminal Division described the move as part of a broader campaign. "Seizures of these marketplaces are critical in the fight against fraud that affects so many Americans," he said. The seizure is the latest action under Operation Riptide, an ongoing FBI campaign targeting the infrastructure and criminal actors involved in global cyber fraud and money laundering. The DOJ has previously seized domains of darknet markets and exchange infrastructure. This action follows that pattern but targets a Telegram-based platform specifically.

U.S. authorities have said these networks cost Americans billions of dollars each year. They rely on messaging platforms and crypto rails to move money outside the traditional banking system. The DOJ action fits into a broader U.S. campaign against Southeast Asian scam networks.

Telegram-based marketplaces are difficult for enforcement because they layer private messaging on top of anonymous vendor accounts, with crypto payments moving across borders. Telegram's encrypted channels and large group capacity make it a preferred platform for these markets, which often have thousands of members. Criminals can move money without traditional banking controls. The U.S. action targets the operational backbone rather than a single wallet or account.

Previous actions often targeted specific crypto wallets or exchange accounts. This one went after the cloud computing infrastructure that runs the marketplace's backend systems. The seizure eliminates one technical means that enabled launderers to carry out their activities. Some blockchain analysts said the effect will depend on how quickly Huione operators adapt. Previous enforcement actions against similar networks caused short-term fragmentation, not permanent disruption. Networks shift liquidity, reroute transactions, or move to replacement platforms.

The next formal step is FinCEN's proposed amendment to the Huione designation, which must go through public consultation after Federal Register publication. Updates to the OFAC sanctions list will show whether additional Huione-linked entities or replacement platforms are being designated. Blockchain intelligence reports from Chainalysis and Elliptic in 2026 should indicate whether flows are being disrupted or rerouted.

U.S. victims reported $7.2 billion in cryptocurrency investment fraud in 2025, according to FBI data. Total cybercrime losses for the year reached $21 billion.