DOJ strikes at Huione Group infrastructure in bid to choke billions in crypto fraud flows

On June 23, the U.S. Department of Justice seized a cloud computing account used to power backend systems tied to Cambodia’s Huione Group, escalating a global push to disrupt crypto-enabled fraud laundering networks operating across messaging platforms and blockchain rails.

The move targeted infrastructure supporting Huione Guarantee, a Telegram-based marketplace alleged by U.S. authorities to have functioned as an escrow hub for laundering illicit cryptocurrency proceeds alongside trade in stolen financial data and other criminal services, according to DOJ filings.

The seizure comes amid rising cybercrime losses. U.S. victims reported $7.2 billion in cryptocurrency investment fraud in 2025, according to FBI Internet Crime Complaint Center data, within total cybercrime losses of $21 billion for the year.

The DOJ said blockchain intelligence firms Chainalysis and Elliptic, working with Google’s CyberCrime Investigation Team, assisted in the investigation.

DOJ hits Huione’s technical backbone

Huione Guarantee, also known as Haowang Guarantee, is a Telegram-operated marketplace alleged to have provided escrow services for crypto laundering, stolen financial data, identity credentials, and other criminal services, according to U.S. court documents and DOJ statements.

Elliptic previously reported that Huione evolved into a broader digital finance infrastructure, including a stablecoin called USDH, activity across Ethereum, BNB Chain, and Tron, and wallet and exchange-like services. In practice, the structure looked like a separate financial network operating outside regulated compliance systems.

The DOJ’s seizure focused on the cloud account supporting that infrastructure, rather than only wallets or individual bad actors. That matters because U.S. authorities are increasingly trying to disrupt the technical systems that allow fraud networks to scale.

Telegram escrow market allegedly enabled laundering

Huione Guarantee allegedly worked as a marketplace where criminal actors could find escrow services, payment channels, and tools for moving illicit funds.

Telegram-based marketplaces are difficult for enforcement agencies because they combine private messaging, anonymous vendor accounts, crypto payments, and cross-border infrastructure. That makes them useful for fraud networks that need to move money quickly while avoiding traditional banking controls.

U.S. authorities allege that Huione’s ecosystem helped criminals convert stolen or scammed digital assets into more liquid forms, including fiat-linked pathways.

The structure also made it easier for fraud operators to transact with vendors selling stolen data, identity documents, and laundering services. That gave Huione a role beyond simple crypto payments: it allegedly became a service layer for cybercrime.

FinCEN ties Huione to $4B in illicit flows

According to a Financial Crimes Enforcement Network investigation, Huione-related organizations were involved in laundering at least $4 billion from August 2021 through January 2025.

Those flows allegedly included proceeds tied to “pig butchering” investment scams, North Korea-linked Lazarus Group cyberattacks, and other transnational fraud schemes.

The North Korean connection is especially important for sanctions enforcement. U.S. agencies have repeatedly warned that crypto laundering channels can help move funds used to support Pyongyang-linked cyber operations despite international restrictions.

Huione Group has also been designated by FinCEN as a primary money laundering concern under the U.S. PATRIOT Act. FinCEN aims for an extended scope of affiliated entities and financial intermediaries related to the broader Huione network.

US agencies widen pressure on Cambodia scam networks

The DOJ action fits into a broader U.S. campaign against Southeast Asian scam networks.

Treasury has also sanctioned people and entities linked to Cambodia-based scam centers connected to Huione. U.S. authorities have repeatedly said these networks cost Americans billions of dollars each year and rely on a hybrid infrastructure of messaging platforms, crypto rails, and offshore payment systems.

The seizure of Huione’s cloud computing account eliminates one more technical means that was employed to enable the launderers to carry out their activities. The effect that this will have on the market depends on the speed at which other avenues are found.

On-chain analysts have warned that similar enforcement actions often cause short-term fragmentation rather than permanent disruption. Criminal networks may shift liquidity, reroute transactions, or move to replacement platforms when one piece of infrastructure is taken down.

The next test is whether Huione’s network splinters

The next key phase will come through FinCEN’s proposed amendment on Huione’s designation, which is expected to move through public consultation after publication in the Federal Register.

Early signals will likely come from updates to the OFAC sanctions list. New designations would show whether additional Huione-linked entities or replacement platforms are being identified.

Later in 2026, blockchain intelligence reports from firms such as Chainalysis and Elliptic should provide a clearer picture of whether illicit flows tied to Huione are being disrupted or simply rerouted. Those reports may also show whether USDH liquidity and broader cross-chain activity patterns shift in response to the enforcement action.

Assistant Attorney General A. Tysen Duva of the DOJ Criminal Division described the move as part of a broader effort to hit fraud at the infrastructure layer, saying that “seizures of these marketplaces are critical in the fight against fraud that affects so many Americans, and to stop avenues for criminal proceeds to be laundered.”

If you're reading this, you’re already ahead. Stay there with our newsletter.