The U.S. Justice Department seized a cloud computing account used by subsidiaries of Cambodia-based Huione Group on June 23, calling it "one of the world's most prolific criminal marketplaces." The account hosted backend infrastructure for Huione Guarantee, a Telegram marketplace where criminal groups traded stolen card data, malware payloads and services for laundering USDT. On the same day, FinCEN moved to extend its existing ban on Huione to a successor entity, H-Pay Service PLC.
The seizure is part of Operation Riptide, an FBI campaign targeting the technical infrastructure behind online fraud. DOJ described the seized account as "a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed" before entering the legitimate banking system.
What Was Seized and Who Led the Investigation
The cloud account stored server-side backend components for multiple Huione Group subsidiaries. Assistant Attorney General A. Tysen Duva said the seizure "strikes a blow against one of the world's most prolific criminal marketplaces" and described the account as the tool that let fraudsters move and hide billions before converting them into clean funds. The proceeds came mainly from scam centers across Myanmar, Cambodia and Laos.
The investigation was conducted by the FBI's San Francisco field office and IRS Criminal Investigation, both operating under Operation Riptide. The campaign has previously targeted servers and credentials tied to Asian call centers. Blockchain analytics firms Chainalysis and Elliptic provided transaction-tracing support. Huione Group has not issued any public statement since the seizure.
For background: Huione Group operates primarily in Cambodia and presented some of its services as legitimate financial products. Prosecutors say a substantial share of its revenue came from criminal operations.
Huione Guarantee: a Telegram Bazaar for Criminal Deals
Huione Guarantee, also known as Haowang Guarantee, differed from traditional dark-web forums in one clear way: trading happened directly on Telegram, with no VPN or specialized browser required. Court documents detail the platform's inventory:
- stolen card credentials and victim identity data
- proceeds from malware attacks
- escrow services for anonymous criminal crypto deals
- ready-made kits for romance fraud and pig-butchering investment scams
Blockchain analysts described Huione Guarantee as the largest illicit online marketplace in history, eclipsing Silk Road. Telegram banned its channels in May 2025 under regulatory pressure. Successor platforms emerged almost immediately. Victims came from many countries, drawn into fake crypto investment schemes or fabricated romantic relationships with imposters.
The FBI recorded $7.2 billion in reported crypto investment fraud losses in the U.S. in 2025; total cybercrime losses reached $20 billion for the year, a 26% jump from the year before.
FinCEN Extends the Ban to H-Pay Service PLC
FinCEN designated Huione Group as a "primary money laundering concern" in October 2025, cutting the company off from the U.S. financial system. The rule cited its role in laundering crypto fraud proceeds and funds linked to North Korean cyberattacks. U.S. banks were required to report any interaction with the group.
On June 23, FinCEN announced it was applying the same rule to H-Pay Service PLC, which it identified as a Huione Group successor already being used to sidestep existing restrictions. The timing matched the DOJ seizure exactly, pointing to coordination between the two agencies.
The two actions together make a fast recovery harder for Huione Group. Losing the technical backend while the new legal workaround gets blocked at the same time cuts both the operational and financial paths to restarting.
Broader Picture: Cybercrime Losses and Market Pressure
The Huione Group case fits a pattern of growing U.S. law enforcement pressure on criminal crypto infrastructure. Operation Riptide focuses on the cloud and server layer of fraud networks. Where taking down an individual executor once had little lasting impact, the FBI now targets the platforms themselves.
FBI data puts 2025 U.S. cybercrime losses at $20 billion, up 26% year over year. Crypto investment fraud accounts for $7.2 billion of that figure. FinCEN separately flagged Huione Group's ties to North Korean state hacking proceeds. That link between Southeast Asian fraud networks and state-sponsored hackers has appeared with growing frequency in cases from the past two years.
The investigation is ongoing. Whether this breaks the cycle of "shut one marketplace, another opens" will become clear over the coming months.
Comments
Your email address will not be published. Required fields are marked *