Loading article…
DOJ seized Huione cloud infrastructure linked to $4B in crypto fraud, disrupting a major marketplace for scam proceeds.
The U.S. Department of Justice seized a cloud computing account used by subsidiaries of Cambodia’s Huione Group, disrupting what officials called a "technological backbone" used to launder billions in fraud proceeds [1, 3]. The action targets the backend infrastructure for Huione Guarantee, a Telegram-based marketplace that facilitated the transfer of stolen crypto and the sale of illicit services [2, 3].
| At a glance | |
|---|---|
| Action | Cloud account seized by DOJ [1] |
| Scale | >$4 billion in laundered funds (Aug 2021–Jan 2025) [1] |
| Target | Huione Group / Huione Guarantee [1] |
| Catalyst | Operation Riptide [1] |
The seized account hosted backend systems for Huione Guarantee, also known as Haowang Guarantee, which operated as an escrow marketplace on Telegram [2, 3]. Prosecutors allege the platform enabled vendors to trade stolen credit card and identity information, malware proceeds, and services for laundering money from romance and investment scams [1, 3]. Blockchain analysts at Elliptic have described the marketplace as the largest illicit online marketplace ever, surpassing dark-web predecessors like Silk Road [3]. The DOJ credited intelligence from Chainalysis, Elliptic, and Google’s CyberCrime Investigation Team for providing information leading to the seizure [1].
The seizure is part of Operation Riptide, an FBI campaign targeting the financial networks behind cyber-enabled fraud [1, 2]. The Treasury’s Financial Crimes Enforcement Network (FinCEN) estimates the Huione Group laundered more than $4 billion in illegal funds between August 2021 and January 2025 [1]. FinCEN previously designated the group a "primary money laundering concern," and on Tuesday moved to extend this ban to a successor entity, H-Pay Service PLC, to prevent the group from evading U.S. restrictions [3]. This follows the National Bank of Cambodia revoking Huione Pay’s banking license in March 2025 and the extradition of former chairman Li Xiong to China in April 2026 to face money laundering charges [1].
By targeting the cloud infrastructure rather than just individual actors, authorities aim to degrade the scalability of global crypto-fraud operations that rely on third-party technical services [1, 2].
Coverage is mostly measured — 63 of 65 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 3 outlets · Jun 25, 2026 · How we report
Imposter scams, where fraudsters pose as law enforcement, government officials, or tech support, convince victims to withdraw cash and deposit it via a QR code into a crypto ATM.
Indiana, Tennessee, and Minnesota have enacted bans, while South Dakota, Arizona, Colorado, Arkansas, Virginia, and Wisconsin have implemented transaction caps and refund rules.
The Crypto Fraud ATM Fraud Prevention Act would require ATM operators to register with the Treasury, limit transaction amounts, enforce verification calls, use blockchain analytics, and provide refunds if victims report scams within 30 days.
The DOJ seized backend cloud accounts linked to the Huione Group, aiming to disrupt the service layer that enables large‑scale illicit finance and money‑laundering.
According to the FTC, they are over three times more likely to lose money in these scams, often due to the high‑pressure tactics used in imposter schemes.