DOJ seizes Huione cloud infrastructure in crypto money‑laundering

The U.S. Department of Justice seized a cloud‑computing account that hosted the backend infrastructure for Huione Group’s subsidiaries on June 23, 2026, striking at the technological backbone that moved billions of dollars in illicit crypto proceeds [3].

Infrastructure focus of the crackdown

The DOJ’s action targets the cloud layer that enables scam operators to shift funds quickly across borders, a shift from earlier efforts that froze individual wallets or named perpetrators. According to the Justice Department, the seized account was used by subsidiaries of Huione Group to facilitate cryptocurrency investment fraud, cyber scams and other criminal activity, converting crypto proceeds into the traditional banking system undetected [2]. Assistant Attorney General A. Tysen Duva called the move a “blow against one of the world’s most prolific criminal marketplaces,” highlighting that the infrastructure allowed “billions in fraud proceeds” to be transferred and concealed [2].

Context and regulatory backdrop

FinCEN had already designated Huione Group a primary money‑laundering concern in October 2025, citing at least $4 billion in illicit proceeds between August 2021 and January 2025 [3]. The agency’s analysis also broke out roughly $300 million of those funds as tied specifically to cyber and CVC scams. The latest seizure builds on that designation and follows a notice of proposed rulemaking to expand the definition of the Huione Group to include H‑Pay Service PLC [2]. Law‑enforcement agencies, including the FBI’s Cyber Division and the IRS Criminal Investigation unit, are coordinating the effort under Operation Riptide, which targets the broader ecosystem of cyber‑enabled fraud that cost Americans over $20 billion in the prior year [2].

Implications for crypto businesses

The focus on backend services signals that compliance risk is moving deeper into the infrastructure stack. Platforms that provide hosting, payment processing, escrow or messaging support may face heightened scrutiny to identify and block high‑risk customers. While the seizure does not directly affect any specific token price, it underscores the growing regulatory pressure on services that enable the rapid, cross‑border movement of stablecoins and other crypto assets used by fraud networks [1].

What to watch

• Any further DOJ or FBI announcements targeting cloud or hosting providers linked to crypto fraud.
• Updates to FinCEN’s Section 311 rulemaking that could expand the list of designated entities within the Huione ecosystem.
• On‑chain activity spikes in stablecoin transfers associated with addresses previously linked to Huione Guarantee.

The seizure demonstrates that U.S. authorities are willing to disrupt the underlying infrastructure of crypto‑based fraud, not just the visible wallets, raising the bar for compliance across the digital‑asset ecosystem.