Justice Dept. seizes Huione Group cloud account tied to billions in crypto fraud

The Justice Department announced the seizure of a cloud computing account used by subsidiaries of the Huione Group, a Cambodia-based corporate conglomerate whose subsidiaries are alleged to have assisted individuals and organizations in transferring proceeds of cryptocurrency investment frauds, cyber scams and other criminal activity, the department said.

The seized account hosted backend infrastructure for subsidiaries of the Huione Group, including Huione Guarantee — also known as Haowang Guarantee — which court documents allege operated Telegram channels featuring discussions regarding illicit products and services, including the sale of stolen credit card and identity information, malware-enabled theft proceeds, the procurement of individuals for human trafficking schemes, and money laundering services for romance and investment scam operators.

“Today’s seizure strikes a blow against one of the world’s most prolific criminal marketplaces,” Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division said. “The Huione Group used this cloud computing account as part of a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed — much of it stolen through Southeast Asian scam centers.”

Huione Guarantee also provided escrow services for criminals conducting transactions on its platforms, including money launderers moving cryptocurrency, prosecutors said. Law enforcement has continuously traced cyber-enabled fraud proceeds to cryptocurrency addresses attributed to the Huione Group, including Huione Guarantee, where funds were further laundered, according to the department.

The scale of the problem is significant. Complainants reported more than $7.2 billion in losses to the FBI’s Internet Crime Complaint Center in 2025 due to cryptocurrency investment fraud alone, the department said.

The action builds on earlier regulatory steps. Last October, the Treasury Department’s Financial Crimes Enforcement Network issued a final rule severing the Huione Group from the U.S. financial system, finding it to be a primary money laundering concern under the USA Patriot Act. FinCEN cited the group’s role in laundering proceeds of cryptocurrency investment fraud, cyberheists conducted by North Korea, and other cyber scams. In a concurrent action, FinCEN issued a notice of proposed rulemaking to expand that rule’s definition of the Huione Group to include H-Pay Service PLC, among other changes.

The FBI’s San Francisco Field Office and IRS Criminal Investigation are handling the investigation. The Justice Department credited intelligence teams at Chainalysis, Elliptic and Google’s CyberCrime Investigation Team with providing voluntary assistance.

The seizure is part of Operation Riptide, an ongoing FBI campaign targeting criminal actors, infrastructure and financial networks behind cybercrime, cyber-enabled crime and fraud. Americans reported more than $20 billion in cybercrime losses last year, a 26% single-year increase, the department said.