The Justice Department's seizure of cloud computing infrastructure tied to the Huione Group marks one of the most aggressive enforcement actions yet against what blockchain analysts have called the largest illicit online marketplace in history, surpassing even Silk Road in scale. The move targets the technical backbone that allegedly moved billions in cryptocurrency fraud proceeds through a Cambodia-based conglomerate with deep roots in Southeast Asian scam networks.
At a Glance
- U.S. authorities seized a cloud computing account used by Huione Group subsidiaries to operate backend infrastructure for criminal marketplaces.
- Huione Guarantee, also known as Haowang Guarantee, is described by blockchain analysts as the largest illicit online marketplace ever recorded.
- Americans reported more than $7.2 billion in losses from crypto investment fraud to the FBI in 2025, part of over $20 billion in total cybercrime losses, a 26% jump year over year.
- The Treasury's FinCEN had already cut Huione off from the U.S. financial system last October; Tuesday's action extended that designation to a successor entity, H-Pay Service PLC.
- The case is part of Operation Riptide, an FBI campaign targeting fraud infrastructure, with analytical support from Chainalysis, Elliptic, and Google's cybercrime team.
What Was Seized and Why It Matters
The Justice Department's Criminal Division announced Tuesday that federal investigators had taken control of a cloud computing account operated by subsidiaries of the Huione Group, a Cambodia-based conglomerate. According to court documents, the account did not simply store data. It hosted the backend infrastructure enabling Huione's affiliated criminal marketplaces to process transactions, shift funds across accounts, and obscure the money trail before it entered conventional banking channels.
Assistant Attorney General A. Tysen Duva described the account as "a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed," with much of that money traced to Southeast Asian scam centers. Seizing the infrastructure, rather than simply freezing financial accounts, reflects a deliberate strategic choice: cut off the operational layer that keeps these markets running, not just the money sitting in wallets at any given moment.
The account specifically supported Huione Guarantee, a Telegram-based marketplace where vendors traded stolen card data, identity credentials, malware proceeds, and laundering services tailored to romance scams and crypto investment fraud. The platform also ran escrow services so that criminal counterparties, including professional money launderers, could transact in cryptocurrency with a degree of trust usually absent from illicit markets. Telegram banned Huione Guarantee's channels in May 2025, forcing a shutdown, though successor platforms emerged quickly in its wake.
The Scale of the Huione Operation
Blockchain analysts have placed Huione Guarantee in a category of its own. The platform eclipsed prior dark-web marketplaces, including Silk Road, in both volume and operational sophistication. Rather than a single site accessible via specialized software, Huione Guarantee operated through Telegram, exploiting the messaging app's encrypted channels and its massive global user base to reach criminals across dozens of jurisdictions.
The group has also shown a notable capacity to adapt. As enforcement pressure tightened, Huione launched its own stablecoin, USDH, giving affiliated operators a proprietary settlement layer insulated from the mainstream stablecoin infrastructure that regulators and exchanges can more readily monitor. Activity migrated to affiliated platforms, and when Telegram finally removed the channels, successor markets moved quickly to absorb displaced vendors and buyers. That pattern of regrouping after each enforcement action is precisely what makes Tuesday's infrastructure seizure significant: targeting the cloud computing backbone is an attempt to disrupt operations at a layer that is harder to replicate quickly than a new Telegram channel.
A Year of Escalating Pressure
Tuesday's action is the latest in a series of moves against Huione that began building momentum in late 2024. Last October, the Treasury Department's Financial Crimes Enforcement Network (FinCEN) issued a final rule designating Huione as a "primary money laundering concern" under the Bank Secrecy Act, effectively cutting the group off from the U.S. financial system. The designation cited Huione's role in laundering proceeds from crypto investment fraud and from cyber heists attributed to North Korean state-sponsored hackers.
On Tuesday, FinCEN moved to extend that rule to H-Pay Service PLC, a successor entity the group apparently stood up to route around the original ban. The extension signals that regulators are watching for corporate restructuring as a evasion tactic and are prepared to move against successor entities before they gain operational momentum. The FBI's San Francisco field office and IRS Criminal Investigation led the underlying case, with blockchain analytics firms Chainalysis and Elliptic, as well as Google's cybercrime team, providing analytical support.
Crypto Fraud by the Numbers
The enforcement context is backed by a striking set of figures. Americans filed complaints with the FBI's Internet Crime Complaint Center reporting more than $7.2 billion in losses from crypto investment fraud alone in 2025. Total cybercrime losses across all categories exceeded $20 billion last year, representing a 26% increase over the prior year. Those numbers reflect reported losses only; researchers and law enforcement consistently note that a substantial share of victims never file formal complaints, which means the true figures are likely higher.
Pig butchering scams, the romance-fraud-to-investment-fraud pipeline that Huione Guarantee reportedly serviced, account for a large portion of those crypto fraud losses. Victims are cultivated over weeks or months through fake romantic relationships before being directed to fraudulent trading platforms and persuaded to deposit increasingly large sums. The Huione marketplace allegedly provided the full supply chain: stolen identity data for building fake personas, money laundering services for processing the proceeds, and escrow infrastructure to guarantee payment among the criminal vendors themselves.
Operation Riptide and the Broader Strategy
The Huione seizure falls under Operation Riptide, an FBI campaign specifically designed to target the infrastructure layer underpinning online fraud, rather than chasing individual transactions or arresting low-level operators. The logic mirrors approaches taken against ransomware groups: disrupt the shared tools and services that multiple criminal enterprises depend on, and you degrade the capacity of many actors simultaneously rather than one at a time.
Blockchain analytics firms Chainalysis and Elliptic have both published research on Huione Guarantee's transaction flows, providing the kind of on-chain evidence that supports both the FinCEN designation and the criminal investigation. Google's cybercrime team contributed additional technical analysis. The collaboration between federal law enforcement, financial regulators, private blockchain intelligence firms, and a major technology company represents a model that investigators have increasingly used against sophisticated crypto-adjacent criminal networks.
Frequently Asked Questions
What is Huione Guarantee and how did it operate?
Huione Guarantee, also called Haowang Guarantee, was a Telegram-based marketplace where criminal vendors sold stolen financial data, malware services, and money laundering tools, primarily in support of romance scams and crypto investment fraud. It also provided escrow services so that criminal counterparties could settle transactions in cryptocurrency. Blockchain analysts have described it as the largest illicit online marketplace on record, larger than Silk Road.
What did the Justice Department actually seize?
Authorities seized a cloud computing account used by subsidiaries of the Huione Group. Court documents describe this account as hosting the backend infrastructure that let criminals transfer and conceal fraud proceeds before moving money into the conventional banking system.
What is USDH and why did Huione create it?
USDH is a stablecoin launched by the Huione Group as enforcement pressure on mainstream stablecoin platforms intensified. By operating a proprietary settlement layer, affiliated operators gained a tool for transacting value that sits outside the standard stablecoin infrastructure monitored by exchanges and regulators.
How large is the crypto fraud problem in the United States?
The FBI's Internet Crime Complaint Center received reports totaling more than $7.2 billion in crypto investment fraud losses in 2025. Total cybercrime losses across all categories exceeded $20 billion last year, up 26% from the previous year. These figures cover only reported incidents.
What Comes Next for Enforcement
Huione's track record of adapting to enforcement actions means that Tuesday's seizure, while significant, is unlikely to be the final word. Successor markets to Huione Guarantee were already operating before the cloud infrastructure was taken down. The FinCEN extension to H-Pay Service PLC suggests regulators expect further attempts to reconstitute operations under new corporate structures. For investigators, the challenge is maintaining the pace of enforcement actions faster than criminal networks can rebuild, a contest that the $20 billion-plus in annual cybercrime losses suggests is far from resolved.
