DOJ seizes Huione cloud account tied to crypto fraud

The Justice Department announced the seizure of a cloud computing account used by subsidiaries of the Cambodia-based Huione Group, saying the account supported infrastructure that moved and concealed billions in dollars in cryptocurrency fraud proceeds. The action was revealed Tuesday by Assistant Attorney General A. Tysen Duva of the Criminal Division and is part of the FBI’s Operation Riptide, an effort targeting large-scale cybercrime networks.

Duva described the seizure as “a blow against one of the world's most prolific criminal marketplaces” and added that disrupting such networks helps protect consumers and close routes used to launder criminal proceeds.

According to court filings and the department statement, Huione subsidiaries used the cloud account to operate systems that transferred and hid funds generated by investment scams, cyber heists and other illicit activity. Transactions were often routed through scam centers in Southeast Asia before funds were converted on blockchain networks and integrated into traditional bank accounts.

The filing names Huione Guarantee, also known as Haowang Guarantee, as operating Telegram channels that advertised stolen credit card data, identity information, malware proceeds, human trafficking services and escrow services for laundering cryptocurrency tied to romance and investment scams.

Prosecutors cited blockchain analysis showing that Huione launched a stablecoin called USDH on Ethereum, Binance Smart Chain and Tron, and promoted a decentralized exchange, a native crypto wallet and a proprietary blockchain called Huione Chain or Xone. The analysis indicated those products were used as alternative payment rails for the group's marketplace.

The Justice Department said much of the theft that moved through Huione systems was associated with actors tied to the Democratic People's Republic of Korea. The department also identified H-Pay Service PLC as part of the Huione Group in its actions against the organization.

The seizure follows a 2025 designation by the U.S. Treasury’s Financial Crimes Enforcement Network that named Huione Group a primary money laundering concern under the USA PATRIOT Act. Officials said the current action builds on that designation and other enforcement measures aimed at disrupting the group's financial channels.

Federal figures cited in the department announcement show Americans reported more than $7.2 billion in losses to cryptocurrency investment fraud to the FBI’s Internet Crime Complaint Center in 2025, part of nearly $21 billion in total reported losses from cybercrime and cyber-enabled fraud that year.

Prosecutors described the cloud-account seizure as one element of an ongoing investigation and enforcement effort focused on the technical infrastructure that enables large-scale crypto laundering. The department stated the action is intended to reduce marketplaces and services that facilitate transnational fraud and to protect consumers who report losses to fraudulent investment schemes.