On June 23, 2026, the U.S. Department of Justice seized a cloud computing account that hosted backend infrastructure for the Huione Group, a Cambodia-based conglomerate that operated what blockchain analytics firms describe as the largest illicit online marketplace ever recorded. The combined tra...
"Today's seizure strikes a blow against one of the world's most prolific criminal marketplaces. The Huione Group used this cloud computing account as part of a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed — much of it stolen through Southeast Asian scam centers." — A. Tysen Duva, Assistant Attorney General, U.S. Department of Justice Criminal Division
On June 23, 2026, the U.S. Department of Justice seized a cloud computing account that hosted backend infrastructure for the Huione Group, a Cambodia-based conglomerate that operated what blockchain analytics firms describe as the largest illicit online marketplace ever recorded. The combined transaction volume across Huione Guarantee and Huione Pay totaled $134 billion, according to analysis by Elliptic — more than 100 times the $1.2 billion lifetime volume of Silk Road.
The seizure represents the culmination of a multi-year, multi-agency enforcement campaign. FinCEN designated Huione Group a primary money laundering concern under Section 311 of the USA PATRIOT Act in October 2025, effectively severing the conglomerate from the U.S. financial system. The FBI, IRS Criminal Investigation, Chainalysis, Elliptic, and Google's CyberCrime Investigation Team collaborated on the infrastructure takedown. FinCEN simultaneously proposed a rule amendment to extend the designation to H-Pay Service PLC, a successor entity, closing a rebranding loophole.
The case offers a forensic view of how crypto-native laundering infrastructure now operates at a scale that dwarfs its darknet predecessors. It also exposes the structural tension between stablecoin utility and stablecoin compliance — and the limits of issuer-level enforcement when criminal networks build their own monetary rails.
The numbers define the case. Huione Guarantee, the group's marketplace arm, processed $31 billion in cryptoasset transactions before it was forced offline, according to Elliptic. Huione Pay, the group's payments subsidiary, handled $103 billion over its lifetime and operated physical outlets across Cambodia. The combined $134 billion figure makes Huione the largest illicit crypto operation ever documented.
For context: Silk Road, the original darknet marketplace seized by the FBI in 2013, handled approximately $1.2 billion in total transactions. AlphaBay, shut down in 2017, processed roughly $166 million. Huione's volume exceeds both combined by a factor exceeding 100x.
FinCEN's own analysis, which focused on a narrower time window (August 2021 to January 2025), confirmed at least $4 billion in identifiable illicit proceeds flowing through Huione entities. The gap between FinCEN's $4 billion confirmed-illicit figure and Elliptic's $134 billion gross volume reflects the difficulty of distinguishing laundered funds from legitimate payment activity in a dual-use infrastructure — a challenge that applies to the broader stablecoin ecosystem.
Americans reported $7.2 billion in cryptocurrency investment fraud losses to the FBI's IC3 in 2025, a 24% increase year-over-year. Total cybercrime losses reported to IC3 reached $20 billion. Huione served as a downstream processing node for a significant share of these proceeds, particularly those originating from "pig butchering" (shā zhū pán) romance and investment scams operated out of Southeast Asian compound facilities.
Huione Guarantee operated as a Telegram-based marketplace, hosting thousands of channels primarily in Chinese. It functioned as an escrow and matchmaking service connecting scam operators with specialized vendors. According to DOJ court filings, the marketplace facilitated:
The marketplace settled almost entirely in Tether's USDT stablecoin, exploiting its liquidity, speed, and acceptance across Southeast Asian crypto markets. Huione Guarantee also provided escrow services — holding funds in custody during transactions between buyers and sellers of illicit goods — a function that mirrors legitimate marketplace infrastructure.
Huione Pay, the payments arm, maintained physical offices in Cambodia and served as the bridge between the crypto and fiat banking systems. It received at least $103 billion in cryptoasset payments, according to Elliptic, and processed conversions that allowed fraud proceeds to enter the legitimate banking sector.
In September 2024, Huione launched USDH, a proprietary USD-backed stablecoin. The move came in direct response to Tether's compliance actions: Tether had frozen $29 million in USDT linked to Huione-connected wallets, and separately froze $225 million in USDT tied to a Southeast Asian human trafficking syndicate.
USDH's marketing materials stated the token "avoids the common freezing and transfer restrictions of traditional digital currencies" and "is not restricted by traditional regulatory agencies." The stablecoin was deployed on Ethereum, BNB Chain, Tron, and Huione's own proprietary blockchain — Huione Chain.
The September 2024 expansion was comprehensive. Alongside the stablecoin, Huione launched its own blockchain, a cryptoasset exchange, and a messaging application designed to operate independently from Telegram — anticipating the platform risk that materialized when Telegram removed Huione channels on May 13, 2025.
This vertical integration represents a structural escalation in illicit finance. Rather than depending on third-party infrastructure that could be seized, frozen, or deplatformed, Huione attempted to build a self-contained financial stack: its own blockchain, its own stablecoin, its own exchange, and its own communications platform. The strategy mirrors legitimate fintech vertical integration — applied to criminal operations.
FinCEN's designation of Huione cited its role in laundering proceeds from cyber heists conducted by the Democratic People's Republic of Korea. Between June 2023 and February 2024, Huione Pay received cryptocurrency worth over $150,000 from a digital wallet used by the Lazarus Group, North Korea's primary state-sponsored hacking unit, according to blockchain analytics.
The DPRK connection extends the implications. North Korean cyber operators stole $2.02 billion in cryptocurrency in 2025, a 51% year-over-year increase, pushing their cumulative all-time theft total to $6.75 billion, according to data compiled by TRM Labs and Chainalysis. Through April 2026, DPRK-linked actors accounted for 76% of all crypto hack value, driven by the $1.5 billion Bybit exploit in February 2025 (the largest single cryptocurrency theft ever recorded, attributed by the FBI to the Lazarus Group cluster tracked as TraderTraitor) and a $292 million Kelp DAO exploit in April 2026.
Huione's infrastructure served as one node in a laundering chain that converted stolen crypto into usable fiat. The FinCEN finding means that any U.S. financial institution is prohibited from maintaining correspondent or payable-through accounts for Huione Group — effectively cutting the conglomerate off from the dollar system.
The takedown of Huione followed a sequential enforcement pattern across multiple agencies and jurisdictions:
| Date | Action | Entity | |------|--------|--------| | July 2024 | First public exposure of Huione Guarantee | Elliptic | | September 2024 | Huione launches USDH, Huione Chain, exchange, messaging app | Huione Group | | October 2025 | FinCEN Section 311 designation; final rule severing Huione from U.S. financial system | U.S. Treasury | | May 13, 2025 | Telegram removes Huione Guarantee channels | Telegram | | January 2026 | Tudou Guarantee (successor marketplace) ceases operations | — | | April 2026 | Chairman Li Xiong extradited to China | Chinese authorities | | June 23, 2026 | Cloud computing account seized; FinCEN proposes extending designation to H-Pay Service PLC | DOJ / FBI / FinCEN |
The investigation was led by the FBI's San Francisco Field Office and IRS Criminal Investigation. Prosecutors Ethan Cantor (Computer Crime and Intellectual Property Section) and Sailaja Paidipaty (Northern District of California) handled the case. The DOJ credited "voluntary assistance" from Chainalysis, Elliptic, and Google's CyberCrime Investigation Team.
Assistant Attorney General A. Tysen Duva stated the seized cloud account served as "a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed." FBI Criminal Division Assistant Director Heith Janke noted the action targeted "every component of the illegal ecosystem."
Enforcement actions against Huione did not eliminate the underlying demand for crypto laundering services. Two successor marketplaces emerged:
Tudou Guarantee processed $12 billion in transactions before ceasing operations in January 2026. Xinbi Guarantee, which Elliptic identified as a separate but functionally similar marketplace, has processed $24 billion in cryptoasset transactions to date.
This displacement pattern — where shutting down one marketplace causes activity to migrate to successor platforms — is consistent with decades of enforcement experience in darknet markets. The Silk Road takedown in 2013 was followed by the rise of AlphaBay and Hansa. AlphaBay's shutdown led to migration to Dream Market and Wall Street Market.
The critical difference with Huione's ecosystem is scale. Silk Road's successor platforms handled hundreds of millions in volume. Huione's successors are already operating at tens of billions. The infrastructure is more sophisticated, the integration with traditional banking is deeper, and the geographic concentration in Southeast Asian jurisdictions with limited enforcement capacity creates persistent operational resilience.
FinCEN's proposed rule amendment to include H-Pay Service PLC — a Huione successor entity — signals awareness of the rebranding tactic. Whether regulators can keep pace with entity proliferation remains an open question.
The Huione case exposes three structural tensions in crypto's compliance architecture:
1. Stablecoin issuer enforcement has limits. Tether froze assets linked to Huione. Huione responded by building USDH. The pattern suggests that issuer-level freeze capabilities, while useful, create incentives for criminal networks to develop proprietary monetary infrastructure. The more effective freeze powers become, the stronger the incentive to build freeze-resistant alternatives.
2. Gross volume obscures illicit share. FinCEN confirmed $4 billion in illicit proceeds. Elliptic documented $134 billion in total volume. The ratio — roughly 3% identifiably illicit — illustrates the challenge of distinguishing criminal flows from legitimate activity in high-volume payment systems. This ratio is comparable to estimates for illicit transaction share in the broader crypto ecosystem, though the concentration of illicit activity in Huione was far higher than in general-purpose platforms.
3. Vertical integration raises enforcement costs. When a criminal network controls its own blockchain, stablecoin, exchange, and communications platform, each enforcement action must target a different layer of the stack. The DOJ's cloud account seizure targeted infrastructure. FinCEN's rule targeted banking access. Telegram's deplatforming targeted communications. Each action imposed costs, but none was individually sufficient to shut down operations permanently.
The FBI's Operation Level Up, a proactive notification initiative for crypto fraud victims, had notified 8,935 victims as of March 2026, 77% of whom were unaware they were being scammed. The program estimates $562 million in prevented losses. These numbers underscore the scale of ongoing victimization that Huione-class infrastructure enables.
The Huione case represents the largest enforcement action ever taken against crypto-native laundering infrastructure. The $134 billion in combined transaction volume processed by the Huione ecosystem exceeds the combined lifetime volumes of every major darknet marketplace in history by orders of magnitude.
The enforcement pattern — blockchain analytics exposure, platform deplatforming, Treasury designation, infrastructure seizure, and successor entity rule amendments — establishes a template that will likely be applied to future cases. But the displacement to successor platforms, each operating at multi-billion dollar scale, suggests the underlying economic incentives remain intact.
For the stablecoin sector specifically, the case creates a regulatory feedback loop. Tether's compliance actions (freezing Huione-linked wallets) demonstrated issuer control. Huione's response (building USDH) demonstrated the limits of that control. The GENIUS Act and MiCA framework, both now in implementation phases, will need to address whether stablecoin compliance regimes can adapt faster than criminal networks can build alternatives.
The data shows a crypto laundering infrastructure operating at a scale that exceeds most traditional banking enforcement targets. Whether the current multi-agency enforcement model can match the speed and adaptability of successor networks remains the central, unresolved question.