On June 23, 2026, three U.S. federal agencies executed a coordinated strike against the Huione Group, a Cambodia-based conglomerate that processed more than $31 billion in illicit crypto transactions — making it the largest criminal marketplace ever recorded, exceeding the combined volume of Silk...
"Scam centers in Southeast Asia steal billions of dollars from American victims each year." — Scott Bessent, U.S. Secretary of the Treasury
On June 23, 2026, three U.S. federal agencies executed a coordinated strike against the Huione Group, a Cambodia-based conglomerate that processed more than $31 billion in illicit crypto transactions — making it the largest criminal marketplace ever recorded, exceeding the combined volume of Silk Road and AlphaBay by a factor of 25. The Department of Justice seized cloud infrastructure hosting Huione Guarantee's backend systems. The Treasury's OFAC sanctioned nine individuals and 26 entities linked to the Prince Group transnational criminal organization. FinCEN simultaneously proposed amending its October 2025 rule to close a rebranding loophole exploited by successor entity H-Pay Service PLC.
The action represents a tactical escalation: rather than freezing wallets or blacklisting addresses, U.S. enforcement targeted the physical network layer — cloud accounts, servers, and operational infrastructure — that underpins crypto-native money laundering. The parallel Singapore investigation, which has seized S$600 million ($465 million) in assets from two Chinese nationals tied to Prince Group, adds an international dimension that complicates any successor's ability to reconstitute.
This report examines the enforcement timeline, the scale of Huione's operations, the coordinated multi-agency and multi-jurisdiction response, the successor marketplace problem, and what the action signals for crypto compliance infrastructure broadly.
The Huione enforcement campaign spans 14 months across multiple jurisdictions.
May 2025: FinCEN designated Huione Group as a financial institution of "primary money laundering concern" under Section 311 of the USA PATRIOT Act, citing at least $4 billion in illicit proceeds laundered between August 2021 and January 2025.
July 2025: Telegram banned Huione Guarantee and Xinbi Guarantee channels, disrupting their combined $35 billion in USDT-denominated marketplace volume. According to CoinDesk, illicit trade "quickly rebounded" as vendors migrated to successor platforms.
October 2025: FinCEN finalized the rule severing Huione from the U.S. financial system, prohibiting covered financial institutions from opening or maintaining correspondent accounts for or on behalf of Huione Group. The rule took effect November 17, 2025. Separately, the U.S. Treasury designated Prince Group as a transnational criminal organization (TCO).
January 2026: Chen Zhi, founder and chairman of Prince Group, was arrested in Cambodia and extradited to Beijing. His Cambodian citizenship was revoked as part of the process. Singapore authorities simultaneously seized assets linked to Hu Xiaowei's bank and securities accounts.
March 2025 (Cambodia): The National Bank of Cambodia revoked Huione Pay's payment services license.
April 2026: Li Xiong, head of Huione Group, was arrested in Cambodia and extradited to China.
June 23, 2026: The coordinated three-agency strike — DOJ seizure, OFAC sanctions, FinCEN amendment — executed in a single day.
Huione Guarantee operated as a Telegram-based escrow marketplace. Its economic function was intermediation: connecting buyers and sellers of illicit services — stolen credit card data, identity documents, malware-enabled theft proceeds, pig-butchering scam infrastructure, and human trafficking procurement — while providing escrow settlement to reduce counterparty risk between criminals.
According to the DOJ, Huione Guarantee's channels processed more than $31 billion in cryptoasset transactions, predominantly in USDT on the Tron blockchain. FinCEN's analysis identified at least $4 billion in confirmed illicit proceeds between August 2021 and January 2025. The FBI's Internet Crime Complaint Center (IC3) reported $7.2 billion in cryptocurrency fraud losses in 2025 alone, and over $20 billion in total cybercrime losses — a 26% year-over-year increase.
The Treasury estimated Americans lost at least $10 billion to Southeast Asia-based scam operations in 2024, a 66% increase from the prior year. Huione served as a "critical node" for laundering proceeds from both investment fraud and North Korean cyber heists, according to FinCEN.
Huione's marketplace model differed from prior darknet markets (Silk Road, Hydra) in that it operated entirely on Telegram rather than the Tor network, lowered operational security barriers for participants, and relied on stablecoin settlement rather than Bitcoin — making transactions faster and more liquid but also more traceable through chain analytics.
The June 23 action was notable for its simultaneity and its target selection.
DOJ (Criminal Division + FBI): Seized a cloud computing account — hosted by Google — that served as backend infrastructure for Huione Guarantee's operations. Assistant Attorney General A. Tysen Duva stated: "Today's seizure strikes a blow against one of the world's most prolific criminal marketplaces." The seizure targeted infrastructure rather than wallets — a harder action to execute but significantly harder for criminals to recover from, as rebuilding server infrastructure requires time, capital, and operational security that wallet rotation does not.
OFAC: Sanctioned nine individuals and 26 entities linked to Prince Group TCO. The designated individuals include Hu Xiaowei, described as Prince Group's "second-in-command"; Brendon Luo and Qiu Weiren, identified as major scam compound investors; and Dai An, a high-level Prince Group TCO leader. The 26 entities span multiple jurisdictions including Hong Kong, the UK, Cambodia, and Singapore, encompassing shell companies, payment gateways, a commercial bank (CCU Commercial Bank PLC), and hotel management firms.
FinCEN: Proposed amending the October 2025 final rule to redefine "Huione Group" to include H-Pay Service PLC and any successor entity. The amendment addresses a specific evasion tactic: after Huione Pay lost its Cambodian license, its branches, customer base, and operational footprint migrated to H-Pay. FinCEN's proposed rule would close this loophole by designating any future successor, regardless of name.
Singapore's parallel investigation adds a second enforcement vector. The Singapore Police Force is investigating two Chinese nationals — Hu Xiaowei, 44, and Qiu Wei Ren, 38 — for suspected money laundering offences linked to Prince Group. Hu holds passports issued by Cyprus, Saint Kitts and Nevis, and Hong Kong. Qiu holds Cambodian and Saint Kitts and Nevis passports.
Since March 2026, Singapore has seized or placed under prohibition orders more than S$600 million ($465 million) in assets, including three properties, a yacht, luxury vehicles, high-end bags, and watches. The Singapore probe began in 2024 and escalated in October 2025 with island-wide operations. In March 2026, Singapore Police arrested three Singaporeans in a money laundering investigation relating to Prince Group.
The multi-jurisdictional nature of these enforcement actions — spanning the U.S., Cambodia, China, and Singapore — reflects the distributed structure of the criminal organization itself. Prince Group operated more than 100 shell companies across 12 countries and territories, according to U.S. and British authorities.
Enforcement has not eliminated the underlying demand for illicit crypto services. Data from blockchain analytics firms shows a consistent pattern: when one marketplace shuts down, volume migrates.
After Telegram banned Huione Guarantee in July 2025, Tudou Guarantee — in which Huione held a 30% financial stake acquired in December 2024 — saw a 70-fold increase in daily inflows. According to Elliptic, Tudou's cryptocurrency inflows approximately equaled Huione Guarantee's pre-shutdown levels. Tudou processed $12 billion in transactions before shutting down in January 2026, likely prompted by the arrest and extradition of Chen Zhi.
According to TRM Labs, the closure of Huione and Xinbi has "reshaped the guarantee services landscape" but not eliminated it. Elliptic reported that Telegram dark markets expanded to fill the gap, with activity dispersing across dozens of smaller marketplaces. Services offered on successor platforms include stolen personal data, money laundering, phishing infrastructure, and deepfake software for voice cloning and face swapping during video calls with scam victims.
The pattern mirrors the aftermath of Hydra Market's April 2022 seizure, where volume fragmented across multiple smaller Russian-language darknet markets within months.
Huione's reliance on USDT for settlement created a vulnerability that issuers could exploit. In July 2024, Tether froze $29.6 million in USDT on Tron linked to Huione Group. In January 2026, Tether froze $182 million across five Tron wallets. In April 2026, Tether froze a further $344 million in USDT on Tron after requests from U.S. authorities.
These cumulative freezes — exceeding $555 million — demonstrate that centralized stablecoin issuers can serve as effective enforcement choke points when they cooperate with authorities.
Huione's response was to launch USDH, its own dollar-pegged stablecoin issued on Ethereum, BSC, Tron, and Huione's proprietary blockchain (Xone Chain). According to Elliptic, USDH was designed to be "not subject to freezing or transfer limitations enforced by issuers." The stablecoin represents an attempt to build censorship-resistant payment infrastructure specifically to evade the kind of enforcement cooperation that Tether demonstrated.
Whether USDH gains meaningful adoption among illicit actors depends on liquidity, exchange listings, and whether on/off-ramp infrastructure materializes — all of which face significant headwinds given the current enforcement environment.
The Huione enforcement campaign reveals several structural dynamics in crypto-native financial crime:
Infrastructure targeting works. Seizing cloud accounts is operationally harder than blacklisting wallet addresses, but it imposes substantially higher reconstitution costs on criminal organizations. Wallet migration requires minutes; rebuilding server infrastructure requires weeks or months and creates operational security exposure.
Successor entity designation is a necessary innovation. FinCEN's proposed amendment — designating H-Pay and any future successor — attempts to break the rebrand-and-resume cycle. If finalized, it would create a precedent for "follow-the-entity" enforcement that tracks organizational continuity rather than corporate names.
Stablecoin issuers are de facto compliance gatekeepers. Tether's $555 million+ in cumulative Huione-related freezes demonstrates that centralized stablecoin issuers occupy a structural enforcement position. This dynamic increases the strategic value of USDT/USDC compliance capabilities and raises the regulatory stakes for any stablecoin issuer that fails to cooperate.
The hydra problem remains unsolved. Despite the largest coordinated enforcement action against a crypto-native criminal marketplace, the underlying demand for illicit services persists, and successor platforms continue to emerge. Enforcement can raise the cost of criminal operations but cannot eliminate the market structure that generates them.
The Huione enforcement campaign represents the most comprehensive U.S. action against crypto-native financial crime infrastructure. Its significance lies not in any single action but in the coordinated deployment of multiple enforcement tools — infrastructure seizure, sanctions designation, successor entity rules, and international cooperation — against a single criminal network.
The $31 billion in total Huione volume, the $10 billion in annual American losses to Southeast Asian scam operations, and the $555 million in Tether freezes quantify the scale of the problem. The 14-month enforcement timeline — from FinCEN designation through extraditions to infrastructure seizure — demonstrates the operational tempo that U.S. agencies can sustain.
The unresolved question is whether the hydra dynamic — volume fragmentation and marketplace reconstitution — can be structurally addressed, or whether enforcement will remain a perpetual cost-imposition exercise against a market that regenerates faster than it can be suppressed. FinCEN's successor entity rule and the infrastructure-targeting approach suggest an evolution in enforcement doctrine, but the emergence of platforms like Tudou and its own successors indicates that the demand side of the equation remains untouched.