On June 23, 2026, the U.S. Department of Justice seized a cloud computing account used by subsidiaries of Cambodia's Huione Group, dismantling backend infrastructure that facilitated an estimated $70 billion in cryptocurrency transactions over five years. The action, coordinated with the FBI, IRS...
"The Huione Group used this cloud computing account as part of a technological backbone that allowed billions in fraud proceeds to be transferred." — A. Tysen Duva, Assistant Attorney General, U.S. Department of Justice
On June 23, 2026, the U.S. Department of Justice seized a cloud computing account used by subsidiaries of Cambodia's Huione Group, dismantling backend infrastructure that facilitated an estimated $70 billion in cryptocurrency transactions over five years. The action, coordinated with the FBI, IRS Criminal Investigation, and FinCEN, represents the latest strike against what blockchain analytics firms Elliptic and Chainalysis have identified as the largest illicit online marketplace in history — one that processed more than $31 billion through its Telegram-based Huione Guarantee platform alone.
The Huione ecosystem — spanning payments (Huione Pay, $103 billion in lifetime crypto volume), marketplace services (Huione Guarantee, $31 billion), and a proprietary "unfreezable" stablecoin (USDH) — functioned as the central financial plumbing for Southeast Asian cyber fraud networks, North Korean state-sponsored hackers, and transnational organized crime. FinCEN's investigation identified at least $4 billion in confirmed laundered proceeds between August 2021 and January 2025, including funds linked to the DPRK's Lazarus Group. The DOJ seizure caps a 14-month federal campaign that began with FinCEN's May 2025 designation of Huione as a "primary money laundering concern" under Section 311 of the USA PATRIOT Act.
The takedown raises uncomfortable questions for the stablecoin industry. Huione settled almost entirely in Tether's USDT before launching USDH specifically to circumvent issuer-enforced freezing mechanisms — exposing the limits of voluntary compliance in stablecoin-mediated crime flows.
Huione Group operated as a Cambodia-based corporate conglomerate with three interlocking components, each serving a distinct function in the illicit value chain:
Huione Pay processed at least $103 billion in cryptocurrency payments over its operational lifetime, according to Elliptic research. The payment processor converted between fiat currencies and crypto, providing the on-ramp and off-ramp infrastructure that connected scam operations to the legitimate banking sector.
Huione Guarantee (also known as Haowang Guarantee) operated thousands of Telegram channels, primarily in Chinese, functioning as a marketplace and escrow service for criminal vendors. According to Elliptic, merchants on the platform sold money laundering services (the largest category), stolen personal data for victim targeting, scam website development kits, telecommunications equipment used in fraud operations, and — according to DOJ filings — electric shackles and batons intended for use on trafficked workers held inside scam compounds.
Huione Crypto operated as an exchange platform, while the broader group launched the Xone blockchain and USDH stablecoin in September 2024 as part of an effort to build a self-contained financial infrastructure beyond the reach of Western enforcement.
The business model was built on trust. Huione Guarantee acted as an escrow intermediary, providing the reputational infrastructure that allowed otherwise anonymous criminal parties to transact with confidence. This guarantor function — common in Chinese-language dark markets — enabled the platform to scale far beyond anything previously seen in the illicit marketplace space.
The U.S. government's campaign against Huione has unfolded across multiple agencies over 14 months:
The prosecution is being handled by Trial Attorney Ethan Cantor and Assistant U.S. Attorney Sailaja Paidipaty out of the Northern District of California. The FBI's San Francisco Field Office, Criminal Division, and Cyber Division are leading the investigation, with IRS Criminal Investigation providing support.
The numbers place Huione in a category of its own.
| Marketplace | Lifetime Transaction Volume | Era | |---|---|---| | Silk Road | ~$216 million | 2011–2013 | | AlphaBay | ~$1 billion | 2014–2017 | | Hydra Market | ~$5.2 billion | 2015–2022 | | Huione Guarantee | $31 billion+ | 2021–2025 | | Huione Pay | $103 billion+ | Operational lifetime | | Combined Huione Ecosystem | $134 billion+ | Aggregate |
By Elliptic's assessment, Huione Guarantee alone handled roughly 140 times the transaction volume of Silk Road and 31 times that of AlphaBay. The combined Huione ecosystem — $134 billion — exceeds the GDP of more than 120 countries.
Chainalysis estimated the network processed over $70 billion in crypto transactions in the past five years, with the network accounting for more than 20% of global crypto laundering activity. In 2024 alone, Huione Guarantee recorded nearly $10 billion in transactions, according to FinCEN data.
Americans reported $11.36 billion in crypto fraud losses to the FBI in 2025 (181,565 complaints, a 21% year-over-year increase), with an average loss of $62,000 per victim in advanced scams. The FBI reported $7.2 billion in cryptocurrency investment fraud losses specifically. Operation Riptide is the federal government's sustained response to that threat.
Perhaps the most consequential aspect of the Huione case for the broader crypto industry is the USDH stablecoin.
In September 2024, Huione Group launched USDH — a dollar-pegged stablecoin available on Ethereum, BSC, Tron, and Huione's proprietary Xone chain. The group explicitly marketed USDH as "not restricted by traditional regulatory agencies," a direct response to Tether's June 2024 decision to freeze Huione-linked accounts after identifying funds connected to the Lazarus Group.
FinCEN stated that Huione "intentionally launched" USDH to avoid the freezing controls that most stablecoin issuers maintain. The timing was telling: Tether froze Huione's USDT holdings after tracing connections to North Korean state-sponsored hacking proceeds. Rather than ceasing operations, Huione built its own financial rails.
The USDH episode exposes a structural tension in the stablecoin ecosystem. The industry's compliance argument — that centralized issuers like Tether and Circle can freeze illicit funds at the smart contract level — functions only as long as criminals continue using those issuers' tokens. When enforcement pressure works, it incentivizes the creation of alternative tokens designed to circumvent the exact controls that regulators rely on.
Before the USDH launch, Huione settled "almost entirely in the USDT stablecoin," according to Elliptic. USDT on Tron was the dominant rail. The shift to USDH demonstrated that the compliance layer in stablecoins, while useful, is not a substitute for broader structural enforcement.
The national security dimension of the Huione case extends beyond financial crime. FinCEN explicitly linked Huione's operations to the DPRK's weapons of mass destruction program, stating that the group "offers services to North Korea that facilitate the laundering of funds obtained from cyber heists, including those carried out by the Lazarus Group."
Specific transactions documented by FinCEN and the FBI include:
The Lazarus Group was also behind the $1.4 billion Bybit heist in early 2025, the largest single cryptocurrency theft on record. While not all Bybit proceeds have been traced to Huione, the infrastructure overlap highlights how a single laundering hub can service both state-sponsored and criminal enterprise clients.
The Huione takedown illustrates a persistent challenge in crypto crime enforcement: dismantling infrastructure does not eliminate demand.
When Telegram removed Huione Guarantee's channels in May 2025, the platform's volumes dropped 50%. But affiliate Tudou Guarantee — in which Huione had acquired a 30% stake in 2024 — saw a 70x jump in daily inflows, according to blockchain analytics. Huione formally directed vendors to migrate to Tudou.
Tudou itself processed $12 billion in transactions before halting operations in January 2026, according to Elliptic. New entrants have since filled the vacuum:
The pattern mirrors what narcotics enforcement agencies have documented for decades: disrupting supply hubs creates temporary friction but drives rapid market reconfiguration. Each successor marketplace appears to launch with the operational lessons of its predecessor.
The Huione case arrives as the U.S. Congress debates the GENIUS Act, which would establish a federal framework for stablecoin issuance. The case provides direct evidence for several regulatory arguments:
For mandatory freeze mechanisms: Tether's ability to freeze Huione-linked USDT in 2024 demonstrated the value of issuer-level controls. But USDH's subsequent launch demonstrates the limits: compliance mechanisms work only against actors willing to remain within the regulated ecosystem.
For comprehensive AML infrastructure: FinCEN's Section 311 designation, combined with OFAC sanctions and DOJ infrastructure seizures, represents a full-spectrum approach. No single tool — neither Tether's voluntary freeze nor FinCEN's banking system severance alone — was sufficient.
For cross-border coordination: The simultaneous U.S. Treasury and UK enforcement actions on October 14, 2025, underscore that crypto laundering infrastructure operates across jurisdictions and requires coordinated responses.
The economic value question is stark. The blockchain rails that Huione exploited — primarily Tron-based USDT transfers — generated legitimate fee revenue for validators and network operators. But the $70 billion in transaction volume flowing through a single criminal ecosystem demonstrates that a material portion of on-chain activity on certain networks serves illicit purposes. This complicates the narrative that transaction fee revenue represents organic, sustainable demand for blockchain infrastructure.
The Huione Group case is the most significant enforcement action against cryptocurrency laundering infrastructure to date, both in financial scale and in the breadth of coordinated government response. The $134 billion ecosystem that Elliptic documented dwarfs every prior illicit marketplace by orders of magnitude.
The case demonstrates that stablecoin-mediated crime has reached a scale that demands regulatory infrastructure beyond voluntary issuer controls. Tether's freeze worked — and then Huione built around it. The cycle from compliant token to "unfreezable" alternative took approximately three months.
For the stablecoin industry, the implications are direct. The GENIUS Act and similar legislative efforts must contend with the reality that compliance mechanisms at the issuer level, while necessary, are insufficient against well-resourced criminal enterprises. The Huione playbook — operate on USDT until frozen, then launch a proprietary stablecoin — is now public and replicable.
The successor marketplace pattern suggests that enforcement against Huione will need to be sustained and iterative. Dabai Guarantee and its peers are already operational. The infrastructure templates are documented. The criminal demand — $20 billion in annual U.S. cybercrime losses alone — persists.
What Huione's $134 billion operation reveals, ultimately, is the scale at which blockchain infrastructure has been captured for illicit use. The economic value flowing through these networks is real, but a material fraction serves as plumbing for fraud, theft, and state-sponsored cybercrime. Distinguishing legitimate from illicit transaction volume remains the central unsolved problem for both regulators and the industry.