The U.S. Department of Justice on June 23, 2026, seized the cloud computing infrastructure underpinning Huione Group, a Cambodia-based conglomerate whose subsidiaries processed $134 billion in combined cryptocurrency transactions, according to blockchain analytics firm Elliptic. The seizure, cond...
"The Huione Group used this cloud computing account as part of a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed." — A. Tysen Duva, Assistant Attorney General, U.S. Department of Justice
The U.S. Department of Justice on June 23, 2026, seized the cloud computing infrastructure underpinning Huione Group, a Cambodia-based conglomerate whose subsidiaries processed $134 billion in combined cryptocurrency transactions, according to blockchain analytics firm Elliptic. The seizure, conducted under Operation Riptide, targeted backend systems supporting Huione Guarantee — a Telegram-based marketplace that facilitated money laundering, sale of stolen identity data, and escrow services for pig-butchering investment scams.
The action caps a 24-month enforcement campaign that began with Elliptic's initial exposure of the platform in July 2024, continued through FinCEN's designation of Huione as a "primary money laundering concern" under Section 311 of the USA PATRIOT Act in October 2025, and culminated in the April 2026 extradition of former chairman Li Xiong from Cambodia to China. Despite this sustained pressure, Elliptic currently tracks more than 30 active successor guarantee marketplaces, led by Xinbi Guarantee, which has already received $24 billion in crypto transactions.
On June 23, the DOJ announced the seizure of a cloud computing account that hosted backend infrastructure for Huione Group subsidiaries, including the now-defunct Huione Guarantee marketplace and Huione Pay payment processor. The FBI's San Francisco field office and IRS Criminal Investigation led the operation as part of Operation Riptide, the FBI's sustained enforcement campaign against cybercrime infrastructure.
The seized account functioned as the technical backbone enabling billions in fraud proceeds to be transferred, moved, and laundered before conversion into the traditional banking system. According to court documents, the infrastructure supported Telegram channels where vendors openly traded stolen credit card data, identity information, malware-enabled theft proceeds, and money laundering services for romance and investment scam operators.
The case was prosecuted by Trial Attorney Ethan Cantor of the DOJ's Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Sailaja Paidipaty of the Northern District of California. The DOJ noted that CCIPS has recovered over $350 million in victim funds since 2020.
The numbers dwarf anything previously observed in illicit online marketplaces:
| Metric | Value | Source | |--------|-------|--------| | Huione Guarantee total transactions | $31 billion | Elliptic | | Huione Pay lifetime volume | $103 billion | Elliptic | | Combined ecosystem volume | $134 billion | Elliptic | | FinCEN-confirmed laundered proceeds | $4 billion (Aug 2021–Jan 2025) | FinCEN | | Xinbi Guarantee (successor) volume | $24 billion | Elliptic | | Tudou Guarantee volume before closure | $12 billion | Elliptic |
For context: Silk Road processed approximately $216 million in total transactions. AlphaBay handled roughly $1 billion. Huione Guarantee alone was more than 25 times larger than both combined, according to Elliptic's analysis.
When Elliptic first exposed the platform in July 2024, it had traced $11 billion in flows. Within two years, the confirmed figure nearly tripled to $31 billion for the marketplace alone — an indication that much of the activity accelerated even as enforcement pressure mounted.
Chainalysis estimated the broader Huione-linked ecosystem processed more than $70 billion in crypto transactions over five years, with approximately $16.1 billion in illicit funds processed in 2025 alone — representing more than 20% of estimated global crypto laundering activity for that year.
The takedown of Huione unfolded across multiple jurisdictions and agencies over two years:
Huione Guarantee's vendor ecosystem offered a full-service toolkit for financial crime:
Pig-butchering scams: The platform served as primary infrastructure for romance and investment fraud operations across Southeast Asia. The FBI's IC3 reported Americans lost $11.37 billion to cryptocurrency scams in 2025, a 22% year-over-year increase. Of that, pig-butchering schemes accounted for a significant portion. The FBI's Operation Level Up, a proactive victim notification initiative, had by March 2026 notified 8,935 victims, 77% of whom were unaware they were being scammed. The program saved an estimated $562 million in potential losses. Ninety-three victims required FBI referral to suicide intervention specialists.
North Korean cyber heists: FinCEN confirmed Huione laundered at least $37 million in cryptocurrency stolen by the Democratic People's Republic of Korea's Lazarus Group. Between June 2023 and February 2024, Lazarus sent $150,000 in illicit crypto directly to Huione for laundering. FinCEN's investigation found Huione officials dealt directly with a North Korean national representing the Reconnaissance General Bureau (RGB), the DPRK's primary foreign intelligence service.
Human trafficking: Court documents allege the marketplace facilitated procurement of individuals for trafficking schemes, and sold physical restraints including electric shackles. The platform's vendor channels also offered telecoms equipment used to staff scam compounds across Southeast Asia.
Identity theft and malware: Merchants openly sold stolen credit card data, personal identity packages, and malware-derived theft proceeds through thousands of Telegram channels.
Despite the comprehensive enforcement campaign, the guarantee marketplace model has proven resilient. Elliptic currently tracks more than 30 active successor platforms. The market has consolidated rapidly.
Xinbi Guarantee leads the post-Huione ecosystem, having received over $24 billion in cryptoasset transactions to date, with monthly USDT inflows peaking above $1.2 billion. According to blockchain analytics firm Bitrace, Xinbi has achieved near-monopoly status through a closed-loop ecosystem that inherited the merchant base and operational model of its predecessors.
The pattern is consistent: when Telegram shut down Huione Guarantee in May 2025, merchants migrated to successor platforms within weeks. Tudou Guarantee absorbed significant volume before winding down in January 2026, whereupon its merchant ecosystem transferred largely intact to Xinbi.
The United Kingdom has sanctioned Xinbi, but the marketplace continues to operate. The underlying demand — crypto-denominated escrow and settlement services for cross-border illicit transactions — has not diminished.
In the first four months of 2026, law enforcement across jurisdictions arrested 276 individuals connected to pig-butchering operations and evacuated at least nine scam compounds, according to a joint agency press release from April 29, 2026. The enforcement activity represents more coordinated action than the entire preceding decade, yet the infrastructure continues to reconstitute.
USDT on the TRON network served as the dominant payment rail across Huione's ecosystem. Transactions were settled through thousands of Telegram channels using stablecoin transfers that offered near-instant, pseudonymous, cross-border settlement.
In response to the Huione exposure, Huione launched USDH in September 2024, a proprietary stablecoin explicitly marketed as "unfreezable" — a direct counter to Tether's ability to blacklist addresses at law enforcement request. To date, Tether has blacklisted addresses holding a combined $3.29 billion in frozen assets across Ethereum and TRON networks, and has integrated the U.S. Secret Service and FBI into its compliance platform for direct wallet flagging.
The dynamic illustrates a structural tension: stablecoins enable the settlement infrastructure that makes guarantee marketplaces operationally viable, while the same issuers serve as potential chokepoints for law enforcement. The creation of "unfreezable" alternatives suggests criminal operators have identified — and are attempting to route around — these control points.
The Huione Group enforcement arc — from Elliptic's initial exposure in July 2024 to the DOJ infrastructure seizure in June 2026 — represents the most comprehensive action ever taken against a crypto-enabled criminal marketplace. The scale of $134 billion in combined transaction volume places it in a category previously occupied only by sanctioned nation-state financial networks.
The operational question is no longer whether law enforcement can dismantle individual platforms. The Huione case demonstrates it can. The question is whether the guarantee marketplace model — crypto-settled, Telegram-hosted, jurisdictionally distributed — can be structurally suppressed. With 30+ successors active and Xinbi processing over $1.2 billion monthly in USDT, the current evidence suggests it cannot, at least not through platform-level enforcement alone.
The data points toward a structural dependency on stablecoin settlement rails. Future enforcement efficacy may hinge on whether issuers can freeze funds faster than operators can migrate to "unfreezable" alternatives, and whether jurisdictions hosting scam compounds face sufficient diplomatic pressure to act. Cambodia's extradition of Li Xiong suggests movement on the latter front. The former remains an open question.