U.S. Department of Justice has announced the seizure of a cloud computing account allegedly used by subsidiaries of Cambodia based conglomerate Huione Group to facilitate cryptocurrency fraud, cyber scams, and large scale money laundering activities. The action was revealed alongside new sanctions imposed by the U.S. Treasury against nine individuals and 26 entities linked to Prince Group. According to DoJ, the seized cloud infrastructure supported backend operations for several Huione subsidiaries that were allegedly involved in helping criminal organizations move proceeds generated from cryptocurrency investment fraud, online scams, and other illicit activities through blockchain networks while enabling the conversion of those proceeds into the legitimate financial system. Authorities stated that the infrastructure played a significant role in supporting services used by criminal networks operating across Southeast Asia and beyond.
Investigators said the seized account hosted systems connected to HuiOne Guarantee, also known as Haowang Guarantee, an illicit marketplace that operated primarily through Telegram between 2021 and 2025. The platform allegedly facilitated billions of dollars in transactions involving a wide range of cybercrime related services and products. According to DoJ, merchants on the marketplace offered stolen personal and financial information, money laundering services, web development assistance for fraudulent investment platforms, phishing websites, and tools designed to support online scams. Authorities also alleged that the marketplace provided access to software capable of face swapping, voice cloning, and deepfake based impersonation during video calls with victims. HuiOne Guarantee further operated escrow services that enabled secure transactions between criminals, including cryptocurrency laundering activities. DoJ stated that these services helped move substantial amounts of funds stolen through scam centers operating across Southeast Asia. Previous research published by blockchain analytics company Elliptic in July 2024 found that some merchants on the platform marketed tear gas, electric batons, and electronic restraints allegedly intended for use by operators of scam compounds to control and punish workers. Researchers reported that sellers openly referenced preventing escapes and maintaining control over workers involved in fraudulent operations.
Assistant Attorney General A. Tysen Duva stated that Huione Group used the cloud computing account as part of a technological backbone that allowed billions of dollars in fraud proceeds to be transferred, concealed, and laundered. Officials emphasized that disrupting marketplaces that enable large scale fraud and financial crime remains a critical component of efforts to combat cyber enabled scams targeting individuals and businesses. Although Huione publicly announced the closure of its operations in May 2025, recent research from cybersecurity company Flare indicates that the ecosystem surrounding the platform remains active. Researchers identified more than 30 successor marketplaces that have emerged since the shutdown, with operators increasingly developing proprietary messaging platforms to replace Telegram after enforcement actions and account bans. Flare researcher Chris d’Eon noted that enforcement measures introduced during 2025 prompted visible changes across the ecosystem, including rebranding efforts, redistribution of financial flows, and migration to alternative communication channels. However, the company reported that overall transaction volumes across the broader ecosystem have not significantly declined.
At the same time, U.S. Treasury’s Financial Crimes Enforcement Network has designated H Pay Service PLC as a primary money laundering concern in an effort to prevent Huione Group from bypassing restrictions imposed on its access to the U.S. financial system. This follows FinCEN’s earlier designation of Huione Group as a primary money laundering concern in May 2025. Elliptic stated that merchants operating on HuiOne sold money laundering services, stolen personal information, websites, and other tools used to conduct pig butchering scams and related forms of online fraud. By the time the marketplace ceased operations, researchers estimated it had processed more than $31 billion in cryptocurrency transactions, making it the largest illicit online marketplace ever documented and significantly larger than Silk Road and AlphaBay combined. The latest actions also coincide with sanctions targeting leadership figures, investors, and front companies associated with Prince Group, which was designated a Transnational Criminal Organization more than eight months ago due to its alleged involvement in scam compounds, fraud operations, and money laundering activities. U.S. Treasury stated that criminal organizations operating from Southeast Asia, supported by entities such as Huione Group, continue to conduct extensive cyber enabled fraud campaigns that target victims around the world and generate billions of dollars in illicit proceeds.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
