DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering
The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a cloud computing account put to use by subsidiaries of Cambodia-based corporate conglomerate HuiOne Group, as the Treasury unveiled fresh sanctions against nine individuals and 26 entities linked to Prince Group.
"These subsidiaries are alleged to have assisted individuals and organizations in transferring proceeds of cryptocurrency investment frauds, cyber scams, and other criminal activities on cryptocurrency blockchains and allowing for the conversion of the proceeds of these schemes to the legitimate banking sector undetected," the DoJ said.
The seized account, the Justice Department added, hosted backend infrastructure for the subsidiaries, including HuiOne Guarantee (aka Haowang Guarantee), which operated an illicit Telegram-based marketplace that engaged in transactions with billions of dollars between 2021 and 2025 by peddling a wide range of crimeware tools.
These included personal and financial data, money laundering services, web development services for setting up fraudulent investment platforms and phishing websites, the procurement of individuals for human trafficking schemes, as well as software to facilitate face swapping, voice cloning, and deepfake-powered impersonation during video calls with victims.
"HuiOne Guarantee also provided escrow services for criminals transacting on its platforms to facilitate transactions, including money launderers laundering cryptocurrency," the DoJ said. "In doing so, HuiOne Guarantee facilitated the movement of considerable funds stolen by Southeast Asian scam centers."
A July 2024 analysis from Elliptic revealed that merchants on HuiOne also marketed tear gas, electric batons, and electronic shackles for use by scam compound operators to imprison and torture their workers. "The merchants refer to 'preventing escapers' and controlling 'runaway dogs,'" the company noted at the time. "Those working within the scam compounds are commonly referred to as 'dogs' or 'dog pushers.'"
"The HuiOne Group used this cloud computing account as part of a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed β much of it stolen through Southeast Asian scam centers," said Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division.
"Seizures of these marketplaces is critical in the fight against fraud that affects so many Americans, and to stop avenues for criminal proceeds to be laundered."
Although HuiOne announced it was ceasing operations in May 2025, a new analysis from Flare has revealed that more than 30 marketplaces have emerged since to fill up the void left by the guarantee platform, with the operators building proprietary messaging platforms to bypass Telegram's bans.
"The wave of enforcement in 2025 was the first coordinated attempt to reach both the financial and physical layers of the ecosystem at the same scale," Flare researcher Chris d'Eon said. "It has produced visible adaptation, including reshuffled channel branding, redistributed flows across successor markets, and accelerated work on alternative venues. However, it has not meaningfully reduced volume across the ecosystem in aggregate."
In tandem, the U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) has assessed H-Pay Service PLC as a primary money laundering concern to guard against "HuiOne Group's attempts to circumvent being cut off from the U.S. financial system." It's worth noting that FinCEN designated HuiOne Group as a "primary money laundering concern" in May 2025.
"Merchants sold money laundering services, stolen personal data, websites and other goods and services necessary to perpetrate so-called 'pig butchering' scams and other online fraud," Elliptic said in a statement. "By the time HuiOne was forced offline, it had received more than $31 billion in cryptoasset transactions, making it the largest illicit online marketplace ever recorded, more than 25 times larger than Silk Road and AlphaBay combined."
The development also comes as the Treasury levied sanctions against Prince Group's leadership, investors in scam compounds, and front companies, a little over eight months after it was classified as a Transnational Criminal Organization (TCO) for its role in furthering a criminal enterprise built on the foundations of scam compounds, fraud, and money laundering. Prince Group's chairman, Chen Zhi has since been arrested, extradited to China, and stripped of his Cambodian citizenship.
"Transnational criminal organizations based in Southeast Asia, like the Prince Group TCO and with support of their enablers like HuiOne Group, continue to target Americans through large-scale cyber-enabled fraud and scam operations," Treasury said.
source: TheHackerNews
