Cyber & Technology — 2026-06-27

DOJ Seizes Huione Cloud Infrastructure and Treasury Sanctions 35 Entities in Coordinated Crypto Laundering Takedown

BLUFHuione Group will likely reconstitute a successor marketplace within 90 days of the June 23 seizure, as infrastructure takedowns without parallel human network disruption have consistently failed to prevent rapid platform migration.

On June 23, the Justice Department seized a cloud computing account used by subsidiaries of Cambodia-based Huione Group, which DOJ officials characterized in court documents as "one of the world's most prolific criminal marketplaces" 1. The account hosted backend infrastructure for Huione Guarantee, also known as Haowang Guarantee, a Telegram-based platform that brokered stolen identity data, human trafficking services, and cryptocurrency laundering for Southeast Asian scam operations 12. The same day, Treasury sanctioned nine individuals and 26 entities linked to Prince Group, and FinCEN issued a proposed rule extending its existing Huione ban to successor entity H-Pay Service PLC 23. FBI's Internet Crime Complaint Center reported over $7.2 billion in cryptocurrency investment fraud losses in 2025, part of more than $20 billion in total cybercrime losses for the year, a 26 percent single-year increase 12.

Analysis
Huione Group will likely reconstitute a functioning successor marketplace within 90 days. Moderate confidence rests on its documented adaptation pattern: after Telegram banned its channels in May 2025, successors emerged within weeks, and the group concurrently launched its own stablecoin as financial access narrowed. The factual record is anchored by DOJ and Treasury's own disclosures, with secondary outlets adding no independent corroboration. Infrastructure seizures without commensurate human network disruption have not prevented prior reconstitutions, and sustained enforcement velocity may instead drive a shift to decentralized infrastructure structurally harder to seize. If reconstitution occurs within 90 days, FinCEN's H-Pay extension is insufficient and financial institutions cannot reduce Huione-linked AML screening. Absent reconstitution, infrastructure seizure becomes a viable standalone disruption tool for adjacent Southeast Asian networks.
5 sources
  1. Justice Department Seizes Backend Infrastructure Used by the Huione Group for Money Laundering Services - U.S. Department of Justice
  2. DOJ Seizes Huione Infrastructure Linked to Billions in Crypto Laundering - Decrypt
  3. Justice Department seizes infrastructure used by cyber scam and criminal marketplace - CyberScoop
  4. DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering - The Hacker News
  5. Treasury Further Dismantles Overseas Scam Operations Targeting Americans - U.S. Department of the Treasury

View in full brief →

UNCLASSIFIED // OPEN SOURCE