The US Justice Department has seized a cloud account connected to Huione Group, with the action centered on infrastructure allegedly used by a Telegram-based operation. Authorities said the move focused on Huione Guarantee, also registered as Haowang Guarantee, which is accused of offering escrow services for illicit crypto proceeds and facilitating the trade of stolen financial data and other illegal services.
Authorities target the infrastructure behind the network
The operation did not focus only on individual wallets or suspects. It went after the technical systems keeping the marketplace active. Assistant Chief A. Tysen Duva of the Justice Department’s Criminal Division said taking control of this kind of infrastructure is important for fighting fraud that affects large numbers of Americans and for shutting down channels used to launder criminal proceeds. The investigation was supported by Chainalysis, Elliptic, and Google’s Cybercrime Investigation Team.
The report describes Huione Guarantee as a service layer that helped build trust inside criminal markets. In an escrow model, a third party holds payment until a transaction is completed. Inside illicit networks, that structure can make deals easier to execute by reducing counterparty risk between actors who would otherwise have little reason to trust each other.
FinCEN links at least $4 billion in illicit flows to Huione
The Financial Crimes Enforcement Network, or FinCEN, said organizations tied to Huione were involved in laundering at least $4 billion in illegal funds between August 2021 and January 2025. According to the report, those transfers were connected to investment scams, attacks attributed to North Korea’s Lazarus Group, and other cross-border fraud operations.
FinCEN has also designated Huione Group as a primary money laundering concern under the US PATRIOT Act. The measure extends beyond the main group itself and reaches related entities and financial intermediaries, showing that US authorities are widening their response to the broader network rather than isolating one company.
Telegram-based markets draw renewed scrutiny
US officials say marketplaces built on platforms such as Telegram combine private messaging, anonymous vendor accounts, crypto payments, and cross-border infrastructure in a way that can avoid traditional banking oversight. The US Treasury had already sanctioned people and organizations tied to Cambodian scam centers associated with Huione. Washington says these networks cause billions of dollars in losses to US citizens each year.
Data from the FBI Internet Crime Complaint Center shows that crypto investment scams alone caused $7.2 billion in losses in the US in 2025. Total recorded losses from all cybercrimes during the same period reached $21 billion. Blockchain analysts cited in the report said crackdowns of this type often lead to fragmentation in the short term instead of a full shutdown, with liquidity moving to other channels and transactions rerouted across alternative platforms.
Attention now turns to the public comment phase for the FinCEN proposal and to any changes in the OFAC sanctions list. On-chain intelligence reports expected in late 2026 may show whether Huione-linked flows have actually stopped or have simply shifted direction.