DoJ Seizes Huione Cloud Account in Crackdown on Cyber Scam Money Laundering

The U.S. Department of Justice (DoJ) announced the seizure of a cloud computing account used by subsidiaries of the Cambodia-based HuiOne Group, which facilitated money laundering for cryptocurrency investment fraud, cyber scams, and other criminal activities. The account hosted backend infrastructure for HuiOne Guarantee (aka Haowang Guarantee), an illicit Telegram-based marketplace that transacted billions of dollars between 2021 and 2025 by offering crimeware tools, including personal and financial data, money laundering services, web development for fraudulent platforms, phishing websites, human trafficking procurement, and deepfake software for face swapping and voice cloning.

HuiOne Guarantee provided escrow services for criminals, enabling the movement of funds stolen by Southeast Asian scam centers. A July 2024 analysis by Elliptic revealed merchants also marketed tear gas, electric batons, and electronic shackles for use by scam compound operators. Although HuiOne ceased operations in May 2025, Flare reported that over 30 successor marketplaces have emerged, with operators building proprietary messaging platforms to bypass Telegram bans. The U.S. Treasury’s FinCEN assessed H-Pay Service PLC as a primary money laundering concern to prevent HuiOne Group from circumventing U.S. financial restrictions.

Elliptic noted that HuiOne had received over $31 billion in cryptoasset transactions, making it the largest illicit online marketplace ever recorded. Concurrently, the Treasury sanctioned nine individuals and 26 entities linked to Prince Group, which was classified as a Transnational Criminal Organization (TCO) for its role in scam compounds, fraud, and money laundering. Prince Group’s chairman, Chen Zhi, has been arrested and extradited to China.