The U.S. Department of Justice has seized key infrastructure of the cryptocurrency laundering operation Huione Group — a blow to the "shadow bank" of scammers.
The U.S. Department of Justice has dealt another devastating blow to the global network of financial crimes by seizing a cloud account that served as a digital hub for the structures of the notorious Huione Group. This account supported the server infrastructure through which dozens of platforms and channels specializing in illegal financial operations functioned.
According to investigation materials, the Huione Group ecosystem represented a full-fledged "shadow bank" for crypto scammers, hackers, and organizers of investment fraud. Related Telegram channels actively advertised services for money laundering, selling stolen personal data, and technical support for fraudulent call centers. In essence, it was an entire industry built on servicing cybercrime.
Scale of the Disaster: $4 Billion in Illegal Flows
The Huione Group has long been in the focus of U.S. regulators. As early as 2025, the U.S. Treasury Department's FinCEN designated the company as a "primary money laundering concern," effectively cutting it off from the U.S. financial system. According to the agency's estimates, from August 2021 to January 2025, at least $4 billion in illegal funds passed through the group's structures. This amount includes not only money from cryptocurrency scams but also assets stolen by North Korean hacker groups, as well as proceeds from other transnational criminal schemes.
The ecosystem included the payment service Huione Pay, the cryptocurrency platform Huione Crypto, and the marketplace Haowang Guarantee (formerly Huione Guarantee). Analysts called the latter the largest illegal online platform for servicing crypto scammers. It was a veritable supermarket of tools for fraudsters.
Systematic Cleanup: Criminal Infrastructure Under Attack
The seizure of the server infrastructure is not just a one-time operation but part of a systemic U.S. campaign against financial services that support transnational fraud networks in Southeast Asia. The Justice Department directly stated: the goal of the operation is not only to pursue individual criminals but to completely destroy the infrastructure that enables the entire crypto scam ecosystem. This is a fundamentally important approach.
Against the backdrop of these events, it is worth noting that according to Chainalysis, in 2025, over $154 billion was sent to illegal crypto wallets—a 162% increase compared to 2024. The market for illegal crypto services continues to grow, but actions like the confiscation of Huione's infrastructure show that regulators are moving from targeted strikes to the systematic dismantling of entire criminal ecosystems.
My professional opinion: The confiscation of the Huione Group's cloud account is a signal to all "crypto laundries" that think they are invulnerable. Regulators have learned to strike not at wallets but at infrastructure. If scammers could previously quickly move servers between jurisdictions, now cloud providers will be much more thorough in checking their clients. For the market, this means the cost of running an illegal crypto business is rising sharply, and we will see further consolidation among those trying to stay in the shadows.