The U.S. Department of Justice has dealt a devastating blow to the crypto laundering operation Huione Group: its server infrastructure has been seized.
The U.S. Department of Justice announced the seizure of a cloud account that served as a technical hub for the structures of the notorious Huione Group. According to the investigation, this infrastructure supported a range of services specializing in the transfer and laundering of funds obtained from cryptocurrency scams and other cybercriminal activities.
The seized account was a critical element in the chain: it supported the servers that hosted platforms and channels involved in illegal financial operations. The investigation claims that the Huione Group ecosystem provided "back-office" services for organizers of investment fraud, cryptocurrency thefts, trading of personal data, and even for supporting fraudulent call centers. Related Telegram channels openly advertised money laundering services and the sale of stolen data.
Major hub of crypto crime under attack
The Huione Group has long been in the focus of U.S. regulators. As early as 2025, FinCEN designated the company as a "primary money laundering concern," effectively cutting it off from the U.S. financial system. Estimates suggest that between August 2021 and January 2025, at least $4 billion in illicit funds passed through the group's structures, including money from crypto scams and cyberattacks attributed to North Korean hackers. The ecosystem included the payment service Huione Pay, the crypto platform Huione Crypto, and the marketplace Haowang Guarantee, which analysts called the largest illegal online platform for servicing crypto scammers.
Pressure on infrastructure: a new strategy
The seizure of server infrastructure is not just another arrest but a shift in tactics. The Justice Department emphasized that the goal of the operation is not to pursue individuals but to completely destroy the technical foundation on which the entire ecosystem of transnational crypto scams in Southeast Asia rests. This is a logical step given the scale of the threat: according to Chainalysis, the volume of illegal crypto assets grew by 162% in 2025, exceeding $154 billion.
My analysis: This operation marks a transition from combating consequences to attacking the root of the problem. While regulators limited themselves to blocking wallets, fraudsters quickly created new ones. Destroying the Huione Group's server infrastructure delivers a much more painful blow, paralyzing the operations of an entire criminal network. This is a precedent that will likely be applied to other similar "crypto laundries" in the region. The market must realize: the anonymity of cloud services is not a panacea.