The U.S. Department of Justice has struck a blow against the infrastructure of the crypto laundering operation Huione Group: key servers have been seized.
The U.S. Department of Justice has officially announced the seizure of a cloud account used by structures of the notorious Huione Group. This account served as the foundation for a range of services specializing in the transfer and laundering of funds obtained from crypto scams and other criminal activities. The seizure of the server infrastructure is a significant step that directly impacts the operational capabilities of one of the largest shadow financial networks.
According to the investigation, the seized infrastructure supported platforms and channels through which illegal financial transactions were conducted. The Huione Group ecosystem essentially represented a full-cycle "crypto laundry." It provided services for organizers of investment fraud, cryptocurrency thieves, traders of personal data, and other cybercriminals. In particular, related Telegram channels actively advertised services for money laundering, selling stolen databases, and supporting the operations of fraudulent call centers.
One of the Largest Centers of Crypto Crime
The Huione Group has long been under close scrutiny by U.S. regulators. As early as 2025, the U.S. Treasury Department's FinCEN designated the company as a "primary money laundering concern," effectively cutting it off from the U.S. financial system. The agency's estimates were shocking: from August 2021 to January 2025, at least $4 billion in illegal funds passed through the group's structures. This amount included money from cryptocurrency fraud, cyberattacks by North Korean hackers, and other criminal schemes.
The ecosystem included the payment service Huione Pay, the cryptocurrency platform Huione Crypto, and the marketplace Haowang Guarantee. Analysts called the latter the largest illegal online platform for servicing crypto scammers, making the Huione Group a key link in the global cybercrime chain.
Pressure on Fraudsters' Infrastructure Intensifies
The seizure of the server infrastructure is not just a targeted strike but part of a systemic U.S. campaign against financial services that support transnational fraud networks in Southeast Asia. The Justice Department emphasized that the operation's goal is not only to pursue individual criminals but also to completely destroy the infrastructure that supports the entire crypto scam ecosystem. This resembles the "scorched earth" strategy previously successfully applied against darknet marketplaces.
Analyst Comment: The confiscation of the Huione Group's cloud account is a landmark event that demonstrates the growing ability of U.S. law enforcement to attack not only wallets but also the operational infrastructure of crypto criminals. Given that in 2025, the turnover of illegal crypto assets increased by 162%, reaching $154 billion, such measures are becoming critically important for curbing the wave of fraud. However, as practice shows, such networks quickly restructure, and the market should expect the emergence of new, even more sophisticated schemes.