DOJ Seizes Huione Group Cloud Infrastructure as Treasury Sanctions 26 Entities Tied to Cambodian Scam Networks
The U.S. Justice Department seized cloud infrastructure used by Huione Group's criminal marketplace Huione Guarantee, while Treasury sanctioned 26 Prince Group-linked entities, disrupting billions in scam proceeds.
The Justice Department on Tuesday seized a cloud computing account that served as the technological backbone for Huione Guarantee, a criminal marketplace operated by the Cambodia-based Huione Group. The platform, also known as Haowang Guarantee, facilitated a vast array of cyber-enabled crimes including the sale of stolen credit card data, malware-enabled theft, human trafficking schemes, and money laundering from romance and investment scams. Officials said the marketplace used Telegram channels to conduct illicit transactions and offered escrow services for cryptocurrency launderers.
“The Huione Group used this cloud computing account as part of a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed — much of it stolen through Southeast Asian scam centers,” said Tysen Duva, assistant attorney general of the Justice Department’s Criminal Division. “Seizures of these marketplaces is critical in the fight against fraud that affects so many Americans, and to stop avenues for criminal proceeds to be laundered.”
Simultaneously, the Treasury Department announced fresh sanctions against Huione Group and 26 additional entities linked to Prince Group, the conglomerate chaired by Chen Zhi. Treasury designated H-Pay Service as a successor entity to the previously sanctioned Huione Group, further severing its access to the U.S. financial system. The sanctions target individuals and organizations that Treasury says served as critical nodes for laundering proceeds from cyber heists and virtual currency investment scams.
Tuesday’s actions build on a major October 2025 enforcement wave in which the DOJ seized $15 billion in bitcoin from Chen Zhi and indicted him on cryptocurrency fraud and other charges. Following those seizures, an alleged key figure in Chen’s criminal network was arrested in Cambodia and extradited to China. The coordinated U.S. crackdown reflects the Trump administration’s intensified focus on combating transnational cybercrime and fraudulent operations that originate from Southeast Asian scam centers.
The Huione Group’s criminal marketplace had been under increasing scrutiny after researchers at Flare earlier in June 2026 detailed a network of Chinese-language ‘guarantee’ marketplaces on Telegram that processed over $35 billion in cryptocurrency transactions. While Tuesday’s DOJ action specifically targets Huione Guarantee infrastructure, the broader ecosystem of such escrow-based Telegram markets continues to facilitate stolen data sales, phishing kits, and deepfake services on a massive scale.
“Seizures of these marketplaces is critical in the fight against fraud that affects so many Americans, and to stop avenues for criminal proceeds to be laundered,” Duva emphasized. The Justice Department's announcement did not disclose the identity of the cloud provider whose account was seized, but officials confirmed the infrastructure hosted backend systems that allowed Huione Guarantee to operate with apparent impunity until the takedown.
The coordinated law enforcement action marks a significant escalation in U.S. efforts to dismantle the financial infrastructure enabling Southeast Asian cybercrime. With billions in proceeds flowing through Huione-linked accounts, the sanctions and infrastructure seizure are expected to disrupt ongoing fraud operations and deter legitimate cloud and financial services from unknowingly supporting criminal marketplaces.
The Department of Justice confirmed on June 23 that it seized a cloud computing account hosting backend infrastructure for subsidiaries of Huione Group, the Cambodian conglomerate previously cut off from the U.S. financial system. This seizure is the latest U.S. law enforcement action against technical assets powering Southeast Asian cyber-scam operations, including Telegram channels where stolen credentials and human trafficking resources were traded. The action follows Treasury sanctions on 26 entities and the extradition of former Huione head Li Xiong to China.