U.S. Justice Department seizes Huione cloud account in Operation Torrent
The action targets backend infrastructure tied to Huione Guarantee as FinCEN extends its anti-money-laundering measures to H-Pay Service PLC to block potential sanctions evasion.
The U.S. Justice Department seized a cloud computing account used by a Huione Group subsidiary to provide backend infrastructure for Telegram marketplace Huione Guarantee, widening a U.S. crackdown on the technical systems that authorities say support crypto-enabled fraud and laundering networks. Authorities say Huione Guarantee, also known as Haowang Guarantee, functioned as a Telegram-based marketplace and escrow hub that helped launder proceeds from billions of dollars in crypto investment scams and cyber fraud while facilitating trade in stolen financial data, identity credentials and other criminal services. The action, part of Operation Torrent, comes after FinCEN designated Huione Group a primary money laundering concern and said Huione-related organizations were involved in laundering at least $4 billion from August 2021 through January 2025, including funds tied to pig-butchering scams, North Korea-linked Lazarus Group cyberattacks and other transnational fraud schemes. FinCEN said the same day it extended its prior action against Huione to successor entity H-Pay Service PLC to prevent sanctions evasion. The DOJ said Chainalysis and Elliptic, working with Google's CyberCrime Investigation Team, assisted in the investigation.
- escrow hub: A service that temporarily holds funds during a transaction until agreed conditions are met.
- pig-butchering scams: Fraud schemes in which victims are groomed over time and persuaded to send increasing amounts of money, often through fake investment platforms.
- sanctions evasion: Attempts to bypass government restrictions that prohibit dealings with designated people, entities or jurisdictions.