On Tuesday, the U.S. Department of Justice (DoJ) revealed that it had taken control of a cloud computing account used by subsidiaries of HuiOne Group, a Cambodia-based corporate conglomerate. Simultaneously, the Treasury Department imposed new sanctions on nine individuals and 26 entities connected to Prince Group.
According to the DoJ, these subsidiaries are accused of helping various individuals and organizations move illicit funds stemming from cryptocurrency investment scams, cyber fraud, and other illegal activities across cryptocurrency blockchains, while also enabling the conversion of those illicit proceeds into the legitimate banking system without detection.
The Justice Department further explained that the seized account hosted the backend infrastructure for the subsidiaries, including HuiOne Guarantee (also known as Haowang Guarantee), which ran an illegal marketplace on Telegram. Between 2021 and 2025, this marketplace facilitated billions of dollars in transactions by offering a broad array of criminal tools and services.
Among the offerings were personal and financial data, money laundering assistance, web development services for creating fake investment platforms and phishing sites, recruiting individuals for human trafficking operations, and software designed to enable face swapping, voice cloning, and deepfake-driven impersonation during live video calls with victims.
“HuiOne Guarantee also acted as an escrow service for criminals using its platform to carry out transactions, including those laundering cryptocurrency,” the DoJ stated. “In this role, HuiOne Guarantee helped move significant sums of money stolen by scam operations across Southeast Asia.”
A July 2024 report from Elliptic found that vendors on HuiOne were also selling tear gas, electric batons, and electronic shackles intended for use by scam compound operators to detain and abuse their workers. “The sellers use terms like ‘preventing escapers’ and controlling ‘runaway dogs,'” the firm observed at the time. “People forced to work inside these scam compounds are often referred to as ‘dogs’ or ‘dog pushers.'”
“The HuiOne Group leveraged this cloud computing account as a key piece of its technological infrastructure, which enabled the transfer, movement, and concealment of billions in fraudulent proceeds — much of it siphoned off through Southeast Asian scam centers,” said A. Tysen Duva, Assistant Attorney General of the Justice Department’s Criminal Division.
“Taking down these kinds of marketplaces is essential in the battle against fraud that impacts so many Americans, and in cutting off channels used to launder criminal proceeds.”
Even though HuiOne declared it was shutting down in May 2025, a recent analysis by Flare indicates that over 30 new marketplaces have since emerged to take the place of the guarantee platform, with their operators building custom messaging systems to circumvent Telegram’s enforcement actions.
“The 2025 wave of law enforcement actions marked the first coordinated effort to target both the financial and physical layers of this ecosystem at the same scale,” said Flare researcher Chris d’Eon. “It has led to noticeable changes, including rebranded channels, redistributed activity across successor markets, and faster development of alternative platforms. However, it hasn’t significantly reduced the overall volume of activity across the ecosystem.”
In a related move, the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) has classified H-Pay Service PLC as a primary money laundering risk to prevent “HuiOne Group’s efforts to bypass being cut off from the U.S. financial system.” It’s worth noting that FinCEN had already designated HuiOne Group as a “primary money laundering concern” back in May 2025.
“Vendors on the platform sold money laundering services, stolen personal data, websites, and other goods and services needed to carry out so-called ‘pig butchering’ scams and various forms of online fraud,” Elliptic said in a statement. “By the time HuiOne was forced offline, it had processed over $31 billion in cryptocurrency transactions, making it the largest illegal online marketplace ever documented — more than 25 times the combined size of Silk Road and AlphaBay.”
This development also follows the Treasury’s imposition of sanctions targeting Prince Group’s leadership, investors in scam compounds, and front companies. This comes just over eight months after Prince Group was designated as a Transnational Criminal Organization (TCO) for its involvement in a criminal enterprise rooted in scam compounds, fraud, and money laundering. Prince Group’s chairman, Chen Zhi, has since been arrested, extradited to China, and had his Cambodian citizenship revoked.
“Transnational criminal organizations operating out of Southeast Asia, such as the Prince Group TCO and supported by enablers like the HuiOne Group, continue to prey on Americans through large-scale cyber-enabled fraud and scam operations,” the Treasury stated.
