FBI Targets Huione: The $134 Billion Illicit Marketplace Dismantled
The FBI has seized cloud computing infrastructure belonging to subsidiaries of the Huione Group, the Cambodian conglomerate that ran what investigators and blockchain analysts now describe as the largest illicit online marketplace ever recorded. With more than $134 billion traced across the broader Huione ecosystem, the case marks a watershed moment for crypto anti-money laundering enforcement and carries direct implications for any firm that touches stablecoins, reviews digital asset counterparties, or relies on crypto accounting software to demonstrate transaction-level compliance.
What Huione Group Actually Was
On the surface, Huione Group looked like a diversified Cambodian conglomerate: financial services, insurance, tourism, real estate. Beneath that surface sat Huione Guarantee, a peer-to-peer marketplace that launched in 2021 and quickly became the operational backbone of industrial-scale online fraud across Southeast Asia and beyond.
Huione Guarantee ran through thousands of Telegram channels, conducted all its business in Chinese, and settled transactions almost exclusively in USDT, the world's largest stablecoin by volume. The marketplace acted as guarantor for every transaction, which gave merchants and buyers enough confidence to scale the operation far beyond anything previously documented.
What Was Being Sold
Early listings included cars and real estate, providing a veneer of legitimacy. In practice, the dominant product categories were anything but. The largest merchant segment offered money laundering as a service: accepting victim payments sourced from pig-butchering scams and other cyber-enabled fraud, moving those funds across borders, and converting them into cash, stablecoins, and Chinese payment app balances.
Other merchants sold stolen personal data used to identify and target victims, ready-made scam websites, and telecoms equipment for running call-centre fraud operations. Some listings were more disturbing still: electric shackles and batons intended for use on trafficked workers held inside scam compounds in Cambodia and the wider region.
The Scale in Context
By the time Huione Guarantee was forced offline, it had processed at least $31 billion in transactions. That figure alone dwarfs every illicit darknet market previously on record. Silk Road, which defined an era in crypto crime, handled around $216 million across its entire lifespan. AlphaBay, which was substantially larger, reached approximately $1 billion. Huione Guarantee was in a different category entirely.
Huione Pay, the Group's payments arm, extended the network further. It received at least $103 billion in crypto asset payments over its lifetime and operated physical outlets across Cambodia, providing the on- and off-ramp infrastructure that kept laundered funds moving.
How the Case Developed Over Two Years
The FBI's seizure on 22 September 2026 was not the beginning of this investigation. It was the culmination of a two-year enforcement arc that moved through intelligence disclosure, regulatory designation, platform-level takedowns, and ultimately criminal charges.
Key Milestones in the Huione Takedown
In July 2024, blockchain intelligence analysis first publicly identified Huione Guarantee as a marketplace built to serve the online scam ecosystem, tracing at least $11 billion through the platform at that stage. The research named specific merchant categories, mapped wallet attributions, and gave regulators and law enforcement a detailed picture of how the network operated.
Huione's response to that exposure was to attempt operational independence. It launched its own stablecoin (USDH), its own blockchain, a crypto asset exchange, and a messaging application. It rebranded the marketplace as Haowang Guarantee, apparently trying to create distance from the Huione name. None of it succeeded in breaking the investigative thread.
The US Treasury's Financial Crimes Enforcement Network (FinCEN) subsequently moved to designate Huione Group as a primary money laundering concern, explicitly citing blockchain intelligence research in its filing and proposing to cut the Group off from the US financial system. Telegram removed Huione Guarantee's channels from its platform based on intelligence disclosures, forcing the marketplace offline. By that point it had handled at least $31 billion.
Activity did not disappear. It migrated. A marketplace called Tudou Guarantee, believed to be partly owned by Huione, absorbed much of the displaced volume. Haowang Guarantee itself later collapsed, identified in real time as transaction activity across its administrative wallets dropped sharply. By then it ranked as the third-largest illicit marketplace ever recorded, with over $12 billion in received crypto asset transactions.
Huione's chairman, Li Xiong, was extradited from Cambodia to China. Cambodia revoked his citizenship. He faces charges of fraud, money laundering, and concealing criminal proceeds. The FBI's seizure of cloud computing infrastructure used by Group subsidiaries is the latest, and most operationally significant, enforcement step.
The Stablecoin Exposure That Matters for Compliance Teams
The Huione case is not primarily a story about exotic or obscure tokens. It is a story about USDT, the stablecoin that sits in the treasury accounts, trading books, and settlement workflows of legitimate businesses around the world. The marketplace's near-total reliance on USDT for settlement is the detail that should concentrate every compliance officer's attention.
Why Stablecoin AML Controls Are Now Under Scrutiny
USDT's on-chain traceability is both an advantage and a liability. It is an advantage because the blockchain record exists and can be audited. It is a liability because firms that have not built the infrastructure to actually read that record are exposed to counterparty risk they cannot currently quantify. The Huione network's $103 billion in Huione Pay flows means that, statistically, a meaningful proportion of firms accepting USDT payments over the past several years will have received funds that touched this ecosystem at some remove.
That is precisely the kind of second- and third-degree exposure that robust crypto compliance reporting frameworks are designed to surface. Without transaction-level tracing integrated into your crypto accounting software, that exposure is invisible until it becomes a regulatory problem.
For context on why the US regulatory framing matters here, our earlier analysis of stablecoin accounting implications of the Clarity Act Senate defeat covers the legislative gap that leaves stablecoin issuers and users without a unified federal AML framework. The Huione case illustrates exactly what that gap looks like when exploited at scale.
AML and Accounting Implications for B2B Firms
For accounting practices, auditors, and CFOs managing any digital asset exposure, the Huione enforcement arc produces several concrete obligations worth reviewing now.
Counterparty Due Diligence Cannot Be Static
Huione Group's businesses were structured to look legitimate. A one-time KYC check at account opening would not have surfaced the risk. Ongoing transaction monitoring, regular sanctions screening against updated OFAC and FinCEN designation lists, and the ability to trace stablecoin flows back to named wallet clusters are now baseline expectations, not advanced capabilities. The FinCEN primary money laundering concern designation is an actionable trigger: any firm that has not reviewed its exposure to Huione-linked addresses following that designation faces potential regulatory scrutiny.
Digital Asset Accounting Software Must Support Chain-Level Tracing
The enforcement action underscores a practical gap that many firms have not yet closed. Standard bookkeeping workflows treat a USDT receipt as a line item with a counterparty name attached. What the Huione case requires is the ability to trace that receipt back through the on-chain history to assess whether it has passed through a sanctioned or high-risk wallet cluster. That is not a function of a spreadsheet or a generic ledger tool. It requires digital asset accounting software that integrates blockchain analytics at the data ingestion layer, not as a retrospective add-on.
The Migration Pattern Has Compliance Consequences
Investigators are currently tracking more than 30 active guarantee marketplaces operating in the same space Huione Guarantee occupied. Xinbi Guarantee, identified as the current market leader in this ecosystem, has already received over $24 billion in crypto asset transactions and sells the same categories of goods and services. The pattern after each disruption is migration, not collapse. For compliance teams, that means the threat model does not retire when a named entity is sanctioned. The operational infrastructure moves and re-emerges, and your screening processes need to move with it.
This pattern is consistent with findings from broader enforcement trends. Our coverage of how US enforcement is reshaping crypto AML obligations sets out the wider regulatory posture that the Huione action reflects.
What Firms Should Do Now
Immediate Steps for Compliance and Accounting Teams
First, run a retrospective screen of all USDT and stablecoin inflows against the published Huione Group wallet clusters and any addresses listed in the FinCEN designation materials. This is not optional if you are subject to Bank Secrecy Act obligations or advise clients who are. Second, update your sanctions screening lists to include the full set of Huione Group entities, including Huione Pay, Haowang Guarantee, and any successor entities identified in law enforcement disclosures. Third, review your crypto bookkeeping software configuration: if your current setup cannot attach an on-chain provenance flag to a stablecoin receipt at the point of ingestion, that is a gap to close before your next audit cycle. Fourth, brief your risk committee on the migration dynamic. The relevant question is not just whether you have exposure to Huione Group specifically, but whether your monitoring infrastructure is capable of tracking its successors as they emerge.
Frequently Asked Questions
What did the FBI actually seize in the Huione action?
The FBI seized a cloud computing account used by subsidiaries of the Huione Group. This is distinct from seizing crypto asset wallets directly, though prior enforcement steps included wallet-level actions taken through other agencies and platforms.
What is a FinCEN primary money laundering concern designation and what does it require?
A primary money laundering concern designation under Section 311 of the USA PATRIOT Act allows FinCEN to impose special measures on a named institution, up to and including prohibiting US financial institutions from maintaining correspondent accounts with the designated entity. For firms holding stablecoin positions or processing payments, it creates an obligation to screen for and sever any exposure to the designated entity and its known affiliates.
Does the Huione case create liability for firms that received USDT that passed through the network?
Indirect exposure does not automatically create liability, but it does create an obligation to investigate. If transaction tracing reveals that funds received by your firm passed through wallets subsequently identified as belonging to a sanctioned entity, you may have a suspicious activity reporting obligation depending on your jurisdiction and registration status. Legal counsel with AML expertise should be engaged for any specific exposure assessment.
Why did USDT feature so prominently in the Huione marketplace?
USDT offers settlement finality, cross-border transferability, and a stable value that makes it practical for pricing services and holding balances. It also has deep liquidity across exchanges and over-the-counter desks, making conversion to local currencies straightforward. Those same features that make it attractive for legitimate treasury management also made it the instrument of choice for Huione's merchant network.
What is Xinbi Guarantee and should it be on our screening lists now?
Xinbi Guarantee has been identified by blockchain intelligence researchers as the current leading marketplace in the guarantee ecosystem that Huione Guarantee previously dominated. It has received over $24 billion in crypto asset transactions and offers the same categories of illicit services. Yes, it should be on your screening lists, and any wallet clusters publicly attributed to it should be incorporated into your transaction monitoring configuration immediately.
Source: Elliptic