Huione Group

The Huione Group’s designation as a primary money laundering concern by FinCEN exposes Cambodia’s acute vulnerabilities as a Southeast Asian cybercrime hub, where lax regulatory oversight and deficient AML/KYC frameworks enabled the laundering of at least $4 billion in illicit proceeds from 2021-2025, including DPRK cyber heists and “pig butchering” scams devastating global victims. This Cambodia-based consortium’s integrated network—spanning Huione Pay’s fiat-to-crypto cash exchanges in Phnom Penh, Huione Crypto’s VASP operations with proprietary USDH stablecoin, and Haowang Guarantee’s Telegram marketplace peddling scam tools—exploited the kingdom’s crypto bans and weak enforcement to layer funds through nested accounts, cross-border transfers, and illicit marketplaces, processing over $2.6 billion in USDT alone while evading detection despite public exposure. Critically, despite the National Bank of Cambodia revoking Huione Pay’s license in March 2025 and U.S. prohibitions severing its financial system access, the absence of robust local crackdowns perpetuates Cambodia’s role in transnational laundering loops, underscoring the urgent need for enhanced cross-border intelligence sharing and jurisdictional reforms to dismantle such infrastructures before they fuel further DPRK proliferation and TCO dominance.

The Huione Group, based in Cambodia, has emerged as a major conduit for laundering proceeds from Southeast Asian cyber-enabled fraud and international cybercrimes, notably linked to DPRK criminal syndicates. Between 2021 and 2025, it processed an estimated $4 billion in illicit funds using a network of financial service entities that combine fiat and cryptocurrency payment channels with an online marketplace for illicit goods and services. The group lacks effective AML/KYC controls, aiding its role as a critical laundering hub. FinCEN designated it a primary money laundering concern, cutting off its access to the U.S. financial system, but Cambodian regulatory measures appear insufficient or ineffective to mitigate the ongoing risks. This case underscores Cambodia’s vulnerabilities as a regional money laundering hub facilitated by weak financial oversight and illicit cryptocurrency activity.

Countries Involved

Primarily Cambodia, with transnational links across Southeast Asia and connections to global cybercrime actors including the Democratic People’s Republic of Korea (DPRK) and the United States due to enforcement actions.

Date Discovered / Reported

The financial crimes tied to the Huione Group came under detailed scrutiny and were publicly reported in 2025, with key FinCEN findings and notices issued between April and October 2025, covering illicit activities from August 2021 to January 2025.

Cryptocurrency Involved

USDT (Tether), Huione-issued stablecoin USDH, BTC, ETH, and other convertible virtual currencies

Type of Crime

Money laundering, cyber-enabled fraud, investment scams (notably “pig butchering” scams), cyber heists involving DPRK-linked malicious actors, and providing infrastructure for the sale of illicit goods and services online.

Entities Involved

Huione Group functions as a conglomerate with key subsidiaries including Huione Pay PLC (payment services institution), Huione Crypto (VASP), and Haowang Guarantee (an online illicit marketplace). These entities collectively form the financial and transactional infrastructure for laundering proceeds from cyber-enabled crimes.

PEP Involvement

No direct public evidence indicates politically exposed persons (PEPs) involvement, though the group’s operation within Cambodia raises concerns about regulatory oversight in jurisdictions with limited AML enforcement.

Laundering Techniques Used

Huione Group uses an interconnected network that mixes fiat payment services and virtual asset transfers to launder proceeds. The laundering cycle involves layering through fake online marketplaces, payment services with deficient AML/KYC controls, use of their proprietary stablecoin, and mixing illicit crypto assets to obscure links to cybercrime proceeds. The operational model allows a continuous flow of funds derived from scams, fraud, and cyber theft into legitimate financial systems.

Estimated Value Laundered

At least $4 billion in illicit proceeds between August 2021 and January 2025. This includes around $37 million linked to DPRK cybercriminal heists, $36 million to crypto investment frauds, and approximately $300 million related to various cyber scams.

Transaction Analysis Summary

Huione Group’s transaction patterns reveal large volumes of convertible virtual currency moved between its Huione Crypto platform and fiat payment services under Huione Pay. Transactions frequently involve obscure crypto conversions and transfers to hide the illicit origin. The group’s marketplace Haowang Guarantee serves as an exchange point for illicit cybercrime tools and services, supporting the money laundering ecosystem. Lack of effective AML/KYC policies and failure to detect or report suspicious transactions significantly facilitate the laundering process in Cambodia, enabling the region to function as a laundering hub for regional and DPRK cybercriminal outputs.

Regulatory/Enforcement Actions Taken

FinCEN designated Huione Group as a “primary money laundering concern” under Section 311 of the USA PATRIOT Act in 2025. This designation resulted in a rule prohibiting U.S. financial institutions from maintaining correspondent accounts for Huione’s entities, effectively cutting off its access to the U.S. financial system. No evidence of effective AML regulation or enforcement has been reported within Cambodia to counter these activities, highlighting weak local oversight. The U.S. Treasury and allied agencies have publicly named and proposed regulatory sanctions to disrupt Huione Group’s laundering activities.

Links to Reports / Sources

Case Title / Operation Name:

Huione Group Money Laundering Case in Cambodia

Country(s) Involved:

Cambodia, United States

Platform / Exchange Used:

Huione Pay PLC (payment institution), Huione Crypto (virtual asset service provider with stablecoin issuance), Haowang Guarantee (online illicit goods marketplace)

Cryptocurrency Involved:

USDT (Tether), Huione-issued stablecoin USDH, BTC, ETH, and other convertible virtual currencies

Volume Laundered (USD est.):

Estimated $4 billion laundered between August 2021 and January 2025 via combined fiat and crypto transaction networks

Wallet Addresses / TxIDs :

Multiple blockchain addresses linked to Huione Crypto and Haowang Guarantee, including notable USDT transfer addresses involving over $2.6 billion

Method of Laundering:

Complex layering through interconnected platforms mixing fiat (cash exchange at Phnom Penh office) and cryptocurrency transfers; use of Huione stablecoin for layering; online marketplace facilitating sale of illicit tools, fake identities, and cyber scamware; regulatory arbitrage exploiting Cambodia’s weak AML enforcement; use of nested banking and crypto exchange accounts; conversion of scam proceeds via cross-border digital asset transfers and cash-outs

Source of Funds:

Proceeds from cyber scams including “pig butchering” investment scams, DPRK cyber heists, online gambling/ransomware, human trafficking ransom payments, sanction evasion by criminal entities

Associated Shell Companies:

Subsidiaries and related entities under Huione Group umbrella including Huione Pay PLC, Huione Crypto, Haowang Guarantee; additional corporate entities registered in Cambodia, Poland, Hong Kong; possible links to lesser-known shell companies facilitating layering

PEPs or Individuals Involved:

No public evidence of direct PEP involvement, though reports indicate connections between Huione and Cambodian business circles; one unit director reportedly related to Cambodian ruling family, but no explicit regulatory proof of PEP facilitation

Law Enforcement / Regulatory Action:

FinCEN designated Huione Group as a “primary money laundering concern” under the USA PATRIOT Act Section 311 in 2025, banning U.S. financial institutions from correspondent accounts with Huione entities. U.S. Treasury and allied authorities have publicly sanctioned the group. Cambodian regulatory enforcement remains weak or ineffective, enabling ongoing illicit activity despite bans.

Year of Occurrence:

2025 (covers activities and exposures from August 2021 to January 2025)

Ongoing Case:

Ongoing

AML Network Risk Rating:

🔴 High Risk