Loading story…
The United States Department of Treasury has officially blacklisted the Huione Group, a Cambodian conglomerate, for its involvement in extensive money laundering activities. The Huione Group operates a vast illicit online marketplace, a money laundering service, and a cryptocurrency trading platform that issues its own stablecoin. According to U.S. officials, the group laundered at least $4 billion in illicit proceeds between August 2021 and January 2025. This sum includes $300 million in virtual currency linked to various scams and $36 million derived from investment fraud schemes. The U.S. Treasury's action culminated in the publication of a final rule that bans the Huione Group from accessing the U.S. dollar financial system. Although the group does not have direct relationships with U.S. financial institutions, it has been able to access U.S. dollars through nested correspondent account relationships outside the United States. The Treasury highlighted the increasing burden on U.S. financial institutions to conduct due diligence on foreign correspondent account holders as a result of such schemes. U.S. officials also revealed that the Huione Group worked directly with North Korea, further raising concerns about the group's international connections and the potential for sanctions evasion. The crackdown on Huione comes amid a surge in U.S. losses to online investment scams, which have exceeded $16.6 billion in recent years. The blacklisting is intended to disrupt the group's ability to move funds through the global financial system and to deter similar illicit operations. The Treasury's move is part of a broader effort to combat cybercrime and financial fraud originating from Southeast Asia. The action underscores the growing use of cryptocurrency platforms for laundering proceeds from cyber-enabled fraud and investment scams. U.S. authorities are urging financial institutions to strengthen their anti-money laundering controls, particularly regarding correspondent banking relationships. The case highlights the challenges of tracking illicit financial flows that exploit gaps in international banking oversight. The Huione Group's activities demonstrate the convergence of cybercrime, cryptocurrency abuse, and traditional money laundering techniques. The U.S. government is expected to continue monitoring and targeting entities that facilitate large-scale financial crime. The blacklisting serves as a warning to other organizations that may be complicit in similar schemes. The Treasury's action is likely to have significant repercussions for the Huione Group's operations and its partners worldwide.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
The U.S. Department of the Treasury blacklisted Cambodia-based Huione Group, barring it from access to the dollar settlement system over its alleged central role in Southeast Asian cybercrime and money laundering. Treasury said the group had laundered at least $4 billion in illicit proceeds and facilitated funds tied to scams, investment fraud, and North Korean cyber activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States imposed a new round of sanctions on Cambodia’s **Prince Group** network, targeting nine individuals and 26 companies over alleged involvement in cyber scams, forced labor, human trafficking, and human rights abuses tied to scam compounds in Southeast Asia. Treasury identified **Hu Xiaowei**, described as Prince Group’s second-in-command, along with figures including **Chen Bo**, **Brendon Luo**, **Qiu Wei Ren**, and **Fang Zhizhen**, and entities such as **CCU Commercial Bank PLC** and **White Horse Hotel Management Group**. U.S. officials said the operations lured workers with fake job offers, confiscated passports, and coerced victims through debt bondage, violence, and threats into running online fraud schemes, including digital-asset investment scams that contributed to at least **$10 billion** in losses to Americans in 2024. The Justice Department also seized a cloud computing account used as backend infrastructure by subsidiaries of Cambodia-based **Huione Group**, which authorities described as a major criminal marketplace and laundering hub linked to scam centers and cyber-enabled theft. Officials said the infrastructure supported **Huione Guarantee** or **Haowang Guarantee**, which allegedly facilitated money laundering, stolen-data sales, malware-enabled theft, cryptocurrency escrow services, and other criminal activity. The enforcement action came as Japanese police arrested Hu Xiaowei in Osaka on suspicion of filing a fraudulent address change while living under the Cypriot identity **"Hu Shi"** and seeking permanent residency, adding to mounting international pressure on Prince Group and associated networks, which have denied the allegations and said their businesses are legitimate.
Jun 29, 2026
FinCEN issued a final rule severing Cambodia-based Huione Group from the U.S. financial system, using its authority to prohibit covered U.S. financial institutions from opening or maintaining correspondent accounts for the group. The measure targets a financial organization identified by U.S. authorities as a money-laundering concern within the Southeast Asian cyber-enabled fraud ecosystem. Separately, Thai authorities have frozen roughly **20.4 billion baht** in assets associated with a network allegedly tied to Cambodian businessman Yim Leak and South African businessman Benjamin Mauerberger, also known as Ben Smith. The network is accused of routing proceeds from regional scam centers into Thai capital markets; Thailand has pursued certain nominee, disclosure, and customer-identification matters but has not brought substantive laundering cases against alleged local facilitators. Singapore arrested two Capital Asia Investments directors and froze more than **S$160 million**, while Mauerberger and his wife, Cattaliya Beevor, face Thai arrest warrants connected to an alleged 2016 investment fraud; Mauerberger disputes the allegations through counsel.
Sep 18, 2026
The U.S. Department of Justice, in collaboration with federal law enforcement and interagency partners, has intensified efforts to combat large-scale cryptocurrency-enabled fraud originating from Southeast Asia. This includes the creation of the Scam Center Strike Force, which targets scam compounds that use forced labor to perpetrate investment fraud, and the designation of groups such as the Democratic Karen Benevolent Army (DKBA) and companies like Trans Asia and Troth Star for their roles in these operations. The U.S. government estimates that Americans lost at least $10 billion to such scams in 2024, a significant increase from previous years, and has already seized over $401 million in cryptocurrency assets, with further forfeiture actions underway. A notable case in this crackdown involves the Prince Group, led by Chen Zhi, which operated forced-labor scam compounds in Cambodia. The U.S. Department of Justice unsealed an indictment against Chen Zhi for wire fraud and money laundering, and filed a civil forfeiture complaint for approximately 127,271 Bitcoin—proceeds from these illicit activities. The Chinese National Computer Virus Emergency Response Center (CVERC) has alleged that the U.S. may have acquired these bitcoins from a 2020 attack on the LuBian bitcoin mining pool, raising geopolitical tensions. The Prince Group action is seen as a landmark in the ongoing U.S. campaign to disrupt the infrastructure behind Southeast Asian pig butchering scams and related cybercrime.
Jul 12, 2026