FinCEN Blacklists Huione Group for Laundering $4 Billion Through Crypto Loopholes

The global anti-money laundering community has been shaken by one of the most consequential enforcement actions of 2025.

The U.S. Financial Crimes Enforcement Network (FinCEN) has officially named the Cambodia-based Huione Group a foreign financial institution of primary money laundering concern under Section 311 of the USA PATRIOT Act. The designation effectively severs the group’s ties with the U.S. financial system, setting a new precedent in tackling cryptocurrency-enabled money laundering networks.

Behind this unprecedented decision lies a complex network of crypto transactions, fraudulent stablecoins, and opaque payment channels that enabled Huione Group to launder billions of dollars before being blacklisted. The case exposes how a hybrid system blending fintech operations with criminal structures managed to thrive in regulatory grey zones — and why it now stands as a critical test for global AML regimes.

Huione Group’s money laundering structure

Huione Group outwardly presented itself as a diversified financial services conglomerate operating across several jurisdictions. In reality, it functioned as a coordinated laundering network, integrating fiat and virtual asset transfers, crypto exchanges, and an online marketplace used by cybercriminals.

The group’s network was built around four main components:

• Huione Pay PLC, a licensed Cambodian payment services provider responsible for handling both fiat and digital transactions.

• Huione Crypto, a virtual asset exchange controlled by the group that issued its own stablecoin, USDH.

• Haowang Guarantee (formerly Huione Guarantee), an online marketplace that enabled peer-to-peer trading of “virtual products” — including illicit items.

• Huione Group Limited, the overarching holding entity registered in Hong Kong but largely managed from Phnom Penh, Cambodia.

Each branch played a defined role. Huione Pay served as the fiat on-ramp, Huione Crypto managed virtual conversions and private stablecoin transactions, while Haowang Guarantee acted as a commercial hub for scammers and organized cybercrime groups to recycle illicit funds. Together, they created an integrated and unregulated financial web valued in the billions.

Blockchain investigators traced Huione-linked wallets that transacted or held over USD 4 billion between August 2021 and January 2025. Of that total, at least USD 37 million originated from North Korea’s Lazarus Group cyber-heists, another USD 300 million from so-called “pig-butchering” investment scams, and hundreds of millions more from transnational cyber fraud and darknet payments.

Despite operating under multiple brand names, all Huione affiliates shared customer data, transaction infrastructure, and settlement systems, creating deliberate opacity that blurred accountability and made compliance oversight nearly impossible.

Anatomy of the laundering operation

1. Exploiting regulatory fragmentationHuione capitalized on regulatory gaps across jurisdictions, maintaining registrations in Cambodia, Poland, and Hong Kong. Although the National Bank of Cambodia banned crypto activities in 2018, enforcement remained weak. This lack of coordination allowed Huione to operate openly even after being linked to major laundering cases.

2. Laundering via convertible virtual currencies (CVCs)At the core was Huione Crypto, which issued USDH, a stablecoin marketed as “unfreezable.” Unlike legitimate stablecoins that cooperate with law enforcement, USDH was designed to avoid freezes and seizures, granting criminals the ability to move illicit funds freely across blockchains. What was marketed as freedom from interference became a direct attack on AML safeguards.

3. Integration of illicit marketplaces and payment railsHaowang Guarantee resembled a typical e-commerce platform but facilitated trade in digital identities, SIM cards, scam software, and surveillance gear. The marketplace generated liquidity for illicit proceeds, while Huione Pay and Huione Crypto handled payments. This integration enabled criminal groups to operate entirely within Huione’s infrastructure — from purchasing scam tools to cashing out proceeds.

4. Obfuscation via nested correspondent accountsThough based in Asia, Huione managed to access U.S. dollar clearing through nested correspondent accounts. Some of its subsidiaries were even registered as Money Services Businesses (MSBs) with FinCEN, listing mail-forwarding addresses in Denver. These registrations gave Huione indirect access to U.S. financial channels through foreign intermediaries — a clear exploitation of correspondent banking vulnerabilities.

5. Rebranding to avoid scrutinyAfter critical blockchain analytics and media reports in 2024, Huione Guarantee quietly rebranded as Haowang Guarantee, scrubbing public records and altering its website. Regulators viewed the move as a classic obfuscation tactic, used to continue illicit operations under a new identity.

FinCEN’s Section 311 designation

The U.S. Treasury’s move underscores the enduring power of Section 311 of the USA PATRIOT Act, which allows FinCEN to designate any foreign financial institution or jurisdiction as being of primary money-laundering concern.

In its finding, FinCEN determined that Huione Group met all statutory criteria:

• It qualified as a foreign financial institution under the Bank Secrecy Act (BSA).

• It operated outside the U.S. but maintained significant exposure to global laundering networks.

• It exhibited systemic AML and KYC failures, openly admitted by its own staff.

• It facilitated laundering linked to North Korea’s Lazarus Group and transnational organized crime.

Following interagency consultation with the State Department, Department of Justice, and the Federal Reserve, FinCEN imposed Special Measure Five — the most severe sanction under Section 311. This measure:

• Prohibits U.S. financial institutions from maintaining or opening correspondent or payable-through accounts for Huione Group.

• Requires enhanced due diligence on foreign correspondents to prevent indirect Huione access.

• Mandates notification to all correspondent account holders warning them against processing Huione-related transactions.

• Obliges institutions to document compliance with these special measures.

In practical terms, Huione is now completely cut off from the U.S. financial system. Any bank found assisting the group risks civil and criminal penalties under 31 U.S.C. §§ 5321–5322.

FinCEN’s final ruling emphasized that Huione’s issuance of an “unfreezable” stablecoin and laundering of DPRK-linked cybercrime proceeds significantly worsened its risk profile. The agency concluded that lesser actions, such as enhanced reporting or beneficial ownership verification, would have been futile given Huione’s reliance on shell companies, hidden ownership, and nested banking channels.

Global implications for AML and compliance

The Huione designation has far-reaching consequences for regulators and financial institutions worldwide. It reinforces that crypto-fiat hybrids now form the backbone of modern laundering networks — and that enforcement must adapt accordingly.

1. Crypto-fiat hybrids blur traditional boundaries.Huione’s model combined exchange, stablecoin issuance, and payment processing. Compliance teams must treat such entities as financial institutions under equivalent risk standards to banks, regardless of licensing labels.

2. “Unfreezable” assets are a red flag.Stablecoins claiming immunity from enforcement undermine global sanctions systems. Banks should treat them as high-risk instruments subject to enhanced screening.

3. Nested correspondent risk remains a key vulnerability.Even without a U.S. presence, foreign institutions can exploit correspondent networks to access dollar clearing. Banks must rigorously monitor nested relationships to prevent backdoor access for banned entities.

4. Rebranding is not remediation.Name changes, website redesigns, and new shell structures often indicate evasion, not compliance — as evidenced by Huione’s rebranding to Haowang Guarantee.

5. Transparency and KYC are essential.Huione’s absence of real KYC controls made it a haven for illicit actors. Effective AML frameworks must integrate blockchain analytics, identity verification, and ongoing monitoring.

6. Collaboration between analytics firms and regulators is vital.The Huione action was built on blockchain forensics that mapped wallet clusters and stablecoin flows. Future enforcement will rely heavily on such public-private intelligence sharing.

7. Section 311 now extends to crypto.FinCEN’s use of this tool against a crypto-based network signals broader application of Section 311 — with more designations expected against exchanges, payment providers, and potentially even decentralized protocols that knowingly facilitate laundering.

Lessons for the financial sector

For banks, fintechs, and virtual asset service providers, the takeaway is clear: proactive compliance or enforced isolation. Institutions should:

• Conduct ongoing risk reviews of crypto-related partners.

• Add Section 311-designated entities to sanctions-screening lists alongside OFAC designations.

• Verify counterparties’ AML procedures and ultimate beneficial ownership.

• Treat marketing claims like “unfreezable,” “anonymous,” or “privacy guaranteed” as indicators of non-compliance.

• Build cross-functional AML and cyber-risk teams equipped to track emerging laundering typologies.

The Huione case also highlights jurisdictional disparities in enforcement. While the U.S. has acted decisively, Huione continues operating within Cambodia and neighboring countries, revealing the uneven global implementation of FATF standards.

A turning point for AML enforcement

Huione’s designation marks a shift in AML strategy — targeting the infrastructure of laundering, not just individual transactions. By isolating entire ecosystems such as exchanges, stablecoins, and payment processors that facilitate criminal finance, regulators aim to cut illicit liquidity at its source.

For compliance professionals, the message is structural and clear: ecosystem accountability is the future of AML enforcement. As FinCEN’s action demonstrates, opacity, rebranding, and hybrid financial models no longer shield entities from global isolation. When a network enables the flow of illicit funds, it can — and will — be disconnected from the international financial system. 

By fLEXI tEAM