The US Cracks Down on Huione Group: A Key Laundromat for North Korean Cybercriminals
U.S. Treasury Accuses Huione of Laundering $37 Million from Cyber Thefts Linked to North Korea
Here's the lowdown on the latest move by the US Treasury Department: they're aiming to block Cambodia-based Huione Group from accessing the American banking system. This decision comes following allegations that the conglomerate has been involved in money laundering worth billions, with substantial funds linked to North Korean cyber heists.
On May 1, the Financial Crimes Enforcement Network (FinCEN) announced its decision, proposing a rule that would prohibit US financial institutions from maintaining accounts for the Huione Group. The goal is to cut off the company's access to US banking channels and disrupt their operation as a "marketplace of choice for malicious cyber actors."
US Treasury Secretary, Scott Bessent, stated that the Huione Group has become a hub for cybercriminals who have stolen billions from Americans. This action by the Treasury aims to make it harder for these groups to convert their stolen funds.
The Huione Group operates various businesses, including payment service platform Huione Pay, cryptocurrency exchange Huione Crypto, and the illicit marketplace Haowang Guarantee, which offers goods and services of dubious origin. Although the conglomerate doesn't directly hold accounts with US financial institutions, it maintains relationships with foreign firms that do, providing indirect access to the US financial system.
Since 2021, Huione Group is alleged to have laundered over $4 billion in cryptocurrency, with at least $37 million of this amount linked to North Korea's cyber theft operations. Haowang Guarantee, the group's online marketplace, is described by FinCEN as a "one-stop shop" for criminals, allowing them to launder cryptocurrency obtained through illegal activities.
The proposed rule by FinCEN falls under Section 311 of the Patriot Act, which empowers the Treasury Secretary to take action against money laundering and terrorist financing threats. The Notice of Proposed Rulemaking (NPRM) remains open for public comment for 30 days before it can take effect.
Cambodia's financial authorities have already taken action against Huione Group, with the National Bank of Cambodia revoking the company's local banking license in March. Nevertheless, the US action adds another layer of pressure on the group, aiming to cut off a significant channel for illicit funds flowing into and through US banks.
A Closer Look at Huione Group's Operations
- Nature of Illicit Activities: Huione Group has laundered billions in cryptocurrency since 2021. A substantial amount, around $37 million, is directly linked to cyber heists by North Korea’s Lazarus Group, notorious for a massive $1.4 billion Bybit hack in 2025. Other illicit funds, around $36 million, stem from investment fraud scams known as "pig butchering" scams [2][5].
- Operational Mechanisms: The group's network of services includes payment processing (Huione Pay), cryptocurrency exchange (Huione Crypto), and an online marketplace (Haowang Guarantee). These interconnected platforms facilitate the movement, layering, and integration of illicit funds, making it difficult for authorities to trace and combat the money laundering [5][3].
- Compliance Failures: Huione Group has demonstrated ineffective anti-money laundering (AML) and know-your-customer (KYC) controls, indicating a need for stronger regulations [3].
Connections to North Korean Cyber Heists
The Lazarus Group has used Huione’s platforms extensively for laundering funds acquired from cyber heists, helping North Korea evade international sanctions aimed at its nuclear weapons program and other illicit state activities [1][3][4].
The use of an "unfreezable" stablecoin and complex crypto services offered by Huione makes it challenging for regulators and banks to freeze or track stolen assets, enabling ongoing illicit financial flows for North Korean actors and related transnational criminal organizations (TCOs) [5].
Implications for the US Banking System
By designating Huione Group as a major money laundering concern and proposing to block its access to the US financial system, FinCEN aims to eliminate a critical conduit for illicit funds flowing into and through US banks [1][5]. This action serves as a preventive measure to maintain the financial system’s integrity and reduce exposure to funds linked to cybercrime and sanctioned entities [1][5].
The case underscores broader vulnerabilities in the global financial and digital asset systems, emphasizing the need for stronger regulatory frameworks to address laundering of funds from sophisticated cyber heists and emerging threats such as digital asset scams and unregulated stablecoins [3]. It also signifies increased scrutiny on crypto marketplaces and payment networks facilitating illicit finance, encouraging banks and financial institutions to enhance their AML/KYC practices and vigilance against high-risk entities connected to state-sponsored cybercrime and fraud [3].
- The US Treasury Department aims to prohibit Huione Group, a Cambodia-based conglomerate allegedly involved in money laundering worth billions, from accessing the American banking system.
- FinCEN announced that US financial institutions should not maintain accounts for the Huione Group, effective in dismantling their operation as a "marketplace of choice for malicious cyber actors."
- US Treasury Secretary, Scott Bessent, stated that the Huione Group has become a hub for cybercriminals who have stolen billions from Americans, making it harder for these groups to convert their stolen funds.
- The Huione Group operates various businesses, including Huione Pay, Huione Crypto, and Haowang Guarantee, which have allegedly facilitated the laundering of billions in cryptocurrency since 2021, with at least $37 million linked to North Korea’s cyber theft operations.
- By designating Huione Group as a major money laundering concern and proposing to block its access to the US financial system, FinCEN aims to eliminate a critical conduit for illicit funds flowing into and through US banks.
- The case underscores broader vulnerabilities in the global financial and digital asset systems, emphasizing the need for stronger regulatory frameworks to address laundering of funds from sophisticated cyber heists and emerging threats such as digital asset scams and unregulated stablecoins.