# DoJ Dismantles Billion-Dollar Cybercrime Infrastructure Behind "Pig Butchering" Scams and Human Trafficking
The U.S. Department of Justice has seized a cloud computing account that served as the technological backbone for one of the world's largest marketplaces for cybercrime services, disrupting a criminal ecosystem that facilitated billions of dollars in fraud and enabled human trafficking operations across Southeast Asia.
On June 24, 2026, federal authorities announced the takedown of infrastructure operated by HuiOne Group subsidiaries—a Cambodia-based operation that transformed Telegram into a shopping mall for digital and physical tools of crime. The seizure represents the first coordinated federal enforcement action targeting both the financial and operational layers of the scam ecosystem simultaneously, signaling an escalation in U.S. efforts to dismantle criminal infrastructure that has plagued American citizens for years.
## The Scale of the Operation
HuiOne Guarantee, operating under the alias Haowang Guarantee, ran what law enforcement describes as an "illicit Telegram-based marketplace." Between 2021 and 2025, the platform processed transactions valued in the billions of dollars. The seized cloud account hosted the backend infrastructure that kept the operation running—the servers, databases, and applications that allowed operators to coordinate criminal activities across jurisdictions and cryptocurrencies.
"These subsidiaries are alleged to have assisted individuals and organizations in transferring proceeds of cryptocurrency investment frauds, cyber scams, and other criminal activities on cryptocurrency blockchains and allowing for the conversion of the proceeds of these schemes to the legitimate banking sector undetected," the Department of Justice stated in its official announcement.
The Treasury Department simultaneously imposed fresh sanctions against nine individuals and 26 entities linked to the Prince Group, expanding an enforcement action begun in 2025 when HuiOne was first designated a "primary money laundering concern."
## What Was Being Sold: The Crimeware Catalog
The HuiOne marketplace functioned as a one-stop shop for cybercriminals. Analysis by Elliptic revealed the breadth of services and goods available:
| Category | Examples |
|---|---|
| Data & Intelligence | Stolen personal and financial data, credentials, databases |
| Fraud Infrastructure | Web development services for fake investment platforms, phishing sites |
| Deepfake & Impersonation | Software for face-swapping, voice cloning, deepfake video generation |
| Financial Services | Money laundering services, cryptocurrency conversion, escrow services |
| Other Services | Human trafficking procurement, document forgery |
One particularly disturbing category of merchandise revealed the violent nature of the scam ecosystem: physical restraint devices. Merchants sold tear gas, electric batons, and electronic shackles marketed for use by scam compound operators to control and torture workers. Documentation reviewed by researchers showed operators referring to imprisoned victims as "dogs" or "dog pushers," and marketing materials explicitly mentioned "preventing escapers."
"The merchants refer to 'preventing escapers' and controlling 'runaway dogs,'" Elliptic noted in a 2024 analysis. "Those working within the scam compounds are commonly referred to as 'dogs' or 'dog pushers.'"
## The Human Cost: Modern Slavery in Scam Compounds
Behind the financial figures lies a human trafficking crisis. Southeast Asian scam centers—primarily located in Cambodia, Myanmar, and Laos—have imprisoned tens of thousands of workers who are forced to conduct romance fraud schemes, investment scams, and other confidence operations. Many are trafficked from neighboring countries, sold false promises of legitimate employment, and then held captive.
HuiOne Guarantee did not merely facilitate financial transactions. It provided the infrastructure, tools, and services that kept these prison-like compounds operational. The marketplace enabled operators to:
This represents an intersection of cybercrime and human trafficking that U.S. law enforcement has only recently begun to systematically target.
## The Money Laundering Architecture
One of HuiOne Guarantee's core functions was facilitating the movement of illicit proceeds from the criminal economy to the legitimate financial system. The platform offered:
Assistant Attorney General A. Tysen Duva emphasized this point: "The HuiOne Group used this cloud computing account as part of a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed – much of it stolen through Southeast Asian scam centers."
The Treasury Department's Financial Crimes Enforcement Network (FinCEN) also designated H-Pay Service PLC as a primary money laundering concern, identifying it as part of HuiOne Group's attempt to circumvent sanctions and continued access to U.S. financial systems.
## The Resilience Problem: New Markets Emerge
Despite the seizure and shutdown of HuiOne in May 2025, the criminal ecosystem has proven remarkably adaptable. Research by Flare revealed that more than 30 successor marketplaces have emerged since HuiOne's closure. Rather than consolidating on a single platform, criminals have fragmented operations across multiple venues and built proprietary messaging platforms to evade Telegram's bans on illegal content.
"The wave of enforcement in 2025 was the first coordinated attempt to reach both the financial and physical layers of the ecosystem at the same scale," noted Chris d'Eon, a researcher at Flare. "It has produced visible adaptation, including reshuffled channel branding, redistributed flows across successor markets, and accelerated work on alternative venues. However, it has not meaningfully reduced volume across the ecosystem in aggregate."
This finding suggests that seizing individual marketplaces, while operationally disruptive, does not address the underlying demand and infrastructure that sustains the ecosystem. Criminals quickly migrate to alternative platforms, shift to encrypted communications, and rebuild their networks.
---
## HackWire Analysis
The HuiOne takedown represents a watershed moment in federal enforcement against cybercrime, yet it also exposes the fundamental limitations of marketplace seizures as a deterrent strategy.
What makes this case significant is the integrated nature of the enforcement. The DoJ targeted infrastructure, the Treasury targeted financial flows, and international pressure targeted physical compounds simultaneously. This coordination worked—HuiOne was forced offline and significant assets were seized.
However, the emergence of 30+ successor markets within months reveals an uncomfortable truth: the bottleneck is not technology or infrastructure; it's demand. There are enough cybercriminals, enough fraud victims, and enough profit incentive that the market will re-aggregate regardless of which platform gets seized. Flare's finding that overall ecosystem volume has not meaningfully declined despite enforcement indicates that criminals are operating at the same scale, just on different infrastructure.
For defenders and policymakers, this suggests three strategic implications:
First, marketplace seizures must be paired with prosecution of operators and users. Taking down a platform creates operational friction, but only prosecution creates personal consequences that deter participation. The DoJ indicted individuals, but the low conviction rate suggests that many operators remain at large.
Second, the focus must shift upstream to financial infrastructure. Every cryptocurrency conversion, every bank transfer, every money exchange is a chokepoint. FinCEN's designation of H-Pay Service PLC shows this thinking, but enforcement at the financial layer must expand globally and in real-time rather than retrospectively.
Third, and most critically, the physical scam compound problem requires coordinated international operations in Southeast Asia. Shutting down the technology stack does nothing if thousands of captive workers continue generating victim lists for fraud operations. The human trafficking dimension cannot be separated from the cybercrime dimension. Law enforcement in Cambodia, Myanmar, and Laos must prioritize raids on documented scam compounds with the same intensity that the DoJ applied to cloud infrastructure seizures.
The HuiOne case is a tactical victory but a strategic stalemate. Without addressing the underlying demand, the profit incentives, and the physical infrastructure of scam compounds, enforcement will remain perpetually reactive. — HackWire Editorial
---
## Recommendations for Organizations
Financial Institutions & Compliance Teams:
Victims of Romance & Investment Fraud:
Organizations & Enterprises:
---
## Related Coverage