Skip to main content
Back to the takedown index

Huione Group backend infrastructure seizure

June 2026, Cryptocurrency laundering
Led by Federal Bureau of Investigation

Source linked. Verified August 21, 2026.

What was taken down?

Cloud-computing account and associated backend infrastructure seized.[1]

See what happened

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Not established

See people and accountability

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

See what happened afterward

DOJ seized a cloud-computing account alleged to host backend infrastructure used by Huione Group subsidiaries to facilitate laundering of proceeds from cyber-scam operations.[1]

Date
June 2026
Target
Huione Group money-laundering backend, cloud hosting backend
Activity
Cryptocurrency laundering
Operational lead
FBI
Partners
DOJ[1]
Jurisdiction
Not established
Outcome
Cloud-computing account and associated backend infrastructure seized.
Status
Completed
Legal mechanism
US seizure warrant.
Group accounted for
Not established

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not established

The cited record does not say how large the group was or whether everyone involved has been identified.

See the organizations and roles behind this action

Not established in the public record. No later activity is recorded against this entry.[1]

Numbered markers throughout this entry link to the source that supports the claim beside them.

What each part of this entry rests on

The audit recorded which sources carry which part of the record. These are those sources.

Official sources

  1. [1]
    DOJ seizes cloud infrastructure behind Huione Group money-laundering backend

    US DOJ, June 23, 2026, Source grade P1

    Establishes the seizure of a Huione Group-linked cloud-computing backend account.

    Open source
Coverage note. Notable because the action targeted a cloud-hosting account rather than a conventional public-facing domain.