On May 1, 2025, the US Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) announced that it is issuing a notice of proposed rulemaking against the Huione Group under Section 311 of the US PATRIOT Act.
Why Huione Group matters to US financial security
FinCEN issued the notice after designating the Cambodia-based financial institution (FI) as representing an extreme risk of money laundering through its crypto hacks and scams perpetrated on behalf of the multiply sanctioned Democratic People’s Republic of Korea (DPRK or North Korea) and Southeast Asian organized crime groups (OCGs).
If successful, this will prevent US FIs from doing business with Huione Group, effectively cutting its access to the US financial system.
This report is intended to provide compliance teams at affected business entities with the background, motivation, and implications of the proposal if it is implemented.
FinCEN intends to implement the rarely used special measure five, the sternest penalty allowed by Section 311, which will prohibit US FIs from “opening or maintaining a correspondent account for, or on behalf of, Huione Group.”
There are three main elements to FinCEN’s findings against Huione Group and the issuance of special measure five:
- FinCEN asserts that Huione Group offers services to North Korea that facilitate the laundering of funds obtained from cyber heists, including those carried out by the Lazarus Group. This, in turn, supports the nation’s nuclear weapons of mass destruction (WMD) program.
- Southeast Asian OCGs use Huione Group services to launder the proceeds of crypto hacks and scams, including pig butchering operations.
- It operates an illegal online ‘dark market’ where illicit products and illegal services, including money laundering, are bought and sold.
These services are carried out by the Phnom Penh-headquartered parent company’s subsidiaries, which the proposal also covers:
- Haowang Guarantee is an e-commerce platform that is known to enable the sale of illegal goods and services, including products used in pig butchering operations that are associated with human trafficking and forced labor.
- Huione Pay PLC, a money transmitter service which facilitates the in- or exfiltration of crypto to or from fiat currency on behalf of OCGs.
- Huione Crypto, a virtual asset service provider (VASP) that provides a platform for illicit crypto trading.
Crypto money laundering at Huione Group: the numbers
FinCEN alleges that these entities laundered a total of $4 billion from mid-2021 to early 2025. Among the criminal activities cited in the NPRM are:
- Between June 2023 and February 2024, the Lazarus group sent illicit crypto worth $150,000 to the Huione Group for laundering purposes.
- In June 2023, Huione Group received $2.6 million in crypto stolen during the Atomic Wallet, Coinspaid, and Alphapo heists.
- In May 2024, Huione Group received $35 million from the Japanese VASP, DMM.
- In July 2024, the group received $35 million in stolen funds, suspected of involving the Lazarus Group.
- In total, FinCEN alleges that the Huione Group has received at least $37.6 million in crypto heist proceeds with North Korean associations.
- From 2022 to 2024, Huione officials dealt directly and often with an unnamed North Korean national representing the sanctioned country’s Reconnaissance General Bureau (RGB), its primary foreign intelligence service.
- Through Huione Groups’ illicit services and its online ‘dark market’, it acts as a money laundering “one-stop shop’ for OCGs.
- In total, the Huione Group has received at least $36 million in stolen crypto from the proceeds of investment scams, and a total from general cybercrime of $300 million.
- The Huione Group’s AML/KYC framework varies between negligent and non-existent, a fact that it acknowledged in 2024 by saying that its “[KYC] capabilities are now seriously insufficient.”
- Despite the National Bank of Cambodia’s prohibition of including crypto in assessed legal transactional activities, the Huione Group continues to do so. It even flouted the law by issuing the “unfreezable” USDH stablecoin, which evades law enforcement efforts to freeze illicit financial flows (IFF).
The notice stated that the Huione Group also engages in legitimate business enterprises in Cambodia. Citizens widely use their systems to settle electricity, water, and telephone bills. Additionally, the group runs a QR code system that is popular among Cambodians for use in restaurants, hotels, and supermarkets.
With a total (legal and illegal) crypto transaction volume of $49 billion since 2021 and $41 million cleared through US correspondent accounts from late 2020 to late 2024, the legitimate contribution is acknowledged. However, FinCEN contends that the money laundering and terrorism financing risk the group represents far outweighs any adverse consequences for the company or Cambodian businesses.
The FinCEN action against Huione Group: the intended outcome
The implementation of special measure five is intended to achieve three main objectives for US national security:
- It will terminate Huione Group’s access to US dollars.
- It will impede Huione Group’s ability to process the IFFs of North Korean hacker groups and Southeast Asian OCGs.
- It will improve public and business awareness and understanding of how cybercriminals exploit jurisdictional inconsistencies to launder funds and support terrorism, WMD proliferation, and OCG crypto scams.
The US industry participants impacted include banks, securities brokers and dealers, futures commission merchants and commodities brokers, and mutual fund companies. These entities and individuals, and their subsidiaries, are subject to the following compliance requirements:
- They are prohibited from opening or maintaining US correspondent accounts linked to the Huione Group.
- They must take reasonable steps to prevent the facilitation of transactions through correspondent accounts linked to the Huione Group.
- They are required to apply special due diligence to all foreign correspondent accounts and inform those account holders if Huione Group transaction activity is suspected. Their transaction screening frameworks must also be able to detect fund transfers where Huione Group is the originator of the funds.
- They must implement strict recordkeeping and reporting systems that document their compliance processes.
FinCEN has opened the proposal for public comment for 30 days, concluding on June 4, 2025, prior to its possible implementation. Read the full NPRM here.
What this means for crypto compliance
By proposing special measure five, which can only be done in consultation with the Secretary of State, the Attorney General, and the Chairman of the Board of Governors of the Federal Reserve System, FinCEN has demonstrated how serious it is about protecting the US financial system from the Huione Group and others.
If the proposal is implemented, compliance teams at exchanges and crypto businesses will be tested by the incoming regulatory requirements designed to bar Huione Group and whoever takes their place from the US financial ecosystem. Meanwhile, cybercriminals develop and deploy ever more sophisticated cybercrime typologies to circumvent security frameworks, and exchange compliance teams need blockchain intelligence expertise, tools, and systems equal to countering the threat.
Watch Crystal’s VP of Intelligence, Nick Smart, talk about FinCEN’s proposal in the video below.
