US Treasury Targets Cambodia-Based Huione Group, Citing Its Role in Facilitating North Korean Hacking

The Telegram-based operation has been a "critical node for laundering proceeds of cyber heists" and aiding in so-called "pig butchering" scams

The U.S. Treasury Department on Thursday proposed cutting off the Cambodia-based Huione Group from the U.S. financial system, citing the cyber-crime help the illicit marketplace gives to North Korean hackers and other criminal groups.

The Telegram-based operation has been a “critical node for laundering proceeds of cyber heists” and aiding in so-called “pig butchering” scams that typically use fraudulent romantic ties to tap people for crypto assets, according to the Treasury’s Financial Crimes Enforcement Network (FinCEN) that proposed severing it from the financial system.

Huione, which offers personal data and money laundering services, has been said to handle as much as $24 billion of such transactions, according to analytical firm Elliptic. The Cambodian marketplace also launched its own stablecoin earlier this year.

“Huione Group has established itself as the marketplace of choice for malicious cyber actors like the DPRK and criminal syndicates, who have stolen billions of dollars from everyday Americans,” Secretary of the Treasury Scott Bessent, in a statement. So FinCEN sought to tap its nuclear-option power — using Section 311 of the USA PATRIOT Act — to sever Huione from the financial system.

As recently as last year, Phnom Penh-based Huione Pay was said to receive crypto totaling more than $150,000 from a wallet associated with North Korean hackers Lazarus, the group accused of stealing billions of dollars in crypto over the past several years that’s likely used to fund national projects.