US Treasury targets Cambodia's Huione in proposed rule, citing links to North Korean hackers

The U.S. Treasury Department's Financial Crimes Enforcement Network (FinCEN) proposed prohibiting Cambodia's Huione Group from accessing the U.S. financial system due to money laundering concerns, including alleged ties with North Korean hackers.

"[The] proposed action will sever Huione Group's access to correspondent banking, degrading these groups' ability to launder their ill-gotten gains," Treasury Secretary Scott Bessent said in a Thursday announcement.

The proposed rulemaking, made under Section 311 of the Patriot Act, would allow FinCEN to require domestic financial institutions to prohibit Huione and its affiliated entities from opening and managing accounts. 

"For years, Huione Group has laundered illicit proceeds from cybercrimes— namely, cyber heists carried out by the Lazarus Group," FinCEN said in the submitted filing. It added that Huione also facilitated crypto investment scams from Southeast Asia-based transnational criminal organizations.

FinCEN alleged that between August 2021 and January 2025, Huione Group laundered over $4 billion worth of illegal funds, including $37 million worth of assets stolen in North Korea-led cyber heists.

Huione's businesses include crypto trading platforms and online payment services, which were established as "the marketplace of choice" for malicious cyber actors, Bessent said. 

"This network offers services ranging from an online marketplace selling items useful for carrying out cyber scams, to payment services in fiat currency and CVC frequently used for money laundering, as well as a recently developed stablecoin," FinCEN said.

Earlier this year, Huione launched its own stablecoin to circumvent restrictions and asset seizures imposed by traditional regulatory agencies, blockchain analytics firm Elliptic said.

The proposed rulemaking follows a recent report by the United Nations Office on Drugs and Crime, which described Huione's online marketplace Haowang as a "one-stop-shop" for illicit cyber actors seeking infrastructure to conduct cyber fraud.

The report also noted that several competing entities have emerged in the region offering similar services to Huione, which may undermine efforts to disrupt the Cambodian group.

The public comment period for the proposed rulemaking will be open for 30 days after its publication in the Federal Register.