The Dark Side of Telegram: Inside the $2B/Month Crypto Laundering Bazaars
The world’s largest online black markets may no longer reside in the dark web, but openly on Telegram itself. According to analysts, a sprawling network of Chinese-language “guarantor markets” has taken root on the platform, servicing crypto fraud operations and laundering nearly two billion dollars every month.
These marketplaces offer far more than so-called scam “services” in exchange for cryptocurrency. They traffic in a wide array of illicit goods and underground offerings, while their channels and accounts are swiftly resurrected after takedowns, allowing operations to continue with little interruption.
This assessment comes from blockchain analytics firm Elliptic. Its report notes that after a brief downturn in early 2025—when Telegram blocked two of the largest such markets—the ecosystem not only recovered but expanded even further. Today, the dominant players are said to be Tudou Guarantee and Xinbi Guarantee, which together generate an estimated monthly turnover approaching two billion dollars. Through these platforms flow money-laundering operations, sales of stolen data, fake investment websites, AI-powered tools including deepfakes, and a wide range of other illegal offerings.
The rise of these markets is closely tied to the boom in so-called “pig butchering” scams—long-con romance and investment schemes in which victims are gradually groomed through personal interaction before being persuaded to transfer funds into supposedly lucrative opportunities. Such operations are often run out of compounds in Southeast Asia, where individuals are reportedly held in conditions of forced labor.
According to the FBI, victims in the United States alone lose roughly ten billion dollars each year to these schemes. Telegram-based markets effectively sustain this shadow economy: they facilitate cash-outs and fund transfers, sell tools and infrastructure for new attacks, and scale in tandem with the broader fraud industry.
Researchers describe the scale of this activity as unprecedented. For comparison, the notorious dark-web marketplace AlphaBay processed just over one billion dollars in transactions during its two and a half years of operation, while Hydra handled more than five billion dollars across seven years. Against this backdrop, another Chinese-language Telegram market—Huione Guarantee—stands out even more starkly. Elliptic estimates that between 2021 and 2025, approximately twenty-seven billion dollars flowed through Huione, making it the largest illicit online marketplace ever documented.
In May, Telegram reportedly blocked Huione Guarantee—by then rebranded as Haowang Guarantee—after U.S. authorities labeled it a money-laundering operation. Yet Elliptic suggests that the vacuum was quickly filled by Tudou Guarantee, a platform in which Haowang is alleged to hold a stake.
Elliptic now estimates Tudou’s monthly volume at around 1.1 billion dollars, with Xinbi handling roughly 850 million dollars per month. Xinbi itself was reportedly taken down in May, only to relaunch and resume operations shortly thereafter. In total, Elliptic tracks around thirty such markets, which collectively move tens of billions of dollars annually.
Telegram’s own stance remains contentious. The report cites a company response explaining its reluctance to conduct repeated “mass purges,” arguing that such markets may serve as a means for Chinese users to bypass capital controls and move funds abroad.
Telegram states that it evaluates reports on a case-by-case basis and opposes blanket bans when activities are framed as efforts to circumvent repressive restrictions, while emphasizing its commitment to privacy and “financial autonomy.” Analysts and anti-fraud organizations strongly dispute this view, contending that the overwhelming majority of activity on these markets is plainly criminal.
The research and accompanying commentary further note that beyond scam-related services, these platforms host offerings linked to prostitution, including listings that may point to the exploitation of minors. Critics stress that, in light of documented forced labor in scam compounds, such markets become part of a broader chain that sustains both fraud and human trafficking.
Another critical pillar of this ecosystem is the stablecoin USDT (Tether). According to the report, USDT is the primary medium of exchange and laundering on these platforms. While its issuer theoretically has the ability to freeze funds, it is alleged to intervene only rarely and at limited scale. Neither Telegram nor Tether responded to requests for comment regarding their roles in these activities.
Some researchers ultimately conclude that without sustained international pressure, the situation is unlikely to change. Current countermeasures—from selective takedowns to sporadic raids on scam compounds in Southeast Asia—have failed to produce lasting results. The schemes rebound quickly and continue generating vast sums. To dismantle this market, they argue, global coordination and prioritization on par with counterterrorism or major narcotics enforcement are required—otherwise, the scale of harm will only continue to grow.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
