Telegram had removed several scam marketplaces linked to Huione Guarantee and Xinbi Guarantee from its platform following a May US crackdown. Still, the groups behind them appear to have found alternative hosts for their operations.
The banned platforms had facilitated over $35 billion in USDT-denominated transactions, according to a July report from blockchain intelligence firm TRM Labs. After the takedown, the illicit ecosystem reportedly restructured and resumed through Telegram-based affiliated service Tudou Guarantee.
Crackdown on Chinese-language fraud hubs not enough
The initial enforcement wave began on May 13, when the US Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) issued a proposed rule under Section 311 of the USA PATRIOT Act. The rule formally designated the Huione Group, a conglomerate operating out of Cambodia, as a financial institution for money laundering.
FinCEN cited the laundering of more than $4 billion in criminal proceeds derived from cyber fraud, pig-butchering scams, and digital asset thefts between August 2021 and January 2025.
Huione Guarantee, the Group’s flagship marketplace, is a Chinese-language escrow and money-laundering platform that allegedly supports online scam syndicates and cybercriminal networks.
Telegram responded by banning channels linked to Huione Guarantee, Xinbi Guarantee, and other associated platforms following the findings of an investigation by blockchain analytics firm Elliptic.
The Elliptic report mentioned how the forums were used to sell scam tools, stolen identity data, and handle fraudulent transactions while providing escrow protections.
TRM Labs: Illicit activity migrated to Tudou Guarantee
In its Wednesday insight, TRM Labs reported that Huione-connected vendors migrated to Tudou Guarantee, another Telegram-based marketplace in which Huione Group already held an ownership stake.
Telegram’s bans caused Huione Pay, a digital payment platform linked to the same group, to experience a 50% jump in transaction volume. TRM Labs concluded that the increase was directly tied to vendors transitioning to Tudou Guarantee. These vendors use Huione Pay to store and move funds despite public enforcement actions.
Huione Guarantee’s daily incoming transaction volumes, which had peaked at $60 million earlier in 2024, dropped to $30 million after the crackdown. But even after the bans, volumes briefly rebounded to $40 million before settling back to the $30 million level.
TRM’s Graph of Huione Pay’s withdrawal hot wallet (top) sending funds to both sets of Huione Guarantee’s security deposit wallets. Source: TRM Labs
The insight also revealed that on May 25, 2025, Huione Group acquired a new Telegram ID and a channel using a new Chinese name, but it has retained the original “hw” initials from its HaoWang branding, and its automated bot retained the HaoWang name.
Meanwhile, Elliptic identified a spike in activity in more than 30 new or lesser-known guarantee platforms, many of which continue to operate openly to fill the void left by Telegram’s crackdown on the larger players.
US sanctions on illicit marketplaces continue
The US government went fully on the offensive later in May, when the Office of Foreign Assets Control (OFAC) issued targeted sanctions against Funnull Technology, a company linked to Huione Group, and two digital wallets tied to pig-butchering fraud operations.
Funnull Technology Inc. supported cybercriminal networks by acquiring large volumes of IP addresses from cloud service providers, which were then resold to operators running fraudulent investment platforms.
The infrastructure enabled scammers to host fake websites that imitated legitimate investment services, tricking victims into committing funds to schemes that did not exist. These scams have collectively caused over $200 million in victim losses, according to the Treasury.
Still, the enforcement actions and Telegram bans have not fully shut down Huione’s broader ecosystem. The Cambodia-based Huione Pay is operational and is the preferred payment processor for crypto-linked scams.
