Crypto Darknet Markets Multiply on Telegram Following Huione Guarantee Shutdown

In an alarming twist, the recent shutdown of Huione Guarantee, a Chinese-language crypto darknet marketplace once responsible for over $27 billion in illicit transactions, has failed to curb underground activity. 

According to a report by blockchain analytics firm Elliptic, over 30 Telegram‑based darknet markets have emerged since the social media app banned Huione’s channels in mid‑May. Many of the new platforms are offering services that facilitate money laundering, stolen data, pig-butchering schemes, and ransomware infrastructure.

Rise in Telegram-based Darknet Markets

Elliptic’s research reveals that Tudou Guarantee, a close affiliate of Huione, where the latter holds a 30% stake, has become the primary beneficiary of this issue. Its user base has doubled, and transaction volumes in Tether (USDT) now rival those of Huione pre‑shutdown, around $15 million to $16 million per day.

After Telegram banned thousands of Huione-linked accounts on May 13, on‑chain USDT inflows to Huione plummeted to near zero by late May. Yet, merchants swiftly rebranded (Xinbi Guarantee) or shifted to Tudou, effectively restoring the entire ecosystem within weeks. Tudou’s Telegram channel now boasts roughly 289,000 members, almost matching Haowang’s 296,000 before its takedown.

These sub-ecosystems are known as guarantee marketplaces. They capitalize on Telegram’s escrow-style facilitation of deals, often denominated in USDT, to streamline illicit acts. They include money laundering, the sale of stolen data, scam infrastructure, and even prostitution services. Such markets thrive on anonymity, encrypted communications, and Telegram’s reluctance to impose sweeping bans, especially in response to Telegram’s claim that it supports financial autonomy in regions under capital controls.

Critics emphasize that only legal pressure, such as the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) designation of the Huione Group as a primary money-laundering concern, will force Telegram to act more decisively. Without it, these illicit hubs are merely migrating across channels, growing stronger, and becoming harder to suppress.

Telegram as a Hub for Illicit Crypto Activity

This latest wave of growth in darknet markets is part of a larger trend. In Southeast Asia, criminal networks are increasingly leveraging Telegram for major cybercrime operations. They are trading stolen credentials, malware, deep‑fake tools, and unlicensed exchanges, generating between $27 billion and $36 billion annually. Malware attacks, crypto scams, and fake bot trading groups on Telegram have surged by more than 2,000% this year alone.

Meanwhile, Telegram continues to expand rapidly, having recently raised $1.5 billion in convertible bonds. Regardless, the elimination of illicit activity remains lax. Critics argue the platform’s financial stability and ambitions may be coming at too high a cost.