Telegram’s Attempt to Block Huione Proves Ineffective, Says TRM Labs

In May, the messaging platform Telegram blocked the channels Huione Guarantee and Xinbi Guarantee, through which $35 billion in USDT was laundered. However, this did not reduce the overall activity of the extensive network of Chinese darknet platforms, according to analysts at TRM Labs.

According to experts, in 2024, the peak daily volume of incoming transactions for Huione reached $60 million. The platform failed to restore its accounts on Telegram, but it continues to operate “in a reduced mode.” After the restrictions, activity stabilized at $30 million.

Meanwhile, Xinbi resumed operations under its previous identifier. Since May 11, activity on this platform has surged by 90%.

Simultaneously, the daily inflow of funds to Tudou—a platform linked to the Chinese darknet marketplace network—increased 70-fold. Analysts suggested that Huione is now secretly operating through this service to avoid further blocks.

“On May 25, 2025, Huione Group created a new account on Telegram. The channel received a different name in Chinese, but retained the old initials ‘hw’ from the previous brand HaoWang, and the automated bot still uses this name. It seems they deliberately kept part of the old brand—it’s easier to retain clients who might have been confused after the blocks,” the TRM report states.

In closed Telegram chats, Huione has left only VIP sellers. Other users are redirected to Tudou.

“Blockchain transaction analysis shows that sellers who previously worked through Huione have moved to Tudou, using the same Huione Pay crypto wallets,” experts stated.

The Connection Between Huione Pay and Huione Guarantee

Huione Pay is positioned as a separate service, but it is inextricably linked with Huione Guarantee, TRM emphasized. Since 2021, Huione Pay’s “hot” wallets have been transferring funds directly to four deposit accounts of the platform.

Sellers on Huione are required to make a cryptocurrency deposit before starting work. These funds act as a guarantee: in case of rule violations, the platform retains the deposit.

In September 2024, Huione complicated the scheme—six new wallets appeared. Each was intended for a specific category of services:

• for cybercrimes like phishing or malicious software, the client needs to pay from 1000 to 5000 USDT;
• for large-scale money laundering, the platform charges from 20,000 to 70,000 USDT.

“This deposit gradation likely reflects the anticipated risks and transaction volumes for different services. Higher deposits serve not only as a guarantee but also demonstrate the seller’s reliability in this shadow ecosystem, where trust is minimal,” analysts emphasized.

Back in early May, the FinCEN, citing research by Elliptic, named Huione Group as a “financial institution posing a primary money laundering threat,” and proposed to cut off its access to the US financial system. The agency accused the company of assisting the North Korean hacker group Lazarus Group in laundering cryptocurrency.