Chinese Darknet Transactions on Telegram Surge to $2 Billion

Chinese-speaking users transfer $2 billion monthly via Telegram, reports WIRED.

Telegram has emerged as a hub for a shadow economy centred around cryptocurrencies. Chinese-speaking users are transferring $2 billion monthly through the platform, reports WIRED, citing Elliptic. 

Experts have identified two of the largest markets — Tudou Guarantee and Xinbi Guarantee. They offer tools for fraud (stolen data, investment scam sites, deepfake creation tools) and other illegal services: from surrogacy to child prostitution. 

These services overshadow historical counterparts: 

• AlphaBay was once the largest darknet marketplace for buying drugs, stolen data, and hacking tools. According to the FBI, it was ten times larger than Silk Road and at its peak processed transactions exceeding $1 billion;
• Hydra — a Russian platform that also offered money laundering services to crypto scammers and hacker groups. Over seven years, it processed about $5 billion.

In comparison, the Chinese-language Huione Guarantee on Telegram processed $27 billion from 2021 to 2025. 

“When it comes to the illegal use of crypto assets, there is simply nothing larger today,” noted Elliptic co-founder and chief scientist Tom Robinson.

Experts say the rise of such platforms is driven by the increasingly popular “pig butchering” scheme. 

Failed Blockade 

In May 2025, the messenger blocked channels of Huione Guarantee (which had by then been renamed Haowang Guarantee). In July, TRM Labs analysts called the measures ineffective, a view later confirmed by Elliptic specialists. 

The void was quickly filled by Tudou Guarantee, which maintained ties with Haowang’s owners. Its monthly turnover rapidly reached $1.1 billion, nearly matching Haowang’s previous figure of $1.4 billion.

Simultaneously, the second-largest darknet market, Xinbi Guarantee, was blocked. However, it was swiftly relaunched, with a monthly turnover exceeding $850 million. 

According to Elliptic, Tudou and Xinbi are just two examples among approximately 30 similar platforms that continue to operate actively.

Telegram’s Stance

In June, WIRED journalists asked Telegram’s management why the messenger allows the resurgence of illegal markets.

The company stated it does not intend to block these platforms again. The decision was explained as protecting the “financial freedom” of Chinese users, who are forced to seek alternative channels for transferring funds due to strict currency controls.

“We consider each case individually and categorically reject blanket bans — especially when users are trying to circumvent repressive restrictions of authoritarian regimes,” Telegram emphasized. 

Cybercrime experts called this stance hypocritical and dangerous. Elliptic and other analysts pointed out that the vast majority of operations on these markets are criminal in nature.

The primary clients of such darknet platforms are fraudulent syndicates. These groups are known for organizing camps in Southeast Asia, where thousands of people are held captive and used for forced labour.

“They have the opportunity to destroy an entire economy of fraud and human trafficking. Instead, they provide a Craigslist for crypto scammers. These are just bad actors creating a platform for other bad actors,” commented Erin West, former prosecutor and head of the anti-fraud organization Operation Shamrock. 

The Role of Tether 

The second critical link in the operation of darknet marketplaces is the stablecoin USDT from Tether. This asset is most commonly used by criminals for transactions involving illegal goods and services.

Analysts highlight a paradox: as a centralized issuer, Tether is technically capable of blocking and confiscating funds linked to criminal activity. However, the company rarely takes such measures, which experts describe as a systemic problem.

Jacob Sims, a transnational crime expert from Harvard’s Asia Center, compared Tether and Telegram’s efforts to “show raids” in Southeast Asia. According to him, such actions only create an illusion of combat, while fraudulent hubs are almost instantly restored.

“Impunity at all levels renders any serious efforts to curb this futile,” he believes.

Sims insists that real change requires a global response, akin to the fight against terrorism and drug trafficking. 

“The response to this growing threat has not yet reached the necessary level of coordination and determination. This is precisely what is lacking to start addressing the problem with the seriousness that matches the scale of the damage it causes,” he concluded. 

Earlier in December, the payment business of the Cambodian conglomerate Huione Group — Huione Pay — suddenly ceased operations and froze payments.