Chinese-speaking networks on Telegram have become the backbone of the world's largest illegal crypto economy.
These groups have bypassed the dark web by combining scams, AI-based fraud, and money laundering into one industrial system.
Telegram markets are now larger than historical Dark Web giants
The scale is unprecedented. According to Elliptic's data, Huione Guarantee, which was later renamed Haowang Guarantee market, handled $27 billion between 2021 and 2025.
This number exceeds all significant dark web markets throughout history.
When Telegram banned the Huione market in May, operations moved forward. Two markets now dominate the field:
Tudou Guarantee: approximately $1.1 billion per month
Xinbi Guarantee: approximately $850 million per month
Combined monthly volume now exceeds what AlphaBay processed during its entire existence.
Why Telegram replaced the dark web
Telegram offers public channels, escrow-style systems, and immediate global availability. Users do not need a Tor browser or technical expertise.
Markets replicate the classic features of the dark web:
Seller reputation ratings
Escrow and dispute resolution
Stablecoin payments
Rapid rebranding after bans
In practice, Telegram has become the 'kitless dark web'.
Crypto scam markets feed the global fraud industry
These markets do not sell drugs or weapons in large quantities, but they sell scam infrastructure.
The primary customer group is in the pig-butchering scam sector. These long-term romance and investment scams alone generate about $10 billion a year in the U.S., according to federal data.
Operations focus on Southeast Asia. Many scams are based on forced labor, which is confined to scam camps.
Telegram markets offer, among other things:
Money laundering services
Fake investment platforms
Stolen identities
Telecom and social manipulation tools
The scam economy and markets grow together.
AI face-swapping tools enhance fraud
A significant growth factor is artificial intelligence. In Chinese-language Telegram groups, various items are actively sold, including:
Real-time face-swapping software
Voice cloning tools
Deepfake identity packages
With these tools, scammers can appear as real people in video calls. This significantly increases trust and the number of successful scams.
Threat analysts describe the phenomenon as the industrialization of social manipulation. Now scams operate with assembly line efficiency.
USDT is the economic backbone
Almost all transactions are settled in Tether (USDT). Unlike decentralized cryptocurrencies, USDT can be frozen if necessary. This capability exists, but it is utilized very rarely and in large amounts.
Centralized stablecoin serves as the foundation of the largest illegal crypto markets throughout history. This dependency concentrates risks in scams, money laundering, and cross-border fraud.
Telegram has previously removed significant markets. However, replacement services appear within weeks.
Ownership relations fluctuate between markets, and liquidity shifts quickly.
Elliptic currently tracks about 30 Chinese-language Telegram markets. Together, they transfer tens of billions of dollars annually, primarily through crypto.
Pressure from authorities remains fragmented and variable.
Overall, this is no longer a marginal cybercrime story.
Public communication platforms now enable large-scale illegal financing. Language networks are more critical than geography, and new tools are shaping the structure of the fraud economy.
The result is a criminal ecosystem larger than any dark web system ever has been. And it operates openly in plain sight.
If coordinated action is not achieved on platforms, stablecoins, and regulatory cooperation, the system will continue to grow.