Chinese-speaking networks on Telegram have become the backbone of the world's largest illegal crypto economy.
These groups have surpassed the dark web by combining fraud, AI-driven deception, and money laundering into one industrial system.
Telegram markets surpass historical dark web giants
The scale is unprecedented. According to data from Elliptic, Huione Guarantee, later renamed to Haowang Guarantee, processed $27 billion between 2021 and 2025.
That number exceeds all major dark net markets in history.
After Telegram excluded Huione in May, activity shifted. Now two markets dominate:
Tudou Guarantee: approximately $1.1 billion per month
Xinbi Guarantee: approximately $850 million per month
Combined monthly volume now exceeds what AlphaBay processed throughout its lifetime.
Why Telegram replaced the dark web
Telegram offers open channels, systems equivalent to escrow, and immediate global reach. Users do not need a Tor browser or technical knowledge.
The markets recreate classic features of the dark web:
Supplier reputation system
Escrow and dispute resolution
Settlement in stablecoins
Rapid reprofiling after exclusions
In practice, Telegram has become a 'frictionless dark web.'
Crypto fraud markets drive a global fraud industry
These markets do not sell drugs or weapons on a large scale, but they sell fraud infrastructure.
The main customers are the pig-butchering fraud industry. These long-term romance and investment scams generate around $10 billion annually from American victims alone, according to federal data.
The operation is concentrated in Southeast Asia. Many exploit human trafficking and workers in fraud camps.
Telegram markets offer:
Money laundering services
Fake investment platforms
Stolen identities
Telecom and social engineering tools
The fraud economy and markets grow together.
AI face-swapping tools increase fraud
An important accelerator is artificial intelligence. Chinese-language Telegram groups actively sell:
Real-time face-swap software
Voice cloning tools
Deepfake identity packages
These tools enable fraudsters to impersonate real people in video calls. They dramatically increase trust and conversion rates.
Threat analysts describe this as the industrialization of social manipulation. Fraud is now driven with assembly line efficiency.
USDT is the financial backbone
Almost all transactions are settled in Tether (USDT). Unlike decentralized cryptocurrencies, USDT can be frozen. That possibility exists, but is rarely used on a large scale.
As a result, the most centralized stablecoin forms the basis for the largest illegal crypto markets ever recorded. This dependency concentrates risk across fraud, money laundering, and cross-border fraud.
Telegram has previously removed large markets. Each time, new replacements have appeared within weeks.
Ownership shares move between markets. Liquidity follows immediately.
Elliptic currently monitors around 30 Chinese-language Telegram markets. Collectively, they move tens of billions of dollars annually, mostly through crypto.
Government pressure remains fragmented and inconsistent.
Overall, this is no longer a niche story about cybercrime.
Public messaging platforms are now hosting global illegal financing on a large scale. Networks based on language now matter more than geography; tools are changing the economics behind fraud.
The result is a criminal ecosystem larger than anything the dark web has ever produced. And it operates right in front of us.
Without coordinated efforts from platforms, stablecoins, and law enforcement, this system will continue to grow.