Networks in the Chinese language on Telegram have become the foundation of the world's largest illegal crypto-economy.
These groups have overtaken the dark web by combining scams, AI-driven deception, and money laundering into one industrial system.
Telegram markets now larger than historical dark web giants
The scale is unprecedented. Elliptic data shows that Huione Guarantee, later rebranded as Haowang Guarantee, processed $27 billion between 2021 and 2025.
That amount is greater than all major dark web markets in history.
After Telegram banned Huione in May, activities moved. Now there are two markets leading the market:
Tudou Guarantee: about $1.1 billion per month
Xinbi Guarantee: about $850 million per month
The combined monthly volume is now larger than what AlphaBay processed in its entire existence.
Why Telegram has replaced the dark web
Telegram offers public channels, escrow-like systems, and direct global access. Users do not need a Tor browser or technical knowledge.
The markets replicate classic features of darknet markets:
Reputation systems for sellers
Escrow and dispute resolution
Stablecoin payments
Quick name changes after bans
In practice, Telegram has become a 'dark web without hassle.'
Crypto scam markets feed the global fraud industry
These markets do not sell drugs or weapons on a large scale, but they offer scam infrastructure.
The main customer group is the pig-butchering scam industry. These long-term scams through romance and investment fraud reportedly generate about $10 billion per year from just U.S. victims, according to federal data.
The operations are concentrated in Southeast Asia. Many scammers take advantage of people who work under duress in scam compounds.
Telegram markets provide, among other things:
Money laundering services
Fake investment platforms
Stolen identities
Telecom and social engineering tools
The scam economy and markets continue to grow together.
AI face-swap tools accelerate fraud
Artificial intelligence accelerates this process. The following AI tools are actively sold in Chinese Telegram groups:
Real-time face-swap software
Voice clones
Deepfake identity kits
With these tools, scammers can impersonate real people in video calls. This greatly increases trust and conversion.
According to threat analysts, this is the industrialization of social engineering. Scams now operate with the efficiency of an assembly line.
USDT is the financial backbone
Almost all transactions are settled in Tether (USDT). Unlike decentralized cryptocurrencies, USDT can be frozen. This possibility exists, but it rarely happens on a large scale.
As a result, the most centralized stablecoin ever supports the largest illegal crypto markets. That dependence brings together risks for scams, money laundering, and cross-border fraud.
Telegram has previously removed large markets. Each time, replacements appeared within weeks.
Shares and ownership rights exchange easily between markets. Liquidity flows directly.
Elliptic now tracks about 30 Chinese Telegram markets. Together, they process tens of billions of dollars annually, primarily through crypto.
Enforcement is fragmented and irregular.
This is no longer just a small cybercrime issue.
Public messaging services now facilitate illegal global money flows. Language networks are more important than geography; the tools used change the fraud economy.
Thus, a criminal ecosystem has emerged that is larger than anything the dark web has ever produced. And it happens openly.
Without joint action from platforms, stablecoins, and police, this system will continue to grow.
