Chinese networks operated on Telegram have become the center of the world's largest illegal cryptocurrency economy.
These groups have merged fraud, AI-based deception, and money laundering into a single industrial system beyond the dark web.
Telegram market surpasses large dark web sites
The scale is unprecedented. According to Elliptic data, Huione Guarantee (rebranded as Haowang Guarantee) processed $27 billion from 2021 to 2025.
This figure surpasses all previous records of major dark web markets.
After Telegram blocked Huiyuan last May, activities shifted elsewhere. Currently, two markets are leading.
Tudou Guarantee: about $1.1 billion per month
Xinbi Guarantee: about $850 million per month
The monthly trading volume of the two markets has already surpassed the trading volume recorded by AlphaBay during its entire operational period.
Why Telegram replaced the dark web
Telegram provides public channels, an escrow-like system, and immediate global accessibility. Users do not need the Tor browser or high technical knowledge.
These markets replicate traditional darknet functionalities.
Seller reputation systems
Escrow and dispute resolution services
Stablecoin settlement
Rapid rebranding after blocking
In fact, Telegram has become a 'frictionless dark web.'
Cryptocurrency fraud markets... fuel the global fraud industry
These markets do not sell drugs or weapons on a large scale. However, they sell fraudulent infrastructure.
The main clientele is the pig-butchering fraud industry. According to federal data, this long-term romance and investment fraud generates about $10 billion annually from victims in the U.S.
Operations are mainly concentrated in Southeast Asia. Many organizations rely on trafficked labor trapped in fraud compounds.
Telegram markets offer the following.
Money laundering services
Fake investment platforms
Stolen identity information
Communication and social engineering tools
The fraud economy and markets are growing together.
AI face swapping tools, surge in fraud
The key accelerant is artificial intelligence. Chinese Telegram groups are actively selling the following.
Real-time face-swapping software
Voice replication tools
Deepfake identity kits
These tools allow scammers to impersonate real individuals during video calls. They significantly increase trust and conversion rates.
Threat analysts describe this as the industrialization of social engineering. Currently, fraud operates with conveyor belt efficiency.
USDT plays a central role in finance
Almost all transactions are settled in Tether (USDT). Unlike decentralized cryptocurrencies, USDT can be frozen. Such functionality exists but is rarely used on a large scale.
As a result, the most centralized stablecoin underpins the largest illegal cryptocurrency market on record. This dependency concentrates risks across fraud, money laundering, and cross-border financial fraud.
Telegram has previously removed major markets. Each time, alternative markets emerge within weeks.
Ownership between markets can move freely. Liquidity also follows instantly.
Elliptic is currently tracking about 30 Chinese Telegram markets. Together, they move hundreds of billions of dollars annually, mostly through cryptocurrencies.
Enforcement pressure is still dispersed and inconsistent.
Now this phenomenon is no longer limited to certain cyber crimes.
Public messenger platforms have become venues for large-scale illegal money flows. Language-based networks have become more important than geographical location, and new tools are changing the landscape of the fraud economy.
Ultimately, this has become a larger criminal ecosystem than any created by the dark web. And all of this is happening in plain sight.
Without a joint response from platforms, stablecoins, and law enforcement, this system will continue to grow.
