Written by: Andy Greenberg
Compiled by: Shenchao TechFlow
Once, online black markets were hidden in the shadows of the dark web. Now, they have moved to public platforms like Telegram and amassed historic illegal wealth.
More than a decade ago, when the black markets for drugs, guns, and various contraband first emerged on the dark web, the technological complexity of cryptocurrencies and anonymous software like Tor seemed to be the key means for executing billions of dollars in illegal transactions.
However, by 2025, all of this seems somewhat outdated. Today, to complete billions of dollars in black market crypto transactions, all you need is a messaging app willing to provide a platform for scammers and human traffickers, the tenacity to recreate channels and accounts when banned, and fluency in Chinese.
According to a recent analysis by the cryptocurrency tracking company Elliptic, the market ecosystem of Chinese cryptocurrency scammers based on the Telegram messaging service has now developed to an unprecedented scale. Although there was a brief decline after Telegram banned the two largest such markets in early 2025, the current two major markets—'Potato Guarantee' and 'New Coin Guarantee'—achieve nearly $2 billion in transaction volume each month through activities such as money laundering, selling scam tools (like stolen data, fake investment websites, and AI face-swapping tools), and other black market services (such as surrogacy and underage prostitution).
Cryptocurrency romance scams and investment scams are notorious for their brutal 'pig slaughtering' operational model. These scams primarily operate from secret bases in Southeast Asia, typically composed of thousands of human trafficking victims. According to the FBI, these types of scams can defraud approximately $10 billion annually in the United States alone, making them one of the most profitable forms of cybercrime globally.
By providing money laundering services and other related tools to these scam organizations, markets like 'Potato Guarantee' and 'Coin Guarantee' have rapidly expanded in scale. Tom Robinson, co-founder and chief scientist of Elliptic, stated: 'If you consider the illegal uses of cryptocurrency assets, there is currently nothing larger than this.'
In fact, these criminal trading markets are not only the largest online black markets today but also the largest in history. The once-dominant dark web market AlphaBay, known for selling drugs, stolen data, and hacking tools, had a transaction volume exceeding $1 billion during its two and a half years of operation, according to the FBI, which is ten times that of the peak period of the original Silk Road dark web market. Meanwhile, Russia's dark web market Hydra completed over $5 billion in transactions during its seven years of operation, providing money laundering services for cryptocurrency thieves and ransomware gangs.
In contrast, according to Elliptic's data, the Chinese Telegram group market 'Huiwang Guarantee' completed an astonishing $27 billion in transaction volume between 2021 and 2025, far exceeding all previous online black markets. Even though it operates entirely openly on the Telegram platform, it is still referred to as 'the largest illegal online market in history.'
Although Telegram banned 'Huiwang Guarantee' (which had been renamed 'Haowang Guarantee') in May of this year due to the U.S. Treasury Department's Financial Crimes Enforcement Network (FinCEN) designating it as a money laundering operation platform, the market did not disappear as a result. Haowang Guarantee's shares in 'Potato Guarantee' quickly filled this gap. According to Elliptic's data, Potato Guarantee's monthly transaction volume has reached $1.1 billion, closely matching Haowang Guarantee's monthly transaction volume of $1.4 billion. The second-ranked cryptocurrency scam market, 'Coin Guarantee', despite being banned in May and going back online, has seen its monthly transaction volume rise to $850 million. The total transaction volumes of the two major markets even exceed the previous total market size, while Elliptic is currently monitoring around 30 similar markets, which have a total annual transaction volume reaching hundreds of billions of dollars.
In June of this year, when (Wired) magazine contacted Telegram, pointing out how these markets are reconstructing their criminal empires in the public eye, Telegram's response sparked controversy. Telegram stated that they decided not to implement a ban on these markets, believing that these markets provide Chinese users with a way to circumvent 'capital controls', which often leave citizens with no choice but to seek other means for international fund transfers. 'We assess each report on a case-by-case basis and firmly reject a blanket ban—especially when users are attempting to circumvent oppressive restrictions imposed by authoritarian regimes,' Telegram stated in a June declaration to (Wired), 'We are always committed to protecting user privacy and defending fundamental freedoms, including financial autonomy.'
This position has sparked widespread controversy and raises the question: under the banner of protecting privacy and freedom, can we turn a blind eye to cybercrime?
Elliptic and other scam industry analysts have strongly countered Telegram's view of maintaining market freedom, pointing out that the vast majority of market activities like 'Potato Guarantee' and 'Coin Guarantee' are illegal. In addition to scam-related services, these markets also involve prostitution transactions—posts in Coin Guarantee even feature suggestive ads related to underage sex trafficking, such as services for 'Lolitas' or 'young girls'. Furthermore, clients of these scam operations have also been widely documented as using forced labor in modern slavery-like conditions.
'They have the ability to shut down this scam economy and human trafficking activities, but they have become a 'classified ad platform' for cryptocurrency scammers,' said Erin West, former prosecutor of Santa Clara County in California and current leader of the anti-fraud organization 'Operation Shamrock'. 'These bad actors are using their bad platform to facilitate other bad actors.'
In addition to Telegram, another cryptocurrency company, Tether, also plays a key role in these scam markets. This popular 'stablecoin' is the preferred tool for money laundering transactions in these markets. Unlike most cryptocurrencies, Tether has a centralized structure, meaning the company behind it (Tether Ltd.) can seize or freeze funds at any time. However, the company has made almost no interventions regarding the large-scale fund flows it supports.
In response to (Wired) comments regarding its role in the black market trading of 'Potato Guarantee' and 'Coin Guarantee', both Telegram and Tether have not responded.
Jacob Sims, a visiting scholar at Harvard University's Asia Center focusing on transnational crime research, believes that Tether and Telegram's efforts to combat the expansion of the scam industry are akin to the 'symbolic' raid actions by Southeast Asian law enforcement against scam bases. These law enforcement actions are often merely formal, subsequently allowing these scam organizations to rebuild and resume operations. 'The lack of effective law enforcement at all levels leads to ineffective crackdowns,' Sims stated.
Sims also pointed out that only through centralized cooperation among international governments and law enforcement agencies can there be substantial changes to this situation. He compared this effort to coordinated actions against global terrorism or drug trafficking, arguing that the same international pressure should also be applied to companies that fuel the proliferation of scams.
'The current response to this increasingly severe scam industry has not reached a level of coordination and urgency that matches the problem,' Sims said, 'and only when we elevate it to a priority that matches the immense damage it causes is there any possibility of resolving the issue.'