Telegram Shuts Down Huione’s Largest Crypto Scam Market Ever, But Rivals Take Over with 400% Volume Surge

Telegram shutting down Huione Guarantee, the largest illicit marketplace in history, with over $27 billion in transactions, paradoxically strengthened the dark market as rival platforms experienced a 400% volume surge and quickly absorbed the criminal user base.

Following blockchain analytics firm Elliptic’s investigation, Telegram banned thousands of channels and accounts linked to Huione on May 13, 2025.

However, the successor platform, Tudou Guarantee, immediately captured the displaced criminal activity, processing equal volumes within weeks of the shutdown.

Elliptic tracked over 30 highly active guarantee marketplaces in Southeast Asia that continue to facilitate money laundering, stolen data trading, and “pig butchering” scam infrastructure.

The Hydra Effect: How Huione Multiply Under Pressure

The $27 billion Huione marketplace had operated as a sophisticated criminal ecosystem, offering everything from fake documents and stolen personal data to money laundering services and intimidation-for-hire through Telegram’s encrypted infrastructure.

The platform’s reach extended far beyond simple financial crime, with ties to human trafficking operations disguised as legitimate IT companies across Cambodia, Laos, and Myanmar, where victims were forced to execute romance scams and crypto fraud under constant surveillance.

Huione has been connected to Cambodia’s ruling elite and its role in laundering proceeds for North Korea’s Lazarus Group. This made it a primary target for the U.S. Treasury’s FinCEN, which designated the entire Huione Group as a money laundering concern in May 2025.

The criminal enterprise strategically acquired a 30% stake in Tudou Guarantee in December 2024, effectively ensuring operational continuity before enforcement action materialized.

Source: Elliptic

This planning enabled the seamless migration of hundreds of thousands of users. Tudou’s transaction volumes surged from negligible levels to over 300,000 by June 15.

The same merchants who previously operated through Huione immediately established operations on Tudou, offering identical services, including stolen data, money laundering capabilities, and specialized tools for pig butchering scams targeting Western victims.

Beyond Tudou’s dominance, multiple smaller platforms experienced exponential growth as the criminal ecosystem fragmented and diversified.

According to Elliptic, Shuangying marketplace saw user numbers triple from 40,000 to 110,000 transactions, and Fully Light expanded from 20,000 to over 80,000 transactions.

Source: Elliptic

These platforms use Telegram’s encryption for communication and comprehensive business operations, including reputation management, order fulfillment, and dispute resolution among vendors and clients.

They also use Tether’s USDT stablecoin as the primary medium of exchange, which provides these criminals with dollar-denominated stability while avoiding traditional banking systems.

The UN estimates that Telegram-based criminal activity generates up to $36.5 billion annually through scams, money laundering, and stolen data sales.

Ongoing Enforcement Challenges On Telegram’s Encrypted Crime Economy

Despite Telegram’s cooperation in removing thousands of channels and banning associated accounts, Chainalysis research revealed that Huione’s core cryptocurrency processing infrastructure remained operational, which Elliptic also confirmed.

Source: Elliptic

The platform is simply migrating to new domains and quietly resuming Telegram’s presence within weeks of the apparent shutdown.

This resilience stems from the platform’s complex architecture, which separates public-facing marketing infrastructure from core financial processing systems. This allows criminal operations to continue even when their most visible components face disruption.

The enforcement action’s limited impact becomes particularly evident when examining the broader criminal ecosystem that Huione enabled, including forcing trafficking victims into crypto scam operations across Southeast Asian compounds where legitimate job seekers are lured with false IT positions before being held against their will and coerced into executing fraudulent schemes.

These physical operations, often disguised as customer service centers, create a hybrid criminal model that combines digital financial crime with traditional human trafficking, making comprehensive enforcement exponentially more complex as it requires coordination across multiple jurisdictions and crime categories.

While Telegram has begun responding to pressure by removing certain features and updating content policies, the platform’s core encrypted messaging capabilities remain attractive to criminals who exploit the technology’s legitimate privacy protections to operate sophisticated marketplace ecosystems.

The challenge for regulators lies in addressing criminal abuse without undermining the privacy rights and communication security that make encrypted platforms valuable for legitimate users worldwide.

Telegram CEO Pavel Durov is also fighting this battle with the regulators. He was recently arrested and released on bail, but surveillance remains.