Guarantee Marketplaces: Telegram’s Scam Networks Fuel Southeast Asia’s Illicit Economy

Key Takeaways

• In May, Telegram moved to shut down two of the largest guarantee marketplaces.
• Platforms like Huione Guarantee use Telegram to operate black-market services for the trade in illicit goods and services.
• Huione Guarantee, which was shut down in May, mostly catered to cyber criminals operating across China and Southeast Asia.

In May 2025, Telegram shut down Huione Guarantee and Xinbi Guarantee, two illicit marketplaces for goods and services used in fraud and scams.

But although Huione and Xinbi are gone, a host of smaller guarantee marketplaces continue to serve criminal groups operating across China and Southeast Asia.

What Are Guarantee Marketplaces?

Generally speaking, guarantee marketplaces are platforms that facilitate trusted transactions between buyers and sellers by providing payment guarantees or escrow-like mechanisms to reduce risk.

The concept is often associated with legitimate online marketplaces. But in recent years, it has also been used to describe black-market escrow services.

From 2015 onward, Telegram emerged as a key platform for illegal trade. 

Compared to darknet markets, Telegram-based services have a lower technical barrier to entry, are mobile-friendly, and easier to reorganize if they get shut down by authorities. Telegram bots also support more automated trade flows for guarantee markets.

Huione Guarantee

Launched in 2021, Huione Guarantee was a Chinese-language Telegram marketplace that provided escrow services for a range of illicit trades.

While some Telegram marketplaces are focused on the drug trade or other areas of the illicit economy, Huione mostly catered to cybercriminals conducting online fraud and scams.

In 2024, an investigation by Elliptic found that listings on the platform included fraud tools, money laundering services and stolen data. In the most shocking example, one vendor was reportedly selling electrified shackles intended for use on scam compound workers.

Payments on the platform were mostly facilitated with USDT, but other forms of crypto, as well as bank transfers and payment apps, were also used.

Elliptic’s investigation exposed ties between the Telegram marketplace and Huione Pay, which were both operated by the Cambodian technology conglomerate Huione Group. 

Telegram Shuts Down Dark Markets

In the wake of Elliptic’s investigation, Telegram moved to shut down Huione Guarantee and another similar platform, Xinbi Guarantee.

In an effort to crack down on illicit trade, the company banned thousands of related accounts, channels, bots and usernames.

“Criminal activities like scamming or money laundering are forbidden by Telegram’s terms of service and are always removed whenever discovered,” it said at the time.

However, Telegram’s guarantee marketplaces have proven to be resilient.

Guarantee Markets Continue to Thrive

According to new research by Elliptic, Huione’s initial shutdown was only a temporary setback for Telegram’s broader ecosystem of guarantee marketplace.

The blockchain analytics company said it is currently tracking over thirty “highly-active markets” that have stepped up to fill the gap left by Huione’s exit.

Most notably, Tudou Guarantee has seen its users more than double, and its cryptocurrency inflows are now approximately equal to those seen for Huione Guarantee before it was shut down.

Marketplace Whac-a-Mole

The tendency for Telegram’s illicit economy to bounce back mirrors the years-long marketplace whac-a-mole familiar to the darknet. 

The primary difference is that while darknet market busts typically require intelligence agencies shutting down physical servers, the work of policing Telegram markets lands on the app operator itself.

Telegram has come under fire for not doing enough to stamp out criminal activity on its platform, with authorities in France and elsewhere criticizing the firm for alleged complacency.

After CEO Pavel Durov was arrested in 2024, the company has moved to tighten its moderation and compliance policies. For example, it has disabled certain discovery features and standardized how it responds to law enforcement data requests.

Recently, Durov has criticized his treatment by French authorities and the media, which he accused of orchestrating a smear campaign against Telegram.