Telegram Takes Down the Two Largest Criminal Crypto Marketplaces Ever
On 13 May 2025, Telegram permanently removed Huione Guarantee and Xinbi Guarantee from its platform, ending the operations of what are now confirmed as the two largest illicit online marketplaces in recorded history. Together, the two platforms processed more than $35 billion in Tether's USDT stablecoin. The action was taken after Elliptic, a blockchain analytics firm, provided Telegram with the on-chain evidence needed to identify and attribute the marketplace infrastructure. For accounting firms, auditors, and CFOs with any exposure to stablecoins or digital asset payment flows, the case carries direct and urgent compliance lessons.
What Huione Guarantee and Xinbi Guarantee Were
Unlike the darknet markets of the previous decade, which required Tor browsers and technical know-how, this new generation of criminal platforms operated openly inside Telegram, an app with more than one billion users. Both Huione Guarantee and Xinbi Guarantee were so-called "guarantee marketplaces": Chinese-language platforms that functioned as managed commercial directories for criminal service providers.
How the marketplace model worked
The platforms did not themselves sell illicit goods. Instead, they provided the commercial infrastructure: merchant onboarding, anti-fraud deposits (the "guarantees" that give these markets their name), escrow services, and automated transaction monitoring bots. Sellers listed their services. Buyers placed orders. Disputes were mediated. The marketplace administrator collected fees. Almost every transaction settled in USDT.
The range of services listed on Huione Guarantee spanned money laundering, stolen personal data, SIM cards, and the development of fraudulent investment websites. Physical goods on offer included electric shock restraints marketed explicitly for use on workers held in scam compounds, a grim indicator of the human trafficking networks these platforms supported.
Scale that dwarfs every prior precedent
Elliptic's on-chain analysis found that Huione Guarantee had processed more than $27 billion in USDT since launching in 2021, making it the single largest illicit marketplace ever to have operated. Xinbi Guarantee, which launched in 2022, processed a further $8.4 billion, placing it in second position. Combined, the two platforms comfortably exceed the transaction volumes of every previously known criminal marketplace, including the Silk Road ($216 million), AlphaBay ($639 million), and the Russian-language Hydra market ($5.6 billion), which had previously held the record for a Tor-based platform.
Huione Group, the Cambodian conglomerate behind Huione Guarantee, also operates a payments business called Huione Pay. Until recently, Huione Pay's website actively directed users toward the marketplace's Telegram channels, underscoring how seamlessly the illicit infrastructure was embedded within a nominally legitimate corporate structure.
How On-Chain Data Led to the Takedown
Blockchain analytics made this enforcement action possible. Because virtually all transactions on both platforms settled in USDT on public blockchains, every payment left a verifiable, permanent record. Elliptic mapped those records, quantified the flows, and attributed them to the specific Telegram channels and usernames operating the marketplaces. That intelligence was then shared with Telegram.
The mechanics of the platform shutdown
In early 2025 Telegram had already attempted a partial removal of Huione Guarantee, deleting a number of its channels. The marketplace responded by migrating to backup channels and redirecting its usernames to the new locations. One central channel dropped from more than 800,000 users to around 250,000 as a result, but the operation continued.
The 13 May action went further. Telegram deleted the channels and, critically, banned the associated usernames for both platforms. Banning a username on Telegram is functionally comparable to seizing a website domain: the marketplace operators can no longer use it to redirect users to new infrastructure, making a relaunch significantly harder to execute.
Divergent responses from the two operators
Huione Guarantee announced a suspension of operations on 13 May, followed later that day by a declaration of permanent closure. The announcement also directed its merchants and users toward Tudou Guarantee, a rival platform in which Huione had acquired a 30% stake in December 2024. User numbers on Tudou subsequently rose by close to 30%.
Xinbi Guarantee took a more defiant position, announcing plans to relaunch as "Xinbi 2.0" and pointing users to new channels. Some users publicly expressed concern that the announcements could be a precursor to an exit scam by the platform's administrators.
AML Implications for Compliance Teams and CFOs
The Huione and Xinbi case is not an abstract law enforcement story. It has direct and concrete implications for any firm that touches stablecoins, processes USDT payments, or provides accounting and audit services to clients in the digital asset space.
Stablecoins are not compliance-neutral
The use of USDT as the near-exclusive settlement currency for more than $35 billion in criminal transactions is the most significant data point in this story for compliance professionals. Stablecoins are frequently treated as lower-risk instruments than volatile cryptocurrencies, partly because their price stability makes them more tractable for bookkeeping. This case illustrates that price stability has nothing to do with money-laundering risk. USDT flows warrant the same level of transaction monitoring, counterparty screening, and source-of-funds analysis as any other digital asset, and arguably more scrutiny given their liquidity and cross-border utility.
Firms using crypto accounting software that captures only fiat-equivalent balances without preserving the underlying transaction graph are operating with a significant blind spot. Regulators and law enforcement now demonstrate, through cases like this, that they can reconstruct complete transaction histories from public blockchain data. Firms that cannot do the same for their own books are exposed.
Counterparty due diligence and the embedded corporate risk
The connection between Huione Guarantee and the legitimate-looking Huione Pay payments business highlights a counterparty risk that is easy to underestimate. A corporate structure that includes a regulated payments entity and an illicit marketplace is not a theoretical concern: it is what Huione Group was. Due diligence on digital asset payment processors, treasury management counterparties, and stablecoin liquidity providers therefore needs to extend to any affiliated entities and the full beneficial ownership chain, not just the regulated vehicle presenting itself at the front door.
For accounting firms advising clients who accept USDT as payment or hold USDT on their balance sheets, this is a direct prompt to revisit the source-of-funds documentation underpinning those balances. For more context on how regulators are deploying data-driven tools to enforce exactly these standards, see our analysis of how blockchain analytics is reshaping crypto AML supervision.
Platform enforcement as a compliance model
A less-discussed implication of this case is what it signals about the future of enforcement. The action was not taken by a financial regulator or a law enforcement agency serving a court order. It was taken by a commercial platform, Telegram, acting on intelligence provided by a private analytics firm. This public-private enforcement model is becoming increasingly common across the digital asset space, as we noted in our coverage of what the FBI's crypto scam network takedown means for compliance teams.
The implication for firms is that compliance obligations are no longer discharged solely by satisfying a regulator. Payment infrastructure providers, stablecoin issuers, and messaging platforms are now active participants in enforcement. A firm's digital asset accounting and AML records need to be clean and auditable not just for regulators, but for the commercial partners on whose rails transactions run.
What Happens Next: Displacement, Not Eradication
Elliptic's own analysis notes that the closure of these two platforms does not eliminate the underlying criminal activity. Huione's migration of users toward Tudou Guarantee, and the near-30% growth in Tudou's user base that followed, is a clear signal that the demand side of these markets remains intact.
The decentralisation threat
A more structurally significant development is the possibility that some guarantee market operators will build their own decentralised platforms, including their own messaging infrastructure, to avoid the single point of failure that Telegram represented. Huione itself has reportedly developed its own Telegram-like application. If guarantee marketplaces migrate to censorship-resistant, decentralised communications and payments infrastructure, the on-chain analytics approach that made this enforcement action possible becomes harder to apply, because attribution depends partly on the metadata and channel structure that centralised platforms hold.
For compliance professionals, this is the scenario worth monitoring. Decentralised platforms that combine private messaging with stablecoin payment rails would create a far more challenging AML environment than Telegram-based markets ever did. Firms whose digital asset accounting software and transaction monitoring tools are calibrated only for centralised exchange flows should be asking their providers how those tools will adapt.
Accounting records as enforcement evidence
A final, practical point for firms: this case demonstrates that blockchain transaction records are durable, auditable, and increasingly the primary evidentiary basis for enforcement actions. The $35 billion figure was not estimated: it was computed from on-chain data. Firms that maintain accurate, granular crypto bookkeeping records, including wallet addresses, transaction hashes, timestamps, and counterparty attributions, are in a far better position both to demonstrate compliance and to defend themselves if their counterparties turn out to have criminal links. Firms that do not are exposed to exactly the kind of retroactive reconstruction that brought down Huione and Xinbi.
Frequently Asked Questions
What were Huione Guarantee and Xinbi Guarantee?
They were large-scale criminal marketplaces operating inside Telegram, serving predominantly Chinese-language criminal networks. They functioned as managed directories for illicit service providers, with merchant deposits, escrow services, and automated transaction bots. Almost all payments were made in USDT.
Why does this matter for firms that are not involved in criminal activity?
The case confirms that stablecoin flows are fully traceable, that platform operators will act on analytics-driven intelligence, and that counterparty structures can conceal illicit activity behind apparently legitimate entities. Any firm holding or transacting in USDT needs robust source-of-funds documentation and counterparty due diligence.
What does "banning a Telegram username" mean in practice?
A Telegram username acts like a domain name: it allows an operator to redirect users to new channels even if old ones are deleted. Banning the username removes that redirect capability, making it significantly harder for the marketplace to reconstitute its user base under the same brand.
How should crypto accounting software handle stablecoin AML risk?
Digital asset accounting software should preserve transaction-level data including wallet addresses, transaction hashes, and on-chain timestamps, not just fiat-equivalent balances. This data is the foundation for any credible source-of-funds analysis and is the same data that regulators and analytics firms use to reconstruct transaction histories.
Is the criminal activity simply moving elsewhere?
Almost certainly yes, in the short term. Huione's acquisition of a stake in Tudou Guarantee before its own shutdown, and the subsequent growth in Tudou's user base, suggest that migration plans were prepared in advance. The longer-term risk is that operators build decentralised, censorship-resistant platforms that are harder for analytics firms and platform operators to surveil and act against.
Source: Elliptic