Telegram recently removed several major scam marketplaces connected to Huione Guarantee and Xinbi Guarantee from its platform after a U.S. government crackdown in May. However, the criminal organizations operating these services have successfully migrated their operations to alternative platforms, with much of the activity now flowing through a Telegram-based service called Tudou Guarantee.
The banned marketplaces had processed more than $35 billion in USDT transactions before their removal, according to research published by blockchain intelligence firm TRM Labs in July. Following the enforcement actions, the criminal ecosystem quickly reorganized and continued operating through affiliated services that remained accessible on Telegram.
U.S. Enforcement Actions Target Cambodia-Based Operations
The crackdown began on May 13 when the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) proposed new rules under Section 311 of the USA PATRIOT Act. These regulations formally classified the Huione Group, a Cambodia-based conglomerate, as a financial institution engaged in money laundering activities.
FinCEN’s investigation revealed that the organization had laundered over $4 billion in criminal proceeds between August 2021 and January 2025. The funds originated from various illegal activities including cyber fraud schemes, pig-butchering scams, and cryptocurrency thefts targeting victims worldwide.
Huione Guarantee served as the group’s primary marketplace, operating as a Chinese-language escrow and money-laundering platform. The service provided infrastructure support for online scam syndicates and cybercriminal networks, enabling them to conduct fraudulent transactions with built-in protections.
Telegram took action against these platforms after blockchain analytics firm Elliptic published findings about their operations. The investigation documented how these forums facilitated the sale of scam tools and stolen identity information while providing escrow services for fraudulent transactions.
Criminal Groups Build Crypto Networks to Launder Billions
Southeast Asian crime groups now build their own crypto systems to avoid detection.
One key player is Huione Guarantee (now rebranded as Haowang) processed over $24 billion in fraud-linked crypto in four years. Based in… pic.twitter.com/dEi8r21bA0
— VERITAS PROTOCOL (@veritas_web3) May 8, 2025
Criminal Operations Shift to Alternative Platforms
TRM Labs reported on Wednesday that vendors previously using Huione-connected services have migrated to Tudou Guarantee, another Telegram-based marketplace. The Huione Group already maintained an ownership stake in this alternative platform, allowing for a relatively seamless transition of operations.
The migration caused transaction volumes on Huione Pay, a digital payment platform linked to the same criminal organization, to surge by 50%. TRM Labs determined this increase resulted directly from vendors moving their activities to Tudou Guarantee while continuing to use Huione Pay for fund storage and transfers.
Daily transaction volumes for Huione Guarantee had reached $60 million at their peak in early 2024 before dropping to $30 million following the crackdown. Despite the enforcement actions, volumes temporarily recovered to $40 million before stabilizing back at the $30 million level.
On May 25, 2025, the Huione Group established a new Telegram identity and channel using a different Chinese name. However, the organization retained the “hw” initials from its original HaoWang branding, and their automated bot systems continued operating under the HaoWang name.
Elliptic’s analysis identified increased activity across more than 30 new or lesser-known guarantee platforms following Telegram’s actions against the major players. Many of these alternative services continue operating openly to fill the market gap left by the enforcement actions.
Ongoing Sanctions Target Supporting Infrastructure
The U.S. government expanded its enforcement efforts later in May when the Office of Foreign Assets Control (OFAC) imposed targeted sanctions on Funnull Technology, a company connected to the Huione Group. The sanctions also included two digital wallets linked to pig-butchering fraud operations.
Funnull Technology Inc. provided crucial infrastructure support to cybercriminal networks by purchasing large quantities of IP addresses from cloud service providers. The company then resold these addresses to operators running fraudulent investment platforms, enabling them to host fake websites that mimicked legitimate investment services.
This infrastructure allowed scammers to create convincing replicas of established financial platforms, tricking victims into investing in non-existent schemes. According to Treasury Department estimates, these coordinated scams have caused victim losses exceeding $200 million.
Despite the enforcement actions and Telegram bans, the broader Huione ecosystem continues operating. The Cambodia-based Huione Pay remains functional and serves as the preferred payment processor for cryptocurrency-related scam operations worldwide.
Implications for Regulatory Oversight
The enforcement actions demonstrate regulatory agencies’ growing focus on cryptocurrency-based money laundering operations, though the quick migration to alternative platforms suggests these efforts may have limited immediate impact on overall market confidence. The continued operation of these criminal networks through new channels indicates that regulatory pressure alone may not be sufficient to eliminate established illicit cryptocurrency infrastructure.
Leave a comment