Despite a high-profile crackdown by Telegram on May 13, the Huione Guarantee and Xinbi Guarantee crypto marketplaces have quickly reemerged under new names and channels, continuing to operate on the same platform that banned them. According to a May 29 report by blockchain intelligence firm TRM Labs, both groups have resumed activity, highlighting the resilience and adaptability of cybercrime networks built around stablecoins and encrypted communications.
Telegram Ban Proves Fleeting
Telegram’s decision to remove channels linked to the notorious Huione and Xinbi markets initially appeared to disrupt their operations. However, TRM Labs now confirms that Huione Group is still running exclusive “VIP” vendor channels on the app, while Xinbi Guarantee resumed operations within days—some of it under a rebranded “Xinbi 2.0” name. Huione has also relaunched its crypto exchange, continuing to process transactions using its proprietary USDH stablecoin.
These rapid recoveries illustrate a familiar playbook: when digital black markets are shut down, operators migrate, rebrand, and reestablish their networks with little friction. Telegram remains their preferred platform due to its large user base and lenient moderation.
Huione’s Billion-Dollar Operation Still Active
The scale of these marketplaces is staggering. TRM Labs estimates that Huione Group has facilitated over $81 billion in crypto transactions since 2021 eclipsing even infamous darknet markets like Hydra and Silk Road. Xinbi, though smaller, is tied to more than $8.4 billion in USDT movement since 2022.
Unlike traditional darknet platforms that rely on Tor, Huione and Xinbi operated openly on Telegram. They did not sell illicit goods directly but facilitated transactions via escrow services, enabling deals for SIM cards, forged documents, malware kits, surveillance equipment, and fraudulent investment tools. All payments were routed through stablecoins such as USDT to preserve anonymity.
How Guarantee Marketplaces Work
These platforms introduced a twist to typical online crime by offering a layer of “trust” between buyers and vendors. Known as “guarantee marketplaces,” they used escrow systems and vendor deposits as anti-fraud mechanisms. Sellers were required to put down security deposits that could be forfeited if they were found to be defrauding users. Bots automated everything from listings to payments, minimizing human exposure.
As Elliptic researchers explained, this ecosystem created a controlled, large-scale digital bazaar for illicit services one that mimicked legitimate platforms while serving the needs of organized cybercrime syndicates across Southeast Asia and China.
Enforcement and Escalation
U.S. authorities have taken action. In early May, the Financial Crimes Enforcement Network (FinCEN) designated Huione Group a “primary money laundering concern.” On May 29, the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Philippines-based Funnull Technology for connections to Huione’s services. Despite this pressure, enforcement appears to have had limited impact.
Telegram’s ban reduced Huione’s member count from over 800,000 to around 250,000, but many of those users and vendors have simply regrouped. Some moved to Tudou Guarantee, a Huione-affiliated platform whose user base surged by nearly 30% following the crackdown.
A Growing and Disturbing Market
Beyond fraud and document forgery, both TRM Labs and Elliptic found listings for more disturbing items: stun guns, metal restraints, and surrogate women sometimes described with broken or machine-translated captions hinting at exploitation in scam compounds. These marketplaces have become enablers for a broader, professionalized ecosystem of digital and physical crime.
From Telegram to Alternatives
Looking ahead, TRM Labs warns that Huione and Xinbi operators are exploring alternatives to Telegram. They are testing proprietary messaging apps like ChatMe and SafeW, which mimic Telegram’s functionality but offer greater resistance to takedowns. In essence, even as surface-level names and channels change, the infrastructure and criminal networks remain intact.
Final Thoughts
The reappearance of Huione and Xinbi after Telegram’s ban is a cautionary tale in the fight against digital financial crime. Enforcement actions may disrupt operations temporarily, but without long-term solutions and coordinated tech platform accountability, these groups will continue to evolve. The billion-dollar flows and increasing sophistication of these networks suggest that more aggressive and coordinated global efforts are needed to tackle this growing cybercrime threat at its root.
