Telegram has taken action against two large-scale digital marketplaces operating on its platform, effectively dismantling hubs used by cybercriminals and fraud syndicates across Asia. The two Chinese-language markets — Xinbi Guarantee and Huione Guarantee — went offline this week, signaling a significant disruption to online criminal operations that collectively processed tens of billions of dollars.
Both markets had become notorious for enabling scams, laundering illicit funds, and providing digital infrastructure for criminal enterprises. Their sudden disappearance on Thursday was confirmed by Telegram, which stated that all illegal activities — including fraud and money laundering — are banned under its terms of service and are removed as soon as they are detected.
Telegram removes two of the largest black markets on its platform
Though Telegram offered no additional commentary beyond its brief message to Reuters, the platforms’ removal marks a major victory in the ongoing fight against cybercrime. According to blockchain analytics firm Elliptic, the two illicit marketplaces handled over $35 billion in cryptocurrency transactions since 2021 — an amount that dwarfs the figures seen on infamous dark web sites such as Silk Road, which was known for distributing narcotics globally before being taken down by U.S. law enforcement.
“This is a substantial setback for cybercriminals, who had come to rely heavily on these marketplaces for trading stolen information, laundering proceeds, and accessing digital communications tools,” Elliptic said in a public statement.
The shutdowns have not gone unnoticed by those behind the scenes. Huione Guarantee, which had at one point operated under the alias “Haowang Guarantee,” acknowledged on its website that Telegram had blocked its channel on Tuesday. The group stated that it would “cease operations from now on,” although it did not provide further clarification or respond to follow-up inquiries.
Efforts to reach Xinbi Guarantee were unsuccessful, as no valid contact details could be located at the time of publication.
Huione Group tied to sanctioned financial operations and North Korean hackers
Huione Guarantee is a branch of the broader Huione Group, a conglomerate based in Cambodia with ties to various financial technology operations including Huione Pay and Huione Crypto. These entities have come under intense scrutiny from U.S. authorities, particularly after revelations last year that Huione Pay had received over $150,000 in cryptocurrency from a wallet linked to Lazarus Group — a hacking collective aligned with the North Korean government and responsible for several high-profile cyberattacks worldwide.
Following the investigation, the U.S. Treasury took action in May 2025 to ban the Huione Group from the American financial system altogether. In a strongly worded statement, U.S. Treasury Secretary Scott Bessent described Huione as a central player in the global cybercrime economy. “The Huione Group has served as the marketplace of choice for dangerous cyber actors,” he stated.
As of Thursday, the Huione Group had not responded to requests for comment on either the shutdown or the U.S. sanctions.
Online fraud networks face growing global pressure
The elimination of Xinbi and Huione Guarantee reflects a growing international consensus on the need to rein in illicit digital markets. Cybercriminals had increasingly relied on platforms like Telegram — which offers encrypted messaging and broad anonymity — to conduct illegal business without detection. These now-defunct marketplaces had become hubs for trading hacked data, providing untraceable money laundering services, and coordinating scams targeting individuals and businesses worldwide.
Investigators say the business models of these black markets evolved over time. Initially posing as escrow or “guarantee” services for transactions in Chinese-speaking communities, platforms like Huione Guarantee quickly morphed into full-fledged digital crime networks. Their services extended from fake identity generation and access to fraudulent bank accounts to comprehensive support for call center scams and romance fraud schemes.
Global enforcement closing in on cybercrime infrastructure
With these networks now in disarray, law enforcement agencies and researchers see a temporary disruption — but they remain cautious about the potential for resurgence. Cybercrime operations have shown remarkable adaptability in the past, often shifting operations to new platforms or resurrecting themselves under different names.
Nonetheless, the coordinated enforcement actions and platform removals mark an important step forward. Experts note that targeting the infrastructure — including digital wallets, payment systems, and communications platforms — can severely undermine criminal supply chains.
As governments continue to tighten regulations and pressure tech companies to enforce compliance, digital marketplaces involved in illegal activities may face increased difficulty in staying operational.
Telegram, like other messaging platforms, has struggled to strike a balance between privacy protections and regulatory obligations. While its end-to-end encryption appeals to users seeking secure communication, it also presents challenges in monitoring criminal content. However, Thursday’s actions demonstrate the company’s willingness to respond when clear violations are identified.
For now, the disappearance of these two massive black markets sends a powerful signal: no platform, regardless of its size or anonymity features, is beyond the reach of global enforcement efforts. The world’s cybercriminal underworld has lost a major foothold — and the hunt for the next hub has already begun.
