Crypto Dark Markets Rebound Post-Telegram Ban

Executive Summary: Following Telegram’s May 13 ban of Huione Guarantee, a major platform in Asia’s illicit crypto trading network, transaction volumes have largely migrated to successor platforms, primarily Tudou Guarantee. Despite Telegram’s efforts to shut down the largest dark marketplace, Elliptic analysis shows a rapid regrouping of cybercriminals, with illicit volumes reaching approximately $27 billion by early June.

Headline: Market Resurgence After Huione Ban

• Tudou Guarantee has captured most of Huione Guarantee’s transaction volume.
• USDT transactions on Huione collapsed to near zero post-ban.
• Over 30 successor platforms are now active, with several experiencing significant transaction growth.

Persistence and Adaptation:

Elliptic’s analysis, released Monday, confirms a swift migration of criminal activity away from Huione Guarantee after Telegram’s intervention. The investigation found:

• Huione Guarantee’s transaction activity ceased almost immediately after the ban announcement on May 11.
• Tudou Guarantee’s transaction volume surged, surpassing 200,000 by May 18 and exceeding 300,000 by June 15.
• Other platforms like Shuangying (+200%) and Fully Light (+300%) also saw significant growth, indicating a rapid redistribution of Asia’s cybercrime infrastructure.

Elliptic noted that Tudou Guarantee had already acquired a 30% stake from a related criminal group in December 2024, ensuring operational continuity despite the ban.

These “guarantee marketplaces,” operating primarily on Telegram, facilitate the trade of stolen data, malware, hacking tools, and money laundering services, often using Tether’s USDT stablecoin to obscure transactions and bypass traditional financial regulations.

Headline: Complex Connections and Lingering Threat

Elliptic tracks over 30 active illicit markets now, many attempting to fill the void left by Huione. Tudou was previously identified as a potential successor in earlier research.

These platforms continue to offer services explicitly marketed towards scammers, including “pig butchering” schemes targeting Western victims. The vendors remain largely the same merchants who previously operated through Huione.

Elliptic concludes that disrupting Asia’s cyber scam infrastructure requires sustained efforts, including the continued removal of these marketplaces from Telegram.