Chinese Groups Have Transformed Telegram into the Dark Web of Crypto Scams

Chinese-language networks operating on Telegram have become the backbone of the world’s largest illicit crypto economy. 

These groups have surpassed the dark web in fusing scams, AI-driven deception, and money laundering into a single, industrial system.

Telegram Markets Now Dwarf Historical Dark Web Giants

The scale is unprecedented. Elliptic data shows Huione Guarantee, later rebranded as Haowang Guarantee, processed $27 billion between 2021 and 2025. 

That figure exceeds every major dark web market in history.

After Telegram banned Huione in May, activity migrated. Two markets now dominate:

• Tudou Guarantee: roughly $1.1 billion per month
• Xinbi Guarantee: roughly $850 million per month

Combined monthly volume now surpasses what AlphaBay processed over its entire lifetime.

Why Telegram Replaced the Dark Web

Telegram offers public channels, escrow-like systems, and instant global reach. Users need no Tor browser or technical knowledge.

Markets recreate classic darknet features:

• Vendor reputation systems
• Escrow and dispute resolution
• Stablecoin settlement
• Rapid rebranding after bans

In practice, Telegram has become a “dark web without friction.”

Crypto Scam Markets Feed a Global Fraud Industry

These markets do not sell drugs or weapons at scale, but they sell scam infrastructure.

The primary customer base is the pig-butchering scam industry. These long-term romance and investment scams generate roughly $10 billion annually from US victims alone, according to federal data.

Operations are concentrated in Southeast Asia. Many rely on trafficked labor held in scam compounds.

Telegram markets provide:

• Money-laundering services
• Fake investment platforms
• Stolen identities
• Telecom and social-engineering tools

The scam economy and the markets grow together.

AI Face-Swap Tools Supercharge Fraud

A key accelerant is artificial intelligence. Chinese-language Telegram groups actively sell:

• Real-time face-swap software
• Voice-cloning tools
• Deepfake identity kits

These tools allow scammers to impersonate real people on video calls. They dramatically increase trust and conversion rates.

Threat analysts describe this as the industrialization of social engineering. Scams now operate with assembly-line efficiency.

USDT Is the Financial Backbone

Nearly all transactions settle in Tether (USDT). Unlike decentralized cryptocurrencies, USDT can be frozen. That capability exists but is rarely used at scale.

As a result, the most centralized stablecoin underpins the largest illicit crypto markets ever recorded. This dependency concentrates risk across scams, money laundering, and cross-border fraud.

Telegram has removed major markets before. Each time, replacements emerged within weeks.

Ownership stakes shift between markets. Liquidity follows instantly.

Elliptic tracks roughly 30 Chinese-language Telegram markets today. Together, they move tens of billions of dollars annually, mostly through crypto. 

Enforcement pressure remains fragmented and inconsistent.

Overall, this is no longer a niche cybercrime story.

Public messaging platforms now host global illicit finance at scale. Language-based networks matter more than geography; tools are reshaping fraud economics.

The result is a criminal ecosystem larger than anything the dark web ever produced. And it operates in plain sight.

Without a coordinated platform, stablecoin, and law-enforcement action, this system will keep growing.