Wired: Chinese Cybercriminals Are Back on Telegram — and Telegram Isn’t Blocking Them

Crypto-tracking company Elliptic has discovered that “black market” crypto scam networks have once again resurfaced on Telegram.

According to experts, this resurgence follows Telegram’s mid-May takedown of thousands of accounts and channels linked to two major “crypto laundering” operations. These networks were reportedly used to wash illicit crypto transactions.

Among those removed were accounts and channels tied to Haowang Guarantee, a shadow crypto marketplace that facilitated over $27 billion in fraudulent transactions. Elliptic also previously reported on Xinbi Guarantee, which processed a slightly lower sum — $8.4 billion.

Wired now reports that, a month later, smaller markets have nearly fully occupied the void left by the two major players.

“Telegram appears to have no plans to stop them.”

One of these replacements is Tudou Guarantee, which is reportedly partially owned by Huione Group — the same parent company behind the now-defunct Haowang Guarantee. Tudou’s operations have more than doubled in size.

The platform has seemingly positioned itself as an alternative for cybercriminals seeking convenient services that were previously displaced by Telegram’s moderation.

• Tudou Guarantee’s main channel has 289,000 users and is processing around $15 million in crypto payments daily.
• That figure is close to the $16.4 million Haowang was moving each day before its Telegram presence was shut down.
• Tudou Guarantee is now, by some accounts, the largest black market on the internet.
• Xinbi Guarantee has also reappeared on new channels and already amassed hundreds of thousands of users.
• The platform has essentially rebuilt itself on new accounts — without even changing its name.

Researchers found ads on these platforms offering money laundering services and fraudulent website creation. There were also vendors selling stolen personal data and prostitution services, some of which allegedly involve minors.

One Tudou post openly advertises prostitution, including references to possible underage participants. “Students, queens, lolita,” the post states next to pictures of young women. “All available!!”

Telegram has reportedly not removed any of the new accounts linked to these underground markets flagged by Elliptic. Tom Robinson, co-founder of Elliptic, reminded the public that the scammers operating on these shadow platforms “have inflicted misery on millions of victims around the world, stealing billions of dollars.”

A Telegram spokesperson told Wired:

“The channels in question predominantly involve users from China, where rigid capital controls often leave citizens with little choice but to seek alternative avenues for moving funds internationally,” the statement reads.

“We assess reports on a case-by-case basis and categorically reject blanket bans—particularly when users are attempting to circumvent oppressive restrictions imposed by authoritarian regimes. We remain unwavering in our commitment to safeguarding user privacy and defending fundamental freedoms, including the right to financial autonomy.”

Robinson responded by saying that his team has been monitoring these markets for nearly two years — and they are not promoting financial freedom:

“These are marketplaces that primarily facilitate money laundering for the proceeds of fraud and other illicit activity."

Former prosecutor Erin West, head of the nonprofit Operation Shamrock, weighed in on Telegram’s role:

“These are bad guys, enabling bad-guy business on their bad-guy platform. They have the ability to shut down a scam economy and the trafficking of human beings. Instead, they’re hosting Craigslist for crypto scammers.”

Jacob Sims, a fellow at Harvard’s Fairbank Center for Chinese Studies, suggested that Telegram’s apparent inconsistency may have more to do with avoiding conflict with the U.S. government than with its stated commitment to “financial autonomy.”

Huione Group was identified by the U.S. Treasury Department as a major money laundering concern. According to Sims, this likely prompted Telegram’s initial takedown of Haowang Guarantee accounts and channels, given its connection to the Cambodia-based Huione Group.

He believes another high-level government action may be needed to get Telegram to act again:

“It also shows how fast the scammers are going to adapt. There's no real legal culpability that tech companies have for what happens on their platform unless there's a specific case brought to their attention by law enforcement. And so, until that changes, I just don't know what incentive they have to be proactive.”