The cryptocurrency darknet markets on Telegram have experienced a significant resurgence, rapidly filling the void left by the recent shutdown of the notorious Huione Guarantee. According to a report by blockchain analytics firm Elliptic, researchers have uncovered a surge in user activity across more than 30 Telegram-based marketplaces since May, when Telegram initially removed Huione Guarantee’s public channels. This quick adaptation by illicit operations highlights the persistent challenge in combating their presence on messaging platforms, even after targeted interventions.
Darknet Markets Rebound on Telegram
Following the shutdown of the crypto darknet marketplace Huione Guarantee, Telegram-based alternatives have quickly emerged to fill the void. Blockchain analytics firm Elliptic has uncovered a significant surge in user activity across more than 30 Telegram-based marketplaces since May. This demonstrates the resilience and adaptability of these illicit networks, which swiftly re-establish operations despite platform interventions.
Tudou Guarantee Leads the Resurgence
Among the new platforms, Tudou Guarantee has witnessed the largest migration of users and activity. Its user numbers have more than doubled, and its transaction volumes now match those once recorded by Huione Guarantee. Elliptic’s analysis confirms that many merchants previously active on Huione Guarantee have resumed operations on Tudou Guarantee, continuing to offer illicit services.
Illicit Services Continue Unabated
These resurrected marketplaces, including Tudou Guarantee, continue to offer a range of illegal services. These include the sale of stolen data, sophisticated money laundering operations, and infrastructure essential for various scam-related activities. This continuity of service highlights the persistent demand for such illicit wares and the ease with which vendors can relocate their operations to new platforms.
Huione Guarantee’s Transaction Decline
While Huione Guarantee attempted to provide private escrow services post-shutdown, on-chain data indicates a significant drop in its crypto transaction volumes. Primarily conducted in Tether (USDT), these volumes fell to negligible levels by late May. This suggests that despite efforts to maintain operations discreetly, the public channel removal severely hampered its direct transaction flow.
Conglomerate Activity Beyond Marketplaces
Elliptic’s report clarifies that while the marketplace segment was disrupted, other entities within the parent conglomerate, such as Huione Pay, continue to process large volumes of crypto transactions. It’s important to note that these transactions are distinct from those directly linked to the marketplace, utilizing different wallet infrastructure and business operations. This indicates a broader, more diversified illicit network at play.
Calls for Sustained Platform Action
Researchers emphasize that the closure of Huione Guarantee sent “shockwaves” through the guarantee market ecosystem. However, they warn that “many other similar Telegram-based marketplaces remain in operation and continue to expand.” Elliptic’s report concludes with a strong call for wider, ongoing removal of these marketplaces from Telegram to effectively curb the global scam epidemic.
Huione Guarantee’s Pre-Shutdown Scale
Prior to its shutdown, Huione Guarantee was described as the largest darknet marketplace of its kind, having facilitated over $27 billion in illicit transactions. Operating predominantly in Chinese, it functioned as an escrow-based platform connecting vendors and buyers involved in various online scams. Its primary focus was on scams originating from across Southeast Asia and China, impacting victims globally.
Range of Illicit Offerings
Vendors on Huione Guarantee offered a diverse array of illicit goods and services. These included fake IDs, black market SIM cards, surveillance tools, and complex money laundering arrangements. Payments were typically conducted using stablecoins like USDT, with merchants required to post deposits as a trust mechanism within the illicit trading community, further highlighting the sophisticated nature of their operations.
Rebranded Domains Keep Network Alive
Further investigations by Chainalysis support Elliptic’s findings, revealing that while Huione Guarantee’s original domain and public channels were taken down, its laundering network remained operational. Chainalysis reported that Huione reemerged under a new domain, Huione.me, preserving its original branding along with its linked token XOC and the USDH stablecoin, both of which remain actively listed for trading.
USDH Flagged by FinCEN
The USDH stablecoin, specifically linked to the Huione network, has been flagged by FinCEN (Financial Crimes Enforcement Network) for its design. Its structure reportedly makes it difficult for law enforcement to freeze funds, thereby enabling illicit actors to move funds with minimal risk of seizure. This highlights a persistent challenge for regulators in tracking and disrupting sophisticated money laundering operations using stablecoins.
Exploring Proprietary Messaging Apps
A separate report from TRM Labs warned that Huione and related groups are actively exploring proprietary messaging apps such as ChatMe and SafeW. These apps are designed specifically to avoid third-party moderation, a direct response to Telegram’s ongoing crackdown on illicit activities. This shift signifies a growing trend among criminal enterprises to move towards more insular and encrypted communication channels to evade detection.
