Banned illicit crypto marketplaces Huione and Xinbi Quietly resurface on Telegram

Banned by Telegram in May, the Huione and Xinbi Market channels have resurfaced under new names, TRM Labs said in a recent update.

Despite Telegram’s May 13 ban on the notorious Huione Guarantee and Xinbi Guarantee crypto marketplaces, both appear to have reemerged — according to blockchain intelligence firm TRM Labs — following a familiar cybercrime pattern where shuttered platforms resurface under new names, new channels, or slightly altered forms.

In a May 29 blog post, TRM Labs revealed that despite Telegram’s ban on Huione Guarantee’s public-facing vendor channels, Huione Group is “still operating channels for its ‘VIP’ vendors on the platform.” More than that, the Cambodia-based company has also relaunched its crypto exchange, which continues to process payments using its own USDH stablecoin.

TRM Labs also said it found indications that Xinbi Guarantee, banned the same day, had resumed activity on Telegram “within days.” Some vendors linked to Huione Guarantee and its wallet service, Huione Pay, were also active on Xinbi Guarantee, raising the possibility of shared infrastructure or close coordination between the two, the analysts note.

These findings come despite recent enforcement steps. Just two weeks before the bans, the U.S. Financial Crimes Enforcement Network designated Huione Group as a “primary money laundering concern.” And on May 29, the Treasury’s Office of Foreign Assets Control sanctioned Funnull Technology, a Philippines-based cyber scam operator reportedly linked to Huione’s services.

But enforcement efforts haven’t fully pushed these networks completely underground as Telegram still functions as the main gateway for many such operations. And when bans do occur, operators often adapt quickly: new aliases, new channels, same methods.

The rise of guarantee marketplaces

To understand the current landscape, it helps to know what guarantee marketplaces are, and why they matter.

Unlike traditional darknet markets, platforms like Huione Guarantee and Xinbi Guarantee don’t operate on Tor or in obscure corners of the internet. They function openly on Telegram and don’t directly sell illicit goods. Instead, they facilitate transactions between buyers and vendors, mostly across Southeast Asia and China.

The concept is straightforward: create a trusted environment for high-risk or illegal deals. Huione Guarantee served as a kind of escrow service. Vendors offered services ranging from SIM cards and fake IDs to surveillance equipment and fake investment platforms. Buyers browsed listings and paid in stablecoins like Tether (USDT).

To maintain “trust,” vendors were required to post a security deposit that could be forfeited in the event of fraud. Automated bots managed logistics, and all payments flowed through crypto, preserving user anonymity.

As another blockchain firm Elliptic put it, the marketplace administrator “controls access and operates anti-fraud mechanisms such as merchant deposits (‘guarantees’) and escrow services.” The result, in effect, was a vast digital bazaar for cybercrime, running on stablecoins and encrypted chat apps.

Huge money, bigger risks

These weren’t marginal operations. TRM Labs said Huione facilitated at least $81 billion in crypto transactions since 2021.

That’s more than the infamous Hydra darknet market before it was shut down in 2022. Xinbi, by comparison, was tied to over $8.4 billion in USDT transactions since 2022. Combined, their volumes appear to surpass every other known illicit marketplace to date, including Silk Road and Alphabay.

Telegram did take action. On May 13, the company removed several related channels and banned associated usernames, limiting vendors’ ability to direct users to replacement groups. Still, Huione’s team had contingencies in place.

“The marketplace was ready — using backups to recreate the marketplace in new channels,” Elliptic noted. One major Huione group dropped from over 800,000 members to around 250,000, but continued operating.

Xinbi’s operators seemed even more brazen, announcing a relaunch under the name “Xinbi 2.0.” Some users reportedly expressed concern about a possible “exit scam.”

Beyond fraud

While financial fraud and identity theft dominated activity on these platforms, some listings were more disturbing. TRM Labs and Elliptic identified vendors offering electric shock devices, metal restraints, and even women marketed as surrogates. Captions — apparently machine-translated — suggest some of these items were intended for use in scam compounds.

The marketplaces were built to serve professionalized scam networks. Users didn’t need to run an entire operation just purchase what they needed. SIM cards, malicious scripts, money laundering contacts, everything was on offer.

With Telegram offering access to over a billion users and crypto enabling anonymity, the environment proved ideal, at least until it drew too much attention.

Persistence over platform

The apparent resurgence of these markets underscores how adaptable such networks can be. After Telegram’s enforcement action, some Huione-affiliated vendors migrated to Tudou Guarantee, a platform reportedly backed by Huione last year. According to TRM Labs, Tudou’s user count jumped by nearly 30% in the aftermath.

More moves could follow. TRM Labs noted that Huione Group and Xinbi-related operators are exploring alternatives to Telegram, such as ChatMe and SafeW, proprietary messaging platforms modeled on Telegram but free from third-party moderation. In effect, the ecosystem remains intact even if the surface names change.