Author: Andy Greenberg

Compiled by: Deep Tide TechFlow

Once, online black markets hid in the shadows of the dark web. Now, they have moved to public platforms like Telegram, where they have amassed a historic amount of illicit wealth.

More than a decade ago, when the black market for drugs, guns, and various contraband first emerged on the dark web, the technical sophistication of cryptocurrency and the anonymity software Tor seemed to be the key to enabling billions of dollars in illicit transactions.

However, by 2025, all of this seems somewhat outdated. Today, to complete a black market crypto transaction worth tens of billions of dollars, all you need is a messaging app willing to provide a platform for scammers and human traffickers, the perseverance to recreate channels and accounts when banned, and fluent Chinese.

According to a recent analysis by crypto tracking firm Elliptic, the Chinese crypto scam market ecosystem based on the Telegram messaging service has grown to an unprecedented size. While it experienced a brief decline after Telegram banned two of the largest such marketplaces in early 2025, the two current main marketplaces—"Potato Escrow" and "New Coin Escrow"—collectively generate nearly $2 billion in monthly transactions through money laundering, the sale of scam tools (such as stolen data, fake investment websites, and AI face-swapping tools), and other black market services (such as surrogacy and teenage prostitution).

Cryptocurrency romance scams and investment frauds are notorious for their brutal "pig butchering" modus operandi. These scams operate primarily from clandestine bases in Southeast Asia, often staffed with thousands of human trafficking victims. According to the FBI, these scams defraud approximately $10 billion annually in the United States alone, making them one of the most lucrative forms of cybercrime globally.

Markets like "Potato Escrow" and "Xinbi Escrow" have expanded rapidly and become massive by providing money laundering services and other related tools to these fraudulent organizations. "If you consider the illicit uses of crypto assets, there's nothing bigger than this right now," said Tom Robinson, co-founder and chief scientist of Elliptic.

In fact, these criminal marketplaces are not only the largest online black markets today, but also among the largest in history. AlphaBay, once the dominant darknet marketplace, was notorious for selling drugs, stolen data, and hacking tools. According to the FBI, AlphaBay processed over $1 billion in transactions during its two and a half years of operation, ten times the peak of the original Silk Road darknet marketplace. Meanwhile, the Russian darknet marketplace Hydra facilitated over $5 billion in transactions during its seven years of operation, providing money laundering services for cryptocurrency thieves and ransomware groups.

In contrast, according to Elliptic data, the Chinese Telegram marketplace Huione Guarantee processed a staggering $27 billion in transactions between 2021 and 2025, far exceeding any previous online black market. Even though it operates entirely openly on the Telegram platform, it is still referred to as "the largest illicit online marketplace in history."

Despite Telegram's ban on "Huiwang Guarantee" (then renamed "Haowang Guarantee") in May due to the U.S. Treasury Department's Financial Crimes Enforcement Network (FinCEN) designating it as a money laundering platform, the market did not disappear. "Tudou Guarantee," in which Haowang Guarantee holds a stake, quickly filled the gap. According to Elliptic data, Tudou Guarantee's monthly transaction volume has reached $1.1 billion, nearly matching Haowang Guarantee's $1.4 billion monthly transaction volume. Meanwhile, the second-ranked cryptocurrency scam market, "Xinbi Guarantee," although also banned and relisted in May, has seen its monthly transaction volume increase to $850 million. The combined transaction volume of these two markets even exceeds the total market size previously held. Elliptic currently monitors approximately 30 similar markets, with annual transaction volumes reaching tens of billions of dollars.

In June, Telegram's response sparked controversy when Wired magazine contacted it about how these marketplaces were rebuilding their criminal empires in the public eye. Telegram stated that it had decided not to block these marketplaces, arguing that they provided Chinese users with a way to circumvent "capital controls," which often leave citizens with no choice but to seek alternative means of international financial flows. "We assess each report on a case-by-case basis and firmly reject blanket bans—especially when users are trying to circumvent oppressive restrictions imposed by authoritarian regimes," Telegram said in a June statement to Wired. "We remain firmly committed to protecting user privacy and defending fundamental freedoms, including financial autonomy."

This stance has sparked widespread controversy and prompted reflection on whether it is permissible to turn a blind eye to cybercrime under the banner of protecting privacy and freedom.

Elliptic and other fraud industry analysts have strongly refuted Telegram's claims of upholding free markets, pointing out that the vast majority of marketplaces like "Potato Guarantee" and "Trust Guarantee" are illegal. Beyond fraud-related services, these marketplaces also involve prostitution—Trust Guarantee posts even contain suggestive advertisements involving underage sex, such as services with "Lolita" or "young girls." Furthermore, clients of these scams have been extensively documented as using forced labor in modern-day slavery environments.

“They have the ability to shut down this fraudulent economy and human trafficking, but instead they’ve become a ‘classifieds platform’ for cryptocurrency scammers,” said Erin West, former Santa Clara County District Attorney and current leader of the anti-fraud organization Operation Shamrock. “These bad guys are using their bad platform to facilitate other bad guys.”

Besides Telegram, another cryptocurrency company, Tether, also plays a key role in these scam markets. This popular "stablecoin" is the preferred tool for money laundering transactions in these markets. Unlike most cryptocurrencies, Tether has a centralized structure, meaning the company behind it (Tether) can seize or freeze funds at any time. However, the company has minimal intervention in the massive flows of funds it supports.

Telegram and Tether did not respond to WIRED's request for comment regarding their role in the black market transactions of "Potato Guarantee" and "Tether Guarantee".

Jacob Sims, a visiting scholar at Harvard University's Asia Center specializing in transnational crime, believes that Tether and Telegram's efforts to combat the expansion of the fraud industry mirror the "symbolic" raids conducted by Southeast Asian law enforcement on fraud bases. These operations are often merely symbolic, allowing the fraud rings to rebuild and resume operations. "Ineffective enforcement at all levels prevents a truly effective crackdown," Sims stated.

Sims also pointed out that only through concerted cooperation among international governments and law enforcement agencies can this situation be substantially changed. He compared this effort to coordinated global efforts to combat terrorism or drug trafficking, arguing that similar international pressure should be applied to companies that facilitate rampant fraud.

“The current response to this growing fraud industry is not yet at a coordinated and urgent level,” Sims said. “The problem can only be solved when we elevate it to a level commensurate with the enormous damage it causes.”

The Bunni attacker's address deposited 2295.8 ETH into Tornado Cash.

Popular Articles