Multi-Billion Dollar Guarantee Marketplaces Exploit Stablecoins for Scams

Online scams have reached epidemic proportions, with an estimated $442 billion in losses globally in 2025. These range from so-called ‘pig butchering’ scams to impersonation fraud and sextortion. Their growth surged during the COVID-19 pandemic, when criminal syndicates in Southeast Asia repurposed empty resorts and hotels into compounds for large-scale cyberfraud. What began as scattered, small-scale schemes have evolved into a huge industry with specialised service providers, standardised business models and sophisticated supply chains.

Beyond the losses suffered by scam victims lies a humanitarian crisis: an estimated 300,000 trafficked workers are held in these compounds, forced to commit online fraud under threat of torture, sexual violence and death.

One-Stop Shops for Scammers

A scam operator has three broad requirements: individuals to target, the means to communicate with and defraud those victims and the ability to transfer and launder the money extracted from them. Target victims are identified from personal data obtained through data breaches, scraping of social media or data brokers. SIM cards, social media accounts, fake investment websites and other technology infrastructure are then used to communicate with the victim and trick them into making a payment. Finally, mule bank accounts, cryptocurrency transactions, online gambling and other money laundering tactics are used to transfer value from the victim to the scammer.

Guarantee marketplaces have emerged as one-stop shops for all these tools and services. Operating through networks of Chinese-language chat groups on the Telegram messenger app, they allow thousands of individual merchants to sell data, technology and money laundering services to millions of customers. Some even sell physical devices such as tasers and electrified shackles known to commonly be used to detain and control trafficked workers.

The marketplace acts as a trusted intermediary for these purchases, holding ‘guarantee’ deposits posted by each merchant, which can be used to compensate customers if their purchases are not fulfilled. All payments are made in Tether’s USDT stablecoin, primarily on the TRON blockchain. This allows value to be transferred peer-to-peer, circumventing many of the anti-money laundering checks imposed by banks.

Huione Guarantee: The Largest Online Illicit Marketplace of All Time

The largest such guarantee marketplace was Huione Guarantee (later renamed “Haowang Guarantee”), which began operations in 2021. It facilitated transactions totalling at least $31 billion, making it by far the largest illicit online marketplace of all time, dwarfing the likes of the Silk Road ($216 million) and Alphabay (~$1 billion). Huione Guarantee was part of Huione Group, a Cambodian conglomerate with interests in a range of industries and close links to Cambodia’s ruling family. Payments business Huione Pay was key to Huione Guarantee’s operations and itself processed at least $103 billion in USDT transactions.

In May 2025 the US Treasury's Financial Crimes Enforcement Network (FinCEN) began the process of designating Huione Group as a ‘primary money laundering concern.’ Shortly afterwards, Telegram banned thousands of Huione Guarantee’s channels, stating that ‘criminal activities like scamming or money laundering are forbidden by Telegram's terms of service and are always removed whenever discovered’. Huione reacted by announcing the marketplace’s closure. However, the reality was closer to a rebranding, with merchants encouraged to migrate to another market, Tudou Guarantee, in which Huione owned a significant stake.

Tudou facilitated a further $14.6 billion in transactions before closing in early 2026 following pressure from Chinese law enforcement. This came in the wake of the downfall of the Prince Group, alleged to be the front for a multibillion-dollar transnational empire of scam centres, human trafficking and money laundering. In April 2026, the investigation expanded with the extradition of Huione Group chairman Li Xiong to China. Chinese authorities have described Li as a pivotal figure in Chen Zhi’s criminal enterprise and identified Huione as a subsidiary of the Prince Group.

Xinbi Takes the Crown

The demise of Huione and Tudou has allowed a competing guarantee marketplace to take the lead. Xinbi Guarantee has processed transactions totalling $21 billion to date and now handles $35 million daily. Its Telegram channels were banned by Telegram in May 2025, alongside those of Huione. Rather than rebranding, Xinbi simply created new channels and has since operated freely through the messaging app, growing its customer base to more than half a million users. In response to questions about why it has failed to pursue Xinbi and close its new channels, Telegram stated that it had decided to no longer prohibit guarantee markets, arguing that they offered an outlet for Chinese users looking for financial freedom from ‘capital controls’ that ‘often leave citizens with little choice but to seek alternative avenues for moving funds internationally.’

In reality, Xinbi, like Huione and Tudou before it, is almost entirely dedicated to enabling online scams. In March this was acknowledged by the UK government, which sanctioned Xinbi for its role in enabling and profiting from the operation of scam centres in Southeast Asia and associated human rights abuses.

It remains to be seen whether Xinbi will suffer the same fate as Huione but regardless, dozens of identical guarantee marketplaces are waiting to take its place. The commonality between these platforms is their reliance on services provided by two technology companies: Tether and Telegram. Telegram hosts the marketplaces while Tether provides the payment mechanism on which they depend.

From Reactive Disruption to Systemic Prevention

The downfall of Huione and Tudou demonstrates that targeted international action, including sanctions and law enforcement operations, can successfully dismantle individual nodes in this illicit ecosystem. However, the rapid ascent of Xinbi Guarantee underscores the futility of a ‘whack-a-mole’ approach. As long as the underlying digital infrastructure remains permissive, criminal syndicates will simply migrate to new channels. To move from reactive disruption to systemic prevention, the international community must shift its focus toward the structural enablers of these marketplaces.

Global regulators must demand greater accountability from messaging platforms and stablecoin issuers. We need a coordinated mandate that requires Telegram and similar platforms to shut down these marketplaces and obligates stablecoin providers such as Tether to identify and freeze cryptoasset wallets engaged in this activity.

Beyond online scams, these marketplaces also provide a window onto the vast and growing Chinese money laundering networks that make extensive use of stablecoins. Blockchain analytics provides glimpses of these networks’ involvement in laundering the proceeds of DPRK’s crypto heists, Russian sanctions evasion and other transnational financial crime. The infrastructure developed to launder online scam proceeds is becoming a foundational pillar of the modern global illicit economy. Governments must treat these marketplaces not as isolated fraud hubs, but as critical infrastructure for global financial crime.

© RUSI, 2026.

The views expressed in this Commentary are the author's, and do not represent those of RUSI or any other institution.

For terms of use, see Website Terms and Conditions of Use.

Have an idea for a Commentary you'd like to write for us? Send a short pitch to commentaries@rusi.org and we'll get back to you if it fits into our research interests. View full guidelines for contributors.