A massive underground economy is thriving right under our noses, fueled entirely by an escrow system borrowed from legitimate e-commerce.
Between 2021 and 2025, the largest illicit online marketplace ever recorded processed over $27 billion in cryptocurrency.
Running primarily on Telegram, these Chinese-language “guarantee” marketplaces are serving as the ultimate middleman for global cybercriminals.
Today, they are the go-to destination for buying and selling stolen enterprise credentials, money laundering services, and corporate impersonation tools.
By acting as a trusted third party for untrusted actors, this ecosystem has supercharged the operations of Southeast Asian scam compounds and brought sophisticated cyber threats directly to the doorstep of Western organizations.
Stolen Credentials Sold Online
To understand how this underground economy operates, you have to look at its roots. The guarantee model is a direct descendant of the escrow systems pioneered by legitimate Chinese platforms like Alipay two decades ago.
In the early days of the consumer internet, buyers and sellers lacked mutual trust, so platforms held funds in escrow until the goods were safely delivered.
Cybercriminals have seamlessly adapted this exact architecture for the dark web and Telegram. In this illicit version, a marketplace operator stands between the buyer and seller.
The operator holds the buyer’s cryptocurrency usually USDT (Tether) due to its dollar stability and low transaction fees and only releases it upon successful delivery of the stolen data or fraud kit.
If a dispute arises, the operator steps in to adjudicate. To ensure compliance, vendors must post a hefty security deposit that they forfeit if they attempt to scam a buyer. These operations are also highly automated.
Telegram bots handle the heavy lifting of product listings, order tracking, and dispute management, allowing the platforms to scale without large human support teams.
Huione Guarantee pioneered this industrial-scale escrow on Telegram, capturing tens of billions in transaction volume.
However, a coordinated crackdown in May 2025, which included US Treasury sanctions and a massive Telegram ban, shattered Huione’s monopoly.
Rather than disappearing, the market fragmented. Today, more than 30 successor platforms, such as Tudou and Ouyi, have rapidly filled the void.
Vendors now operate across multiple channels simultaneously, and some operators are even developing proprietary messaging apps like ChatMe to escape law enforcement’s reach entirely.
This resilient network forms the logistical backbone for scam operations that extracted $5.8 billion in reported losses from US victims in 2024 alone.
According to Flare research, it is easy to dismiss Southeast Asian scam compounds as a distant consumer problem. However, these guarantee marketplaces pose a direct and escalating threat to corporate networks.
The same infrastructure used to launder billions of dollars in cryptocurrency is also used to broker the tools needed to breach enterprise environments.
Stolen employee credentials, fake identity documents, deepfake creation services, and NFC-relay fraud kits are traded daily across hundreds of thousands of Telegram messages.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
