Telegram shuts the ‘largest darknet marketplace to have ever existed’

The closure of Haowang Guarantee, a major Chinese darknet marketplace operating on Telegram, marks a significant blow to global cybercrime. Facilitating an estimated $27 billion in illicit transactions primarily using Tether (USDT), Haowang Guarantee offered a range of criminal services. These included money laundering, the sale of stolen personal data for pig butchering scams, telecommunications infrastructure, deepfake software, fake IDs, and even physical restraint devices used in scam call centers across Southeast Asia.

Telegram’s decisive action, involving the banning of thousands of associated accounts, effectively shut down the marketplace on May 13, 2025. This move followed a designation by the US Treasury’s Financial Crimes Enforcement Network (FinCEN) as a money laundering operation, severing its ties to the US banking system. Elliptic, a blockchain security firm, hailed the closure as a “huge win,” emphasizing its impact on the global scam epidemic and the ability of online scammers to operate.

While the demise of Haowang Guarantee represents a major victory, the landscape remains dynamic. Elliptic has identified a successor, Xinbi Guarantee, also operating on Telegram. Although its transaction volume of $8.4 billion (a likely underestimate) is considerably less than Haowang Guarantee’s, it highlights the persistent threat posed by these illicit marketplaces. Xinbi Guarantee’s connection to a now-delinquent Colorado-based company incorporated in 2022 further underscores the international reach of these criminal networks.

The existence of these marketplaces reveals a sophisticated China-based underground banking system leveraging stablecoins and crypto payments for large-scale money laundering. The ongoing challenge necessitates continued vigilance and collaboration between law enforcement agencies, technology platforms, and cybersecurity firms to combat these evolving threats. The shutdown of Haowang Guarantee, while significant, underscores the need for proactive measures to disrupt and dismantle the infrastructure supporting these criminal activities.