Cryptocurrency / Artificial Intelligence

A Telegram-hosted “guarantee” marketplace that has been a central hub for a wide spectrum of illicit offerings is now showing signs of shutting down, based on new intelligence from Elliptic.

The blockchain analytics firm reports that Tudou Guarantee has effectively halted transaction activity across its public Telegram groups after a phase of rapid expansion. Cumulative volume is estimated at more than $12 billion, placing it as the third-largest known illicit marketplace by transaction value.

“Other parts of Tudou Guarantee, such as its gambling operations, continue to function, so it remains to be seen whether this represents the first stages of a full shutdown or a pivot away from fraud-related activity,” the company said.

Tudou Guarantee is one of several Telegram-based markets supporting cybercriminal fraud operations. Other notable examples include HuiOne Guarantee and Xinbi Guarantee, which together have handled more than $35 billion in USDT flows. Telegram removed thousands of channels tied to both ecosystems last year.

The marketplace has since evolved into a primary venue for these actors, attracting merchants previously operating on HuiOne Guarantee. Through Tudou, they offer stolen identity data, money laundering and cash-out services, turnkey scam infrastructure such as fake investment portals and phishing sites, and tooling for face swap, voice cloning, and deepfake-driven impersonation during live video calls with victims.

Analysis from Chainalysis released in November 2025 shows that vendors selling scam-enabling technology collectively took in at least $375.9 million in cryptocurrency in 2024. Within that, artificial intelligence (AI) service providers recorded a 1,900% compound annual growth rate between 2021 and 2024, underpinning more realistic identities, higher-fidelity content, and greater operational scale for fraud campaigns.

This merchant migration was driven in part by HuiOne’s acquisition of a 30% stake in Tudou Guarantee in December 2024, positioning Tudou as a strategic backup marketplace for HuiOne-linked sellers.

Elliptic’s Founder and Chief Scientist, Tom Robinson, told The Hacker News that Xinbi Guarantee has rebounded and expanded after Telegram’s earlier takedowns, and that a comparable number of similar markets continue operating. “After shutting down HuiOne Guarantee, Telegram is no longer taking any action against these scam marketplaces. There’s no need for them to move to other messaging platforms,” Robinson added.

The current drawdown in Tudou Guarantee activity also appears linked to recent coordinated law enforcement actions against Cambodian conglomerate Prince Group and its CEO, Chen Zhi, who was detained and transferred to Chinese custody earlier this month.

Underground chatter tying Tudou Guarantee to the Chen Zhi investigation (Source: Elliptic)

The billionaire executive is alleged to have coordinated a large-scale investment fraud network that coerced trafficked workers into scam compounds across Southeast Asia to target victims worldwide. The operation relied heavily on romance-driven approaches and so-called pig butchering schemes. Prince Group has publicly disputed the accusations.

Elliptic notes that on-chain, real-time tracking of Tudou’s core administrative wallets shows a sharp reduction in volume in the days following these arrests, indicating a strong temporal relationship.

“The closure of Tudou is a significant blow to the Southeast Asian scam economy, but history suggests the vacuum will not remain unfilled for long,” the company said, adding that it expects related activity to spread across other guarantee markets that can quickly absorb displaced merchants and their victim funnels.

In parallel, government and law enforcement responses are intensifying. In November 2025, the U.S. government launched the Scam Center Strike Force to disrupt Southeast Asia–based transnational criminal organizations running crypto-enabled investment fraud and pig butchering operations.

To date, the unit has seized and forfeited $401 million in cryptocurrency linked to these activities. It is also partnering with U.S. businesses to identify, seize, and dismantle domestic infrastructure that enables these scams, and to reduce the likelihood that such services will be repurposed against U.S. users.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.