Crypto dark markets have rebounded weeks after Telegram shut down the world's largest illicit marketplace, with successor platforms processing equal volumes, amounting to roughly $27 billion.
Elliptic reported Monday that Tudou Guarantee marketplace has captured most of the transaction volume from Huione Guarantee, which Telegram banned on May 13 following the blockchain analytics firm's investigation.
The report shows how Huione Guarantee's activity collapsed to zero immediately after May 11, while Tudou Guarantee's transaction volume surged, surpassing 200,000 by May 18 and exceeding 300,000 by June 15.
This rapid migration undermines efforts to disrupt Asia's cyber scam infrastructure, where “guarantee marketplaces” enable hundreds of thousands of criminals to trade illicit services through Telegram using stablecoin Tether’s USDT.
Elliptic's on-chain data confirmed USDT transactions dropped to negligible levels by late May following Huione Guarantee’s ban, with the marketplace ceasing even its private escrow services.
The messaging platform terminated thousands of accounts and channels linked to what Elliptic called "the largest dark market to have ever existed," dwarfing Silk Road and AlphaBay in scale.
However, the criminal network's survival was built into as the marketplace acquired a 30% stake in Tudou Guarantee in December 2024, effectively ensuring the continuity of operations.
"Many of the merchants operating on Tudou are the same ones that previously sold through Huione Guarantee, offering stolen data, money laundering services, and other products needed by scammers," Elliptic found.
Complex connections
The report reveals a complex ecosystem where Elliptic is currently tracking over thirty highly active markets, many seeking to fill the gap left by Huione's closure.
Elliptic had previously identified Tudou as a potential successor in earlier research, and the Monday report confirmed these predictions.
Other platforms, such as Shuangying and Fully Light, also recorded steady growth, with Shuangying increasing from around 40,000 to 110,000 transactions and Fully Light rising from 20,000 to over 80,000 by mid-June.
These platforms facilitate trade in technology, data, and money laundering services used by online scammers, with vendors explicitly advertising services for "pig butchering" fraud targeting Western victims.
“It will require wider, ongoing removal of these marketplaces from Telegram if these key enablers of the global scam epidemic are to be stopped,” Elliptic said.
Decrypt has approached Telegram for comment.
Edited by Sebastian Sinclair
