Huione’s takedown spurs 300% rise in successor platforms’ transactions

Telegram’s recent crackdown on the Huione Guarantee marketplace, one of the world’s largest dark markets, has proven to be a short-lived disruption. The takedown, which occurred in May, initially seemed like a significant blow to the illicit trade in stolen data, money laundering services, and scam facilitation. However, the impact was fleeting as successor platforms quickly filled the void, processing tens of billions in illicit transactions. Platforms such as Tudou Guarantee, Shuangying, and Fully Light have emerged as primary successors, with Tudou Guarantee alone recording over 300,000 transactions by mid-June, up from just over 200,000 a month prior. The transition from Huione to Tudou was almost immediate, with Huione’s transaction volume collapsing to near zero by May 11, just days before Telegram’s ban took effect. This rapid reconstitution highlights the resilience and adaptive nature of the sprawling crypto scam ecosystem.

The operators of Huione had already taken a 30% ownership stake in Tudou Guarantee as early as December 2024, effectively building in an escape hatch to keep operations alive if the main platform was compromised. This strategic investment reveals the degree of foresight in the organization and explains why the transition was so frictionless. Beyond Tudou, other platforms such as Shuangying and Fully Light have seen transaction volumes more than triple in just a few weeks. These platforms operate similarly to Huione, offering “guarantee” services that enable anonymous escrow-based transactions via USDT on the Tron blockchain. They are popular among scam operators for facilitating so-called “pig butchering” schemes, a long-con romance and investment scam strategy that has claimed thousands of victims globally.

Vendors on these platforms openly market their offerings for such scams, with services including identity document forgery, SIM card provisioning, crypto account rentals, and digital infrastructure that allow cybercriminals to appear legitimate while targeting victims abroad. The environment is described as “an industrial-scale operation” where Telegram serves as both a marketplace and a communications hub for criminal organizations. All of the marketplaces examined rely on USDT, particularly on the TRON blockchain, as the primary medium of exchange. The use of stablecoins allows criminals to transact with speed, finality, and relative price stability, while Tron’s low fees and high throughput offer practical advantages for bulk payments.

The revival of illicit markets following Huione’s takedown raises fundamental questions about the effectiveness of enforcement measures on centralized platforms like Telegram. Unless there is sustained, systematic removal of these marketplaces and the financial infrastructure that supports them, the cycle is likely to repeat. The lack of proactive stablecoin tracking and enforcement was cited as a key enabler of the scam economy’s resilience. The report concludes that unless stablecoin issuers and messaging platforms adopt stronger Know-Your-Customer and monitoring tools, scam marketplaces will continue to multiply. More than 30 successor platforms are already actively operating on Telegram, with new ones emerging weekly. Industry participants and analysts are increasingly calling for international policy coordination, noting that financial sanctions, wallet tracking, and cross-border takedowns must evolve to match the scale and speed of crypto-based criminal networks. For now, platforms like Tudou Guarantee are not only surviving but thriving despite increased scrutiny.