Short answer: Elliptic’s January 14, 2025 estimate found that wallets associated with Huione Guarantee, its vendors, and related marketplace activity had received at least $24 billion in cryptocurrency. That was an on-chain estimate of identified inflows—not $24 billion in proven criminal profit, cash revenue, or one transaction. The total exceeded the roughly $5 billion to $5.6 billion attributed to Hydra, a major Russian-language darknet market, over about six years.
Huione Guarantee was a predominantly Chinese-language, Telegram-based “guarantee marketplace” linked to Cambodia’s broader Huione Group. Telegram shut down Huione Guarantee and Xinbi Guarantee infrastructure on May 13, 2025, but Elliptic reported that merchants migrated to successor markets rather than disappearing.
What Huione Guarantee was
Huione Guarantee operated as a marketplace inside Telegram and related services. Instead of a conventional website reached through Tor, it used channels, bots, merchant listings, reputation systems, and payment or escrow arrangements to connect buyers and sellers. Cryptocurrency—especially Tether’s USDT—was used for settlement.
The marketplace was associated with the wider Cambodian Huione Group, but those names are not interchangeable. Huione Guarantee (later also called Haowang Guarantee) was the marketplace; Huione Pay was a separate payments business; Huione Group was the broader corporate group. Xinbi and Tudou were other Telegram-based markets.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Elliptic described the marketplace as the largest known illicit online marketplace at the time of its January 2025 report. Its July 2024 exposure was followed by a reported 51% increase in monthly inflows, according to Elliptic.
What the $24 billion figure actually measured
- Measured: Cryptocurrency received by wallets Elliptic associated with Huione Guarantee, its vendors, and related marketplace activity.
- Period: Activity accumulated from the marketplace’s launch in 2021 through Elliptic’s January 14, 2025 report.
- Valuation: Transaction values were calculated using prevailing cryptocurrency exchange rates when each transfer occurred.
- “At least”: The estimate was a floor based on identified wallets and transactions, not a claim that every address or payment had been found.
The number therefore should not be presented as verified turnover, net proceeds, stolen money alone, or confirmed laundering volume. A vendor-associated wallet can receive legitimate-looking payments, pass funds through escrow or payment services, or handle transactions whose criminal character is not established by the blockchain record alone.
Elliptic also identified nearly $6 billion flowing through a Telegram bot used primarily for online gambling. Its initial analysis indicated that much of that activity might constitute money laundering, but that is an analytical assessment—not proof that every gambling transaction was criminal.
What vendors offered
Elliptic identified listings or advertisements for services and goods including:
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
- Money-laundering services
- Stolen personal data, SIM cards, and identity-related materials
- Scam websites and other fraud technology
- Services marketed for laundering proceeds from romance-investment scams
- Equipment allegedly connected to coercion and trafficking in scam compounds
These findings describe what Elliptic observed and attributed to vendors. They do not establish that every listing led to a completed sale or that every vendor was independently verified.
How guarantee marketplaces supported “pig-butchering” scams
In a typical pig-butchering scheme, a criminal builds trust through romance, friendship, social media, or another personal pretext. The victim is then directed to a fraudulent investment platform and persuaded to transfer money. Behind that front end, the operators need websites, fake identities, personal data, payment channels, and ways to move and conceal proceeds.
A guarantee marketplace can act as a service-provider layer for that operation:
- A fraud group searches Telegram channels or vendor listings for infrastructure and services.
- Payment or escrow mechanisms help connect the buyer and seller while reducing reliance on conventional banking.
- The group deploys the purchased tools against victims, often across borders.
- Cryptocurrency is routed through wallets, processors, gambling services, or other intermediaries.
The marketplace did not itself prove that every participant ran a pig-butchering scheme. Its importance was that it concentrated suppliers for online fraud networks, including networks operating from physical scam compounds in Southeast Asia.
Recommended Free Tools
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Huione Guarantee compared with Hydra
| Marketplace | Platform model | Reported crypto scale | Status |
|---|---|---|---|
| Huione Guarantee / Haowang Guarantee | Telegram-based guarantee marketplace | At least $24 billion in Elliptic’s January 2025 report; later Elliptic estimates exceeded $27 billion and $31 billion at different reporting points | Telegram infrastructure shut down May 13, 2025 |
| Hydra | Tor-based Russian-language darknet market | Approximately $5 billion in the January comparison; a later Elliptic comparison used $5.6 billion over roughly six years | Shut down in April 2022 |
The comparison is directionally useful: Huione’s identified crypto inflows were several times larger than Hydra’s. It is not a perfect like-for-like accounting exercise. The platforms served different criminal markets, used different infrastructure, and the estimates were produced at different dates and with different analytical methodologies. See the original comparisons from Elliptic’s January report and its May 2025 update.
Why Telegram mattered
Telegram supplied network effects that a single hidden website does not easily provide: large searchable channels, bots, rapid account replacement, and direct movement of users between communities. Operators could create backup channels after deletions instead of rebuilding an entire marketplace.
Elliptic reported that a central channel fell from more than 800,000 users to roughly 250,000 as Telegram removed infrastructure, while backup channels and redirected usernames helped preserve access. Cryptocurrency also reduced dependence on banks and card networks.
The move toward proprietary crypto and messaging tools
Elliptic reported that Huione Group launched or promoted several products:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
- USDH: a purported U.S.-dollar-backed stablecoin
- A blockchain
- Huione Crypto: a cryptocurrency exchange
- ChatMe: a messaging application for Android and iOS
Elliptic interpreted this product expansion as an effort to reduce exposure to centralized platforms and issuers that can freeze accounts or remove services. That is Elliptic’s interpretation of the business strategy, not an independently established statement of operator intent. USDH should not be treated as equivalent to a regulated U.S.-dollar stablecoin: Elliptic’s reporting did not establish comparable reserves, governance, or transparency.
What authorities and platforms did afterward
Key dates
- July 2024: Elliptic publicly exposed Huione Guarantee as a major marketplace serving online fraud networks.
- January 14, 2025: Elliptic reported at least $24 billion in identified cryptocurrency inflows and more than 900,000 users.
- May 1, 2025: FinCEN identified Huione Group as a primary money-laundering concern under Section 311, as summarized by Elliptic.
- May 13, 2025: Telegram shut down Huione Guarantee and Xinbi Guarantee infrastructure.
- May–June 2025: Elliptic reported migration toward Tudou Guarantee and other Telegram markets.
- June 23, 2026: Elliptic said its intelligence supported an FBI action involving Huione Group infrastructure.
Elliptic later estimated that Huione Guarantee had facilitated more than $27 billion before the shutdown and, in a June 2026 account, said the marketplace had received more than $31 billion by the time it was forced offline. Those later figures are updated cumulative estimates, not revisions that turn the original $24 billion into proven criminal profit.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the U.S. Treasury alleged about Huione Group
Keep the government figures separate from the marketplace total. In October 2025, the U.S. Treasury said Huione Group had laundered at least $4 billion in illicit proceeds between August 2021 and January 2025. Treasury linked the broader group to proceeds from DPRK cyber heists, Southeast Asian transnational criminal organizations, cryptocurrency investment scams, and other cyber scams. Its release identified at least $37 million from DPRK cyber heists, $36 million from virtual-currency investment scams, and $300 million from other cyber scams.
FinCEN’s Section 311 action cut Huione Group off from the U.S. financial system by prohibiting covered financial institutions from opening or maintaining correspondent accounts involving the group. The Treasury estimate is a government assessment of illicit proceeds laundered by the broader corporate group; it is not a replacement for Elliptic’s marketplace-inflow estimate. Read the Treasury release.
Best Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Did the shutdown end the threat?
No. Elliptic reported that merchants moved toward Tudou Guarantee and other Telegram-based markets after Huione Guarantee went offline. Rebranding can represent continuity, migration, or an attempt to distance an operation from its former name; it does not by itself prove that a successor is a legally distinct organization.
Related payment businesses also continued to transact separately from the marketplace. Elliptic’s June 2026 account said Huione Pay had received at least $103 billion in cryptoasset payments over its lifetime. That broader figure must not be added to the $24 billion marketplace total without explaining that it covers a different entity and activity set.
How to read large crypto-crime numbers
- Inflows are not losses: A blockchain total can include payments, refunds, escrow movements, internal transfers, and activity whose criminal status is unresolved.
- Identified is not exhaustive: “At least” signals that associated wallets or transactions may remain undiscovered.
- Entity boundaries matter: Huione Guarantee, Haowang Guarantee, Huione Pay, Huione Group, Xinbi, and Tudou should not be merged into one ledger.
- Price dates matter: Crypto totals valued at the exchange rate on each transaction date are sensitive to asset prices and cannot be read as a fixed pile of dollars held at one time.
- Attribution is not a conviction: Elliptic’s analysis and Treasury’s findings are investigative conclusions; they do not convert every listed vendor or transaction into an adjudicated offense.
If you may have been defrauded
Preserve transaction IDs, wallet addresses, screenshots, platform messages, emails, and bank or exchange records. Report the incident promptly to your bank or exchange and the relevant law-enforcement or financial-intelligence authority in your jurisdiction. Be cautious of private “crypto recovery” services that demand upfront fees or guarantee retrieval; a marketplace’s shutdown does not make recovery offers trustworthy.
The Bottom Line
The $24 billion headline described a minimum estimate of cryptocurrency received by wallets linked to Huione Guarantee and its vendors through January 2025. It showed the scale of a Telegram-centered service ecosystem for online fraud, not proven profit or $24 billion in stolen cash. Telegram later removed the main infrastructure, but successor markets and related payment businesses demonstrated why takedowns can displace illicit activity rather than eliminate it.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
