The sudden shutdown of Huione Guarantee has sent shockwaves across the digital guarantee market, a shadowy network involving countless online fraudsters, money launderers, and brokers of stolen information in Southeast Asia and China.

Despite this disruption, many Telegram-based marketplaces with similar operations remain unaffected and are actively growing.

Vendors Shift to Tudou

According to blockchain intelligence firm Elliptic’s latest report, Huione Guarantee’s activity has come to a halt, but its exit has triggered a migration. Vendors are being steered toward Tudou Guarantee, which has absorbed a large share of Huione’s transactions.

Before its abrupt shutdown, Huione Guarantee was operated by the Cambodia-based Huione Group. It was originally launched in 2021 with the intention of facilitating legitimate transactions involving assets like cars and real estate. Over time, however, the platform’s listings shifted focus. Leading up to its closure, much of Huione Guarantee’s activity seems geared toward supporting cyber scam operations,

The authorities finally dismantled Huione Guarantee on May 13, 2025. This Telegram-based platform processed over $27 billion in transactions, mostly involving tools and services for large-scale online scams like pig butchering. Its downfall followed a detailed investigation by Elliptic, which led Telegram to delete thousands of related channels and ban associated user accounts.

Still, Huione Guarantee represented just one node within a sprawling network of Chinese-language guarantee marketplaces. These platforms, thriving on Telegram, allow the exchange of illicit goods such as stolen data, fraudulent tech tools, and money laundering services, which are all vital to scam operations.

Huione’s USDT Activity Nears Zero

Transactions are conducted entirely in Tether’s USDT stablecoin, which ensures the ease of movement and pseudo-anonymity. In fact, Tether froze a Huione-linked wallet in July 2024 due to suspected ties to the North Korean hacking entity, Lazarus Group. After Telegram removed Huione’s public channels and usernames, the platform formally shut down, advising vendors to migrate to Tudou Guarantee.

Initially, Huione claimed it would continue facilitating private escrow services, but by late May, it announced a full cessation of operations. Elliptic said that its blockchain data confirmed this exit, as incoming USDT flows to Huione’s wallets plummeted to “negligible levels.”

The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Funnull Technology Inc., a technology firm headquartered in the Philippines, and its administrator, Liu Lizhi.

The company has been implicated in running a “pig butchering” scam.

$200M Scam Uncovered

According to the official press release, Funnull has stolen over $200 million from American investors. OFAC has also placed two of Funnull’s cryptocurrency addresses on its Specially Designated Nationals (SDN) List to restrict their access to financial systems.

In response, the FBI’s Internet Crime Complaint Center (IC3) issued a public advisory, outlining key technical indicators, such as infrastructure components and IP addresses tied to Funnull’s scam operations.

Deputy Secretary of the Treasury Michael Faulkender, in an official statement, said

“Today’s action underscores our focus on disrupting the criminal enterprises, like Funnull, that enable these cyber scams and deprive Americans of their hard-earned savings. The United States is strongly committed to ensuring the continued growth of a legitimate, safe, and secure digital asset ecosystem, including the use of virtual currencies and similar technologies.”

Connection to Triad Nexus and Huione Pay

According to the findings by blockchain intelligence Chainalysis, Funnull Technology Inc. enabled cybercriminals by purchasing IP addresses in bulk from major cloud service providers and selling them to operators of fraudulent investment platforms. This infrastructure allowed scammers to host malicious websites that mimicked legitimate investment platforms, thereby deceiving victims into investing in non-existent opportunities.

Funnull was a central player in a network dubbed by security researchers as “Triad Nexus,” which includes more than 200,000 unique hostnames, many of which are associated with investment scams, fake trading apps, and suspect gambling networks. OFAC identified two crypto addresses linked to Funnull Technology Inc., used for receiving cybercriminal payments.

These addresses are tied to scam-related infrastructure and show connections to Huione Pay, which was recently flagged by FinCEN as a major money laundering concern.

Further investigation by blockchain security firm Elliptic revealed that the two addresses in question received more than $4 million in total.

---