Huione and Xinbi Market Channels, banned by Telegram in May, are resurfaced under new names, TRM Labs said in a recent update.
Despite Telegram banning the infamous Huione and Xinbi guaranteed crypto markets on May 13, it appears to have re-occurred following the familiar cybercrime pattern of shutter platforms resurfaced with new names, new channels or slightly altered forms, according to blockchain intelligence firm TRM Lab.
In a blog post on May 29th, TRM Labs revealed that despite Telegram banning public vendor channels for Huione Guaranteed, Huione Group is “operating channels of ‘VIP’ vendors on the platform.” More than that, the Cambodia-based company is also rebooting Crypto Exchange, which continues to process payments using its own USDH Stablecoin.
Reappearing of Crypto Exchanges in Telegram from Huione Group | Source: TRM Lab
TRM Labs also said it had shown that it resumed its activities on Telegram “within a few days” as the Xinbi guarantee was banned on the same day. Some vendors linked to Huione Warranty and its wallet service, Huione Pay, operate on Xinbi Warranty, increasing the possibility of shared infrastructure and the possibility of tight coordination between two people.
These findings arise despite recent enforcement actions. Just two weeks before the ban, the US Financial Crime Enforcement Network designated the Fuione Group as “a major money laundering concern.” And on May 29, the Ministry of Finance’s Foreign Assets Bureau was controlling Funnull Technology, a Philippines-based cyber fraud operator reportedly reportedly linked to Huione’s services.
However, enforcement efforts have not pushed these networks completely underground, as Telegram still functions as the main gateway for many such operations. Also, when a ban occurs, operators often adapt quickly. New alias, new channels, the same way.
The rise of the guarantee market
It helps you understand what the market is and why it matters to understand the current landscape.
Unlike the traditional darknet market, platforms like the Fiione Warranty and Xinbi Warranty do not work on the ambiguous corners of the TOR or the Internet. They work openly in telegrams and do not sell illegal products directly. Instead, it promotes transactions between buyers and vendors, primarily in Southeast Asia and China.
Merchant Directory on Huione Guarantee | Source: Elliptic
The concept is simple. Create a reliable environment for high-risk or illegal transactions. The Huione Warranty acted as a kind of escrow service. Vendors provided services ranging from SIM cards and fake IDs to surveillance equipment and fake investment platforms. Buyers browsed the listing and were paid in stablecoins like tether (USDT).
You might like it too: Telegram shared data with US officials from 2,253 users in 2024
To maintain “trust,” vendors had to post bonds that could be confiscated in the case of fraud. Automated bots managed logistics, and all payments flowed through encryption to maintain user anonymity.
As stated by another blockchain company Elliptic, market managers “control access and manipulate anti-phrase mechanisms such as merchant deposits (“guarantees”) and escrow services. The result was actually a vast digital bazaar for cybercrime running on Stablecoins and encrypted chat apps.
Huge money, greater risk
These were not marginal manipulations. TRM Labs said Huione has driven at least $81 billion in crypto transactions since 2021.
This is more than the infamous Hydra Darknet market before its closure in 2022. By comparison, Xinbi has been linked to more than $8.4 billion in USDT trading since 2022.
Dark Net Marketplace by Influx | Source: Elliptic
Telegram took action. On May 13, the company deleted several related channels, banned related usernames, and limited the ability of vendors to direct users to exchange groups. Still, there was a contingency for the Huione team.
“The market was ready. We’ll use backups to replicate the market in new channels,” Elliptic said. One major Huione group, down from over 800,000 members, to about 250,000, but continued to run.
The Xinbi operators look even brave and announced the renewal under the name “Xinbi 2.0”. Some users reportedly expressed concern about the possibility of an “exit scam.”
Beyond fraud
Financial fraud and identity theft dominated activity on these platforms, but some lists got more intrusive. TRM Labs and Oval Benders offer women for sale as electric shock devices, metal restraints and even surrogates. Captions – obviously machine-translated – suggest that some of these items are intended for use in fraudulent compounds.
The market was built to provide a specialized fraud network. Users didn’t have to just buy what they needed and perform the entire operation. SIM cards, malicious scripts, money laundering contacts, everything was provided.
The anonymity that Telegram accesses over 1 billion users and allows encryption has proven the environment ideal, at least until it attracts too much attention.
Platform Persistence
The obvious revival of these markets underscores how adaptable such networks are. After Telegram’s enforcement action, vendors associated with Huione, a platform backed by Huione last year, have moved to Tudou guarantees. According to TRM Labs, Tudou’s user count rose nearly 30% in the aftermath.
There could be more movements. TRM Labs noted that Huione Group and Xinbi-related operators are investigating Telegram alternatives such as Chatme and Safew, Safew, Safew, Safew and Safews, which are modeled after Telegram but not with third-party moderation. In reality, even if the surface name changes, the ecosystem remains the same.
read more: Southeast Asian Criminal Syndicate launches stubcoin, custom infrastructure for global fraud, UN WARNS
Discover more from Earlybirds Invest
Subscribe to get the latest posts sent to your email.
