Latest news with #HaowangGuarantee
WIRED
8 hours ago
- Business
- WIRED
Telegram Purged Chinese Crypto Scam Markets—Then Watched as They Rebuilt
Jun 23, 2025 12:48 PM Last month, Telegram banned black markets that sold tens of billions of dollars in crypto scam-related services. Now, as those markets rebrand and bounce back, it's done nothing to stop them. One month ago, the messaging app Telegram summarily beheaded the online industry of Chinese-language crypto scam services: It banned virtually all accounts related to the first and second most popular marketplaces for vendors offering money laundering, stolen data, and a variety of other illicit wares to the vast criminal enterprises carrying out investment scams from compounds across Southeast Asia. Then, Telegram watched impassively as those black marketeers rebranded, rebuilt, and returned to business as usual on the messaging service's platform. On Monday, crypto tracing firm Elliptic published a new report showing how the industry of Telegram-based Chinese-language black markets for crypto scammers has bounced back in the wake of Telegram's takedown last month of the two biggest of those bazaars, known as Haowang Guarantee and Xinbi Guarantee. Before Telegram banned the two markets' channels and usernames on May 13, they had together enabled a staggering $35 billion in transactions, much of which represented money laundering by crypto scam operations that steal billions from Western victims and force tens of thousands of people to carry out scams in forced labor compounds across Cambodia, Myanmar and Laos. Since Telegram's purge, however, Elliptic has found that other smaller markets have now grown to almost entirely fill the vacuum those two key marketplaces left behind—and Telegram appears to have no plans to stop them. In particular, one market called Tudou Guarantee, partially owned by Huione Group, the same parent company as the now-defunct Haowang Guarantee, has more than doubled in size, likely taking in many of the scammer-friendly services displaced by Telegram's bans and again enabling those fraudsters' billions of dollars a year in illicit revenue. Its main channel now has 289,000 users by Elliptic's count, close to the 296,000 users that Haowang Guarantee had at its peak. Xinbi Guarantee, too, has relaunched on new channels and regained hundreds of thousands of users, Elliptic says. In terms of sales, Tudou is now enabling around $15 million a day in crypto payments, close to the $16.4 million Haowang was facilitating daily, according to Elliptic. 'Telegram recognized this was illicit activity and the kind they didn't want to be hosting, and so they deleted the channels and banned the associated usernames. But it was clear that these people wouldn't just give up, that they would transfer to different marketplaces,' says Tom Robinson, Elliptic's cofounder. 'These scammers have inflicted misery on millions of victims around the world, stealing billions of dollars. Unless these marketplaces are actively pursued, they will continue to flourish.' Posts Elliptic shared with WIRED from Tudou Guarantee—now by some measures the biggest black market on the internet—show examples of money laundering services, offers of scam website development, and vendors selling stolen personal data that scammers use for targeting. Another Tudou post explicitly offers prostitution, including references to possible minors: 'Students, queens, lolita,' the post states next to pictures of young women. 'All available!!' WIRED reached out to Tudou Guarantee for comment via an administrator's Telegram account but didn't receive a response. Before they were taken down by Telegram, Xinbi Guarantee and Haowang Guarantee displayed similar posts offering explicitly illegal services in all those categories and more. Like the newly ascendant Tudou Guarantee, those other 'Guarantee' marketplaces didn't directly sell services, but instead offer escrow and deposit features that prevent vendors from defrauding customers. When WIRED asked Telegram in May about a report from Elliptic that focused on Xinbi Guarantee's criminal offerings, Telegram responded with a broad purge: It banned not only Xinbi's accounts but also those of Haowang Guarantee, the much larger market that had persisted for three years, enabled around $27 billion in transactions, and sold scam industry services as explicit as the batons and shackles used to imprison forced laborers in scam compounds. In a statement sent to WIRED at the time, Telegram spokesperson Remi Vaughn wrote that 'communities previously reported to us by WIRED or included in reports published by Elliptic have all been taken down,' and added that 'criminal activities like scamming or money laundering are forbidden by Telegram's terms of service and are always removed whenever discovered.' Since then, however, Elliptic has continued to share its findings about apparent money laundering activity on ten other markets, including Tudou Guarantee, in a Telegram group that included a WIRED reporter and a Telegram spokesperson. Yet Telegram didn't take down any of the accounts related to the black markets Elliptic highlighted. Xinbi Guarantee has, in fact, rebuilt at new accounts without even rebranding. It still hasn't faced new account bans, despite Telegram itself stating that the market's content violated its terms of service. In a statement to WIRED, a Telegram spokesperson defended the company's apparent decision not to ban the rebounding black markets. 'The channels in question predominantly involve users from China, where rigid capital controls often leave citizens with little choice but to seek alternative avenues for moving funds internationally,' the statement reads. "We assess reports on a case-by-case basis and categorically reject blanket bans—particularly when users are attempting to circumvent oppressive restrictions imposed by authoritarian regimes. We remain unwavering in our commitment to safeguarding user privacy and defending fundamental freedoms, including the right to financial autonomy.' Elliptic's Robinson rejects that argument. 'We've been researching these marketplaces for nearly two years now, and they're not about helping people achieve financial autonomy,' Robinson says. 'These are marketplaces that primarily facilitate money laundering for the proceeds of fraud and other illicit activity." Erin West, a former prosecutor who now leads the non-profit Operation Shamrock, an organization focused on disrupting crypto scam operations, states her accusation against Telegram more simply. 'These are bad guys, enabling bad guy business on their bad guy platform,' West argues. 'They have the ability to shut down a scam economy and the trafficking of human beings. Instead, they're hosting Craigslist for crypto scammers.' Telegram's seemingly inconsistent approach to banning crypto scam black markets may have less to do with its principles of 'financial autonomy' than with trying not to run afoul of the US government, says Jacob Sims, a visiting fellow at Harvard University's Asia Center. In early May, the US Treasury's Financial Crimes Enforcement Network officially labeled Huione Group a 'primary money laundering concern.' Sims argues that designation, which referred directly to Haowang Guarantee but not Tudou Guarantee, may have spurred Telegram to take action—and that it may take another similar move at the government level to push Telegram to act again. 'Ultimately, last month's crackdown shows how disruptive Telegram can be when it does cooperate, but it also shows how fast the scammers are going to adapt,' Sims says. 'There's no real legal culpability that tech companies have for what happens on their platform unless there's a specific case brought to their attention by law enforcement. And so, until that changes, I just don't know what incentive they have to be proactive.'
WIRED
14-05-2025
- Business
- WIRED
The Internet's Biggest-Ever Black Market Just Shut Down Amid a Telegram Purge
May 14, 2025 4:00 PM Following a WIRED inquiry, Telegram banned thousands of accounts used for crypto scam money laundering, including those of Haowang Guarantee, a black market that enabled over $27 billion in transactions. Photo-Illustration: Wired Staff;For years, a Chinese-language market for crypto scammers and money launderers—by some measures, the internet's biggest black market of all time—operated in plain sight on the messaging service Telegram, facilitating tens of billions of dollars in illicit finance. Now, thanks to the scrutiny of one team of crypto crime researchers and Telegram's ban hammer, it's gone. Haowang Guarantee, the crypto-fueled crime bazaar more widely known by its original name, Huione Guarantee, declared in an announcement posted to its website sometime in the last 24 hours that it would be shutting down. The move comes in response to Telegram's action on Monday to ban thousands of accounts and usernames that served as the infrastructure for the sprawling marketplace of third-party vendors, many of whom provided money laundering and other services to the burgeoning industry of East Asian crypto scammers. 'Telegrame were blocked all of our NFT, Channels and group on May 13th 2025, Haowang Grarantee will cease operation from now,' the company wrote on its website in a short, typo-ridden statement in English, apparently using the acronym NFT to refer to the blockchain-based non-fungible tokens that serve as proof of ownership for certain Telegram usernames. 'Thank you for your attention.' Prior to its abrupt shutdown, Haowang Guarantee—which despite its rebrand was still partially owned by Huione Guarantee and its Cambodia-based parent company Huione Group—had allowed third party vendors to sell a wide variety of services to crypto scammers, all via Telegram, using deposit and escrow systems to 'guarantee' the transactions. Huione Guarantee merchants primarily offered money laundering via the cryptocurrency Tether, but they also sold other components of the crypto scam industry ranging from potential victim data for targeting, telecommunications infrastructure, deepfake software, and even GPS-enabled collars and electric batons used to enslave workers in the scam compounds that have spread across Myanmar, Cambodia, and the Philippines. Telegram's sudden move to ban the marketplace's accounts appears to have been spurred by WIRED's inquiry to Telegram late last week about new findings from researchers at the the crypto-tracing firm Elliptic. Since July of last year, Elliptic has highlighted the enormous volume of money laundering and other illicit transactions taking place on Huione Guarantee and later Haowang Guarantee. By Elliptic's accounting in a January report, the market and its rebrand had facilitated more than $24 billion in total transactions, which would make it by far the largest single black market operation in the internet's history. That figure has since jumped to $27 billion, according to Elliptic. Elliptic's latest findings concerned a second Telegram-based market known as Xinbi Guarantee, which offered a similar model of third-party transactions and had facilitated $8.4 billion in deals since 2022 that researchers say included not only money laundering for scammers, but also stolen data, harassment for hire, and apparent sex trafficking. When WIRED asked Telegram about Elliptic's findings regarding both markets, the company responded with broad bans of Xinbi Guarantee and Haowang Guarantee accounts. 'This is a huge win. The largest darknet marketplace to have ever existed has been shut down," says Elliptic's co-founder Tom Robinson. "It's a game-changer in terms of overall online criminal markets, and it's huge for victims of online fraud. This marketplace was a key enabler of the global scam epidemic, and I think this will put a real dent in the ability of online scammers to do what they do.' In a statement sent to WIRED Monday, Telegram spokesperson Remi Vaughn wrote that 'communities previously reported to us by WIRED or included in reports published by Elliptic have all been taken down," and added that 'criminal activities like scamming or money laundering are forbidden by Telegram's terms of service and are always removed whenever discovered.' Telegram declined to comment further following Haowang's announcement that it was going offline. Although it wasn't mentioned in Vaughn's statement, Telegram's ban may have also been related to an announcement earlier this month from the US Treasury's Financial Crimes Enforcement Network that Huione Group, Huione Guarantee and Haowang Guarantee's parent company, would be added to a list of known money laundering operations in an attempt to limit its access to US financial institutions. While Haowang Guarantee responded to Telegram's bans by almost immediately shutting down, Xinbi Guarantee appears to be making an effort to relaunch itself on new Telegram channels, Robinson says. Elliptic says that Haowang Guarantee's owners also own a stake in another similar Telegram-based market called Tudou Guarantee, according to a Telegram post from one of Haowang's administrators, and may seek to rebuild their business there. Tudou Guarantee has already seen a significant surge in new users, Robinson says. Whether the two markets succeed in relaunching, Robinson notes, will depend largely on how serious Telegram is about its efforts to prevent them from using its messaging services. 'Are they going to pursue all of these marketplaces and continue to do so as new ones emerge?" Robinson asks. "If so, I think that Telegram is no longer a realistic platform for these marketplaces and they'll have to look for somewhere else to operate.' He suggests the crypto scam market operators would then likely try to migrate to another messaging service with less oversight, or even a decentralized one where they can't be effectively banned. Haowang, in particular, has powerful backing from a company with links to businesses associated with the Cambodian ruling family. Huione Guarantee's parent company, the Cambodian financial conglomerate Huione Group, includes a company linked to the family of Cambodia's prime minister, Hun Manet. Hun To, the prime minister's cousin, serves as one of those companies' directors—and has also been linked in an Al Jazeera investigation to an alleged scam compound. All of that means Telegram's takedowns are by no means the end of the crypto scam industry, says Robinson. They may, however, represent a serious setback for the markets that cash out its profits and launder its money. 'Online crime is a cat-and-mouse game in general. But these are very large mice,' Robinson says. 'It's a big blow to the criminal ecosystem that will take a long time to recover from."
New York Post
01-05-2025
- Business
- New York Post
North Korea-linked gang ‘stole' billions from Americans through romance scams, online schemes
WASHINGTON — A Cambodia-based gang with ties to North Korea has 'stolen' billions of dollars from Americans through romance scams and other cyber-heists since August 2021, federal officials said Thursday in announcing a crackdown on the malign network. For years, the online marketplace Huione Group has helped North Korea and other transnational criminal gangs rip people off by sending texts or direct messages on social media platforms and sites to bilk them for fake investments or 'pig butchering.' The cons, which also take place on dating or professional networking sites, have gotten US retirees and others to invest in crypto or other virtual currencies — before eventually defrauding them. Advertisement Between August 2021 and January 2025, Huione raked in at least $4 billion in proceeds from the romance and investment racket, with affiliates helping facilitate payments (Huione Pay PLC), provide fiat currencies (Huione Crypto), and furnish an online marketplace with illicit goods and services (Haowang Guarantee). The US Treasury Department's Financial Crimes Enforcement Network (FinCEN) shared the findings of its investigation into the Huione's scam network exclusively with The Post, tallying up $37 million that went toward North Korean cyber heists and another $336 million in the romance and investments grift. 4 A North Korea-linked group has 'stolen' billions of dollars from Americans through romance scams and other cyber-heists since August 2021, the feds say. AP Advertisement Now, the Treasury is taking action by proposing a federal rule to sever the Cambodian firm's access to the US financial system. 'Huione Group has established itself as the marketplace of choice for malicious cyber actors like the DPRK [North Korea] and criminal syndicates, who have stolen billions of dollars from everyday Americans,' said Treasury Secretary Scott Bessent in a statement 'Today's proposed action will sever Huione Group's access to correspondent banking, degrading these groups' ability to launder their ill-gotten gains. Treasury remains committed to disrupting any attempt by malicious cyber actors to secure revenue from or for their criminal schemes.' Beth Hyland, 53, told The Post in a phone interview Thursday that she had been the victim of a Tinder scammer in 2024 who kept 'manipulating me and gaslighting' until she forked over $26,000 through Bitcoin ATMs. Advertisement 4 The Treasury is taking action by proposing a federal rule Thursday to sever the Cambodian firm's access to the US financial system. Google Maps 'We started chatting and hit it off right away. We were going to meet. He said he was a freelance manager for a construction company,' Hyland recalled, explaining how the Nigeria-based con artist kept claiming he was locked out of his bank accounts and was hard up on funds to pay his workers. 'We were in love,' the Portage, Mich., resident said. 'I thought he was going to move near me and we were going to get a house. … We talked about getting married.' 'I took out loans and he told me to use Bitcoin ATMs to send him the money to pay for his translator,' she went on, recalling the swindler said he was based in Fort Wayne, Ind., and trying to pay out around $10 million to his employees, a lawyer and other parties. Advertisement At one point, he also 'claimed he was headed to Qatar for the payout,' she noted. 'He gave me the email and the login for his bank account. He gave me some fake login credentials and I was able to make this transfer.' 4 'Huione Group has established itself as the marketplace of choice for malicious cyber actors … who have stolen billions of dollars from everyday Americans,' said Treasury Secretary Scott Bessent. AP 'He was in Nigeria the whole time, probably in some office building scamming me,' she added, saying the fraudster 'still tried to come back' and woo her after her she went so far as to consider taking money out of her retirement fund before getting set straight by a personal finance adviser. 'I couldn't believe it, because my heart was so involved,' Hyland recounted. 'And it would have been another $50,000 had I kept going.' It took just five days to transfer the thousands of dollars Hyland cashed out through loans and turned into cryptocurrency by depositing $100 bills into Bitcoin ATMs. 'After it ended, I said, 'I'm not going to let this destroy me,' she also said, sharing that she would 'live my life and advocate.' 4 Sen. Marsha Blackburn (R-Tenn.) and other lawmakers in March introduced the Romance Scam Prevention Act to require dating apps and other sites to send fraud ban notifications to users who have interacted with similar scam artists. AP 'I'm writing a book that will have all the text messages that I had — so people can see the 'love bombing,'' she teased. Advertisement 'They focus on you, they tell you how wonderful they are — all kinds of manipulation — and it feels so real.' Sen. Marsha Blackburn (R-Tenn.) and other lawmakers introduced the Romance Scam Prevention Act last month to require dating apps and other sites to send fraud ban notifications to users who have interacted with similar scam artists. Huione's designation was made under Section 311 of the PATRIOT Act, which lets FinCEN crack down on entities engaged in money laundering or terror financing. The group had lacked effective 'know your customer' and 'anti-money laundering' policies, per Treasury officials, and had failed to identify direct transfers from a North Korean scam to one of its subsidiaries.
