A Telegram-based guarantee marketplace known for promoting a wide range of illegal services appears to be winding down its operations, according to new research from Elliptic.
Blockchain intelligence company Tudou Warranty said it has effectively ceased trading through its public Telegram group after a period of significant growth. The market is estimated to have processed more than $12 billion in transactions, making it the third largest illicit market in history.
“Other parts of Tudou Guarantee, such as our gambling operations, continue to function, so it remains to be seen whether this marks the first step of a complete shutdown or a change in direction from fraud-related activities,” the company said.
Tudou EAN is just one of many Telegram-based marketplaces serving cyber crooks. Others include HuiOne Discussion and Xinbi Discussion, which had USDT transactions totaling over $35 billion. Thousands of channels associated with both services were shut down by Telegram last year.
The marketplace has since emerged as a dominant platform, prompting merchants who previously sold through HuiOne Discussion to migrate to Tudou Anshin, offering stolen personal data, money laundering services, fraudulent infrastructure such as fraudulent investment platforms and phishing websites, and software programs that facilitate identity theft through face swapping during video calls with victims, voice cloning, and deepfakes.
A Chainaracy study published in November 2025 found that fraudulent technology vendors received a total of at least $375.9 million in virtual currency in 2024, and artificial intelligence (AI) service vendors received a 1,900% increase from 2021 to 2024. is witnessing a compound annual growth rate of , which allows fraudsters to forge realistic identities, generate convincing content, and expand their businesses.
This transition was no coincidence, as HuiOne acquired a 30% stake in Tudou Warranty in December 2024, setting up the latter as a key fallback for Huione-related vendors.
Elliptic founder and principal researcher Tom Robinson told Hacker News that Xinbi Guarantee has rebounded and grown after Telegram’s intervention, and that a similar number of markets are still operating. Robinson added: “After closing HuiOne Guarantee, Telegram has not taken any action against these fraudulent marketplaces. There is no need to migrate to other messaging platforms.”
The apparent closure of Tudou Guarantee also appears to be related to recent law enforcement actions against Cambodian conglomerate Prince Group and its CEO Cheng Zhi, who was arrested and extradited to China earlier this month.
Chats mentioning Tudou Guarantee in connection with Chen Zhi Scandal (Source: Elliptic)
The billionaire businessman is accused of masterminding a massive investment scam that lured trafficked workers to forced labor camps in Southeast Asia and defrauded victims around the world. This scam is a scheme known as romance baiting or pig slaughter. Prince Group denies any wrongdoing.
Elliptic said real-time monitoring of Tudou’s centrally managed wallet showed a sudden drop in activity over several days, suggesting a link to the arrest.
“Tudou’s closure is a significant blow to Southeast Asia’s fraud economy, but as history suggests, this gap will not be filled for long,” the company said, adding that it expects malicious activity to spread to other warranty markets and potentially hit evacuated merchants and customers.
Meanwhile, the government and law enforcement agencies are not sitting idle. In November 2025, the U.S. government announced the creation of the Fraud Center Strike Force to dismantle the Southeast Asian transnational criminal networks behind crypto-related scams and pig-butchering scams.
So far, the team has seized and confiscated $401 million in cryptocurrencies from these schemes. We are also working with U.S. companies to seize and disable U.S. facilities and infrastructure that power fraud and prevent them from being weaponized to target U.S. citizens.
Source link
