Report Links Two Telegram Markets to Nearly $2 Billion in Monthly Transactions
THE BRIEF
Schneier on Security, citing Wired and a new analysis from crypto-tracing firm Elliptic, reports that Chinese-speaking darknet markets operating on Telegram have grown substantially. The excerpt says the ecosystem briefly declined after Telegram banned two major markets in early 2025, but two current leaders—Tudou Guarantee and Xinbi Guarantee—are now together enabling close to $2 billion a month in transactions. The reported activity includes money laundering, sales of stolen data, fake investment websites, AI deepfake tools, and other black-market services, including pregnancy surrogacy and teen prostitution. The post also describes “pig butchering” crypto romance and investment scams as being carried out largely from compounds in Southeast Asia staffed with thousands of human-trafficking victims. These details are presented as findings reported by Elliptic through Wired and summarized by Schneier; the supplied excerpt does not provide further methodology or independent verification of those claims.
WHY IT MATTERS
If the reported scale is accurate, Telegram-based markets could give fraud operators a sizable venue for laundering funds and obtaining tools used in scams, including fake investment sites, stolen data, and AI deepfakes. The mention of compounds and trafficking victims also connects online fraud activity with serious human exploitation. For security, fraud, banking, and trust teams, the report is a reminder that platform abuse, crypto movement, impersonation tools, and social-engineering schemes may intersect. The excerpt does not establish exposure for any particular organization.
WHO SHOULD CARE
Financial-crime, fraud, cybersecurity, trust-and-safety, digital-banking, and law-enforcement teams should care, especially those monitoring crypto transactions, investment scams, stolen-data markets, or AI-enabled impersonation. Organizations using Telegram for business communications may also want situational awareness.
WHAT TO DO NOW
- Ask fraud and financial-crime teams to assess whether current monitoring covers Telegram-linked crypto activity and the market names cited in the report.
- Review controls for fake investment websites, stolen-data use, and AI deepfake tool scenarios.
- Brief trust-and-safety and incident-response teams on the reported overlap between scam services, crypto laundering, and Telegram marketplaces.
- Record the Elliptic and Wired attribution, and seek corroboration before treating the reported $2 billion monthly figure as verified.
