How Telegram’s Ban on Huione and Xinbi Has Reshaped the Guarantee Services Landscape

On May 13, 2025, Telegram removed channels linked to Cambodia-based Huione Group’s Huione Guarantee marketplace and to a separate guarantee provider, Xinbi Guarantee. The takedown followed the US Treasury’s Financial Crimes Enforcement Network (FinCEN) designation of Huione Group as a financial institution of primary money laundering concern under Section 311 of the USA PATRIOT Act on May 1, 2025.

Since then, the guarantee services ecosystem has undergone major disruption. Huione and its affiliates appear to be adjusting their operations under mounting law enforcement pressure, while other services are likely moving to capture market share left behind by one of the sector’s dominant players.

In this update, TRM Labs outlines key developments surrounding Huione Group, its associated networks, and the emerging role of services like Xinbi Guarantee in a post-designation landscape.

Key takeaways

• Following the Telegram ban, Huione Pay’s transaction volume increased by 50%, likely due to vendors migrating to another guarantee service, Tudou Guarantee, whose vendors rely on Huione Pay to receive and store funds. Volumes have since stabilized at levels approximately 10% higher than before the ban.
• Xinbi Guarantee experienced a 90% surge in daily inflows as it quickly returned to Telegram. In contrast, Huione Guarantee’s volumes fell from a temporary spike of USD 40 million to a steady USD 30 million — half of its 2024 peak.
• Huione Guarantee is likely merging with — or operating through — Tudou Guarantee, directing vendors to the platform in the wake of its Telegram ban. On-chain and open-source intelligence (OSINT) analysis found that vendors previously hosted on Huione Guarantee are now active on Tudou, using the same wallet infrastructure.
• Tudou has emerged as a key fallback for Huione-affiliated vendors. Since May 11, 2025, when Huione Guarantee announced it was shutting its escrow service, Tudou has experienced a nearly 70-fold increase in daily incoming transaction volume.
• Huione Pay and Huione Guarantee share overlapping infrastructure, including historical fund flows from Huione Pay withdrawal wallets to Huione Guarantee’s security deposit wallets, highlighting the two services’ operational links.

What is Huione Group?

Founded in 2014, Huione Group is a financial conglomerate headquartered in Phnom Penh, Cambodia, with a broad operational footprint across Southeast Asia. The group oversees an extensive network of vendors, payment platforms, and facilitators — many of which are based in Cambodia and cater to both legitimate and illicit markets. According to TRM Labs analysis, Huione-linked infrastructure has received over USD 96 billion in cryptocurrency since 2021.

Huione has become a key financial hub for cyber-enabled criminal activity, including pig butchering scams, large-scale fraud networks, and cryptocurrency heists linked to North Korea. Telegram serves as a major coordination platform for these operations, with many vendors operating under the Huione brand or embedded within its broader ecosystem.

Huione Group’s operations revolve around several core subsidiaries:

• Huione Guarantee: An escrow service that facilitates transactions between buyers and sellers — including those involved in illicit activity. Cyber scam operators have used it to access services ranging from SIM card procurement to laundering fraud proceeds. In 2024, Huione Guarantee acquired a 30% stake in Tudou Guarantee, another escrow platform with similar infrastructure.
  
• Huione Pay: A digital payment and cryptocurrency exchange platform that is attractive to illicit actors due to minimal Know Your Customer (KYC) controls.

TRM’s blockchain analysis shows that while Huione Guarantee and Huione Pay maintain distinct infrastructure, their on-chain activity remains closely intertwined.

What is Xinbi Guarantee? 

Xinbi Guarantee is a Telegram-based escrow service that TRM assesses is likely headquartered in the Asia-Pacific’s Golden Triangle region, which spans parts of Myanmar, Thailand, and Laos. In the wake of Telegram’s takedown of Huione-linked channels, Xinbi appears to be expanding its presence, recently announcing a partnership on Telegram with “Solaire Casino” — likely a reference to the well-known Solaire Resort and Casino chain in the Philippines.

Casinos across Southeast Asia are frequently leveraged by illicit escrow services as hubs for laundering funds and by cybercrime syndicates as bases of operation. These scam compounds are often linked to pig butchering schemes and large-scale investment fraud, generating significant volumes of illicit cryptocurrency that require complex laundering mechanisms to obfuscate their origin.

How the guarantee services landscape has shifted post-Telegram ban

Following Telegram’s ban on channels linked to Xinbi Guarantee and Huione Guarantee, TRM has observed a marked shift in on-chain activity across Huione Guarantee, Xinbi, Huione Pay, and Tudou Guarantee. These disruptions appear to have triggered rapid adaptation among key players in the illicit escrow and payment ecosystem. Below, we examine how each service has responded in the aftermath of the platform takedowns:

Huione Guarantee

In 2024, Huione Guarantee’s daily incoming transaction volume peaked at USD 60 million. Following the ban, it temporarily increased from USD 30 million to USD 40 million, before stabilizing at USD 30 million. Despite the restrictions, its operations have not ceased entirely but continue at a reduced level.

Xinbi

Although Telegram disrupted its operations, Xinbi Guarantee’s daily inflows surged by almost 90%. Unlike Huione Guarantee, which was unable to recover its accounts, Xinbi returned to the platform using the same ID. This likely contributed to its comparative post-ban success.

Huione Pay

Following Huione Guarantee’s Telegram ban, Huione Pay’s average incoming transaction volumes rose by 50% before settling at a level roughly 10% higher than pre-ban volumes. The increase is likely due to vendors transferring funds to Tudou. As Tudou does not offer wallet services, vendors transferring funds through its platform rely on Huione Pay wallets to receive and store those funds.

Tudou

Since May 11, 2025, Tudou Guarantee has experienced a surge in transaction activity — with daily incoming volumes increasing nearly 70-fold. This has likely been driven by Huione Guarantee vendors migrating to Tudou, which Huione Guarantee has encouraged them to do. 

Is Huione Guarantee merging with Tudou Guarantee?

Although Huione Guarantee’s transaction volumes have declined post-ban, TRM’s on-chain and OSINT analysis indicate Huione Guarantee is likely merging with — or operating through — Tudou Guarantee in the wake of increased law enforcement scrutiny and the Telegram ban. 

On May 25, 2025, Huione Group acquired a new Telegram ID. While its Telegram channel has a new Chinese name, it has retained the original “hw” initials from its previous HaoWang branding, and its automated bot continues to use the HaoWang name. As such, we assess that the service is likely prioritizing continuity to retain its customer base following the recent disruption.

The Telegram channel actively promotes VIP vendors through private rooms, but has been directing other vendors to Tudou Guarantee. Huione Guarantee is likely promoting this migration to reduce its risk exposure and the likelihood of further law enforcement scrutiny. 

TRM’s on-chain analysis reveals that vendors previously operating under Huione Guarantee are now active on Tudou Guarantee, using the same wallet infrastructure. Furthermore, Tudou’s on-chain structure closely mirrors Huione Guarantee’s. 

Huione Pay and Huione Guarantee links

Huione Pay and Huione Guarantee — while distinct services — have close operational links and share overlapping infrastructure. TRM has observed vendors offering illicit services under Huione Guarantee, including cybercrime, pig butchering, and money laundering, using Huione Pay wallets to transact. The two services’ links are further underscored by fund flows. Since at least 2021, Huione Pay withdrawal hot wallets have sent funds directly to Huione Guarantee’s security deposit wallets.

How Huione Guarantee’s security deposit wallets work

Huione Guarantee requires vendors to post collateral before advertising services under its brand — typically in the form of digital asset deposits sent to designated wallets. These security deposit wallets serve as a gatekeeping mechanism, holding funds as assurance of vendor credibility or compliance within the ecosystem. From 2021 through September 2024, TRM identified four wallets consistently receiving these deposits. In September 2024, Huione Guarantee shifted to a new operational model, deploying six new wallets, each assigned to a distinct service category, signaling a more segmented and structured approach.

Deposit amounts vary depending on the nature of the service. Vendors offering cybercrime-related services — such as phishing kits or malware — typically post smaller deposits, usually in the low thousands of USDT. In contrast, vendors facilitating money laundering, including large-scale cash-out or on/off-ramp services, often post substantially larger deposits — ranging from 20,000 to 70,000 USDT.

These deposit tiers likely reflect the perceived risk and transactional volume associated with different services. Higher deposits serve not only as collateral but also as a signal of vendor reliability in a trust-minimized, illicit ecosystem. TRM’s analysis of these wallets offers insight into the internal economics of Huione Guarantee’s operations and the relative value placed on different types of illicit services.

Conclusion

Despite recent channel bans by Telegram and the US Treasury’s FinCEN designation, Huione Group continues to operate through a fragmented but resilient network. TRM analysis indicates Huione is likely coordinating with or overseeing Tudou Guarantee, which has remained active while Huione Guarantee scales down on-chain activity. Huione Pay also continues to process significant volumes. Huione Guarantee is highly likely waiting for public attention and investigative pressure to recede before ramping up again, with Tudou serving as an interim platform to retain vendors and maintain continuity.

This operational pivot reflects a broader trend among illicit actors: fragmenting infrastructure, shifting activity across affiliated entities, and re-emerging under alternate branding to evade scrutiny. Huione Group isn’t shutting down — it’s adapting, distributing risk, and evolving to stay ahead of disruption.

Xinbi Guarantee, meanwhile, has demonstrated its own resilience. Its rapid resurgence and public claim of a partnership with Solaire Casino suggest both operational robustness and growing ambition. TRM continues to monitor on-chain activity tied to guarantee services, tracking evolving threats and infrastructure across this illicit financial ecosystem.

{{horizontal-line}}

FAQs

What is Huione Group and why was it banned from Telegram?

Huione Group is a Cambodia-based financial conglomerate with deep ties to illicit crypto activity across Southeast Asia, including pig butchering scams, cyber fraud, and money laundering. On May 1, 2025, the US Treasury’s FinCEN designated Huione Group as a financial institution of primary money laundering concern, prompting Telegram to remove channels associated with its escrow service, Huione Guarantee, and related entities. Despite the takedown, TRM’s on-chain analysis shows Huione continues to operate via affiliates like Tudou Guarantee and digital payment infrastructure such as Huione Pay.

How has the guarantee services landscape changed since the Telegram ban?

Telegram’s removal of Huione and Xinbi-related channels disrupted the region’s escrow ecosystem — but did not dismantle it. Huione Guarantee's volumes initially spiked, then declined to half of its 2024 peak, while vendors began migrating to Tudou Guarantee, which has seen a nearly 70-fold increase in transaction activity. Xinbi Guarantee rebounded quickly and now appears to be gaining traction, aided by its fast return to Telegram and public partnerships in Southeast Asia. These shifts suggest not a collapse, but an adaptation of guarantee services under intensified regulatory scrutiny.

What is the relationship between Huione Guarantee and Tudou Guarantee?

TRM assesses that Huione Guarantee is likely merging with or operating through Tudou Guarantee. Vendors formerly active on Huione are now using the same wallet infrastructure on Tudou, and both services exhibit near-identical on-chain structures. Huione’s Telegram bot still uses its previous HaoWang branding, while directing vendors to Tudou — indicating an intentional strategy to preserve vendor continuity and reduce law enforcement exposure. This migration underscores how illicit ecosystems evolve rather than disappear under pressure.

Is Huione Pay still active following the ban?

Yes — and its activity has actually increased. After the Telegram ban, Huione Pay experienced a 50% spike in average daily inflows, which later stabilized at levels roughly 10% higher than before. This increase is likely tied to vendor transitions from Huione Guarantee to Tudou, as Tudou does not offer its own wallet services. Vendors continue to rely on Huione Pay’s infrastructure, which has historically lacked meaningful KYC checks and has been used to facilitate illicit transactions, including cybercrime and money laundering.

Why does TRM continue to monitor Huione, Xinbi, and Tudou?

TRM monitors these entities due to their central role in facilitating crypto-based illicit finance. Despite bans and sanctions, Huione Group appears to be coordinating operations through Tudou Guarantee and maintaining fund flows via Huione Pay. Xinbi Guarantee, meanwhile, has demonstrated resilience and expansion. As vendors shift between platforms and rebrand, TRM’s blockchain intelligence continues to uncover connections that illuminate how these ecosystems adapt and persist under global regulatory scrutiny.