Loading story…
Blockchain intelligence firm Elliptic reported that the Telegram-based guarantee/escrow marketplace Tudou Guarantee has effectively stopped processing transactions in its public Telegram groups after rapidly scaling into a major hub for cyber-enabled fraud. Elliptic estimates Tudou Guarantee processed more than $12 billion in transactions, ranking it as the third-largest illicit marketplace observed, while noting that some associated services (e.g., gambling operations) may still be active—leaving open whether this is an initial step toward a full shutdown or a pivot away from fraud-related activity.
Tudou Guarantee expanded after Telegram actions against similar Telegram-based marketplaces, including HuiOne Guarantee and Xinbi Guarantee, which—along with Tudou—collectively facilitated tens of billions of dollars in USDT flows tied to scam ecosystems. Reporting indicates Tudou hosted vendors selling stolen personal data, money-laundering services, scam infrastructure (fraudulent investment platforms and phishing sites), and tooling that supports impersonation and social engineering (e.g., face swapping, AI voice cloning, and deepfake-enabled video-call deception). Separate context cited in coverage links the broader scam-marketplace ecosystem to enforcement pressure and sanctions activity, including actions targeting Cambodia-linked scam operations and associated entities.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
By mid-January 2026, transactions in Tudou Guarantee's public Telegram groups had effectively stopped after the marketplace processed more than $12 billion in activity. Elliptic assessed this as an apparent wind-down of fraud-related operations, although some services such as gambling still appeared active.
Following Chen Zhi's arrest in early January 2026, Elliptic observed a sharp decline in activity in Tudou Guarantee's main cryptocurrency wallets. The drop suggested a direct operational impact on the marketplace.
On 2026-01-06, Prince Group chairman Chen Zhi was arrested and extradited, according to reporting cited by Elliptic. The action was linked to alleged large-scale pig-butchering operations and forced-labor scam compounds in Southeast Asia.
In November 2025, the U.S. government announced the Scam Center Strike Force to target infrastructure and cryptocurrency tied to transnational scam operations. Authorities said the effort had seized and forfeited $401 million in cryptocurrency and was working to disable U.S.-based infrastructure supporting the schemes.
In October 2025, the United States and United Kingdom sanctioned Cambodia-linked Prince Group and its chairman Chen Zhi for operating scam hubs tied to pig-butchering and related fraud activity. The sanctions were later cited as a factor in disruption to the surrounding scam ecosystem.
In May 2025, Telegram shut down Huione Guarantee channels, prompting merchants to migrate to Tudou Guarantee. Tudou then expanded rapidly as it absorbed scam-related vendors and services.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Tajin Group**, a Chinese-speaking cybercriminal vendor, has conducted phishing, payment-card theft, carding, financial fraud, and money laundering through Chinese-language Telegram guarantee marketplaces. The group operated on Dabai Guarantee from May 2025 to April 2026 before migrating to Xinbi Guarantee around May 2026, apparently observing marketplace rules limiting vendors to a single platform. On Xinbi, it claimed a **208,848 USDT** vendor deposit—substantially above typical vendor deposits—indicating a potentially significant operation. The group used stolen card data, payment links, and merchant accounts tied to CCAvenue UAE, Geidea UAE, N-Genius, and Selfridges eGift cards to test cards, process unauthorized transactions, and launder proceeds. It primarily targeted mainland Chinese citizens and Chinese banks while recruiting international partners with payment-gateway access and sourcing cards across multiple countries. Operators also bought and sold more than 100 Telegram usernames and anonymous virtual phone numbers via Fragment Market, improving anonymity and complicating attribution.
Sep 15, 2026
The U.S. Treasury designated **Xinbi Guarantee** a significant transnational criminal organization for operating a Chinese-language marketplace that allegedly enabled Southeast Asian cyber-scam syndicates, cryptocurrency investment fraud, money laundering, and sales of stolen data, forged documents, deepfake tools, and cash-out services. Xinbi reportedly used escrow-backed transactions and processed more than **$36 billion** since about 2022; U.S. officials also alleged links to North Korean hackers and other criminal groups. The Justice Department’s Scam Center Strike Force seized Xinbi-linked Telegram infrastructure and digital-asset wallets under a federal court order, while prosecutors restrained **$52 million** in cryptocurrency and OFAC listed 52 associated TRON addresses. OFAC also sanctioned Cambodia-based Anwen Technology, tied to the XinbiPay/NewPay wallet, and Singapore-based SafeW Technology, developer of an encrypted messaging app, for allegedly supporting Xinbi; Telegram banned the marketplace. Separately, U.S. and Malagasy authorities shut 13 alleged scam centers, arresting 500 people, as the U.S. reported restraining $938 million connected to related crypto-scam schemes.
Sep 12, 2026
The UK government sanctioned **Xinbi**, a Chinese-language cryptocurrency marketplace, under its Global Human Rights sanctions regime for allegedly enabling large-scale online fraud, money laundering, and human exploitation linked to scam centers in Southeast Asia. Authorities said Xinbi supported **#8 Park** in Cambodia, a major scam compound reportedly housing up to 20,000 trafficked or indentured workers and associated with pig-butchering and other cyber-enabled fraud schemes. The UK also sanctioned **Legend Innovation Co**, identified as the operator of #8 Park, along with two officials connected to the **Prince Group**. Blockchain analysis cited by the government said Xinbi processed more than **$19.9 billion** in cryptocurrency between 2021 and 2025 and served as a central hub for escrow services, unlicensed OTC trading, sales of compromised personal data, and other scam-enabling services. Researchers also linked the platform to other illicit Chinese-language marketplaces including **Huione** and **Tudou**, and said Xinbi remained resilient after 2025 Telegram takedowns by shifting to the **SafeW** messaging app and launching **XinbiPay**. The move marks a notable escalation in efforts to disrupt the financial infrastructure behind transnational scam operations rather than targeting only individual fraudsters.
Jun 29, 2026