For a long time, we were told that the internet’s worst crimes lived deep in the shadows, buried inside the dark web, accessible only through Tor browsers and anonymous crypto wallets.
That story no longer holds.
Today, the biggest online black markets in history are not hidden at all. They are operating openly on Telegram.
According to investigations by blockchain intelligence firm
Elliptic and
reporting by WIRED, Chinese-language marketplaces hosted on Telegram are now running business close to US$2bn (billion) every month. Interestingly, these marketplaces don’t sell drugs in dark corners or rely on obscure links. They sell something far more scalable: the tools and services that power the global scam industry.
If you have ever received a strange investment message, a friendly 'wrong number' text, or an online pitch that feels polished but slightly off, this is the ecosystem behind it.
Bigger Than the Dark Web Ever Was
To understand the dramatic nature of this shift, it is helpful to look back.
A long time ago, Silk Road, the original darknet marketplace, processed about US$216mn (million) before it was shut down. AlphaBay, once described by the US federal bureau of investigation (FBI) as ten times larger, handled a little over US$1bn in total. Hydra, the largest Russian-language darknet market, transferred about US$5.6bn over a seven-year period.
Now compare that with Huione Guarantee, a Chinese-language marketplace that ran openly on Telegram. Between 2021 and 2025, it facilitated transactions worth US$27bn, according to Elliptic, more than any illicit online market ever recorded.
When Telegram eventually banned Huione Guarantee, the activity barely paused. Two successors, Tudou Guarantee and Xinbi Guarantee, quickly stepped in. Together, they are now processing around US$2bn a month, even after repeated bans and relaunches.
As Elliptic’s co-founder Tom Robinson has said, when it comes to illicit use of crypto assets, there is simply nothing larger right now.
How Telegram Quietly Became the Scam Industry’s Backbone
What makes this new wave of crime different is not just the money. It is the ease.
You no longer need technical expertise to run a scam. On these Telegram markets, everything can be outsourced, including stolen identity data, fake investment websites, artificial intelligence (AI)-generated profile photos, scripted conversations, money laundering services and even customer support.
The platforms themselves function like marketplaces with escrow, merchant ratings and automated bots. They create trust between criminals who never reveal their identities, almost all of whom use Tether’s USDT stablecoin for payments.
In effect, fraud has been industrialised.
Where Ordinary People Get Pulled In
Here is the part that many readers often miss: most victims never even use Telegram.
The first contact typically occurs on familiar platforms, such as WhatsApp, Instagram, Facebook, LinkedIn, dating apps, or via a random text message. The conversation feels casual. Sometimes friendly. Sometimes romantic. Sometimes framed as professional advice or even tips on how to stay safe from online fraud!
Over days or weeks, trust is built. Then comes the pivot: trading, crypto, a 'big opportunity', a private app, or a website that looks legitimate. The money you are asked to invest is often real. What is fake is everything around it.
By the time victims realise something is wrong, their funds have already been routed through laundering networks quietly supported by Telegram-based markets. Recovery is rare. Many victims never report it at all.
And even if you have never invested a rupee in crypto, you are not insulated. Stolen personal data sold on these platforms fuels loan fraud, SIM swaps, account takeovers and identity theft. The scam economy survives on volumes.
The Hidden Human Cost
Behind the money is something darker.
Many of these scams are run from compounds in Southeast Asia where workers are trafficked, beaten and forced to scam strangers under threat of violence. The same markets that sell scam tools also advertise prostitution and coercion services, with some listings raising serious concerns about child exploitation.
According to the FBI, workers in the compounds often are victims of human trafficking, held against their will, abused, and guarded by armed groups as they are instructed to target Americans. “In some of the Southeast Asian countries where these compounds operate, scam-generated revenue is so massive that it amounts to nearly half of the country’s GDP. Recent reporting estimates that this scam industry defrauds Americans of nearly US$10bn per year,”
FBI says in its November 2025 release.
As
I wrote in October 2022, taking advantage of the sensitive geopolitical situation in Myanmar and Cambodia, Chinese criminal gangs are operating 'factories' to deceive thousands of investors worldwide. In that month alone, the Indian embassies in Myanmar and Thailand rescued 13 IT professionals. This was in addition to 32 Indians rescued earlier from the Myawaddy region in Myanmar.
According
to the Indian embassy in Myanmar, a new location at the Hpa Lu area, south of Myawaddy town, is reported to have emerged recently, where most of the Indian victims are being trafficked into via Thailand after being recruited from India as well as from countries like Malaysia and the United Arab Emirates (UAE).
As former US prosecutor Erin West has put it bluntly, these platforms are effectively a 'Craigslist for crypto scammers'.
Why Stablecoins Matter More Than You Think
Nearly all transactions on these markets use Tether’s stablecoin, often referred to by its currency codes USD₮ and USDT, which is fast, liquid (pegged to the US dollar) and crucially, centrally issued (allows use of fiat currencies on blockchains). Unlike most cryptocurrencies, USDT can technically be frozen or seized.
Yet such interventions remain limited.
Elliptic and other analysts have shown how professional money laundering organisations convert physical cash into stablecoins, move it across blockchains and cash out again with remarkable efficiency. Every transaction leaves a trace. The technology to follow the trace exists. What is often missing is sustained and unified action by law enforcement agencies (LEAs) across the borders.
What Authorities Are Doing — And Why It Still Isn’t Enough
There has been progress. In
May 2025, data from Elliptic helped trigger the takedown of Huione Guarantee and Xinbi Guarantee, marketplaces that together had handled more than US$35bn. FBI and other US agencies have since launched a scam centre strike force (SCSF) targeting the Chinese criminal networks behind these operations.
Hundreds of millions of dollars in crypto have been seized. Infrastructure has been disrupted.
But experts warn that these steps still lag far behind the scale of the problem. As one researcher put it, the response often appears to be a staged event for the cameras. It is visible, but temporary. The markets are rebuilt. The channels reappear. The money keeps moving.
How You Can Protect Yourself — Without Becoming Paranoid
There is no silver bullet, but a few habits listed below will go a long way in the ever-evolving cyberworld.
- Be deeply sceptical of unsolicited financial conversations. Legitimate investments do not arrive through random messages or friendly strangers. Ask yourself a basic question as to why the little-known ‘good’ person is eager to help you earn huge money or generate wealth, instead of doing it for himself?
- Never trust screenshots or app dashboards as proof of profits. Fake trading interfaces that look perfectly legitimate are a standard product sold in scam markets.
- Do not move money on someone else’s instructions, especially to wallets, QR codes or platforms you cannot independently verify.
- Follow the golden rule of never ‘investing’ money in any product that you don’t understand.
- Guard your personal data aggressively. Aadhaar details, PAN numbers, one-time passcodes (OTPs), selfies and recovery phrases are all valuable commodities once they reach underground markets.
- And most importantly, speak up early. Shame keeps scams alive. The faster banks, exchanges or authorities are alerted, the better the chance — however slim — of limiting damage.
The most unsettling truth is this: the world’s largest criminal marketplaces did not thrive because they are invisible. They thrived because they are tolerated by everyone, including regulators, LEAs and the end users.
Remember, the scam economy has moved out of the shadows and is now visible in plain sight. Until platforms, payment systems and governments treat it with the urgency it deserves, ordinary users remain the primary targets and the first line of defence.
Staying cautious is no longer about being tech-savvy. It is simply about staying safe in an internet that has changed faster than most people realise.
Stay Alert, Stay Safe!
