The United Nations Office on Drugs and Crime lists what is offered in these markets: targeted lists of stolen data, web hosting, mechanisms to ensure anonymity and bypass authentication on official app stores, money laundering and fund unfreezing services specialising in particular jurisdictions and local financial institutions, compromised social media accounts, multimedia fraud content such as scripts, photos and videos, pre-registered SIM cards, and AI tools including sophisticated automation and deepfake software.

Source: https://www.unodc.org/roseap/uploads/documents/Publications/2025/Inflection_Point_2025.pdf

 

Elliptic reports that the main merchant directory on Huione Guarantee was categorised by the goods and services on offer, including money laundering, stolen personal data, SIM cards and scam investment website development.

A more disturbing category was equipment used on the people inside the scam compounds. Elliptic reports that merchants offered electric shock shackles and batons, which the sellers themselves suggested were for use on scam compound workers.

Taken together, Elliptic states that the two marketplaces shut down that week had facilitated transactions totalling over 35 billion dollars in stablecoins, covering goods and services ranging from money laundering and stolen data to human trafficking and torture devices.

Source: https://www.elliptic.co/blog/elliptic-data-telegram-market-takedown

The Largest There Has Ever Been

Elliptic's analysis indicates that Huione Guarantee facilitated transactions totalling more than 27 billion dollars since launching in 2021, making it the largest illicit online marketplace ever to have operated.

On May 13, 2025, Telegram deleted the channels and banned the usernames of both Huione Guarantee and Xinbi Guarantee, an action Elliptic compares to seizing a website domain. Huione Guarantee announced the suspension of its operations the same day, and later that day announced that it would close permanently.

Xinbi Guarantee, the second largest, having received over 8.4 billion dollars in USDT since 2022, responded more defiantly, declaring that it would relaunch as Xinbi 2.0 and pointing users towards new channels and usernames.

Source: https://www.elliptic.co/blog/elliptic-data-telegram-market-takedown

 

In the United States, on October 14, 2025, the Treasury's Financial Crimes Enforcement Network issued a final rule severing Huione Group from the US financial system, describing the group as a critical node for laundering the proceeds of North Korean cyber heists and for transnational criminal organisations in Southeast Asia running the virtual currency investment scams commonly known as pig butchering. The rule took effect on November 17, 2025.

Source: https://www.fincen.gov/news/news-releases/fincen-issues-final-rule-severing-huione-group-us-financial-system

Closing One Market Is Not Closing the System

This sounds like a victory, and there is a detail that has to be said in full.

The UNODC records that before the marketplace was shut down, Huione had already acquired a 30 per cent stake in another guarantee market, Tudao Guarantee, in December 2024. In plain terms, the risk had been spread in advance of any takedown.

This is what crime science calls displacement. When one channel is closed, the activity does not disappear; it flows to whichever channel remains open. Closing the largest marketplace is a genuine achievement, but it can only be judged by whether transaction volume across the whole system fell, or simply moved house.

Why This Matters for Thailand

The UNODC estimates that in East and Southeast Asia alone, cyber-enabled fraud caused financial losses of between 18 billion and 37 billion dollars in 2023, the majority attributed to scams committed by organised crime groups in Southeast Asia.

Source: https://www.unodc.org/roseap/uploads/documents/Publications/2025/Inflection_Point_2025.pdf

Thailand sits inside that picture both as a country whose citizens are defrauded, and as a route through which people and money reach the scam compounds along the borders.

What this teaches crime prevention is that online fraud is no longer carried out by isolated individuals. It has a full supply chain, with people selling data, people selling SIM cards and people laundering the proceeds, each with a defined role. Chasing only the person who makes the call is like picking leaves off a tree one at a time. The layer that shakes the whole system is the one that lets strangers do business with each other: the middleman who holds the money and guarantees the risk.