Chinese-Language Guarantee Marketplaces Trade Stolen Credentials

Key Takeaways

• A sophisticated network of Chinese-language “guarantee” marketplaces on Telegram has become a major hub for cybercrime, facilitating the trade of stolen credentials, fraud kits, and illicit services globally.
• These platforms leverage an escrow-based trust model, similar to legitimate Chinese e-commerce sites, to build confidence among criminals for transactions involving stolen data and fraudulent tools.
• Despite law enforcement actions, including Telegram bans and US Treasury sanctions, these marketplaces have demonstrated significant resilience and adaptability, quickly re-emerging and migrating to new platforms.
• The largest identified platform, Huione Guarantee, processed over $27 billion in cryptocurrency, highlighting the immense financial scale of this illicit ecosystem.

The Rise of China’s Underground Cybercrime Marketplaces

A burgeoning network of Chinese-language online marketplaces has emerged as a critical financial engine for global cybercrime. Operating primarily on Telegram, this sophisticated ecosystem has quietly expanded its reach, becoming a significant force in facilitating illicit activities worldwide.

These platforms, often referred to as “guarantee” or dānbǎo (担保) marketplaces, employ an escrow-based trust mechanism. This model enables criminals to securely buy and sell a wide array of illicit goods and services, including stolen credentials, comprehensive fraud kits, and various other illegal offerings.

The operational scale of these marketplaces is substantial, with their influence now extending far beyond Southeast Asia to impact Western enterprise environments directly.

Escrow Model Fuels Illicit Trade

At the core of this underground economy is a system remarkably similar to legitimate e-commerce platforms. The guarantee marketplace model mirrors the escrow functionality found on popular Chinese platforms like Alipay and Xianyu. These legitimate services have accustomed hundreds of millions of Chinese internet users to associate platform-mediated transactions with security and reliability. Cybercriminals have effectively co-opted this trusted model, repurposing it for the illicit trade of stolen data, counterfeit identities, deepfake services, and money laundering tools.

Researchers at Flare meticulously tracked these platforms, uncovering staggering figures. Huione Guarantee, identified as the largest of these marketplaces, processed an astounding $27 billion in cryptocurrency between 2021 and 2025. Flare’s report, shared with Cyber Security News (CSN), indicates that Huione represents the largest illicit online marketplace ever recorded. Its competitor, Xinbi Guarantee, handled at least $8.4 billion during a comparable period. Both platforms were operational on Telegram until their removal in May 2025.

These marketplaces are run with a surprising degree of professionalism, resembling legitimate businesses. Each platform is managed by an operator that maintains public branding, a dedicated customer service team, and a tiered program for vendors. Operators hold buyers’ funds in escrow, releasing payment only after the buyer confirms successful delivery of the illicit goods or services. Vendors are required to pay a security deposit, typically in USDT cryptocurrency, to list their offerings under the platform’s banner. This deposit serves as a financial guarantee; if a vendor defrauds a buyer, the deposit is forfeited, lending real financial weight to the “guarantee” system.

Despite significant enforcement actions, including a coordinated Telegram takedown and US Treasury sanctions in May 2025, the ecosystem demonstrated remarkable resilience. Within months, over thirty successor marketplaces emerged, with Tudou Guarantee experiencing a nearly seventyfold increase in daily financial inflows. Operators are now actively developing proprietary messaging platforms, aiming to move entirely beyond Telegram. This strategic shift underscores the adaptability of this underground economy, which continues to evolve faster than current enforcement efforts can contain.

Direct Threats to Western Organizations

The primary business of these platforms revolves around the active trade of stolen and fraudulent digital assets. Listings across Telegram-based guarantee marketplaces include sensitive items such as stolen corporate credentials, fake identity documents, SIM cards, NFC-relay fraud kits, and tools for corporate impersonation. Transactions are often facilitated through bot-automated systems, with USDT held in escrow until the buyer confirms receipt.

A particularly dangerous aspect of this model is its direct contribution to threats targeting Western organizations. Funds illicitly obtained from “pig-butchering” scams frequently enter this ecosystem through victim-controlled wallets. These funds are then converted to USDT and channeled through vendor laundering services, ultimately funding scam compound payrolls and the acquisition of new attack tooling. The FBI reported $5.8 billion in cryptocurrency-investment fraud losses in the United States in 2024 alone, making it the largest category of cybercrime losses that year.

Furthermore, these platforms actively trade in employee Personally Identifiable Information (PII) and brand impersonation assets, which can be directly deployed against enterprise networks. Hundreds of thousands of messages are exchanged daily across more than thirty active channels, making this one of the most dynamic threat intelligence surfaces. However, many Western security teams currently overlook this critical area. Despite US Treasury designations, coordinated Telegram bans, and multi-billion-dollar sanctions, the guarantee model has not only survived but continues to expand.

What You Should Do

• Monitor Chinese-Language Channels: Security teams must actively monitor Chinese-language Telegram channels and emerging private messaging platforms for mentions and trades of stolen corporate credentials, employee PII, and brand impersonation assets.
• Treat Investment Fraud as Enterprise Risk: Recognize that employees falling victim to romance-investment (pig-butchering) schemes can become insider threats, potentially coerced into providing corporate access or diverting business funds. Implement robust employee awareness and financial security training.
• Enhance Threat Intelligence: Integrate intelligence gathering from these Chinese-language illicit marketplaces into existing threat intelligence programs to address a significant blind spot.
• Track Infrastructure Migration: Stay abreast of the continuous rebranding and migration of these operators to new, proprietary messaging platforms to maintain visibility into their activities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.