How does a messaging app built for private conversations become a global bazaar for crime? That question now hangs over Telegram, where researchers say Chinese-language darknet marketplaces have migrated into plain sight on encrypted channels, turning a tool for private communication into one of the internet’s most efficient money‑laundering and fraud ecosystems.
Elliptic, the blockchain forensics firm, recently published an analysis showing that two Telegram-hosted marketplaces—Tudou Guarantee and Xinbi Guarantee—are together facilitating transactions approaching $2 billion per month, moving funds and services across borders with startling speed and scale. Those services range from laundering proceeds and selling stolen databases to offering scam infrastructure like fake investment websites and increasingly sophisticated AI deepfake tools, according to the reporting and analysis that has followed Elliptic’s findings. The growth continued even after Telegram banned two large markets earlier in 2025, underscoring the markets’ resilience and adaptability.
Background: the darknet’s migration into mainstream messaging
Darknet markets have long used specialized infrastructure—Tor, encrypted marketplaces, privacy coins—to hide buyers, sellers and operators. More recently, that commerce has moved into mainstream encrypted messaging platforms. Telegram’s channel and group model, combined with its support for large file sharing and third‑party links, provides low-friction distribution for listings, vendor reputations, and escrow services that mimic conventional marketplaces while operating outside legal protections. Analysts point out that escrow mechanisms and reputational systems, though intended to reduce fraud, cannot eliminate the systemic risks inherent in illegal markets, including operator exit scams and theft.
What is happening now
-
Scale and scope: Elliptic’s analysis shows the two dominant Chinese‑language markets on Telegram accounted for nearly $2 billion a month in transactional value, a sum that includes laundering and the sale of illicit goods and services. That growth resumed quickly despite enforcement actions that briefly disrupted activity.
-
Product mix: Offerings on these channels are diverse—stolen personal and financial data, turnkey scam kits, fake investment and cryptocurrency infrastructure, malware installers distributed as sideloaded APKs, and AI deepfake capabilities used to impersonate voices and faces in fraud. The combination of readily available tools and anonymized payments accelerates criminal campaigns.
-
Operational resilience: When platforms or individual markets are shuttered, operators and vendors rapidly migrate to new channels or rebrand—an outcome long familiar to investigators of darknet ecosystems. That churn complicates law enforcement and regulatory responses.
Why this matters
First, financial harm is enormous. When illicit marketplaces scale to the billions per month, the downstream victims multiply—retail investors, small businesses, consumers whose data is sold, and financial institutions that absorb fraud losses. Second, the technological tools on offer (malware, deepfakes, synthetic identities) amplify the reach and believability of scams, making traditional detection and consumer education less effective. Third, the cross‑border nature of Telegram channels and cryptocurrency flows blurs jurisdictional lines, making coordination and enforcement slow and costly.
Perspectives and trade‑offs
-
Technologists: Security vendors and blockchain forensic firms argue that improved analytics, pattern detection, and cooperation with platforms can reduce harm—but these tools are imperfect. Pseudonymous cryptocurrencies, coin mixers, and privacy‑preserving services still provide layers of obfuscation that forensic tools must constantly adapt to.
-
Policymakers: Regulators face a tension between preserving encryption and privacy for legitimate users and imposing obligations on platforms to curb illicit marketplaces. Heavy‑handed mandates risk driving criminal activity to even less visible corners of the internet, while insufficient action leaves consumers exposed. The policy challenge is to focus enforcement on criminal actors and infrastructure while protecting civil liberties.
-
Users: Ordinary users and even small criminal customers operate outside legal protections—when funds are lost or data sold, recourse is limited. The culture of pseudonymity on these channels creates both a safety illusion and a legal void that leaves victims without remedies.
-
Adversaries: Criminal entrepreneurs and nation‑state actors alike benefit from commodification: ready‑made tools lower the barrier to entry for sophisticated fraud, espionage, and financial crime. The ready availability of deepfake services and sold identity datasets makes targeted, believable scams easier and cheaper to run.
What can be done
-
Platform action: Messaging services can strengthen abuse reporting, remove illicit distribution channels faster, and limit features that enable large‑scale marketplace behavior (for example, by restricting mass‑forwarding or anonymous channel monetization). But platforms must weigh these steps against user privacy and freedom of expression.
-
Financial controls: Exchanges, payment processors, and crypto services can expand Know Your Customer (KYC) and anti‑money‑laundering (AML) measures, and share indicators of compromise with law enforcement and forensic firms—hardening the plumbing that enables laundering. Forensic providers already trace flows and expose patterns that inform action, but criminals adapt quickly.
-
International cooperation: Because transactions and hosting cross borders, multinational investigation and evidence‑sharing frameworks are essential. Ad hoc takedowns of single markets produce temporary relief but not systemic change.
-
Public education and resilience: Consumers must be taught to recognize social engineering, verify financial offers, and treat unsolicited links and attachments with suspicion; enterprises should harden mobile policies and reduce the risk of sideloaded malware distribution.
Balance and unintended consequences
Any response must balance security with the legitimate uses of encryption and peer‑to‑peer communication. Privacy advocates warn that broad surveillance or platform liability could chill dissent and endanger activists in authoritarian states. On the other hand, doing too little amounts to acquiescing to a global, high‑volume criminal market that extracts billions and builds tools that degrade trust online. The right path is narrow: targeted disruption of criminal infrastructure, improved tracing and recovery options for victims, and smarter platform design that raises the cost of operating illicit marketplaces without dismantling privacy protections for lawful users.
Conclusion
Telegram’s rise as a vehicle for large‑scale darknet markets is a reminder that technology is neutral; what matters is how people use it. When encryption and convenience meet commercialized criminal services, the result can be efficient, globalized harm. The question now is whether governments, platforms, technologists, and the public can act in concert to raise the cost of criminal enterprise without stripping away the privacy and openness that power much of the internet’s legitimate discourse. If history is any guide, enforcement will tug one way and privacy advocates another—leaving victims in the middle unless a more nuanced strategy prevails. How many more billions will flow through these channels before a durable solution is found?
Source: https://www.schneier.com/blog/archives/2026/01/telegram-hosting-worlds-largest-darknet-market.html
