TL;DR
- FinCEN’s designation of Huione Group marks a major enforcement milestone; however, the broader ecosystem of Chinese-language guarantee services remains active.
- Guarantee platforms are functionally redundant — vendors and brokers operate across multiple services. Consequently, rather than a full shutdown, Huione Group is more likely to fragment or rebrand.
- Telegram remains the backbone of scam infrastructure, offering pseudonymity and low barriers to entry.
On May 1, 2025, the United States Treasury’s Financial Crimes Enforcement Network (FinCEN) issued a notice of proposed rule making (NPRM) against Cambodia-based Huione Group as a “primary money laundering concern” under Section 311 of the USA PATRIOT Act. The notice, which proposes to sever Huione Group’s access to the U.S. financial system, marks a significant escalation in efforts to disrupt illicit financial infrastructure and is set to take effect in early June.
FinCEN stated that Huione Group facilitated the laundering of at least $4 billion in illicit funds between 2021 and January 2025. These funds have been linked to a range of illicit activities, including:
- Pig butchering scams (highly orchestrated crypto romance schemes);
- Major cyber heists by North Korea’s Lazarus Group;
- And activity by transnational criminal syndicates operating across Southeast Asia.
Huione Group’s subsidiaries — including Huione Pay, Huione Crypto, and Huione Guarantee — have operated with no meaningful AML or KYC controls, despite enabling high-volume cross-border transactions.
Unfortunately, Huione Group, while by far the most significant, is not the only guarantee service in a much broader network, many of which continue to operate in plain sight. These platforms, which serve Chinese-speaking users, function as informal escrow services and play a critical role in laundering illicit proceeds from both crypto-native and fiat-based crimes.
In this blog, we’ll look at how the landscape has shifted post-disruption of Huione Group, examine other websites and Telegram-based guarantee marketplaces, and address what FinCEN’s recent actions mean for the future of compliance and enforcement.
How guarantee services typically operate
Huione Group was the most prominent and by far largest guarantee service, and received the most media attention, but was never alone. Numerous other services continue to enable the sale of synthetic IDs, mule accounts, romance scam kits, Starlink satellites, surveillance equipment and other illicit goods. Some platforms are similarly configured, but offer a more diverse range of vendors, including money movement services and fraudulent cyber technology.
These services are likely designed for redundancy, speaking to the resilience of criminals and the lucrative nature of their businesses. Sellers and brokers frequently operate across multiple platforms, ensuring continuity if one is disrupted. From the perspective of these operators, the guarantee function is what matters most. Their goal is to facilitate trusted transactions brokered by a neutral third party, whether that occurs via a bot, an agent, or a Telegram admin.
As we see in the graph below, many vendors heavily used Huione, but supplemented this with other guarantee services. In some instances, vendors operated across three or four different guarantees, likely illustrating their attempts to extend the reach of their advertisements across multiple guarantee services.
Unlike most of its peers, Huione Group had a web-based presence, but this may have had more to do with optics and traffic acquisition than functionality, as users were still ultimately routed to Telegram. Xinbi is another similar service that previously hosted a website, using it to redirect users to Telegram. Conversely, most small to mid-sized services seldom have public sites, and instead host their operations primarily on Telegram.
Why do guarantee services use platforms like Telegram?
Guarantee services rely on Telegram because it offers the fastest, lowest-friction way to coordinate deals. There’s no need to register a domain or build infrastructure — a group can be created in minutes, brokers can operate under aliases, and communication is encrypted. For actors dealing in illicit or high-risk transactions, Telegram’s pseudonymity and ease of access are major benefits.
Within these Telegram groups, trust is managed socially. Moderators resolve disputes, agents build reputations, and semi-automated bots facilitate trades.
Telegram’s role also poses enforcement challenges. Its design makes it difficult to monitor, and obtaining backend data requires legal processes with uncertain outcomes. Still, the removal of Huione and Xinbi accounts from Telegram following FinCEN’s action suggests that even Telegram’s permissiveness has limits, especially when regulatory pressure is high.
How has the landscape shifted post-Huione Group?
The disruption of a major player like Huione raises the question, what comes next? Historically, similar enforcement actions — whether targeting darknet markets like Hydra or broker networks — have led to dispersion, but not total disappearance. Vendors migrate, new services fill the void, and users adapt quickly. For instance, Telegram took down Xinbi’s channels, but Xinbi has since posted new addresses and Telegram contact points.
Huione has announced its shutdown and even removed its name from its headquarters, but it’s far too early to say whether this marks a true exit or simply the beginning of a quiet rebrand. In the past, Huione Group has taken actions toward future-proofing their operations, such as offering transactions in USDH, which they have claimed cannot be frozen, and acquiring a 30% stake in Tudou Guarantee in December 2024.
In the days following FinCEN’s announcement, inflows to Huione Group slightly decreased, but maintained similar levels to those before the announcement. However, the Telegram enforcement efforts and subsequent shut down announcement show an immediate significant reduction of inflows as of May 13.
For now, the Huione Group takedown may continue to shift some traffic, scramble broker relationships, or inspire short-term caution, but the structural enablers of crypto crime unfortunately remain intact.
What this means for compliance and enforcement
The disruption of Huione Group highlights that illicit finance is increasingly enabled by infrastructure, not just individual actors. As these services move across platforms and become more decentralized, enforcement needs to evolve. When it comes to the scam facilitation ecosystem, traditional platform takedowns are no longer enough. Risk monitoring should focus on identifying possible rebrands, behaviors that mimic existing escrow services, repeated off-chain coordination via Telegram aliases, and on-chain flows that bridge into similar peer-to-peer (P2P) activity.
FinCEN’s proposal to name Huione Group as a primary money laundering concern sends a clear message that regulatory efforts against the scam facilitation ecosystem is expanding. We commend FinCEN’s efforts and encourage further action that targets the enablers of crypto crime. We are also monitoring for on- and off-chain behavior and patterns that would point to a Huione Group rebrand and successor entities.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
The post What the Huione Group Shutdown Signals About the Future of Crypto Scam Infrastructure appeared first on Chainalysis.
