Telegram Blocked Huione and Xinbi

Telegram blocked Huione and Xinbi – the escrow service market has shifted, while infrastructure links remain intact. The reason was Huione Group’s designation as a primary money laundering concern. Meanwhile, TRM Labs recorded a sharp shift in structure and flows among shadow escrow services. Volumes, infrastructure, Telegram presence, and vendor interaction models underwent significant changes.

Volume Metrics and Recovery of Activity

• Huione Guarantee. Before the block, the daily incoming volume reached $60 million. After a drop to $30 million and a short-lived spike to $40 million, volume stabilized at $30 million. Operations continue, but at a reduced level.

• Xinbi Guarantee. Was hit harder, losing up to 90% of daily volume immediately after channel deletion, but returned to Telegram using the same ID. This enabled a recovery of activity – TRM notes stabilization at around $30 million, comparable to Huione.

• Huione Pay. After the Huione Guarantee ban, incoming volume grew by 50%, then stabilized at roughly 10% above pre-block levels. TRM attributes this to vendors rerouting funds through Huione Pay toward alternative platforms.

• Tudou Guarantee. Since May 11, 2025, TRM recorded an extraordinary 70-fold increase in daily volume. The surge may be linked to Huione vendors migrating to Tudou after the Telegram block.

Telegram and Infrastructure Links

Huione Group continues its Telegram activity despite the removal of its previous channel. On May 25, 2025, Huione registered a new Telegram ID with a new channel name but retained the previous "hw" identifier and the name HaoWang in the Telegram bot. In essence, the automatic bot performs the same function, and public messages indicate activity directed toward VIP chats and Tudou. This appears to be an attempt to retain the client base, reduce external pressure, and continue vendor routing.

Additionally, vendors who previously operated through Huione Guarantee now actively use Tudou while maintaining identical wallet connections and infrastructure parameters.

In general, since 2021, Huione Pay withdrawal wallets have regularly sent funds to Huione Guarantee deposit wallets. This proves that although the services are technically separate, they rely on shared infrastructure.

Huione Pay is used as a routing layer where Tudou lacks its own wallet functions. Funds are transferred from Huione Pay addresses to addresses controlled by Huione Guarantee, where they serve as deposits and guarantees.

How the Huione Guarantee Deposit System Works

To access the platform, vendors are required to make a deposit – TRM notes that from 2021 to 2024, four fixed addresses were used. As of September 2024, Huione implemented a six-address model, with each assigned to a specific vendor segment.

The deposit amount depends on the service type:

• for phishing, malware, and similar activities – from $1,000 to $5,000

• for laundering, cash-out, and off-ramp operations – from $20,000 to $70,000

Thus, TRM believes that Huione has not ceased operations but is redistributing them through Tudou while preserving wallet connections, Telegram bots, and infrastructure control. The migration does not involve full brand replacement but retains recognizability (HaoWang ID). Meanwhile, Xinbi follows a different model – the service restored its Telegram channel without altering the structure. This enabled a fast recovery of volume.

Conclusion

While Telegram offers access to an incredibly broad ecosystem and tools, including for crypto platforms, it is also exploited by malicious actors. This is an inevitable outcome of Telegram’s moderation approach, which many consider overly permissive. We will keep watching – and hope that, even with continued freedom, shadow activity will diminish. Stay tuned for the latest updates in crypto, blockchain, and DeFi.