Following Telegram’s ban on Huione Guarantee’s public-facing vendor channels on May 13, 2025, TRM Labs has found that the Cambodia-based Huione Group is still operating channels for its “VIP” vendors on the platform. Its crypto exchange platform has also re-emerged as huione.me, while it promotes transactions through its stablecoin, USDH. According to TRM Labs, Huione has received at least USD 81 billion in crypto since 2021, surpassing Hydra marketplace.
TRM has found transactional and behavioral ties between Huione Guarantee and another Telegram-based guarantee service, Xinbi, which was also banned from the communications platform on May 13, 2025. Following Telegram’s ban, TRM observed that Xinbi re-emerged on the platform within days.
The Huione Group has been a central financial conduit for a broad range of cyber-enabled criminal activity, including pig butchering scams, transnational fraud networks, and cyber heists attributed to North Korea. On May 1, 2025, the US Financial Crimes Enforcement Network (FinCEN) issued a finding and notice of proposed rulemaking (NPRM) for Huione, identifying it as a primary money laundering concern. Furthermore, yesterday (May 29, 2025) the US Treasury’s Office of Foreign Assets Control (OFAC) imposed sanctions targeting Philippines-based Funnull Technology Inc, a cyber scam facilitator that used Huione-related platforms and tactics.
How does Huione facilitate cyber-enabled crime?
The Huione Group operates a sprawling ecosystem of vendors, payment platforms, and guarantee services across Southeast Asia, particularly in Cambodia. Its signature service, Huione Guarantee, acts as an escrow-like offering designed to provide “trust” in otherwise illicit transactions.
Cyber scam operators use Huione Guarantee to broker services ranging from SIM card procurement to money laundering facilitation. Telegram has served as the central platform for onboarding and interaction between buyers and sellers of these services.
As outlined in FinCEN’s May 1, 2025 notice, Huione Guarantee and its affiliates operate with minimal anti-money laundering (AML) oversight.
Links between Huione and Xinbi
TRM has identified on-chain transactions showing inflows to Xinbi-linked addresses after the Telegram removals. Notably, TRM found that vendors using both Huione Pay wallets and the Huione Guarantee service were also using Xinbi Guarantee.
These data points, coupled with Telegram behavioral patterns, suggest that in addition to TuDou DanBao, which Huione acquired before its ban, Xinbi is likely becoming the fallback option for Huione-linked vendors to continue operations.
What this means: A shifting but persistent threat
The Huione Group re-emerging on Telegram underscores the resilience of escrow services and the complex ecosystems in which they operate. Although recent US Government actions demonstrate a strong and growing commitment to disrupting these networks, bad actors often adapt quickly by shifting to new vendors, aliases, or platforms. Huione-linked operations may continue to evolve through clone services or alternative channels such as Huione Group’s SMS app ChatMe and Xinbi’s SMS app SafeW, even amid heightened scrutiny.
Still, actions such as the May 1, 2025 FinCEN designation and the May 29, 2025 OFAC sanctions mark an important step in addressing the infrastructure that enables these operations — both financially and technically — and lay critical groundwork for future enforcement and platform collaboration.
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
