Elliptic chief scientist Tom Robinson published an article on May 19 at the Royal United Services Institute (RUSI), a UK think tank, saying that global online scam losses in 2025 will reach as much as $442 billion. Robinson called out Telegram’s core operational venues for underground markets, while Tether’s USDT serves as a main cross-border payment tool.
Confirmed transaction data for the three major underground markets
Robinson’s article named three major underground guarantee transaction platforms and their accumulated processing amounts: Huione, Xinbi, and Tudou, with the three combined processing amounts totaling $66.6 billion.
Huione is considered the largest underground guarantee transaction platform, closely linked to the Cambodian company Huione Group. Its payment service, Huione Pay, is estimated to have processed more than $103 billion in USDT transactions, which led to sanctions by the US and the UK. After Huione was accused, it was gradually renamed to Haowang Guarantee and Tudou Guarantee. In May 2025, Telegram blocked related channels, but the operators quickly moved to new channels to continue operating. After 2026, as pressure increased from Chinese law enforcement units, Tudou gradually stopped operating, and the market gap was immediately taken over by Xinbi. Robinson said Xinbi’s current daily processing amount has reached $35 million.
Confirmed processing methods of Telegram and Robinson’s assessment
After the UK sanctioned Xinbi in March 2026, the related Telegram channels remained active weeks after the sanctions took effect. Telegram later restricted UK users’ access to Xinbi channels, but Robinson clearly stated in the article that this “only meets the minimum requirements of sanctions,” failing to address the core of the problem; many underground markets can quickly resume operations through new channels, backup groups, and name changes.
Confirmed usage patterns of USDT
Based on Robinson’s report, scam groups use USDT extensively as a payment tool, with transactions mainly concentrated on the TRON blockchain. USDT’s peer-to-peer transfer model enables funds to flow across borders directly while also evading some AML (anti-money laundering) review steps in the banking system. Illegal goods circulating in underground markets include stolen personal data, fake social media accounts, mule bank accounts, and money-laundering services.
Common questions
Which scam types does Elliptic’s $442 billion cover?
Robinson used “global online scams” as the overall loss category; the specific statistical methodology is not disclosed in the original text. As a blockchain analytics firm, Elliptic’s research mainly focuses on tracking on-chain fund flows and underground market activity.
After Huione was sanctioned, how did the related platforms keep operating?
After Huione was accused of involvement in money laundering, it was gradually renamed to Haowang Guarantee and Tudou Guarantee. After Telegram blocked channels, the operators quickly shifted to new channels. After Chinese law enforcement pressure, Tudou shut down; Xinbi took over the market. Even after the UK sanctioned Xinbi, the situation has not fundamentally changed.
What is Telegram’s specific role in underground markets?
According to Robinson’s report, Telegram channels and groups are the main operational venues in the scam industry’s “Guarantee Marketplace” underground chat market, providing transaction spaces for illegal goods such as stolen credentials, fake accounts, mule accounts, and money-laundering services.
