Guarantee Marketplaces

1. Industrial Trust Infrastructure, Not Classic Darknet Shops

Guarantee marketplaces are the escrow and payment rails that make Southeast Asia's scam-center economy scalable.

The U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) states the problem plainly in its September 2026 alert on digital asset investment scam centers: "guarantee marketplaces serve as one of the primary venues for the sale of" ancillary services that keep scam compounds running [1]. These platforms are not Tor-hosted drug bazaars with Bitcoin tumblers. They are Chinese-language Telegram networks (公群, or public groups) that package marketing, vendor deposits (上押), escrow, dispute resolution, and USDT (Tether) settlement into a single operating system for fraud.

The scale dwarfs every prior illicit online marketplace. Elliptic assessed Huione Guarantee at more than $27 billion in facilitation and Xinbi Guarantee at more than $8.4 billion at the May 2025 Telegram ban, for a combined total of more than $35 billion [9]. By May 2026, the Royal United Services Institute (RUSI) put Huione Guarantee at at least $31 billion and Xinbi Guarantee at $21 billion, while U.S. Treasury OFAC and TRM Labs placed Xinbi Guarantee's cumulative volume across digital assets and fiat currency at more than $24 billion ($24.2 billion in TRM Labs' March 2026 profile) [7][18][25]. Silk Road cleared roughly $216 million; AlphaBay cleared roughly $639 million to $1 billion depending on the source; Hydra cleared about $5.6 billion [7][9]. Guarantee markets sit in a different category.

What they sell is trust under anonymity. A scam compound (盘口, or pankou) needs SIM farms, phishing kits, deepfake tooling, mule "motorcades" (车队), and cash-out "water rooms" (水房) that connect into Chinese money laundering networks (CMLNs). Guarantee markets match those buyers and sellers, hold collateral, run bots that search Mandarin keywords, and settle in TRC20 USDT, the version of Tether issued on the TRON blockchain. FinCEN describes them as "marketing venues and payment infrastructure" that "act as trusted intermediaries" and "hold a buyer's payment in escrow until delivery" [1].

Chainalysis estimates that CMLNs account for roughly 20 percent of known illicit crypto laundering over the past five years, with $16.1 billion in CMLN inflows in 2025 alone (roughly $44 million per day across more than 1,799 active wallets) [11]. Stablecoins accounted for 84 percent of illicit transaction volume in 2025 [8][11]. Guarantee markets sit upstream of that CMLN layer: they do not typically control the laundering wallets themselves, but they are where the contracts get made.

Reported U.S. victim losses from cryptocurrency investment fraud rose from $907 million in 2021 to $2.57 billion in 2022 and $7.2 billion in 2025 (part of $20.9 billion in total cybercrime losses reported to the FBI Internet Crime Complaint Center in 2025, a 26 percent single-year increase), according to FBI IC3 figures cited by FinCEN and DOJ [1][5][19]. UNODC's July 2026 threat assessment for Southeast Asia puts East and Southeast Asia, Australia, and New Zealand scam losses in a range FinCEN cites as tens of billions, while the wider $88.3 billion to $114.1 billion figure for 2025 carries regional estimation and methodology caveats [1][14]. Globally, RUSI cites estimated 2025 online scam losses of $442 billion and roughly 300,000 trafficked workers held in regional scam compounds under threat of torture, sexual violence, and death [7]. The industrial machinery behind those losses runs through Telegram escrow groups.

Why "guarantee" is the right analytic frame

The Mandarin term 担保 (danbao) signals a commercial promise: the platform stakes reputation and collateral systems on completing the trade. That promise is what lets strangers on Telegram exchange malware kits, mule slots, and phishing packs without meeting. Classic darknet markets sold goods; guarantee markets sell settlement confidence. FinCEN's language ("trusted intermediaries," escrow until delivery, and dispute resolution funded by vendor deposits) maps directly onto that commercial form [1].

RUSI's May 2026 commentary frames Telegram hosting and Tether rails as joint structural enablers [7]. Investigators who target only wallets miss the contracting layer; investigators who target only chat groups miss the on-chain collateral. The industrial system is both.

UNODC's April 2025 Inflection Point report already treated Huione Guarantee as a "Global Market Leader" among illicit online marketplaces and warned that disrupting existing platforms would likely be offset by others emerging within the region [12]. Events from May 2025 through September 2026 confirmed that forecast.

2. What FinCEN Named: FIN-2026-Alert005 and the SAR Key Term

On 3 September 2026, FinCEN issued FIN-2026-Alert005 and asked every U.S. financial institution to tag related suspicious activity reports (SARs) with FIN-2026-SCAMCENTERS.

The alert, titled FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers, urges vigilance against money laundering tied to digital asset investment scam centers, which is FinCEN's preferred term for what media still call "pig butchering" and what INTERPOL has urged the field to rename [1]. It builds on Treasury's 2026 National Money Laundering Risk Assessment, Executive Order 14390 (Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens, 6 March 2026), and the DOJ Scam Center Strike Force [1][6][20][21].

How FinCEN defines guarantee marketplaces

FinCEN defines guarantee marketplaces through six operational traits that anchor SAR narratives [1]:

• Chinese-language chat-group networks, typically on Telegram.
• Marketing venues and payment infrastructure for vendors.
• Trusted intermediaries between buyers and sellers.
• Escrow of buyer payment until delivery confirmation.
• Dispute resolution and transaction insurance funded by vendor deposits.
• High convenience and scalability via mobile chat groups and bots.

Specialized illicit services FinCEN lists as available on these markets include money laundering services, social media account creation and verification, social media targeting, and mass phishing [1]. Scam-center operators use the markets to arrange transactions with professional money launderers, "in particular, Chinese money laundering networks (CMLNs)," that exploit Chinese underground banking systems [1].

SAR filing instructions investigators should know

FinCEN requests that institutions reference the alert in SAR field 2 (Filing Institution Note to FinCEN) and in the narrative by including the key term "FIN-2026-SCAMCENTERS", and select "Fraud-Other" under SAR field 34(z) with the description "Scam Centers" (and include "FIN-2026-SCAMCENTERS" in the Comments section when filing a suspicious Form 8300) [1]. Filers should also capture cyber indicators (chat logs, phone numbers, social media usernames, virtual-currency addresses and hashes, apps, URLs, domains, and IP addresses) and any suspected nexus to a politically exposed person, geography, or transnational criminal organization (TCO) [1].

The three-stage laundering model FinCEN maps

FinCEN describes scam proceeds moving in three stages: (1) victim payments, often in digital assets via money services businesses (MSBs) and kiosks, and sometimes via fiat wires or Automated Clearing House (ACH) transfers, gold, or gift cards; (2) on-chain laundering (rapid hops, consolidation wallets, mixers, and cross-chain decentralized finance (DeFi) swaps, notably USDT from Ethereum to TRON); and (3) integration into the formal system through money mules, offshore exchanges, peer-to-peer (P2P) exchangers, and over-the-counter (OTC) brokers, with guarantee markets connecting cybercriminal networks to underground banking liquidity [1].

Rapid Response Program (RRP) ACH data in the alert show Asia and Pacific as the largest initial destination region for cyber-scam cases ($386.0 million, or $385,952,452), followed by Europe ($145.7 million), the Americas ($113.2 million), the Middle East and North Africa ($101.7 million), and Sub-Saharan Africa ($5.1 million) for October 2024 to June 2026 [1]. Initial destination does not equal ultimate destination: the table tracks where victim funds first land, before onward laundering.

Policy stack surrounding the alert

FIN-2026-Alert005 does not stand alone. It sits atop the September 2023 pig-butchering alert (FIN-2023-Alert005), the December 2024 FinCEN-impersonation alert (FIN-2024-Alert005), the August 2025 convertible virtual currency (CVC) kiosk notice (FIN-2025-NTC1), the August 2025 CMLN advisory (FIN-2025-A003), the September 2025 cross-border information-sharing guidance (FIN-2025-G001), Treasury's September 2025, October 2025, April 2026, June 2026, and September 2026 scam-network sanctions packages, and the DOJ Scam Center Strike Force's November 2025 launch and April and June 2026 disruption actions [1][6][22][25]. Executive Order 14390 declared a national policy to harden financial and digital systems against cybercrime and predatory schemes targeting Americans [20].

For SAR writers, the practical effect is a shared key term (FIN-2026-SCAMCENTERS) that lets FinCEN and law enforcement query across institutions for a single typology. Pairing that key term with cyber indicators (wallet addresses, Telegram handles, and domain indicators of compromise (IOCs)) turns individual bank detections into multi-bank pattern packages.

RRP geography as a targeting cue

The alert's RRP ACH table is not a map of scam-center locations. It is a map of first-hop receiving accounts. Asia and Pacific dominate ($386.0 million), but Europe ($145.7 million), the Americas ($113.2 million), MENA ($101.7 million), and Sub-Saharan Africa ($5.1 million) show that mule and front-company infrastructure is globally distributed [1]. Bank investigators should not discount a London or Dubai receiving account merely because the compound sits in Myawaddy or Sihanoukville.

3. Anatomy of a Guarantee Marketplace

The product is not a listing page. It is a hierarchy of deposits, bots, numbered public groups, and USDT escrow.

Hierarchy and 上押 (vendor deposits)

A "boss" stakes a USDT deposit (上押) to open a numbered 公群 (public group), a structure documented across ethnographic and open-source intelligence (OSINT) research. The guarantee platform mediates escrow, books the collateral, and arbitrates disputes. Recorded Future's April 2026 case study of Dabai Guarantee (大白担保) documents siloed teams for "sweeping" (retail and ATM fraud), goods-receiving, and inspection, with Public Group 301 (@dbtm301) geared to South Korea and Japan operations [8].

Yanyu Chen's fieldwork on Cambodia-based gateway firms (通道 matching pankou to motorcades) describes company-as-guarantor holding deposits, running bookkeeping bots, and settling via 卡接回U: fiat lands in mule accounts, then converts back to USDT within a 30-minute remittance window [15]. Chen uses pseudonyms and does not equate any observed firm to Huione; the study documents mechanics and jargon rather than attributing activity to a named platform.

Bots, fees, and settlement rails

• Discovery: Search bots match Mandarin keywords (远程 for remote control, 数据 for data, 美国 for United States, 钓鱼 for phishing) to public groups that hold active deposits [8].
• Settlement: USDT on TRON (TRC20) dominates settlement. CertiK reported TRON holding roughly 99.9 percent of studied collateral-address funds (more than $11.92 billion across 20 active platforms, compared with roughly $420,000 across Ethereum, BSC, Base, and Polygon) as of 22 April 2026 [17].
• Fees / risk: Platforms take commissions on escrowed trades and may offer "insurance" funded by vendor collateral; exit-scam risk (卷钱跑路) and rule-manipulation risk (玩规则) exist across the ecosystem [8][15].
• Catalog: Service catalogs span phishing, SIM/data trading, motorcade/通道 services, carding, malware-as-a-service (MaaS), deepfake, and know-your-customer (KYC) bypass tooling [8][12].

Why Telegram

Telegram supplies channel scale, bots, usernames that can be reissued or backed by non-fungible tokens (NFTs), and a mobile interface familiar to Mandarin-speaking operators. Following the late-2023 takedown of Kokang Border Guard Force-linked Fully Light Guarantee, UNODC documented Huione Guarantee growing to more than 820,000 users by October 2024 and more than 970,000 users across thousands of public, private, and VIP groups and channels by April 2025 [12][13]. After the 13 May 2025 purge of Huione and Xinbi channels following inquiries by Elliptic and WIRED, operators reconstituted via backups and new usernames; Elliptic tracked early rebuilds and roughly 30 similar markets [9][16]. RUSI and WIRED later reported Telegram indicating it had decided to no longer prohibit guarantee markets, citing Chinese "capital controls" as its rationale [7][16]. That policy posture, if sustained, is a structural enabler investigators should treat as durable, not temporary.

Service catalog patterns investigators should expect

Recurring offer classes appear across Recorded Future's Dabai catalog and UNODC's marketplace assessments:

• Account creation / KYC-bypass packs and aged social-media identities for romance and investment pretexting.
• Mass phishing and "remote" (远程) tooling aimed at retail banking and broker logins.
• SIM, data, and targeting packages sold by region (for example, Japan and South Korea sweeping groups).
• Motorcade and 通道 brokerage connecting pankou demand to mule supply.
• Deepfake, voice-clone, and generative-AI content services; UNODC noted a more than 600 percent increase in deepfake keyword mentions in monitored Southeast Asian Telegram markets between February and July 2024 [13].
• Malware-as-a-service and stolen card/ID data, both cited in DOJ's Huione backend seizure description [5].

Dispute resolution is part of the product. Platforms that fail to arbitrate lose deposits and merchants. That commercial pressure produces chat logs, bot ledgers, and collateral-address trails, which provide high-value digital evidence when cloud accounts or admin devices are seized.

4. Huione / Haowang: Rise, Volumes, USDH, and Section 311

Huione Guarantee (later Haowang) was the prototype. FinCEN severed the group from the U.S. financial system; operators answered with successors.

Corporate shape and marketplace role

Huione Group is a Phnom Penh-based conglomerate. FinCEN's Section 311 final rule (90 FR 48295, published 16 October 2025, effective 17 November 2025, codified at 31 C.F.R. § 1010.664) treats Haowang Guarantee, Huione Pay PLC, and Huione Crypto (registered in Poland as Huione Crypto Spółka z ograniczoną odpowiedzialnością, alongside a FinCEN MSB registration) as coordinated components sharing convertible virtual currency infrastructure [2]. The controlling entity was originally incorporated in Hong Kong in 2018 as Huione Group Limited; operations are principally in Cambodia [2].

Huione Guarantee launched around 2021. It announced its rebrand to Haowang Guarantee (好旺担保) on 30 September 2024 and completed the change on 19 October 2024 [2][9]. The marketplace offered escrow for scam-related goods and services on Telegram. FinCEN found no meaningful anti-money-laundering (AML) or KYC program despite Huione Group's July 2024 public statement that "our [Know Your Customer] capabilities are now seriously insufficient" [2].

Attributed volumes: do not blend these figures

Analytics firms and government agencies publish non-identical metrics (Guarantee-only vs. Group; inflows vs. facilitation; different cut-off dates). Investigators should cite each figure with its source:

USDH: marketed as unfreezable

In July 2024, Tether froze more than $29 million in USDT held in a Huione Group wallet linked to transnational fraud and criminal operations [2]. In September 2024, Huione Group launched USDH ("U.S. Dollar Huione"), marketed as "unfreezable" and "not restricted by traditional regulatory agencies" [1][2][12]. The product was a direct answer to Tether freezes and law-enforcement cooperation, and FinCEN treats that marketing as compounding primary-money-laundering-concern risk [2].

Section 311 final rule and reconstitution

The final rule imposes special measure five (31 U.S.C. § 5318A(b)(5)): covered U.S. financial institutions may not open or maintain correspondent accounts for or on behalf of Huione Group, and must apply special due diligence to foreign correspondent accounts to guard against processing Huione-related transactions [2]. Complementary OFAC and UK FCDO sanctions against the Prince Group Transnational Criminal Organization and related entities accompanied the 14 October 2025 announcement [3][11].

After the May 2025 Notice of Proposed Rulemaking (NPRM) process and Telegram's ban of thousands of Huione channels, Huione announced closure on 13 May 2025 but steered merchants toward Tudou Guarantee, in which Huione had acquired a 30 percent stake in December 2024 [7][9][12][16]. On 23 June 2026 (published in the Federal Register on 25 June 2026 at 91 FR 38340), FinCEN issued a Notice of Proposed Rulemaking to amend the Huione definition to include successor entity H-Pay Service PLC, assessing that operations transitioned from Huione Pay PLC to H-Pay to evade scrutiny and circumvent the Section 311 special measure [1][4]. On the same day (23 June 2026), DOJ announced the court-authorized seizure of a cloud computing account hosting backend infrastructure used by Huione Group subsidiaries for the Huione Guarantee / Haowang Guarantee marketplace, covering stolen card and ID data, malware proceeds, human-trafficking procurement, romance and investment-scam laundering, and escrow services [5]. Assistant Attorney General A. Tysen Duva called it "one of the world's most prolific criminal marketplaces" [5].

RUSI reports that Chinese authorities extradited Huione Group chairman Li Xiong from Cambodia in April 2026 and described him as a key figure in Chen Zhi's criminal enterprise, identifying Huione as a subsidiary of Prince Group, context that ties the marketplace story to the wider Cambodian scam-compound sanctions wave [7][11].

DPRK and dual-use of the same rails

FinCEN's Section 311 record extends beyond Southeast Asian scam syndicates. Huione Group also laundered proceeds of North Korea's (DPRK) Lazarus Group and Reconnaissance General Bureau (RGB) cyber heists alongside Southeast Asian TCO investment-scam proceeds, and Huione Pay PLC officials met in person with an RGB-linked DPRK national between 2022 and 2024 to convert crypto to fiat [2]. FinCEN analysis identified at least $37 million to $37.6 million in CVC from DPRK cyber actors (including roughly $2.6 million from the June 2023 Atomic Wallet, Coinspaid, and Alphapo heists and $35 million in July 2024 from the May 2024 DMM heist) and approximately $300 million tied to cyber scams (including at least $36 million in CVC investment scams) within the broader at least $4 billion confirmed illicit total for August 2021 to January 2025 [1][2]. Elliptic and Chainalysis separately traced funds from the DPRK-attributed WazirX and Bybit thefts into Xinbi Guarantee addresses and vendor networks, showing peer markets on related paths [10][11].

For sanctions investigators, that dual-use profile means Huione-linked and Xinbi-linked clusters can appear in both DPRK cyber-heist tracing and pig-butchering cash-out graphs. Typology filters that assume "scam-only" will under-count.

5. Xinbi: Rebuild After the Purge

When Telegram banned Xinbi alongside Huione on 13 May 2025, Xinbi did not exit. It reconstituted, scaled, and subsequently drew both UK FCDO and U.S. OFAC sanctions alongside a DOJ infrastructure seizure.

Xinbi Guarantee (新币担保) operated as a Chinese-language Telegram guarantee market from around 2022. Elliptic documented a Colorado incorporation (Xinbi Co., Ltd., incorporated in Aurora, Colorado in August 2022 and updated to "Delinquent" status in January 2025 for failing to file a periodic report) [10]. Early Elliptic volume stood at more than $8.4 billion in USDT facilitation from 2022 through the May 2025 ban [9][10].

Volume estimates after the ban: attributed, not reconciled

Confidence note: TRM Labs' 26 March 2026 profile reports $24.2 billion in total transaction volume ($12.1 billion in inflows since May 2025), updating TRM Labs' earlier February 2026 estimate of $17.9 billion [18]; U.S. Treasury OFAC's 9 September 2026 designation release similarly places Xinbi Guarantee's cumulative volume across digital assets and fiat currency at more than $24 billion [25].

SafeW, XinbiPay, and the USDD pivot

Post-purge adaptation included new Telegram channels branded as "Xinbi 2.0," diversification into the SafeW messaging app (developed by Singapore-based SafeW Technology Co., Ltd. and promoted since June 2025) and XinbiPay / NewPay payment rails (developed by Cambodia-based Anwen Technology Co., Ltd., which processed $94.6 million in its first month), and continued TRON settlement [7][9][17][18][25]. CertiK assessed that Xinbi held more than $1 billion in deposit funds, representing more than 90 percent of studied collateral deposits among 20 platforms as of 22 April 2026, with a single Xinbi-linked address receiving more than $52 million in 20 days [17]. Open-source reporting also tracks operator interest in "unfreezable" or lightly cooperating stablecoin alternatives after USDH-style experiments; treat specific USDD migration claims as evolving OSINT and verify on-chain before operational use.

UK FCDO (26 March 2026) and U.S. OFAC / DOJ (9 September 2026) actions

On 26 March 2026, the United Kingdom's Foreign, Commonwealth & Development Office (FCDO) sanctioned Xinbi under its Global Human Rights sanctions regime for enabling scam centres and associated human-rights abuses, alongside Cambodia's #8 Park compound (capable of holding up to 20,000 trafficked workers and operated by Legend Innovation Co. and director Eang Soklim), BSquare Technology, Tian Xu International Technology, and four individual facilitators [7][11][17][24].

On 9 September 2026, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) designated Xinbi Guarantee as a significant transnational criminal organization under Executive Order 13581 (as amended), concurrently designating SafeW Technology Co., Ltd. and Anwen Technology Co., Ltd. and identifying 52 Xinbi-associated cryptocurrency addresses that received more than $8.4 billion in stablecoins [11][25]. In a coordinated action announced the same day, the DOJ Scam Center Strike Force executed a 7 September 2026 federal court seizure warrant against Telegram channels hosting Xinbi's marketplace and two Xinbi payment-collection wallets holding approximately $12 million in cryptocurrency, while restraining an additional 47 associated wallets for a combined total of more than $52 million in cryptocurrency restrained across Xinbi and its vendor network, while the UK FCDO updated its designation with dozens of additional Xinbi cryptocurrency addresses [11][25].

Elliptic also traced roughly $220,000 in USDT across nine transactions on 12 November 2024 from the $235 million July 2024 DPRK-attributed WazirX theft to Xinbi addresses, and Chainalysis documented tens of millions of dollars from both the $1.5 billion Bybit breach and the WazirX theft moving through "Black U" launderers on Xinbi's vendor network, confirming that guarantee markets sit on paths used by state-sponsored hackers as well as Southeast Asian scam compounds [10][11].

User growth and daily throughput

Elliptic recorded Xinbi users rising from roughly 119,000 in August 2024 to about 233,000 before the May 2025 purge, with Q4 2024 marking its first quarter above $1 billion in inflows [10]. TRM Labs recorded 346,156 Telegram subscribers and 18,557 SafeW subscribers across Xinbi channels by late January 2026 [18], and RUSI's May 2026 snapshot (more than 500,000 users and about $35 million per day) indicates that post-purge reconstitution more than recovered headcount before the September 2026 U.S. takedown [7]. Daily throughput at that level is a compliance-monitoring signal: OTC and nested-exchange corridors that suddenly clear tens of millions in TRC20 USDT without clear commercial purpose deserve escalation.

6. Peer Markets After the Purge

Kill one brand and the escrow function migrates. Tudou absorbed Huione refugees; Xinbi scaled; smaller peers filled niches.

Attested succession map

Platform lineage observed in primary OSINT:

Huione / Haowang (2021 to May 2025 Telegram purge) → Tudou (Huione ~30% stake acquired Dec 2024; shut ~16 January 2026) → Xinbi ascendancy (sanctioned by UK FCDO Mar 2026 and OFAC / DOJ Sep 2026) + peer markets.

Dabai as post-Huione OPSEC lesson

Recorded Future assesses Dabai Guarantee likely launched in December 2024 and stayed Telegram-only, with no clearnet footprint, an operational security (OPSEC) lesson drawn from Huione's website aiding FinCEN's May 2025 action [8]. Six official Dabai channels carried mid-five-figure subscriber counts at report time (for example, @dabai_c with 19,225 subscribers, @dabaiyajing with 17,085, and @dabai_a with 15,372). Public Group 301's TRON wallet (TByDzGWCirpCABaUorkhz5eWhjyDdYWgSo) showed 2,943 transactions, including an example payout of 10,629 USDT [8].

Names in secondary chatter (not verified here)

Several additional market names circulate in secondary synthesis and operator chatter without confirmation in the primary corpora cited here [1][2][5][7][8][9][11][12]: Heihei, Jiaxiang (佳祥), EG Guarantee, Fafafa / FF Guarantee, and Heizhima (黑芝麻). Tiancheng, Timi, Huohu/Firefox, and Huanghelou appear in broader peer lists circulating among researchers; treat them as leads requiring primary corroboration before inclusion in charging documents or board-level certainty. Confidence: unverified.

Jin Bei and OFAC's guarantee-adjacent designations

Chainalysis's 2026 sanctions chapter notes OFAC's October 2025 designation of Jin Bei as a guarantee platform facilitating activity similar to Huione, alongside action by the UK Office of Financial Sanctions Implementation (OFSI) on Byex (which shut down following October 2025 sanctions, per UK FCDO) and the broader Prince Group / Chen Zhi sanctions wave with more than $15 billion in Chen Zhi-linked funds reported seized prior to Chen Zhi's January 2026 arrest in Cambodia and extradition to China [11][24]. Peer designations matter because vendors multi-home: pressure on Xinbi alone redistributes listings to Pilot, Dabai, Yinuo, BoChuang, and unnamed Telegram-only shops.

Tudou's 16 January 2026 closure under Chinese law-enforcement pressure after the Prince Group fall is a reminder that host-state and third-country actions can move volumes faster than U.S. Section 311 alone [7][8][9]. The investigative lesson is sequencing: watch where merchants announce migration within 72 hours of a takedown.

7. How Scam Compounds Use the Markets

Compounds buy capability on the way in and buy cash-out on the way out. Guarantee markets sit on both sides.

Procurement: staffing the fraud factory

Scam compounds in Cambodia, Burma, and Laos, and increasingly in South Asia, Pacific islands, Africa, the Middle East, and South America, need industrial inputs [1][12]. Guarantee catalogs supply phishing infrastructure, account farms, deepfake and AI tooling, malware-as-a-service, and human-trafficking-adjacent recruitment channels. DOJ's June 2026 Huione backend seizure specifically cited trafficking procurement alongside escrow and investment-scam laundering [5]. UNODC, the UN Office of the High Commissioner for Human Rights (OHCHR), and U.S. State Department Trafficking in Persons (TIP) reports document forced criminality: passports seized, quotas enforced by violence, and ransom demands on families, affecting trafficking victims from at least 80 countries [1][14][23].

Cash-out: 搬砖, 车队, 水房, CMLNs

On the exit side, the Mandarin operating vocabulary matters for keyword monitoring and translator tasking:

• Pankou: 盘口 (pankou), the scam "desk" or book that generates victim payments [15].
• Gateway: 通道 (tongdao), gateway brokers matching pankou demand to mule supply [15].
• Motorcade: 车队 (chedui), "motorcades," coordinated mule account teams that receive fiat [11][15].
• Water room: 水房 (shuifang), "water rooms," cash-out and layering shops [15].
• Moving bricks: 搬砖 (banzhuan), "moving bricks," the practice of shuttling value across accounts and rails for a spread using USDT collateral [15].
• Card-to-U: 卡接回U (kaje hui U), card-receive then return-to-USDT: fiat hits mule bank cards, and settlement returns as USDT to the compound [15].

FinCEN states that scam-center operations frequently handle only victim communication and outsource fund-movement infrastructure to professional money launderers (PMLs), with those relationships "often facilitated by guarantee marketplaces" [1]. Chainalysis describes six CMLN service types (running points or 跑分, motorcades, informal OTC or "White U," "Black U," gambling, and mixing/swapping) and explicitly notes that guarantee platforms are marketing and escrow hubs excluded from the CMLN wallet-total metric because they do not control the underlying laundering [11].

That analytical distinction is useful for investigators: hitting a guarantee platform disrupts contracting and escrow trust; hitting CMLN wallets disrupts liquidity. Both layers matter; neither alone collapses the ecosystem.

Victim-payment rails that touch U.S. banks

Even when compounds settle internally in USDT, victim entry often touches regulated rails. FinCEN flags MSB digital-asset services and kiosks as common origination points; scammers instruct victims to open accounts, buy specified assets, and send to scammer-controlled addresses [1]. Fiat paths include wires and ACH into mule-controlled or shell-company accounts, sometimes through fraudulent MSBs that self-register with FinCEN to borrow legitimacy [1][22]. Gold-courier and gift-card variants appear in law-enforcement reporting as well [1].

Guarantee markets enter after or alongside those entry rails: once value is on-chain or ready to cash out, the compound's 盘口 uses escrow groups to hire 车队 and 水房 capacity. Bank detection at Stage One (victim payment) and blockchain detection at Stage Two (on-chain hops) should be fused with Telegram OSINT at the contracting layer.

8. Enforcement Timeline 2024 to 2026 and Adaptation Patterns

Enforcement has been real. Adaptation has been faster.

Recurring adaptation playbook

• Rebrand: Huione → Haowang; Huione Pay → H-Pay; Jin Bei → JinBo-style moves flagged in secondary coverage [2][4][11].
• Channel spawn: Backup channels, NFT usernames, and rapid 公群 renumbering after bans [1][9].
• Alt messengers: SafeW and proprietary clones after Telegram pressure [7][9][18][25].
• Unfreezable stables: USDH and similar "cannot be frozen" marketing [1][2].
• Multi-home: Vendors listing on Dabai, Yinuo, BoChuang, Pilot, and Xinbi simultaneously [8][11].
• Telegram-only OPSEC: Drop clearnet sites that create evidentiary exhibits for regulators [8].

Chainalysis and TRM Labs observed that Huione-linked payment volume did not drop after the May 2025 FinCEN announcement and Telegram ban; instead, Huione Pay volume rose and Tudou Guarantee saw a nearly 70-fold surge in daily inflows before its January 2026 closure, while Xinbi's daily inflows nearly doubled between May and December 2025 [11][18]. Disruption without simultaneous pressure on successors, custom messaging and payment apps, and CMLN liquidity produces displacement, not demolition.

What "success" looks like operationally

The May 2025 Telegram purge removed the two largest brand surfaces then extant. It did not remove escrow demand. Elliptic tracked roughly 30 similar markets and Xinbi's relaunch messaging within days [9]. FinCEN's own alert states that absent ongoing administrator action, guarantee marketplaces "can quickly reconstitute after takedowns simply by creating new chat groups and other online infrastructure" [1].

DOJ's June 2026 Huione backend seizure and September 2026 coordinated OFAC/DOJ/FCDO action against Xinbi Guarantee, SafeW Technology, and Anwen Technology raise the cost of cloud-hosted bot ledgers, custom chat and payment apps, and on-chain escrow pools [5][11][25]. Combined with the H-Pay NPRM [4], they signal a shift from brand-only action toward successor-entity and full-stack infrastructure action. Sustained pressure requires parallel workstreams: sanctions and Section 311 measures on payment and app-development entities, messenger enforcement on 公群, cloud and hosting seizures on backends, and CMLN wallet disruption on liquidity.

9. Red Flags for Banks and Investigators

FinCEN published clustered red flags. OSINT jargon indicators sharpen them.

FinCEN clusters (FIN-2026-Alert005)

Victim-payment indicators

• Customer says a purported law-enforcement or government representative directed a digital-asset payment, international wire, precious-metals purchase, or gift-card purchase [1].
• Payment framed as retaining a "recovery" law firm or entity without documentation demonstrating that the service is legitimate [1].
• Retirement or investment account withdrawals to buy gold from a precious-metals dealer for courier handoff [1].
• Open-source information showing an MSB receiving customer funds has claimed to be "approved by FinCEN," or a digital-asset exchange advertising services "with no KYC" or a lack of compliance measures [1].

Guarantee-marketplace indicators

• Transactions in a digital-asset token issued by or associated with a guarantee marketplace, without source-of-funds documentation [1].
• Payment service provider operating a guarantee marketplace that rebranded or changed its website after law-enforcement action, service-provider takedown, or negative news [1].
• Exchange customer interacting with unattributed address clusters flagged by blockchain analysis as sharing infrastructure with a known guarantee market [1].
• Direct or indirect transactions with attributed guarantee-market addresses lacking an apparent economic, business, or lawful purpose [1].
• Digital-asset payment service provider appearing to operate in Burma, Cambodia, or Laos while taking measures to obfuscate its location or corporate structure [1].

Laundering-technique indicators

• Stablecoin receipts at a digital-asset exchange originating from U.S. centralized exchanges and undergoing transaction patterns associated with on-chain laundering techniques [1].
• Customer digital-asset addresses posted on messaging platforms in proximity to Chinese-language money-laundering terms [1].
• DeFi deposits from wallets that aggregate suspected scam proceeds, followed by cross-chain or cross-asset swaps [1].
• Substantial transactions using a stablecoin whose issuer advertises that it does not cooperate with law enforcement or that its stablecoin cannot be seized or frozen [1].
• Offsetting transaction patterns consistent with an OTC broker or P2P exchanger using liquidity provided by a larger digital-asset exchange [1].
• Stablecoin deposits from a DeFi service lacking AML and countering the financing of terrorism (CFT) controls, followed by fiat conversion and withdrawal [1].

Derived OSINT jargon and behavioral indicators

Pair FinCEN's clusters with language and structure indicators from open sources:

• 公群 numbering patterns; 上押 deposit announcements; bot handles offering keyword search across guarantee catalogs [8].
• TRC20 USDT settlement instructions paired with Mandarin escrow vocabulary [8][17].
• References to 车队 / 水房 / 搬砖 / 卡接回U in chat adjacency to wallet addresses [15].
• Sudden payment service provider (PSP) rename after Section 311, OFAC, UK FCDO, or Telegram enforcement [1][4][11].
• Vendor ads that multi-home the same service across Xinbi, Dabai, Yinuo, BoChuang, or Pilot channels [8][11].
• Cloud or SaaS accounts showing Telegram-bot backends, escrow ledgers, or stolen-credential stores linked to known marketplace brands [5].

Reminder from FinCEN: no single red flag is determinative. Stack historical customer behavior, business purpose, and multiple related indicators before SAR or account action [1].

Section 314(b) and cross-border sharing

FinCEN encourages Section 314(b) information sharing for activities that may involve money laundering, including fraud typologies covered by the alert, and points institutions to cross-border sharing guidance (FIN-2025-G001) given the transnational pattern [1][22]. Scam-center cases are poor candidates for siloed SAR filing: the same mule ring or OTC desk often touches multiple banks within days.

Whistleblower channels are also in play. FinCEN's whistleblower program (31 U.S.C. § 5323) covers Bank Secrecy Act (BSA) and certain International Emergency Economic Powers Act (IEEPA) violations; tips that lead to successful enforcement actions resulting in monetary penalties exceeding $1,000,000 may qualify for awards [1]. Compliance teams should ensure internal escalation paths reflect that program for staff who identify Huione-successor or guarantee-market facilitation.

10. What to Watch Next

The escrow function will outlive any single brand. Watch the function, not the logo.

• Successor capture: Finalization or expansion of the H-Pay / successor-entity NPRM amending the Huione Section 311 definition (91 FR 38340, published 25 June 2026) [4].
• Sanctions contagion: Following the UK FCDO's March 2026 designation of Xinbi and OFAC's 9 September 2026 designation of Xinbi Guarantee, SafeW Technology, and Anwen Technology (alongside DOJ's seizure of Xinbi channels and wallets), whether OFAC and FCDO extend designations to active peer markets such as Dabai, Yinuo, BoChuang, and Pilot Guarantee [8][11][24][25].
• Stablecoin flight: Migration from USDT to self-issued or weakly cooperating stablecoins after freeze events; monitor marketing claims of unfreezability [1][2].
• Messenger shift: Migration to SafeW (now OFAC-sanctioned), ChatMe, proprietary Telegram clones, and non-Telegram messengers hosting 公群 escrow [8][17][18][25].
• Niche spawn: New Dabai-style Telegram-only markets with no clearnet presence and region-specific 公群 (JP/KR/US/CA) [8].
• Liquidity layer: CMLN wallet growth versus guarantee escrow deposits, as displacement metrics matter more than any one marketplace's gross merchandise volume (GMV) [11][17].
• BSA feedback: SAR volumes tagged FIN-2026-SCAMCENTERS and quality of cyber indicators attached as a feedback loop for typology refinement [1].
• Compound geography: Geographic expansion of compounds beyond Mekong special economic zones (SEZs) into South Asia, Pacific islands, Africa, the Middle East, and South America, already flagged by FinCEN and UNODC [1][12][14].
• Name hygiene: Primary corroboration of currently unverified peer names before they enter enforcement targeting lists.

For bank executives, the compliance implication is structural: correspondent exposure, nested MSB and virtual asset service provider (VASP) relationships, and OTC corridors touching Cambodia, Burma, and Laos deserve continuous reassessment under the Huione special measure, the September 2026 FinCEN alert, and the September 2026 OFAC Xinbi designations. For investigators, the operational implication is networked: escrow bots, TRON collateral addresses, and CMLN motorcade wallets are parallel collection priorities. For both audiences, the thesis holds: guarantee marketplaces are industrial trust infrastructure. Treating them as ordinary darknet shops understates the threat and mis-aims disruption.

Five evidentiary limits govern how these findings should be used: (1) conflicting GMV methodologies across Elliptic, Chainalysis, RUSI, TRM Labs, and CertiK are not reconciled here; (2) UNODC July 2026 regional loss ranges require careful citation of methodology; (3) peer names outside the attested table remain unverified; (4) some messenger-migration and USDD-pivot claims are evolving OSINT pending primary confirmation; (5) Chen [15] provides ethnographic evidence of mechanics, not a naming source for Huione.

One additional watch item for 2026 to 2027 collection plans: whether Telegram's reported softening on guarantee-market prohibition [7][16] becomes durable platform policy. If hosting remains permissive, enforcement gravity shifts further toward payment rails, cloud backends, and on-chain collateral clusters, and away from expecting messenger takedowns alone to clear the field.