Bitrace maps a criminal service layer built on USDT, Telegram, and platform-run escrow
Bitrace says illicit crypto guarantee platforms in Southeast Asia have developed into a core service layer for underground markets. In the report, the firm defines these platforms as centralized intermediaries that use stablecoins such as USDT for on-chain settlement, while relying on Telegram communities or proprietary encrypted communication protocols for off-chain matching.
Unlike smart-contract escrow, these platforms lean on brand credit and seller deposits as trust anchors. They step directly into the payment flow between parties, hold or intercept transaction funds, and collect guarantee fees. Bitrace describes the business model as turning trust into a rentable, modular product, then bundling it with deposit management, custody, pre-reporting, traffic acquisition, guarantees, and arbitration for illegal trade.
More than 19 billion USDT flowed into deposit addresses from January 2021 to April 2026
The report says USDT issued on Tron and Ethereum is now the main settlement instrument used by these platforms. Based on Bitrace monitoring of more than 100 crypto-based illicit guarantee platforms, more than 19 billion USDT flowed into platform deposit addresses between January 2021 and April 2026. The inflow rose year by year and reached a peak in 2025.
Bitrace says the report is intended to disclose broader development trends in Southeast Asia’s illicit crypto guarantee industry through its data and intelligence work.
Three operating models: private-group, public-group, and public-to-private-group transactions
Private-group transactions
Bitrace splits the service structure into three formats: Private Group Transaction, Public Group Transaction, and Public-to-Private Group Transaction.
A private group is a temporary venue created for one specific illegal deal involving a buyer, a seller, and the guarantee platform. At present, the report says, this usually takes place inside non-public Telegram groups. Once the trade details are agreed, the parties contact platform support to create the group. One side or both sides then send the required deposit to a published private-group deposit address. After money and goods are exchanged and both sides confirm completion, the platform returns the deposit and charges a commission based on the transaction type and the platform’s pricing schedule.
Public-group transactions
A public group is maintained over a longer period by the platform itself and rented to guarantee merchants for promotion and customer acquisition. The report says these are mainly run through public Telegram groups or channels.
If a participant expects continuing illegal trade, they can pay a deposit to become a guarantee merchant and then rent access to a large group on a monthly basis. During the rental period, the merchant can post exclusive advertising or discuss trade details with prospective customers.
Bitrace says public-group transactions differ from private-group deals because the platform does not hold each trade’s funds in escrow. Instead, it uses a pre-reporting system. Before any trade takes place, the guarantee merchant must submit and record the transaction details through a Telegram bot. The buyer and seller then settle directly. If the merchant commits a serious fault, the customer can file for arbitration and seek compensation. The practical benefit for the merchant is that deposits do not need to be posted and withdrawn for every single trade, as long as concurrent business stays within the public-group deposit limit.
Public-to-private-group transactions
Some public groups, Bitrace says, involve items or services that cannot be handled through simple pre-reporting. In those cases, the merchant and the customer still need to ask the platform to open a separate private group for each deal. That hybrid structure is labeled a public-to-private-group transaction.
The report says human trafficking guarantee platforms now make extensive use of this model. Instead of charging merchants a monthly fee, the platform usually takes a 5% guarantee commission on each group-transfer transaction. Because the ticket size is high, Bitrace says the platform can make several hundred or even more than a thousand dollars from a single trafficking deal.
Online gambling, guarantee platforms, and payment tools are increasingly intertwined
Bitrace says cooperation between online gambling operations and guarantee platforms has tightened in recent years. The guarantee side not only rents out communities, drives traffic, and arbitrates disputes, but also uses its own illegal crypto payment tools for settlement and, in some cases, platform construction.
The report lays out three ways gambling operations use crypto today: building their own settlement channels, integrating third-party crypto payment platforms, or plugging into guarantee platforms.
Self-built settlement channels
The earliest model used crypto as a supplement to fiat settlement. Players bought USDT on their own, sent funds to a specified address, then contacted support for manual deposit confirmation before receiving gaming credits. Withdrawals also required manual review, with customer service sending USDT to the player’s nominated address after approval. Bitrace says that deposit-and-withdrawal setup is slow, labor-intensive, and prone to errors, and has gradually fallen out of favor.
Third-party crypto payment platforms
As specialized payment processors emerged, some gambling platforms began integrating them directly. In this arrangement, the processor assigns each player a unique deposit address. Gambling funds move into the processor’s hot wallet and are later used for withdrawals or laundering, while the gambling platform and payment processor settle with each other on a periodic basis. Bitrace says this is now the dominant model, and large operators may connect to multiple payment platforms at once to speed up fund turnover.
Guarantee-platform integration
When gambling businesses connect to a guarantee platform, Telegram becomes the operating base. The report says guarantee platforms create gambling communities for promotion and customer acquisition, payment platforms launch mini-app payment tools for settlement, and gambling operators use Telegram bots to handle betting activity. Users do not need real identity information to register with the gambling site or the payment tool. A Telegram account is enough.
Platform-run gambling portals and payment tools processed more than 4.8 billion USDT
Bitrace says leading guarantee platforms have launched their own gambling portals and payment products to capture betting demand. A gambling portal, in the report’s description, is a collection of gambling-focused public groups. Public groups created and run directly by the guarantee platform are described as direct-operated gambling groups, and users can usually deposit and withdraw through the platform’s own payment tools.
After Tudou Guarantee collapsed and Huione Pay stopped honoring redemptions, Bitrace says user scale rose sharply at Xinbi Guarantee, Dali Guarantee, Fullylight Guarantee, and their associated payment tools. Among them, Dali Guarantee’s OkPay saw the biggest jump after taking over a large number of public groups previously linked to Tudou Guarantee.
According to the report, those three payment tools received more than 4.8 billion USDT combined between May 2025 and April 2026.
Third-party gambling groups can keep operating after a platform shutdown
Bitrace distinguishes these platform-run groups from third-party gambling groups, which are operated by gambling businesses that pay deposits to a guarantee platform and rent its services.
The report says these third-party groups often retain a high degree of independence. They do not fully depend on the guarantee platform’s own payment tools or communities, and may use the platform only as one settlement route and one traffic source. That means they can continue running even if the underlying guarantee platform is shut down, then shift quickly to a new partner.
Bitrace gives the example of Wangbo Entertainment, tied to Feibo, a former Tudou Guarantee gambling portal. It first built its own settlement tool using Huione Pay’s SaaS system. After Tudou Guarantee collapsed, it moved quickly to work with Xinbi Guarantee and Dali Guarantee, expanding its settlement options through their payment tools.
Starting in January 2026, Wangbo Entertainment began aggregating funds from the players in its Xinbi-linked gambling groups into its own Wangbo Wallet. Over the latest three months, that wallet received 20.88 million USDT from Xinbi groups, equal to 11.56% of total funds, and the share rose month by month. Bitrace says this shows public groups, payment tools, and guarantee platforms are not tightly fused and can be recombined as needed, which limits the impact of action against any single piece.
Laundering groups: card-to-USDT conversion is one of the main mechanisms
Bitrace says laundering-focused entities on guarantee platforms mainly include collection-and-payment groups, OTC exchange groups, and bank-card broker groups. Their common business line is converting fiat into USDT or USDT back into fiat, with differences based on the settlement method, source of funds, stage of laundering, and delivery arrangement.
One term highlighted in the report is "card-to-USDT," slang for a laundering method in which funds arriving in a victim’s bank account are moved quickly and converted into USDT to avoid tracing. Bitrace divides it into "first-hand card-to-USDT" and "second-hand card-to-USDT."
First-hand groups directly receive fresh criminal proceeds through bank cards, such as transfers from fraud victims or funds taken from a pyramid scheme on the verge of collapse. Since victims are likely to report the transfer quickly, launderers move fast to buy USDT and send part of it back to the upstream criminal group, keeping the spread as profit.
Second-hand groups sit downstream. After the first-hand group receives the proceeds, its next transfer is often made to a second-hand card-to-USDT group, which is typically an unregistered OTC trader. Bitrace says the margin from helping laundering rings move money is larger than what could be earned by serving ordinary investors.
As of May 2026, the report says the U.S. dollar was trading at roughly 6.8 yuan. In laundering scenarios, though, the actual exchange rate can move much higher depending on the type of funds being cleaned. In extreme cases, $1 can be exchanged for more than 10 yuan.
Bitrace uses a romance-scam laundering model as an example. A first-hand group first posts a deposit on the guarantee platform, then receives fiat funds directly from the victim through bank cards, buys USDT at a high price from a cooperating second-hand group, and finally transfers part of that USDT to the fraud operator. In that chain, both laundering entities earn commissions while the guarantee platform takes fees for providing transaction assurance.
Laundering-related services made up 66.05% of deposits in monitored Xinbi groups
The report says card-to-USDT groups are only one segment. Guarantee platforms also run many other laundering-focused public groups, including code-based USDT conversion, so-called clean-fund exchange, offline cash pickup, and bank-card dealer services.
Bitrace says it monitored 5,287 Xinbi public groups, of which 2,866 offered laundering-related services. Those groups posted 103 million USDT in deposits, accounting for 66.05% of Xinbi Guarantee’s total deposit volume.
Fraud groups: doxxing services, scam software, and account sales
Bitrace identifies fraud-adjacent services as another major category on guarantee platforms. These include the sale of citizens’ private data, illegal software services, and social-media account trading.
Illegal doxxing queries
In the report, "doxxing query" refers to the illegal acquisition of citizens’ personal information. Customers pay a certain amount of USDT, the task is assigned to staff inside private or public institutions, and those workers use internal access to pull the requested data before returning it to the buyer.
Bitrace says these services help fraud groups gather information on targets and also feed into cross-border trafficking. Based on its long-term observations, telecom fraud compounds in Myanmar and Cambodia pay heavily for doxxing queries to vet intended targets and avoid buying workers who do not meet their standards.
The report says the largest guarantee platform dedicated to illegal doxxing collected 1.13 million USDT in public-group deposits over the past year. Its scale trend suggests that, after multinational law-enforcement action began at the end of 2025, these activities shifted into more concealed venues.
Scam-as-a-service
Bitrace also describes a scam software supply chain. Borrowing from the software industry’s service model, developers package fake crypto wallets, fake exchange websites, and fake project sites into standardized products, then sell or rent them to agents who can deploy them quickly. After victims are defrauded, revenue is split between the developer and the operator. The report labels this structure Drainer as a Service and says it lowers the technical barrier to fraud.
Using fake wallet software as an example, Bitrace says developers can now quickly clone wallet websites, push fake apps into app stores, and transfer victim wallet balances with one click. After mining victim addresses linked to major wallet vendors, Bitrace says one leading crypto wallet company saw more than 7,988 users fall victim to multi-signature fake-wallet theft between 2022 and 2023.
Social-media account trading
Trading in social-media accounts, including WeChat, QQ, and Douyin accounts, is also a key part of the underground toolset. Bitrace says these accounts are used heavily in telecom fraud, online gambling, click-farming, and laundering.
The report links the market partly to real-name registration rules. Fraud groups buy verified accounts to run ads, add contacts, create groups, and post status updates that appear more credible, reducing suspicion and supporting pig-butchering scams, investment fraud, task scams, and sexually exploitative blackmail schemes.
Bitrace says Chinese law enforcement has kept up pressure on crimes involving mobile SIM cards, making it harder for fraud groups to buy or maintain large numbers of registered lines. In response, those groups increasingly recruit the holders of phone cards themselves into criminal operations.
One example is the "mobile phone relay" model. The report says this is a popular voice-relay method in telecom fraud, especially cross-border fraud, designed to make an overseas scam call appear to come from a domestic local number. Two phones are connected by audio cable or used with speakers turned on. One phone uses an internet-based communication app to connect to the overseas fraud operator, while the other phone contains a local SIM card and dials the victim. The result is a real-time relay in which the overseas caller speaks directly with the victim while the caller ID shows a local number. Because recruited participants are geographically dispersed, Bitrace says enforcement has had limited success against this setup.
Human trafficking groups: deal structures, transit routes, and pricing
Bitrace says illegal cross-border human trafficking in Southeast Asia is one of the most important support systems for telecom fraud. Because these businesses operate illegally, the report says they often obtain workers through kidnapping or deception, creating a chain that links domestic recruiters, overseas trafficking merchants, crypto payment tools, and illicit guarantee platforms.
The main victim group, according to the report, is Chinese men aged 20 to 35. They are lured online with offers of high-paying jobs abroad. After crossing borders by legal or illegal means, they are forced into telecom fraud compounds. The compounds typically confiscate identity documents and impose strict controls on movement. Victims often must pay compensation far above their purchase price to leave.
Three transaction types
The report splits trafficking transactions into three forms: naked running, guarantee, and second-hand resale.
"Naked running" refers to trafficking with no protection layer. A recruiter inside China lures the victim out of the country and delivers that person to an overseas merchant, who then sends payment directly to the recruiter’s address. Since the two sides do not meet face to face, each can cheat the other, so Bitrace says only merchants with stronger reputations tend to support this method at scale.
"Guarantee" means the illicit guarantee platform steps in as the transaction arbiter when the two sides do not trust one another. The merchant sends the agreed amount in advance to the platform’s deposit address, and after the deal is completed without dispute, the platform releases the funds to the recruiter.
"Second-hand" refers to a trafficking merchant buying people from another trafficking merchant rather than directly from a recruiter. The report says this often appears when a fraud company shuts down and sells its workers to another company, or when victims fail an interview and are then sold onward to another trafficking group.
Two main cross-border route types
Bitrace says the main cross-border movement patterns for victims fall into two categories: side-road routes and passport routes.
"Side-road" refers to illegal border crossings followed by transport to a fraud compound. These routes are usually short, with compounds located near the border. The report lists Muse and Panghsang on the China-Myanmar border as common crossing points. Victims typically depart from Baoshan, Dehong Dai and Jingpo Autonomous Prefecture, Lincang, Kunming, Pu’er, and Xishuangbanna in Yunnan province, cross the border without authorization, and are quickly moved to the compound.
Bitrace says the market price for that route is 30,000 to 40,000 yuan, or 4,500 to 6,000 USDT, and trafficking groups usually settle funds on the spot once the victim has left the country.
Longer smuggling routes also exist. One popular destination is Three Pagodas Pass on the Thailand-Myanmar border, which the report describes as a major relocation area for scam compounds after crackdowns in Myawaddy. Victims crossing illegally into Myanmar are then moved onward through multiple changes of transport. Another common destination is Bavet on the Vietnam-Cambodia border. In that route, victims often leave from Fangchenggang in Guangxi, cross illegally into Mong Cai in Vietnam, take several additional transport legs, then cross the Vietnam-Cambodia border illegally a second time into Bavet or travel deeper into Cambodia.
Bitrace says those longer routes usually take three to four days, and traffickers often settle only after the victim passes the fraud compound’s interview process.
"Passport" refers to cases where the victim travels abroad legally, usually by plane, and is kidnapped after arrival and taken to a fraud compound. The report says these victims often transit through airports in multiple locations in Thailand, Phnom Penh in Cambodia, or Ho Chi Minh City in Vietnam. Main destinations include Tachileik, Myawaddy, and Three Pagodas Pass on the Thailand-Myanmar border, Poipet on the Thailand-Cambodia border, and Bavet on the Vietnam-Cambodia border.
As of May 2026, Bitrace says the market quote for this route was roughly 6,000 to 12,000 USDT per person.
Trafficking guarantee platforms received more than 85.77 million USDT in deposits
Bitrace says platforms dedicated to guaranteeing illegal cross-border human trafficking transactions can be traced back to 2022, excluding Dali Guarantee and the early phase of Xinbi Guarantee.
Between May 2023 and April 2026, those guarantee platforms received more than 85.77 million USDT in deposits, according to the report. Bitrace says that may correspond to more than 13,000 victims trafficked into telecom fraud compounds through these platforms.
The report also notes sharp drops in transaction volume at the end of 2023, the start of 2025, and the end of 2025. Bitrace links those declines to pressure from real-world enforcement and the collapse of major trafficking guarantee platforms.
Enforcement pressure in 2025 pushed down prices and transaction activity
Bitrace says Southeast Asian countries significantly intensified telecom fraud enforcement in 2025, driven in large part by regional cooperation promoted by China. The focus was on countries with concentrated scam compounds, including Myanmar, Cambodia, and Laos. Measures included legislation, joint operations, utility cutoffs, sanctions, and international coordination.
The trafficking chain, which the report describes as one of the key supports for telecom fraud, was hit hard that year. Linghang Guarantee, a fast-rising guarantee platform for trafficking transactions, had its communities repeatedly banned by Telegram, and some TON blockchain name-service NFTs tied to it were restricted. Bitrace says only a small number of tiny platforms still openly provide guarantee services for trafficking, many smuggling routes have been dismantled, and the price of a single trafficked person has dropped sharply.
During the latest enforcement action at the end of 2025, the monthly median for deposit transactions above 6,000 USDT fell from around 12,000 USDT to below 8,000 USDT, according to the report. Bitrace says that suggests routes transiting through Thailand were hit harder by enforcement.
Anonymous payment tools spread from gambling into laundering, fraud, and trafficking
Bitrace says the growth of anonymous crypto payment tools has moved in parallel with gambling activity on illicit guarantee platforms over the past few years. Heavy settlement demand drove the platforms to develop their own payment systems.
One example in the report is the Huione group, which included both Huione Guarantee and Huione Pay. As an early operator of gambling groups, Huione Guarantee used Telegram developer tools to wrap Huione Pay into a Telegram Mini App for gambling users. Bitrace says both the earlier Huione Telegram Wallet and the later overseas payment tool HWZF were fully anonymous and required only a Telegram account for registration.
Xinbi Guarantee, which emerged later in the gambling-group market, launched its own third-party crypto payment platform, Newpay, and used it to build dedicated settlement channels for each Xinbi gambling group. Bitrace says no real-name verification was required there either.
These anonymous payment tools are not limited to gambling settlement, the report says. They are also used heavily in laundering, fraud, human trafficking, and other illegal activity. Bitrace specifically points to Fullylight Wallet under Fullylight Guarantee and OKPAY under Dali Guarantee, saying both have become infrastructure for underground communities.
The collapse of Tudou Guarantee reshaped market concentration
Bitrace says Tudou Guarantee’s collapse changed the structure of the illicit guarantee market. According to the report, Tudou Guarantee emerged after multiple rebrandings of Huione Guarantee and was ultimately destroyed after sanctions on Prince Group and the extradition to China of one of the figures behind it, Chen Zhi.
Its gambling groups did not disappear, however. Bitrace says those operations spun off after Tudou Guarantee shut down and rebuilt public groups through cooperation with platforms such as Tiancheng Guarantee and Xinbi Guarantee, continuing to provide betting services to guarantee-platform clients.
The report says key business assets, including thousands of Telegram communities and important TON blockchain NFTs, were sold in a package to former competitors led by Dali Guarantee. Some of Dali’s sub-guarantee brands are now marketing themselves as successors to Tudou Guarantee.
At the same time, many former public-group merchants moved to Xinbi Guarantee, pushing it from the number-two position to the top of the market. Bitrace says Xinbi was sanctioned by the UK government in March 2026, but its business did not slow down. Trading activity kept growing, and the platform now accounts for 92.48% of the local illicit guarantee market.
Telegram remains the dominant operating layer
Bitrace closes by saying Telegram’s repeated bans on underground communities show that the platform operator keeps these groups under close watch and has the ability to take targeted action at any time.
After Xinbi Guarantee was hit by sanctions referenced in a joint UK-U.S. statement, channels tied to the platform were restricted from display to UK users. Xinbi then stepped up efforts to shift business to another anonymous social app, Safew, offering incentives such as no monthly fee and no advertising fee for Safew public groups.
Bitrace says the migration effort did not work well. Public-group merchants moved in large numbers only in the month when Tudou Guarantee collapsed. After that, deposit scale in Safew public groups declined steadily, and its share of Xinbi Guarantee’s total business remained very small. On that basis, the report says Telegram is still one of the most important pieces of infrastructure in this criminal ecosystem.