WuBlockchain devoted a recent episode of its podcast series Wu Shuo Bu Jia Mi to the mechanics of Southeast Asian escrow platforms, with Bitrace intelligence analyst Yuri outlining how these services operate, how they make money, and why enforcement against a single brand may not eliminate the wider market.
The episode described these platforms as trust intermediaries for illegal transactions tied to telecom fraud, money laundering, and related underground businesses. Their role is to solve a basic problem inside criminal markets: participants do not trust each other, cannot rely on courts, and still need to complete a large number of peer-to-peer deals.
U.S. action has targeted both Huione Group and Xinbi Guarantee
The podcast said that in 2025, the U.S. Financial Crimes Enforcement Network, or FinCEN, identified Huione Group as a primary money laundering concern and cut it off from the U.S. financial system under Section 311 of the USA PATRIOT Act.
It added that in September 2026, the U.S. Treasury Department's Office of Foreign Assets Control, or OFAC, formally sanctioned Xinbi Guarantee and labeled it a major transnational criminal organization. Around that action, Tether also froze tens of millions of dollars in USDT linked to Xinbi.
According to Yuri, the two cases show that U.S. authorities are attacking these platforms from several directions at once, including financial access, on-chain assets, and technical infrastructure.
How the platforms work
Yuri said the core function of an escrow platform is to provide a trust solution for illegal transactions among actors involved in fraud, money laundering, and other criminal activity. Since the parties often do not know each other and cannot use legal contracts to enforce a deal, a third party steps in as guarantor.
Before a transaction begins, one side or both sides post a deposit with the platform. That deposit is meant to constrain behavior and reduce the risk of fraud or outright theft during the trade.
The user base spans multiple layers of the scam economy, the episode said. That includes people involved in recruiting workers for scam compounds, actors tied to human trafficking, sellers of scam materials and illegally obtained personal data, traffic-generation groups, chat operators used in social-engineering fraud, and payment intermediaries that handle collection and disbursement. Yuri also noted that some businesses on these platforms sit in a grayer area, such as TRON energy rental services.
He said these platforms once supported fiat currencies including the U.S. dollar and the Chinese yuan. Huione Guarantee, for example, initially had both dollar and USDT channels. Over time, the dollar side faded, leaving USDT on TRON and Ethereum, and later Ethereum-based USDT largely disappeared as well. In practice, TRON-based USDT became dominant. One reason, he said, is that fiat is easier to trace.
Private groups and public groups are the two main models
Yuri divided the common operating models into two categories: private-group trades and public-group trades.
A private group is closer to a one-off escrow transaction. The platform creates a temporary, non-public Telegram group and brings in the buyer and seller. One side or both sides transfer a deposit to the platform. The buyer then pays, the seller delivers, and the platform holds the deposit as leverage. If a dispute emerges, the platform can arbitrate and deduct part of the deposit. Once the trade is completed, the deposit is returned and the platform takes a commission, usually around 2% to 5% depending on the business type.
A public group works more like a long-term storefront. The platform operates a large number of Telegram groups and rents them to merchants on a monthly basis. A merchant pays an initial deposit and then ongoing monthly rent, allowing it to keep operating in the group without posting a new deposit for every transaction. In general, the value of a single trade cannot exceed the merchant's deposit, or the risk of absconding rises.
Yuri gave the example of a money-laundering group that wants to take orders. Because it handles funds and could run off with them, it may need to post a deposit first. If that deposit is $1 million, the group can theoretically take business up to that amount. In some cases, both sides post collateral. The mechanism, he said, replaces legal enforcement with deposits.
An underground trust system built on wallets, usernames, and reputation
Asked why participants would trust the platform itself, Yuri said most transactions are not as large as outsiders might assume. Typical deals may range from a few thousand dollars to tens of thousands or into the low hundreds of thousands. Single transactions above $1 million are not common. A few million USDT is already enough to create a strong temptation to steal, so participants usually avoid taking on that level of risk casually.
Inside these communities, platform credibility is judged through a separate set of signals. Users look at whether a founder has a history of fraud or failed exits, whether the platform has a detailed operating process and dispute-resolution system, how much reserve capital sits in public on-chain wallets, and how many valuable Telegram usernames or domain-like identity assets it controls.
The episode said some platforms also built Telegram-based payment tools. Huione, for instance, previously had its own Telegram bot wallet, allowing users to obtain a wallet account through a Telegram identity and transact through it. Yuri described that wallet as a front end that could support multiple blockchain networks.
There are also many so-called red-and-black lists or exposure channels in these communities, where users post accusations that a platform stole funds or refused compensation after a dispute. Yuri said those channels create some pressure, but they are not neutral. Many are run by interested parties, so false accusations also exist. When disputes break out, the sides are often pulled into a separate group and asked to present chat logs, on-chain records, and other evidence in public arguments.
He described the atmosphere as highly combative. Still, he said the process is not meaningless. If a platform is clearly at fault, it will often apologize and compensate users, sometimes even distributing red packets in the community, because reputation matters in a business built heavily on word of mouth.
That trust system can also be exploited. The podcast said fake escrow scams are common enough to be jokingly called the first lesson of the black-and-gray market. Fraudsters copy a real platform's groups, chat records, announcements, and branding almost one for one, then tell a victim to post a deposit in the fake venue. The victim is added to a supposed private group, given an address, and told to transfer funds. Once the money arrives, the operator disappears. Since the victim is already involved in an illegal transaction, reporting the loss through normal channels is difficult. Yuri added that services for building fake escrow platforms can even be purchased on real escrow platforms.
Why some brands became dominant
Yuri said the barrier to running a major escrow platform is higher than it appears. Building a Telegram group is only one piece. Operators also need a full operating system, traffic channels, Telegram bots, payment tools, customer service teams, and a stockpile of valuable Telegram usernames and TON domains. All of that requires capital.
He said short usernames and domains carry unusual weight in these communities. A platform may buy a four-character TON domain tied to its brand abbreviation and map it to an official announcement group or escrow group. Premium short domains are expensive, and holding many of them helps signal financial strength. A randomly created group with no recognizable assets is far less likely to attract deposits.
Long-running platforms also tend not to start from zero. Yuri described two common paths. One is a business that already operates in related sectors and later pivots into escrow, such as a group with hotels, casinos, or online gambling operations and an existing customer base. The other is an individual or entity that has spent years in the underground market and built enough credibility that former partners follow when it launches a new escrow brand.
The episode gave the example of a trafficking-related escrow platform that collapsed, after which a number of former participants quickly announced plans to launch a replacement. In those cases, trust comes from prior relationships and reputation. Yuri said Huione and Xinbi also benefited from pre-existing businesses, capital, channels, and customers rather than appearing out of nowhere.
Some groups, he added, even use charitable donations to shape their public image, such as giving money after local disasters. He framed that as part of brand-building and persona management. In their own view, they may genuinely see themselves as running a business.
These platforms may also set what they call business red lines. The podcast said Huione, despite its scale, publicly claimed not to handle certain categories it considered too risky or too dirty, including human trafficking, drugs, and weapons. Yuri cautioned that public rules should not be confused with everything that happens behind the scenes. He said Xinbi in its earlier period did handle human-trading business, but not through public groups. Instead, those deals were done through private groups. Only later, after the platform grew larger, did it gradually cut that business off. In his view, the distinction between public rules and actual practice matters.
At the top end, the platforms have already adopted company-style operations. Huione, according to the episode, has its own office building in Phnom Penh and hires front-desk staff, developers, customer service workers, and accountants, including through traditional recruitment channels.
Yuri also drew a line between the escrow platform and the criminal entities it serves. The platform itself mainly provides transaction-guarantee services, while its customers are the fraud and laundering operators. From an on-chain risk-analysis perspective, he said, the two carry different risk profiles. Funds in platform addresses may reflect the risk of black-and-gray transaction services, while flows in customer addresses may map more directly to specific criminal proceeds. Some platforms or their parent groups also run other businesses, and in some cases even control scam compounds, so each line of business has to be assessed separately.
Revenue comes from commissions, monthly rent, ads, and self-operated business
Yuri stressed that on-chain turnover is not the same as the true size of black-market trade and is not the same as profit. Outsiders may see tens of billions of dollars in flow and draw the wrong conclusion.
He broke platform revenue into four categories.
- Commissions on private-group trades. Depending on the business, fees may reach 5% for higher-risk activity or sit closer to 2% for other categories, with minimum charges on small transactions.
- Monthly rent from public groups. Merchants post a deposit and then pay recurring rent. Yuri called this the most important revenue stream.
- Advertising. Platforms control large Telegram communities and traffic, which can be sold to merchants as ad placement or lead generation.
- Self-operated business. Some platforms run certain public groups themselves, effectively providing escrow for their own operations.
Using Xinbi as an example, Yuri said the platform once had more than 5,000 public escrow groups. He estimated the total deposit pool at roughly $150 million, with a significant share tied to money-laundering business. Based on different monthly rental rates, he estimated that public-group rent alone may have generated about $5 million a month. He added that Huione had even more groups and may have been larger still.
Yuri also said he had seen a document described as an internal 2024 financial statement leaked from the Xinbi Group. He was careful to say he could not verify the material in full and could only say that some figures looked plausible in terms of order of magnitude. Based on that document, Xinbi Group's net profit after expenses in 2024 was about $23.44 million, at a time when the business was still smaller than it later became. Combining that with later operating scale, he said Xinbi's monthly revenue before the crackdown may have been in the range of $5 million to $10 million. He said those figures should be treated only as reference points, not confirmed facts.
How disputes are handled without courts
Every platform has its own rules and a customer-service team dedicated to disputes, Yuri said. When a conflict arises, users can file a complaint, the platform creates a separate group, both sides submit evidence, and the platform decides responsibility. It then determines how much deposit to deduct, whether compensation is owed, and whether the transaction should continue.
The rules can be highly detailed. In money-laundering business, for example, the timing of a freeze can determine liability. Different sources of funds carry different risk. Gambling-related funds may be relatively lower risk, while money freshly moved from a telecom-fraud victim may be frozen quickly because the victim could report the crime soon after. As a result, the parties may agree in advance that if funds are frozen within one or two days, the provider of the funds bears the loss, while a freeze after that period may shift responsibility to the party handling the next stage. The platform writes those details into its rules and arbitrates accordingly.
But if the platform itself is the problem and decides to steal the funds, users have little real recourse. In the end, Yuri said, they are still relying on the platform's concern for its own reputation and on community pressure from reputation channels.
Why TRC20-USDT remains central
Yuri said stablecoins are attractive in underground markets because the market is highly price-sensitive and specialized. To keep that system functioning, participants need a settlement asset with relatively stable value. A laundering team may already operate on thin margins while carrying legal and operating risk. If the settlement asset itself swings sharply, exchange-rate moves can wipe out the profit. That is why USDT is used so widely.
As for why TRON-based USDT dominates, he pointed to path dependence. Early on, one of TRON's biggest advantages was low transfer fees, and major exchanges broadly supported TRC20-USDT. That helped it build a large user base. Even though TRON transfers are no longer especially cheap, the underground market has already formed a habit around it.
Some escrow platforms tried to support USDT on BSC and Solana, the episode said, but actual usage stayed low and those options gradually lost traction. In Yuri's view, TRC20-USDT's position today is the result of early cost advantages combined with long-term path dependence.
He added that ordinary participants should not be assumed to understand blockchain deeply. Many do not know the underlying technology and have no ideological attachment to crypto. They simply use stablecoins as payment rails. Some do not even know USDT can be frozen or what other stablecoins exist.
Platforms are different. They know USDT carries freeze risk, Yuri said, but still need public on-chain addresses because trust is scarce in this world. One of the main ways a platform proves credibility and financial strength is by showing funds openly on-chain. Users can see money entering platform addresses and leaving them in normal operations. That visibility itself becomes part of the trust model. If a platform hid the funds or relied entirely on centralized exchanges or centralized payment services, users might be less willing to post deposits.
The episode said that if USDT in a platform's custody address is frozen before a transaction is completed, the platform should in principle bear the loss because the funds were already in escrow. Yuri said similar cases have happened before, with some platforms absorbing losses after tens of millions of dollars were frozen. Xinbi had also seen earlier freezes involving several million dollars, and the platform compensated users at that time. In the latest case, he said, the frozen amount reached about $45 million. Xinbi initially promised staged compensation, but after the broader blow to the platform, whether it can actually pay remains uncertain.
He also said large platforms generally do not create a fresh address for every trade. They prefer unified, public addresses because historical transaction records are part of their credibility. If a platform constantly switched to new addresses, users might suspect a fake escrow arrangement and demand an explanation for why the address had no history.
Why shutting down one brand may not solve the larger problem
On the impact of U.S. sanctions and asset restrictions against Xinbi, Yuri said the effects should be viewed on several levels.
First, the short-term shock to operators in the underground market is clear. Many merchants lost deposits held with Xinbi, in some cases tens of thousands of dollars or more than $100,000. Some may leave the business after losing their capital, while others may pull back out of fear of being traced. That could shrink related transaction volume in the near term.
As a brand, however, Yuri said Xinbi is effectively finished. The reason is that the action did not focus on only a few addresses. It targeted the Xinbi Guarantee entity and brand itself. After the first batch of addresses was frozen, newly activated addresses were frozen quickly as well. Related technical services, Telegram communities, and even NFTs tied to Telegram accounts were also affected. In practice, that means continuing under the Xinbi name would make the operation easy to track and hit again.
But the disappearance of a brand does not necessarily mean the people behind it are gone. The episode said Xinbi's public-group deposits had previously been estimated at about $150 million, while the amount frozen this time was less than one-third of that total. If the platform ultimately does not compensate the remaining deposits, the operators may still retain substantial funds. Yuri said similar platforms often prepare backup brands in advance and shift business to a new platform when the old one runs into trouble. On paper it may look like a different entity, but the people behind it may be the same.
He argued that law-enforcement agencies in multiple regions have already taken many actions against illegal networks tied to Southeast Asia over the past several years, and some of those operations were large. Even so, the broader business has not been eradicated. The central reason, he said, is that the scam compounds themselves have not been fully dismantled.
Escrow platforms serve the upstream and downstream businesses around those compounds. The compounds need workers, which creates demand for trafficking. They need scam materials, which creates demand for technical and content suppliers. Once money is stolen, it needs to be laundered, which creates demand for laundering teams. In Yuri's account, all of these surrounding businesses exist because of the demand generated by the compounds. If enforcement only hits the service providers while the core demand remains, other operators can move in quickly. Even if Xinbi disappears, he said, a new escrow platform could still rise and take its place.
AI is already lowering the barrier for cross-border fraud
Yuri said he has not yet seen escrow platforms adopt AI at scale for automation or agent-based operations. He said something else is already clear: fraud groups are using AI heavily.
One common use case is the production of scam materials. In the past, fraud operators had to collect large numbers of images of attractive men and women, luxury cars, property, and companies to build fake identities and send those materials to targets over time. Now, many of those assets can be generated directly with AI.
Another major use case is translation. Yuri said large language models have lowered the barrier for cross-language fraud. Even operators who do not speak English, French, or Spanish can use AI to communicate with targets in different countries. That expands the pool of potential victims they can reach.
Program disclaimer
WuBlockchain said the episode was intended to analyze how black-and-gray markets operate and to raise public awareness of the risks. It said the discussion of transaction processes should not be read as a recommendation, endorsement, or safety assurance for any platform or service, and that the guest's views do not represent WuBlockchain's position.
The program also said some figures on scale, revenue, and profit came from the guest's estimates or from materials he cited. The authenticity of internal financial documents mentioned in the discussion has not been independently verified and should not be treated as confirmed fact. It added that research judgments involving specific entities are not the same as judicial findings, and that sanctions and enforcement details should be based on public documents released by the relevant authorities.
The episode further noted that the audio transcript was generated by AI and may contain errors.