Pierluigi Paganini
January 20, 2026
Blockchain cybersecurity firm Elliptic reports that Tudou Guarantee, a major Telegram-based illicit marketplace in Southeast Asia, has stopped transactions in its public groups after handling over $12 billion. The researchers noted that other services still run, so a full shutdown is unclear.
“Since its inception, Tudou (translated as “Potato”) has processed over $12 billion in transactions, placing it as the third-largest illicit marketplace of all time.” reads the report published by Elliptic. “Other parts of Tudou Guarantee, such as its gambling operations, continue to function, so it remains to be seen whether this represents the first stages of a full shutdown or a pivot away from fraud-related activity.”
Tudou Guarantee grew after the illicit marketplace Huione Guarantee closed. In May 2025, Telegram shut down Huione, a $27B marketplace, prompting merchants to move to Tudou. User numbers quickly doubled and transaction volumes surged. Many sellers continued offering stolen data, laundering, and scam services. Huione had already bought a 30% stake in Tudou in 2024, setting it up as its successor.
Merchants on Tudou sold everything needed to run online scams. They offered money laundering services, sold stolen personal data, and provided ready-made scam platforms and phishing sites. They also marketed face-swapping, AI voice cloning, and deepfake tools to trick victims. Tudou’s escrow service built trust between buyers and sellers, helping a large criminal ecosystem thrive.
Tudou’s shutdown links closely to the collapse of Prince Group. In October 2025, the US and UK sanctioned Prince Group and its chairman Chen Zhi for running scam compounds in Cambodia using forced labor. Law enforcement raids increased, and on January 6, 2026, Cambodian and Chinese authorities arrested and extradited Chen to China. Soon after, Elliptic recorded a sharp drop in activity in Tudou’s main crypto wallets, suggesting the arrest directly impacted its operations.
“The closure of Tudou is a significant blow to the Southeast Asian scam economy, but history suggests the vacuum will not remain unfilled for long.” concludes the report. “The fundamental advantage remains on the side of investigators: Every cryptoasset transaction on these giant scam platforms creates a permanent record on the blockchain. The same transparency that allowed Elliptic to trace $12 billion in activity through Tudou will allow us and government investigators to track where that activity migrates next.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, cybercrime)
