Analysis of Guarantee Platforms and Black Market Operations: Including On-Chain Tracking, Legal Interpretation, and Countermeasures

Author: ChainAnalysis Crypto Lab

Huiwang to Haowang: The "Rebranding Game" and Industry Landscape of Overseas Guarantee Platforms

(I) The essence of guarantee platforms: the international version of "Xianyu" (a Chinese online marketplace for secondhand goods).

In the Web3 ecosystem, the original intention of escrow is to provide a trust endorsement mechanism for legitimate transactions—like the third-party guarantee when you shop on Xianyu (a Chinese online marketplace), where the buyer's funds are temporarily held by the platform after payment and released to the seller only after the buyer confirms receipt, thus resolving the trust issue between the buyer and seller. However, these so-called "escrow platforms" overseas have turned this mechanism into a "fig leaf" for black and gray market activities.

These platforms share common characteristics: they are essentially illegal tools operating without formal financial licenses, relying on Telegram (commonly known as "paper airplane"), and using USDT (stablecoin) as their primary medium of exchange. Their core function is to provide fund custody and arbitration for illegal transactions such as telecom fraud, money laundering, and human trafficking, allowing criminal activities to proceed smoothly under the guise of "guarantees." Simply put, legitimate guarantees protect legal transactions, while these platforms protect criminal transactions.

(II) Huiwang/Haowang Guarantee: A Sanctioned "Black Market Super Hub"

When discussing guarantee platforms, we cannot avoid mentioning Huiwang Guarantee, a platform known in the industry as the "Alipay of the black market." Its development trajectory is essentially an evolutionary history of black and gray market activities.

• Around 2020: Cambodia's Huiwang Group launched Huiwang Guarantee, rapidly rising to prominence by leveraging its geographical advantages in Southeast Asian telecom fraud zones.
• 2022: Due to its involvement in large-scale telecom fraud and money laundering, it was placed on the U.S. Treasury Department's sanctions list, its assets were frozen, and a large number of users were unable to withdraw their funds.
• 2023: Rebranded as "Haowang Guarantee" and continued operating in Telegram groups in an attempt to circumvent regulatory crackdowns.
• 2024 to present: Despite multiple changes in servers and operations teams, the platform remains under close monitoring by regulatory authorities in many parts of the world, and has frequently experienced issues such as runs on funds and withdrawal difficulties.

As the industry leader, Haowang Guarantee's business scale is astonishing: the cumulative transaction volume exceeds US$27 billion, covering black market practitioners in more than 100 countries and regions around the world, and its usage rate in Southeast Asian telecom fraud parks alone exceeds 80%.

Haowang Guarantee Platform Operation Model:

• Sellers (fraud gangs/personal information traffickers) post "goods" on the platform, which may include tens of thousands of citizens' personal information, a set of bank card fraud tools, or even "channel resources" for human trafficking.
• Once the buyer (downstream fraudsters/illegal traders) sees this, they will transfer USDT to the platform's designated wallet;
• After the seller ships the goods, the buyer confirms "receipt" (i.e., confirms that the information is available and the tool is working properly);
• After deducting commission, the platform will transfer the remaining USDT to the seller.
• In the event of a dispute, the platform will act as an "arbitrator," but the arbitration standards are biased towards the logic of black market operations. For example, the determination of "whether the information can be used" is based on whether the buyer has successfully committed fraud.

What's most frightening is its "anonymity": no real-name authentication is required, anyone with a Telegram account can register, and the entire flow of funds uses USDT, completely escaping regulation.

ChainAnalysis' technical team once assisted law enforcement agencies in tracking the flow of funds in a telecom fraud case. One of the funds, 500,000 yuan, came from a domestic victim. After being withdrawn by Kannon and exchanged for USDT by U-merchant, the transaction was completed through Haowang Guarantee and eventually flowed to an overseas fraud gang. The entire process took only 48 hours, and the trajectory of the funds was fragmented.

(III) One picture to understand: Four major types of overseas guarantee platforms

As an important hub in the black and gray market network, guarantee platforms have developed rapidly in recent years, with both user scale and capital scale growing exponentially.

According to on-chain data statistics, the three giants alone—Huiwang Guarantee, Tudou Guarantee, and Xinbi Guarantee—have processed over $78 billion in USDT transactions in the past three years. This amount exceeds the GDP of many small and medium-sized countries.

Besides the three major guarantee platforms mentioned above, there are various other guarantee platforms overseas with clearly defined functions, covering different black market scenarios. Below is a detailed comparison of these four types of platforms:

[Note]: The above data is compiled from case materials of the task force/on-chain data tracking and industry research. The business volume is the cumulative transaction volume, and the risk level is based on a comprehensive assessment of the intensity of regulatory crackdown/concealment/scope of harm.

These platforms also share very obvious commonalities:

❶ USDT is used as the medium of exchange (USDT is pegged to the US dollar at a 1:1 ratio, ensuring price stability and fast cross-chain transfer, enabling the rapid splitting of large sums of money).

❷ Avoid official channels and choose Telegram as the operating platform (Telegram's encrypted communication and group functions make it easy to hide operational traces).

❸ There is no substantial risk control; as long as commissions can be paid, any illegal transaction can be guaranteed.

Black and gray industries vs. escrow platforms: How do ordinary people come into contact with them?

(I) Guarantee Platforms vs. Black and Gray Industries: Resolving the Trust Crisis Between Crimes

Those involved in the black and gray industries are essentially "fraudsters who are wary of each other."

Why is this the case? Fraud rings fear the personal information they buy is fake, information brokers fear not receiving payment after delivery, money laundering teams fear being double-crossed by their intermediary merchants, and intermediary merchants fear being silenced after laundering money. This inherent lack of trust creates a space for escrow platforms to thrive. In simpler terms: the existence of escrow platforms allows scammers to trade with peace of mind.

The following are real-life examples of how our technical team assisted in case investigations:

A telecom fraud gang wanted to purchase a "four-piece set" (bank card/ID card copy/SIM card/U-shield) for money laundering. The seller was a "card farmer" intermediary in China. The two parties were strangers to each other and were both afraid that the other was an undercover agent and afraid of being scammed—the buyer was afraid of paying but not receiving a usable four-piece set, and the seller was afraid of giving the four-piece set but not receiving payment.

At this point, Haowang Guarantee became their "bridge of trust".

Throughout the process, the escrow platform ensures the smooth completion of transactions for both parties and provides anonymity protection, thus closing the loop on criminal activities. Without such a platform, many illicit transactions simply cannot take place—this is the fundamental reason why escrow platforms are irreplaceable in the black and gray market ecosystem.

(II) Guarantee Platforms vs. Ordinary People: Beware of "Quick Money" Traps!

That said, many people feel that the black and gray industries are far removed from their lives. However, in reality, these guarantee platforms are infiltrating the daily lives of ordinary people through various channels, especially targeting those who want to "make quick money with low barriers to entry."

• Social media traffic generation: On social media platforms such as Douyin, Kuaishou, and Xiaohongshu, attract users with keywords such as "cryptocurrency arbitrage", "USDT exchange to earn price difference", and "zero threshold commission tasks", then guide them to add WeChat or QQ, and then transfer them to Telegram groups.
• Introduced by acquaintances: Friends and relatives recommend "a business that allows you to earn pocket money by making online orders. You can earn commissions just by transferring money with a few taps on your phone." Many people lower their guard under the endorsement of acquaintances and eventually become tools of crime.
• Dark Web Redirects: While surfing the internet, you may "inadvertently" see pop-up platform ads that redirect you to Telegram groups. These overseas escrow platforms may also be involved in more serious crimes, such as drug trafficking and arms sales.

(III) The role of guarantee platforms: three core roles in black and gray industries

If the production of black and gray market goods is an industry chain, then the escrow platform is its "core hub," playing three key roles:

• The "Guardian" of Funds Security provides escrow services for illegal transactions, resolving trust issues among black market practitioners and making fund transfers "safer".
• Criminal activities are "legalized" by perpetrators who use "guarantees" to make illegal transactions appear as normal business transactions, lowering participants' psychological defenses and increasing the difficulty of regulatory crackdowns.
• Fund trail "severers" sever the connection between illicit funds and their source through USDT transfers, cross-chain transfers, and multi-address splitting, making tracing the source difficult.

Our technical team once tracked the on-chain data of a certain escrow platform and found that one of its core wallet addresses had transactions with more than 1,200 suspected black market addresses within 6 months, involving more than $800 million. These funds eventually flowed to overseas exchanges, anonymous wallets and other escrow platforms, forming a complex fund network that greatly increased the difficulty of tracing the source.

ChainAnalysis Exclusive Investigation: The Operational Model of the "Laicai Guarantee" Black Market Empire

As a Web3 technology security company, we have assisted the task force in conducting on-chain tracking and technical analysis of multiple illegal guarantee platforms. Among them, the operation mode of "Laicai Guarantee" (the original platform name and data have been anonymized to protect case information) is highly representative. Its business complexity and concealment can be called a "textbook" for black market guarantee platforms.

(I) LaiCai Guarantee's two core businesses: from guarantee to money laundering and money lending.

First, based on our tracking and analysis of the data, Laicai Guarantee is not a single guarantee platform, but rather a black market ecosystem empire centered on guarantees, covering money laundering, system rental, and customer maintenance. The four major businesses are interconnected and form a closed loop.

Core guarantee business

The guarantee business is the foundation and core business of Laicai Guarantee Platform. It provides fund custody and arbitration for black market transactions. The process is similar to Haowang Guarantee, but it is more targeted—mainly serving the connection between "money laundering teams" and "fraud gangs". For example, if a fraud gang needs to recruit money launderers, both parties deposit USDT on the platform, agree on money laundering rules, and then return the deposit through the platform after completion. The platform takes an 8% commission.

According to on-chain data, Laicai Guarantee has three core cryptocurrency addresses, corresponding to the functions of deposit, reserve fund, and deposit:

The deposit address (TKxxxx1) : From May 2024 to February 2026, a total of 96.5618 million USDT flowed in. All the funds came from suspected black market addresses and were mainly used to collect deposits from both parties in the transaction.

Backup fund address (THxxxx2) : From July 2025 to February 2026, a total of 12 million USDT flowed in. All funds came from the deposit address and were mainly used to demonstrate the "platform's strength" to black market practitioners and attract more users to join.

The deposit address (TPxxxx3) : From March 2025 to February 2026, a total of 937 million USDT flowed in. The funds mainly came from the platform's running business address and were used for deposit refunds after the transactions were completed. The flow of funds showed the characteristics of "lump in and scattered out", with most of the outflows being small amounts, which is completely consistent with the fund trajectory of deposit refunds.

Money laundering business

The platform independently developed a money laundering app. Merchants (money laundering agents) need to pay a deposit in advance (minimum 5,000 RMB or equivalent USDT) to participate in money laundering order bidding. After receiving illegal funds, the merchants exchange them for USDT through exchanges or cryptocurrency brokers and transfer them back to the platform. The platform then takes its commission and transfers the funds to overseas trading platforms.

We traced three core payment addresses across the platform, with a total transaction volume of 933 million USDT:

The sole payment address (TQxxxx4) handled 715 million USDT transactions between February 2025 and February 2026, primarily responsible for refunding deposits and transferring funds to overseas trading platforms.

The sole receiving address (TLxxxx5) : From January 2025 to February 2026, 674 million USDT were traded. The funds mainly came from exchanges and cryptocurrency merchants' addresses, and it was the main receiving address for user transfers.

(ii) LaiCai Guarantee's covert technical methods: making every effort to evade regulatory tracking.

As a technology security company, we conducted an in-depth analysis of Laicai Guarantee's technical architecture and discovered that it employed a series of professional covert methods to evade tracking, which is also a common practice among many illegal guarantee platforms:

• Multi-chain parallel processing + cross-chain transfer: It mainly uses the Tron network (TRX) for transactions, while also supporting multi-chain transfers such as Ethereum and Binance Smart Chain. Funds frequently switch between different chains, disrupting the transaction trajectory.
• Multisignature address + anonymous wallet: The core addresses all use multisignature technology, which requires multiple private keys to authorize the transfer, and the funds will eventually be transferred to a decentralized anonymous wallet, which cannot be associated with the real identity;
• Distributed server deployment: The operating servers are located in multiple countries such as Cambodia, Myanmar, and Russia. VPNs and jump servers are used to hide the real IP address. Even if a server in one country is blocked, the other servers can continue to operate.
• Transaction fragmentation: Large sums of money will be split into multiple small transactions, each typically less than 1,000 USDT, with irregular transfer intervals to avoid triggering on-chain monitoring rules;
• Regularly change the address: The core business address is changed every 3-6 months. The old address is no longer used, making it difficult to continue tracking.

Legal Red Line: The Dual Risks for Guarantee Platforms and Participants

Having discussed the technical aspects, let's now talk about the legal aspects.

In real life, many people involved in illegal activities and those looking to "make quick money" harbor wishful thinking, believing that "no one cares about overseas platforms" or that "it's just transferring money, it's not a crime." But the truth is, regardless of whether the platform is located overseas or domestically, as long as it involves Chinese citizens and harms Chinese interests, it will be subject to Chinese law; and regardless of whether the participants actively commit crimes or are passively involved, as long as they break the law, they will bear the corresponding responsibility.

(a) Legal liability of operators of guarantee platforms: Maximum penalty of life imprisonment

According to China's Criminal Law and related judicial interpretations, operators of overseas guarantee platforms are primarily suspected of the following crimes:

① Money laundering includes providing bank accounts, assisting in converting assets into cash or negotiable instruments, assisting in transferring funds through bank transfers or other settlement methods, and assisting in remitting funds abroad, all of which involve proceeds and profits from drug-related crimes, organized crime, terrorist activities, smuggling, corruption, bribery, crimes disrupting financial management, and financial fraud. Those with serious offenses are subject to imprisonment for five to ten years and a fine of 5% to 20% of the laundered amount. If the amount involved is exceptionally large or the circumstances are particularly serious, the maximum penalty is life imprisonment.

❷ The crime of illegal business operations: Operating securities, futures, or insurance businesses without approval from the relevant state authorities, or illegally engaging in fund payment and settlement businesses, constitutes the crime of illegal business operations if the circumstances are serious. Overseas guarantee platforms are essentially illegally engaging in fund payment and settlement businesses; if the circumstances are serious, the offender shall be sentenced to fixed-term imprisonment of not more than five years or criminal detention, and shall also be fined not less than one time but not more than five times the illegal gains; if the circumstances are particularly serious, the offender shall be sentenced to fixed-term imprisonment of not less than five years, and shall also be fined not less than one time but not more than five times the illegal gains or have his property confiscated.

❸ Crime of aiding and abetting cybercrime (hereinafter referred to as the crime of aiding and abetting cybercrime): Anyone who knowingly provides technical support such as Internet access, server hosting, network storage, or communication transmission, or provides assistance such as advertising promotion or payment settlement for others who use information networks to commit crimes, shall be guilty of aiding and abetting cybercrime if the circumstances are serious. He or she shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention, and may also be fined.

In addition, depending on the specific business, platform operators may be subject to multiple charges, such as fraud, trafficking in citizens' personal information, and smuggling, and may be punished for multiple crimes.

It is important to note that even if a platform is registered overseas, its servers are located overseas, and its operators are foreign nationals, Chinese judicial authorities have jurisdiction if its business involves illegal transactions by Chinese citizens or harms China's interests. In recent years, my country has successfully extradited several overseas operators of black market platforms through international judicial assistance, demonstrating that "the net of justice is wide and its meshes are fine."

(II) Legal risks for ordinary people: These behaviors may constitute crimes!

Many people think they're just "making a little money" and won't commit serious crimes, but in reality, the following common behaviors can all constitute crimes:

❶ Participating in money laundering through a platform's money laundering app involves using your bank card, Alipay, or WeChat to receive funds from strangers, then exchanging them for USDT and transferring them to the platform's designated address to earn commissions. This behavior constitutes the crime of aiding and abetting fraud. Even if you only participate once, as long as the amount involved reaches a certain standard (usually a payment settlement amount of over 200,000 yuan, or illegal gains of over 10,000 yuan), you will be held criminally liable.

❷ Acting as a USDT merchant, providing exchange services for the platform: Acting as an intermediary between the platform and users, receiving RMB from users and then transferring it to the platform in USDT, or vice versa, profiting from the exchange rate difference. This behavior may constitute the crimes of illegal business operations, aiding and abetting fraud, or money laundering, especially when it is known that the funds come from illegal activities such as telecommunications fraud or gambling, the penalties will be more severe.

❸ Promoting and attracting new users to the escrow platform by offering a commission for each successful referral. This behavior constitutes aiding and abetting crime through advertising and promotion, and even without direct involvement in financial transactions, one will still bear legal responsibility.

❹ Renting out bank cards and SIM cards: Renting out one's own bank cards and SIM cards to others for receiving funds or registering on a platform is known as "two-card" crime. It is a common form of aiding and abetting fraud and has been a key focus of public security organs in recent years.

In addition, even if it does not constitute a criminal offense, participants' bank cards, Alipay, and WeChat Pay accounts will be frozen, affecting their normal lives; if cross-border fund flows are involved, they may also be included in the credit blacklist, affecting loan and credit card applications, etc.

(III) Legal Misconceptions: These "Excuses" Cannot Be Used as Grounds for Exoneration

Many people involved in cases will try to defend themselves with various excuses after being arrested, but these excuses are not valid in the face of the law:

① "I didn't know it was illegal" Whether someone was aware of the illegality cannot be determined solely by their verbal statement. The judicial authorities will make a comprehensive judgment based on factors such as their cognitive abilities, the environment they were exposed to, and the extent of their profits. For example, someone who has been involved in the cryptocurrency industry for a long time is unlikely to be unaware that USDT transactions are highly likely to involve money laundering. In such cases, the defense of "ignorance" will not be accepted.

❷ "The platform is located overseas, so I thought China couldn't regulate it." As mentioned earlier, as long as the behavior harms China's interests and involves Chinese citizens, Chinese judicial authorities have jurisdiction. Overseas is not a lawless zone.

❸ “I’m just a nobody, I don’t earn much money.” In joint crimes, even accomplices must bear criminal responsibility, although their sentences will be lighter than those of the principal offenders. But this does not mean they can get away with it.

In conclusion: Understanding the truth about escrow platforms and the black market.

The core of Web3 is decentralization and transparency, but technology itself does not distinguish between legal and illegal. Genuine industry practitioners adhere to the bottom line of compliance, while those platforms that use technology to engage in illegal activities will eventually be cracked down on by regulators and abandoned by the industry.

All unlicensed overseas cryptocurrency guarantee platforms are essentially accomplices to illicit activities. What you perceive as a "safe guarantee" is actually endorsing criminal acts, and participating in them means crossing legal boundaries. Behind the "quick money" schemes of these illicit activities lie unseen traps. Platforms may abscond with funds, your money may be frozen, and participation could turn you into a tool for crime, ultimately resulting in "no money earned, but plenty of jail time."

In conclusion, I'd like to say that while Web3 technology possesses immense innovative potential, this potential must be realized within a legal and compliant framework. I hope this article helps everyone bridge the information gap, see through the true nature of certain guarantee platforms, stay away from shady and illegal activities, and protect their assets and freedom.