Cybercriminals Exploit Chinese Guarantee Markets to Sell Stolen Credentials

This report details Chinese-language "guarantee" marketplaces hosted mainly on Telegram that operate as escrow-style criminal platforms enabling the sale of stolen credentials, fraud kits, SIM/KYC bypass, deepfake and laundering services (highlighting Huione, which processed over $27 billion in crypto from 2021–2025). It explains how escrow deposits, bot-managed workflows, and stablecoin settlement reduce exit-scam risk and scale operations into transnational fraud networks and scam compounds, reviews enforcement impacts, and recommends defensive actions including credential hygiene, phishing-resistant MFA, monitoring for illicit listings, and forensic crypto-tracing.