Audit log

Every state-changing event for Dabai Guarantee: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-24 17:13:25Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 450,093,129

   sig

   2stA5rwa6Nq9…Y5QS8AFLcopyexplorer ↗

   hash

   83Nq9QAchNsJ…bLTjfXoJcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (19708 B) ▸

   {"actor":"system:backfill","investigation_id":"ddc342a3-e804-4fbb-abd2-46f783da0afe","kind":"publish","page_slug":"dabai-guarantee","published_at":"2026-09-24T17:13:25.722Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Dabai Guarantee","sections":[{"content":"Dabai Guarantee is believed to have been founded in approximately December 2024, based on the creation date of its primary Telegram channel, according to Recorded Future's Insikt Group. The platform operates exclusively on Telegram and maintains no clearnet website, a deliberate operational security choice consistent with lessons drawn from the law enforcement actions that shut down Huione Guarantee in May 2025. The marketplace consists of a network of public and private Telegram channels, with documented primary channels including a navigation directory (@dabai_a, approximately 15,372 subscribers), a main group (@dabai_c, approximately 19,225 members), a supply-and-demand channel (@dabaiyajing, approximately 17,085 subscribers), a rules channel (@dabai_e), and a customer service roster channel (@dabai_f). A dedicated bot (@dbdbqg_bot) enables searchable access to campaign channels by criminal service category. The platform also operates Public Group 301 (@DBTM301), which focuses on card-fraud sweeping operations in South Korea and Japan. The marketplace employs an organizational hierarchy of bosses (campaign coordinators), administrators, sweeping teams, goods-receiving teams, and inspection teams, which Insikt Group notes complicates law enforcement tracking through siloed operations.","heading":"Platform Overview and Structure","severity":"critical","sources":[{"credibility":2,"name":"Evolution of Chinese-Language Guarantee Telegram Marketplaces — Recorded Future / Insikt Group","type":"research","url":"https://www.recordedfuture.com/research/evolution-of-the-chinese-language"},{"credibility":2,"name":"Malware.news summary: Evolution of Chinese-Language Guarantee Telegram Marketplaces","type":"news_article","url":"https://malware.news/t/evolution-of-chinese-language-guarantee-telegram-marketplaces/106346"}]},{"content":"According to Recorded Future's Insikt Group, Dabai Guarantee's third-party vendors allegedly offer a wide range of services that facilitate crypto-enabled fraud and cybercrime. Documented service categories include: money laundering methods and services (including ATM cash withdrawals and ghost-tapping, an NFC relay fraud technique targeting contactless payment systems); sales of compromised social media and e-commerce accounts; SIM card trafficking; personally identifiable information (PII) datasets; malware-as-a-service (MaaS); deepfake technology services; know-your-customer (KYC) bypass services; phishing kits; carding operations; and traffic generation services. Insikt Group documented that Public Group 301's primary wallet on the Tron network (address: TByDzGWCirpCABaUorkhz5eWhjyDdYWgSo) recorded 2,943 transactions, with a sample transaction of 10,629 USDT documented via the Tron network. Vendors require a minimum deposit of 500 USDT to launch campaigns on the platform. USDT (Tether) via the Tron network is the primary cryptocurrency used across the marketplace. Sweeping operations targeting South Korea and Japan involve fraudulent purchases of goods including tobacco products and consumer electronics at retail locations, as well as ATM cash withdrawals.","heading":"Alleged Criminal Services","severity":"critical","sources":[{"credibility":2,"name":"Evolution of Chinese-Language Guarantee Telegram Marketplaces — Recorded Future / Insikt Group","type":"research","url":"https://www.recordedfuture.com/research/evolution-of-the-chinese-language"},{"credibility":2,"name":"Malware.news summary: Evolution of Chinese-Language Guarantee Telegram Marketplaces","type":"research","url":"https://malware.news/t/evolution-of-chinese-language-guarantee-telegram-marketplaces/106346"}]},{"content":"Recorded Future's Insikt Group documented that a Chinese-speaking threat actor known as the Tajin Group — a phishing, carding, financial fraud, and money laundering operation — operated as a third-party vendor on Dabai Guarantee from May 2025 to April 2026. Tajin Group's activity on Dabai included posting via channel @dbtm898 (Dabai Public Group 8848), which had approximately 141 members at the time of research. The group's deposit on Dabai was 888 USDT. On approximately April 10, 2026, Tajin Group ceased operations on Dabai and migrated to the Xinbi Guarantee marketplace around May 2026, consistent with guarantee marketplace rules that reportedly require vendors to use only one platform at a time. Tajin Group's subsequent Xinbi deposit was 208,848 USDT — more than 230 times larger — suggesting significant operational expansion between the two platforms. The Tajin Group's documented cash-out methods on behalf of clients included exploiting Chinese banks (ICBC, BOC, CCB, Agricultural Bank), stolen payment card procedures, and control-bypass techniques for banking risk systems.","heading":"Vendor Activity: Tajin Group","severity":"high","sources":[{"credibility":2,"name":"Tajin Group: Guarantee Marketplace Vendor Involved in Phishing and Chinese Money Laundering Group — Recorded Future","type":"research","url":"https://www.recordedfuture.com/research/tajin-group-gurantee-marketplace"},{"credibility":2,"name":"Tajin Group Phishing Network Linked to Guarantee Marketplaces — Security Online","type":"news_article","url":"https://securityonline.info/tajin-group-phishing-network/"}]},{"content":"Dabai Guarantee emerged in the context of a rapidly fragmenting Chinese-language guarantee marketplace ecosystem following successive law enforcement actions. Huione Guarantee (also known as Haowang Guarantee) was banned by Telegram in May 2025 and had its backend infrastructure seized by the U.S. Department of Justice on June 23, 2026. Tudou Guarantee wound down in January 2026 after processing approximately $12 billion in transactions, according to Elliptic. Xinbi Guarantee was sanctioned by the UK government in March 2026 and designated as a significant transnational criminal organization by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on September 9, 2026; the U.S. Secret Service simultaneously froze approximately $52.8 million in cryptocurrency linked to Xinbi. Elliptic has tracked over 30 replacement marketplaces that emerged following Huione's shutdown, including Dabai, Tiancheng, Ouyi, Yinuo, Jin Bo, Haihua, and Timi. Insikt Group analysts characterize the environment as a 'whack-a-mole' dynamic: each enforcement action prompts rapid migration of vendors and transaction volume to successor platforms. Dabai operates exclusively on Telegram, with no clearnet presence, which distinguishes it from Huione and reduces one of the enforcement vectors used against prior platforms.","heading":"Ecosystem Context: Successor Marketplace Dynamics","severity":"high","sources":[{"credibility":2,"name":"Elliptic data leads to the shutdown of the two largest online criminal marketplaces of all time","type":"research","url":"https://www.elliptic.co/blog/elliptic-data-telegram-market-takedown"},{"credibility":2,"name":"Tudou Guarantee winds down operations after $12 billion in transactions — Elliptic","type":"research","url":"https://www.elliptic.co/blog/tudou-guarantee-winds-down-operations-after-12-billion-in-transactions"},{"credibility":2,"name":"DOJ Seizes Huione Infrastructure Linked to Billions in Crypto Laundering — Decrypt","type":"news_article","url":"https://decrypt.co/371950/doj-seizes-huione-infrastructure-linked-to-billions-in-crypto-laundering"},{"credibility":1,"name":"Justice Department Seizes Backend Infrastructure Used by the Huione Group — DOJ","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-seizes-backend-infrastructure-used-huione-group-money-laundering-services"},{"credibility":1,"name":"Treasury Cracks Down on Xinbi Transnational Criminal Organization — U.S. Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0624"},{"credibility":2,"name":"Huione marketplace death sprouts 30 more in its place: Elliptic — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/darknet-marketplaces-thriving-after-huione-shutdown"}]},{"content":"The services advertised by vendors on Dabai Guarantee — including money laundering, SIM cards, stolen PII, compromised accounts, and malware-as-a-service — are consistent with the infrastructure layer used by pig-butchering operations and Southeast Asian scam compound networks, according to research from Recorded Future, Elliptic, and the U.S. government. Pig-butchering is a category of fraud in which operators build fake romantic or investment relationships with victims over weeks or months, then induce victims to deposit funds into fraudulent crypto investment platforms. The FBI's Internet Crime Complaint Center (IC3) reported over $7.2 billion in cryptocurrency investment fraud losses in 2025 alone. The guarantee marketplace model — which acts as an escrow to ensure service delivery between criminal buyers and sellers — is described by U.S. prosecutors in the Xinbi and Huione cases as a direct enabler of scam-center operations targeting victims globally, including Americans. No direct public documentation links Dabai Guarantee specifically to a named pig-butchering syndicate or scam compound; the platform's role is documented at the vendor-infrastructure level.","heading":"Connection to Pig-Butchering and Scam-Center Infrastructure","severity":"high","sources":[{"credibility":2,"name":"The 2026 Pig Butchering Reckoning: Inside the Year's Biggest Crypto Scam Crackdowns — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/05/2026-pig-butchering-crypto-scam-crackdowns/"},{"credibility":2,"name":"Chinese Telegram Networks Launder $16B Via Crypto in 2025 — BanklessTimes","type":"news_article","url":"https://www.banklesstimes.com/articles/2026/02/02/chinese-telegram-networks-launder-16b-via-crypto-in-2025/"},{"credibility":1,"name":"Justice Department Seizes Backend Infrastructure Used by the Huione Group — DOJ","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-seizes-backend-infrastructure-used-huione-group-money-laundering-services"}]},{"content":"As of September 2026, no publicly reported enforcement action — including DOJ charges, OFAC designation, Telegram channel seizure, or cryptocurrency freeze — has specifically targeted Dabai Guarantee. The platform is not listed on the OFAC Specially Designated Nationals (SDN) list based on available public records. The platform's Telegram channels were active as of the April 2026 Insikt Group report. The absence of enforcement action does not indicate legitimacy; the guarantee marketplace ecosystem has a documented pattern of migration and reconstitution that complicates sustained action against individual platforms. Peer platforms that have faced enforcement include Xinbi Guarantee (OFAC designation and $52.8 million Secret Service asset freeze, September 9, 2026) and Huione Guarantee (DOJ infrastructure seizure, June 23, 2026; FinCEN primary money laundering concern designation, October 2025). Tudou Guarantee self-shutdown in January 2026. The DOJ's Scam Center Strike Force, launched in November 2025, has restrained approximately $938 million in total since its formation.","heading":"Enforcement Status","severity":"medium","sources":[{"credibility":1,"name":"Scam Center Strike Force Conducts Seizures of Xinbi — DOJ","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/scam-center-strike-force-conducts-seizures-chinese-run-illicit-scammer-marketplace-and"},{"credibility":2,"name":"Secret Service Freezes $52.8 Million in Crypto Tied to Xinbi — Decrypt","type":"news_article","url":"https://decrypt.co/377804/secret-service-freezes-crypto-telegram-bazaar-xinbi"},{"credibility":2,"name":"DOJ Seized Xinbi's Telegram Channels as OFAC Designated It a Criminal Organization — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/10/us-seizes-52m-in-crypto-and-telegram-channels-linked-to-xinbi-guarantee/"}]}],"sources_used":[{"credibility":2,"name":"Evolution of Chinese-Language Guarantee Telegram Marketplaces — Recorded Future / Insikt Group","type":"research","url":"https://www.recordedfuture.com/research/evolution-of-the-chinese-language"},{"credibility":2,"name":"Insikt Group Report PDF (April 22, 2026) — cta-2026-0422","type":"research","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2026/cta-2026-0422.pdf"},{"credibility":2,"name":"Tajin Group: Guarantee Marketplace Vendor Involved in Phishing and Chinese Money Laundering Group — Recorded Future","type":"research","url":"https://www.recordedfuture.com/research/tajin-group-gurantee-marketplace"},{"credibility":2,"name":"Malware.news summary: Evolution of Chinese-Language Guarantee Telegram Marketplaces","type":"news_article","url":"https://malware.news/t/evolution-of-chinese-language-guarantee-telegram-marketplaces/106346"},{"credibility":2,"name":"Elliptic data leads to the shutdown of the two largest online criminal marketplaces of all time","type":"research","url":"https://www.elliptic.co/blog/elliptic-data-telegram-market-takedown"},{"credibility":2,"name":"Tudou Guarantee winds down operations after $12 billion in transactions — Elliptic","type":"research","url":"https://www.elliptic.co/blog/tudou-guarantee-winds-down-operations-after-12-billion-in-transactions"},{"credibility":1,"name":"Justice Department Seizes Backend Infrastructure Used by the Huione Group — DOJ","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-seizes-backend-infrastructure-used-huione-group-money-laundering-services"},{"credibility":1,"name":"Treasury Cracks Down on Transnational Criminal Organization (Xinbi) — U.S. Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0624"},{"credibility":1,"name":"Scam Center Strike Force Conducts Seizures of Xinbi — DOJ USAO-DC","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/scam-center-strike-force-conducts-seizures-chinese-run-illicit-scammer-marketplace-and"},{"credibility":2,"name":"Secret Service Freezes $52.8 Million in Crypto Tied to Xinbi — Decrypt","type":"news_article","url":"https://decrypt.co/377804/secret-service-freezes-crypto-telegram-bazaar-xinbi"},{"credibility":2,"name":"DOJ Seizes Huione Infrastructure Linked to Billions in Crypto Laundering — Decrypt","type":"news_article","url":"https://decrypt.co/371950/doj-seizes-huione-infrastructure-linked-to-billions-in-crypto-laundering"},{"credibility":2,"name":"Huione marketplace death sprouts 30 more in its place: Elliptic — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/darknet-marketplaces-thriving-after-huione-shutdown"},{"credibility":2,"name":"The 2026 Pig Butchering Reckoning — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/05/2026-pig-butchering-crypto-scam-crackdowns/"},{"credibility":2,"name":"Chinese Telegram Networks Launder $16B Via Crypto in 2025 — BanklessTimes","type":"news_article","url":"https://www.banklesstimes.com/articles/2026/02/02/chinese-telegram-networks-launder-16b-via-crypto-in-2025/"},{"credibility":2,"name":"DOJ Seized Xinbi's Telegram Channels as OFAC Designated It a Criminal Organization — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/10/us-seizes-52m-in-crypto-and-telegram-channels-linked-to-xinbi-guarantee/"},{"credibility":2,"name":"Tajin Group Phishing Network Linked to Guarantee Marketplaces — Security Online","type":"news_article","url":"https://securityonline.info/tajin-group-phishing-network/"},{"credibility":2,"name":"The Prehistory of Chinese-Language Guarantee Marketplaces — Flare","type":"research","url":"https://flare.io/learn/resources/blog/prehistory-chinese-language-guarantee-marketplaces"}],"summary":"Dabai Guarantee (Chinese: 大白担保) is a Chinese-language criminal marketplace operating exclusively on Telegram, documented by Recorded Future's Insikt Group as a major active successor platform following the 2025 shutdown of Huione Guarantee and the January 2026 wind-down of Tudou Guarantee. The platform allegedly facilitates money laundering, sales of stolen personal data, SIM cards, compromised accounts, malware-as-a-service, and KYC bypass services for crypto-enabled fraud operations. As of mid-2026, no enforcement action targeting Dabai Guarantee specifically has been publicly reported, though the broader guarantee marketplace ecosystem has faced significant U.S. government action against peers including Huione and Xinbi.","timeline":[{"date":"2024-12","event":"Dabai Guarantee believed founded, based on Telegram channel creation date documented by Insikt Group.","source":"Recorded Future / Insikt Group — Evolution of Chinese-Language Guarantee Telegram Marketplaces","source_url":"https://www.recordedfuture.com/research/evolution-of-the-chinese-language"},{"date":"2025-03-21","event":"Dabai Guarantee Public Group 301 (@DBTM301) established, focusing on sweeping operations in South Korea and Japan.","source":"Recorded Future / Insikt Group — Evolution of Chinese-Language Guarantee Telegram Marketplaces","source_url":"https://www.recordedfuture.com/research/evolution-of-the-chinese-language"},{"date":"2025-05","event":"Telegram bans Huione Guarantee's channels; Huione shuts down. Dabai and other successor platforms begin absorbing displaced vendors. Tajin Group begins operating on Dabai Guarantee around this time.","source":"Elliptic blog; Recorded Future Tajin Group report","source_url":"https://www.elliptic.co/blog/elliptic-data-telegram-market-takedown"},{"date":"2026-01","event":"Tudou Guarantee self-shuts after processing approximately $12 billion in transactions, according to Elliptic. Further vendor migration expected to remaining platforms including Dabai.","source":"Elliptic — Tudou Guarantee winds down operations","source_url":"https://www.elliptic.co/blog/tudou-guarantee-winds-down-operations-after-12-billion-in-transactions"},{"date":"2026-04-10","event":"Tajin Group ceases operations on Dabai Guarantee, later pivoting to Xinbi Guarantee around May 2026.","source":"Recorded Future — Tajin Group report","source_url":"https://www.recordedfuture.com/research/tajin-group-gurantee-marketplace"},{"date":"2026-04-22","event":"Recorded Future / Insikt Group publishes report documenting Dabai Guarantee as a major active Chinese-language guarantee marketplace on Telegram, detailing its infrastructure, services, and vendor ecosystem.","source":"Recorded Future — Evolution of Chinese-Language Guarantee Telegram Marketplaces (report date)","source_url":"https://assets.recordedfuture.com/insikt-report-pdfs/2026/cta-2026-0422.pdf"},{"date":"2026-06-23","event":"DOJ seizes cloud infrastructure used by Huione Group, describing it as one of the world's most prolific criminal marketplaces. Action does not target Dabai.","source":"DOJ Office of Public Affairs","source_url":"https://www.justice.gov/opa/pr/justice-department-seizes-backend-infrastructure-used-huione-group-money-laundering-services"},{"date":"2026-09-09","event":"U.S. Treasury OFAC designates Xinbi Guarantee as a significant transnational criminal organization; U.S. Secret Service freezes approximately $52.8 million in Xinbi-linked crypto. No corresponding action against Dabai announced.","source":"U.S. Treasury press release; Decrypt","source_url":"https://home.treasury.gov/news/press-releases/sb0624"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 63d93e70-adfc-46d1-81c9-3f639139cad2copy