Scammers have used Haotian and other deepfake tools to more easily prove their deception, allowing victims to “videochat” with a character they believe they are talking to as part of an investment opportunity, friendship, or even romantic relationship. An analysis of four cryptocurrency wallets linked to Haotian by cryptocurrency tracing firm Elliptic shows that the company has received at least $3.9 million in payments in recent years, including money from cryptocurrency wallets linked to alleged criminal activity, including fraud. Additionally, Elliptic says that approximately half of its payouts were linked to scam marketplaces sanctioned by the US government.
Haotian, which emerged around 2021, was “the first of its kind and very popular,” says Hieu Minh Ngo, a reformed criminal hacker turned cybercrime investigator at Chongluadao, a Vietnamese scam-fighting non-profit organization. The NGO has conducted extensive research on Haotian and its operations. “The results are almost perfect,” he says. “And they’re getting better and better every day. If you check in the crypto wallet, you’ll see money coming in every day.”
Haotian is just one part of a broader tech ecosystem that has emerged around Southeast Asia’s booming cybercrime industry and forced labor scam compounds. And as face swapping and other video deepfake tools have become more widely available, they have increasingly become involved in scamming and other types of cybercrime around the world. Over the past two years, officials working for the United Nations Office on Drugs and Crime have identified more than 10 face-swapping tools potentially being used by cybercriminals in Southeast Asia, including cryptocurrency scams and police officer impersonation.
Haotian has a website for its face-swapping tool, but it primarily promotes its desktop app through a public Telegram channel, which was launched in October 2023, according to the NGO’s research. Through this channel, which now has more than 20,000 subscribers, the company markets new versions of the app, gives development updates and provides technical support. While marketing software through Telegram isn’t inherently nefarious, researchers say Haotian’s customer base is increasingly skewed toward scammers who already want information about a range of gray market services on the messaging app.
Telegram declined to comment. However, after WIRED contacted the company, the main public Haotian Telegram channel and some associated accounts appeared to be inaccessible or deleted. Telegram did not respond to a request for comment on whether the company had closed these accounts.
<a href