<p>Illicit personal information trading, a hallmark of internet dark and gray industries, has deeply infiltrated the global criminal economic system, serving as a critical driver and “raw material factory” for numerous offenses. This study focuses on its role as the core enabler of China’s telecom fraud criminal ecosystem, revealing its systemic characteristics and multi-dimensional evolutionary patterns, with significant theoretical and practical implications. Utilizing telecom fraud case data and anonymous network transaction data, this research employs analytical description and Event Logic Graph (ELG) to systematically uncover the operational mechanisms and evolutionary rules of illicit personal information trading. The findings demonstrate a pronounced “data capitalization” feature within this trade, empirically validating the cybercrime economics law of “data-as-criminal-capital”. The constructed “communication-fund flow-transaction” evolution model reveals a paradigm shift from traditional tool reliance to technology-driven operations: communication modes migrated from traditional channels to hybrid Telegram API and Tor+Signal architectures; fund flow evolved from fiat cash to USDT mixing and money laundering via “Pao Fen” platforms; transaction models upgraded from bulk sales to “customized subscription” services. This illicit trade has matured into an industrialized division of labor: upstream actors steal full-lifecycle data via automated scripts; midstream processes and packages standardized data products; downstream legitimizes criminal proceeds through diverse money laundering methods. This research not only deepens the understanding of cybercrime economics but also, by uncovering the evolutionary pathways of the criminal ecosystem and its industrial chain structure, provides crucial theoretical foundations and practical targets for formulating targeted governance strategies and building a global collaborative regulatory framework.</p>