Key Takeaways
- Xinbi Guarantee, a Colorado-incorporated entity, has emerged as a central platform in laundering billions in cyberfraud and scam proceeds.
- The marketplace facilitates money laundering for scams such as pig butchering and is linked to North Korean crypto thefts.
- Analysts at Elliptic have traced over $8 billion in crypto inflows to Xinbi-related addresses, revealing industrial-scale illicit operations.
In the increasingly complex world of cybercrime, marketplaces based on the Telegram messaging app are supplanting the more established darknet platforms. A prime example is Xinbi Guarantee, a vast operation entrenched in illicit finance with its nominal headquarters in Colorado, USA.
In spite of apparently legitimate incorporation as “Xinbi Co., Ltd” in August 2022, the state records indicate the business defaulted as of January 2025. Far from standard business activities, Xinbi enables monetization of online fraud on a scale that is enormous.
Over 233,000 registered users, nearly doubling in less than a year, mirror the marketplace’s transactional volume. The marketplace, mainly in Chinese and dealing in the stablecoin USDT, caters to a range of fraudulent players.
These range from “pig butchering” scammers that engage in a form of online romance or investment fraud that manipulates a victim for prolonged interactions.
Elliptic’s analysts estimate that Xinbi-related wallets have received a minimum of $8.4 billion since 2022, but the true figures are considerably greater. It accelerated toward the end of 2024, with Q4 alone reporting over $1 billion of inflows.
Xinbi Crypto Infrastructure Aids Fraud Activities
Xinbi vendors fall into nine categories of vendors, with four of them specifically for money laundering. It not only accepts but solicits scam and cybercrime proceeds and proudly proclaims that it can “whiten” illegal capital.
Aside from laundering services, vendors provide digital fraud infrastructure ranging from hacked personal databases to Starlink equipment used by scam operations located in isolated compounds.
More disturbing are the outliers within Xinbi’s vendor list. Some offer illegal services such as surveillance and physical intimidation inside China, while others traffic in reproductive services and sex work, including the exploitation of minors. These listings suggest that Xinbi’s reach extends beyond cybercrime into traditional criminal enterprise.
Elliptic’s analysis reinforces the extent and magnitude of the operation. Elliptic Investigator, their platform, renders the fraudulent proceeds passing along Xinbi’s infrastructure visually apparent.
This involves following crypto from individual instances of cybercrime activities like the July 2024 hack of India-based WazirX by North Korean actors. A minimum of $220,000 in pilfered funds passed through Xinbi addresses in November of 2024, affirming its status as a nation-state-level cyber-theft laundering platform.
Crypto Laundering and Underground Banking Networks
Xinbi and its peers, like the larger Huione Guarantee, serve as pillars of a growing, decentralized financial underground. According to Elliptic’s analysis, these platforms are central to a broader network of illicit digital banking in China.
They use stablecoins to anonymize and facilitate transfers for various illicit actors globally. Their scale dwarfs early darknet marketplaces like Silk Road, reflecting a pivot in cybercrime priorities from narcotics to more profitable, harder-to-trace financial scams.
Law enforcement and cryptoasset exchanges now have a growing onus on them to become more responsive. Elliptic is calling for the utilization of blockchain screening technologies in order to alert wallets and transactions associated with Xinbi’s network.
The information is available; the question is how to respond in a timely and coordinated manner across both the regulatory and tech fronts. Just as Xinbi’s innovation evolves, the tools constructed to thwart it should follow.
Related Reading | Dogecoin Futures Open Interest Soar 63.9% to $1.62B Even After Price Drop