A Chinese-language marketplace called Xinbi Guarantee has been tied to a firm incorporated in Colorado and has handled at least $8.4 billion in Tether stablecoin since 2022.
Security researchers at Elliptic revealed on May 13 that this Telegram-based illicit market caters to fraudsters across Southeast Asia. The site sells tools for scams known as pig butchering, where victims are lured into fake investment schemes.
Money Laundering Services
On Xinbi’s platform, merchants offer a range of money laundering services. Channels are organised into categories that list how they will clean stolen funds and turn them into so-called white capital.
Many openly advertise their willingness to handle proceeds from pig butchering scams. This core activity accounts for the largest share of transactions on the market.
A Variety of Illegal Goods
Beyond laundering, vendors sell other illicit wares. Buyers can obtain Starlink hardware often used at remote scam compounds. They can purchase counterfeit identity documents and databases of stolen personal data.
Some merchants even advertise services that enable stalking and intimidation within China. Others offer child-bearing surrogates or egg donation, both illegal under local law. Troublingly, several vendors appear to be involved in sex trafficking, including victims as young as fourteen.
Also Read: Thailand’s SEC Strengthens Crypto Regulations Against Money Laundering
Surge in Crypto Flows
Elliptic’s tracking of thousands of crypto addresses linked to Xinbi shows strong growth in stablecoin inflows. The last quarter of 2024 was the first to exceed $1 billion in USDT receipts.
This scale puts Xinbi Guarantee ahead of most older darknet markets like Silk Road and Alphabay, which dealt mainly in illegal drugs. The vast sums reflect the rise of high-value cyber scams compared to the trade in controlled substances.
Corporate Link in Colorado
Xinbi’s website claims it operates through Xinbi Co. Ltd, a firm incorporated in Colorado in August 2022. Public records confirm the company was registered in Aurora, Colorado.
By January, the state declared the corporation delinquent for failing to file a required report. This formal tie gives a veneer of legitimacy to an operation that serves organised crime.
Connections to North Korea Hacks
Researchers have also linked Xinbi Guarantee to laundering cryptocurrency stolen by North Korean–linked groups. After a 2024 breach at the Indian exchange WazirX saw $235 million was stolen, funds passed through Xinbi addresses.
Elliptic’s tools can trace these flows as scammers convert and move assets across blockchains and decentralised exchanges.
Underground Banking Revealed
Xinbi and similar platforms like Huione Guarantee offer a glimpse into an underground banking network in China. This system relies on stablecoins and other digital payments to shuttle money around the globe.
Telegram serves as the front end, providing access to over a billion users. Elliptic now tracks more than thirty markets of this type. Together, they have handled over $35 billion in Tether transactions.
As law enforcement and tech firms clamp down on channels like Xinbi Guarantee, scammers may migrate to new platforms. Regulators face a challenge in policing financial services hidden on messaging apps.
At the same time, the scale of these markets underlines the need for global coordination. Closing one market will not end pig butchering or money laundering. It may only push operators to adapt their methods or move to other apps.
Also Read: FinCEN To Bar Huione Group From U.S. Banking Over Money Laundering & Ties With N.Korean Hackers