Blockchain analytics firm Elliptic has exposed Xinbi Guarantee, a Colorado-registered company operating a Telegram-based black market that has facilitated $8.4 billion in illicit cryptocurrency transactions since 2022.
This Chinese-language platform, masquerading as an “investment and capital guarantee group,” has become a hub for Southeast Asian scammers, money launderers, and even North Korean hackers, raising questions about regulatory oversight and the misuse of U.S.-based entities in global cybercrime.
Xinbi Guarantee, incorporated in Colorado in 2022, operates an online marketplace with 233,000 users, primarily serving fraudsters engaged in “pig butchering” scams—deceptive schemes that lure victims into fake cryptocurrency investments.
The platform’s vendors offer an array of services, including money laundering, stolen personal data, fake IDs, and even Starlink equipment for scammers.
Elliptic’s research also uncovered disturbing offerings, such as harassment-for-hire services.
Some listings even point to potential sex trafficking, with advertisements for teenage sex workers, likely victims of exploitation.
The marketplace’s transaction volume, primarily in Tether (USDT) stablecoins, is staggering.
Elliptic identified thousands of crypto addresses linked to Xinbi, with over $1 billion transacted in the last quarter of 2024 alone.
The firm cautions that the $8.4 billion figure is likely a conservative estimate, as the platform’s true scale may be even larger.
Evidence also ties Xinbi to North Korean hackers laundering stolen funds, highlighting its role in enabling state-sponsored cybercrime.
Notably, Xinbi Guarantee openly boasts its U.S. registration on its website, despite being marked “delinquent” in January 2025 for failing to file required reports.
This raises serious concerns about how a company incorporated in Colorado could operate such a criminal enterprise under the radar.
The platform’s “guarantee model,” which requires vendors to deposit funds to prevent fraud, mirrors tactics used by other illicit markets, creating a veneer of legitimacy while enabling rampant criminality.
Xinbi is not an isolated case.
In July 2024, Elliptic exposed Huione Guarantee, a Cambodia-based marketplace that facilitated $24 billion in illicit transactions, making it the largest known illicit online market.
Huione, recently rebranded as Haowang Guarantee, was designated a money-laundering operation by the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) in May 2025, severing its access to U.S. financial systems.
Both Xinbi and Huione expose a broader “China-based underground banking system” leveraging stablecoins for large-scale money laundering, a growing challenge for global law enforcement.
Following Elliptic’s investigation and inquiries from WIRED, Telegram took action, banning thousands of channels and administrator accounts linked to Xinbi and Huione in May 2025.
Telegram’s spokesperson, Remi Vaughn, emphasized that such criminal activities violate the platform’s terms of service and are removed when detected.
However, Elliptic’s Tom Robinson warns that these markets are likely to resurface, potentially under new branding or accounts, given their profitability.
The exposure of Xinbi Guarantee underscores the urgent need for enhanced regulatory frameworks to combat crypto-enabled financial crime.
Blockchain’s transparency offers tools to trace illicit transactions, but operations like Xinbi require analytics and international cooperation to dismantle.
Elliptic’s work, cited by FinCEN and trusted by financial institutions since 2015, highlights the critical role of blockchain analytics in uncovering these networks.
As governments and regulators grapple with the evolving crypto space, Xinbi’s case serves as a reminder of the risks involved when transacting with digital assets.
While they enable innovation, they also empower criminals when unchecked.
The global community must act decisively to close loopholes, strengthen compliance, and protect victims from the devastating impact of these illicit marketplaces.