Telegram has reportedly responded to Elliptic’s research by shutting down thousands of channels linked to both Xinbi Guarantee. The action by the social networking platform against Xinbi Guarantee and Huione Guarantee has severely disrupted the two large Telegram-based illicit marketplaces, which have collectively engaged in over $35 billion in USDT transactions. Telegram has reportedly shut down thousands of channels linked to Xinbi Guarantee. Source: Tom Robinson For a long time, Telegram allegedly enabled various darknet markets that would usually only be accessed through Tor, the anonymous web browser. But things have finally changed. Telegram targets Huione Guarantee and Xinbi Guarantee in cleanup exercise In July 2024, Elliptic exposed Huione Guarantee, a dark market known for providing goods and services to fraudsters in Southeast Asia, including those responsible for so-called “pig butchering” scams. Merchants on Huione Guarantee sell the key tools that fraudsters use to perpetrate online fraud, with transactions totaling at least $27 billion (all in Tether’s USDT stablecoin), making it the largest illicit online marketplace to have ever operated. After investigations, it was discovered that the wider Huione Group of companies had facilitated over $98 billion in crypto transactions, and in May 2025, the U.S. Treasury tagged it a money-laundering operation. Aside from Huione Guarantee, Elliptic also identified Xinbi Guarantee, with its 233,000 users (up from 119,000 users in August 2024) as a similar outfit, run mostly for the benefit of criminals. Xinbi and Huione Guarantee collectively processed over $35 billion in USDT transactions. Source: Elliptic Like Huione Guarantee, all business is conducted in Chinese, and the primary payment method is Tether’s USDT stablecoin. Xinbi works by grouping merchants into nine categories. The first four categories refer to money laundering services of various types, and they make up the largest share of transactions. The operators of these channels openly advertise the sources of money that they can launder and convert into “white capital” (i.e. clean money), including those associated with online fraud (“slow/quick kills”). Other vendors on Xinbi Guarantee catering to scam operators offer Starlink satellite internet equipment, fake IDs and databases of stolen personal information used to target potential fraud victims. The outfit has even been known to do some work for North Korean hackers, helping them launder proceeds from their cybercrimes, with specific incidents traced back to the $235 million hack of the Indian exchange WazirX. According to its website, Xinbi is an “investment and capital guarantee group company” operating as a Colorado-based corporation. The Colorado corporate register confirms that “Xinbi Co., Ltd” was incorporated in August 2022, with a principal office in Aurora, CO. It was not until January 2025 that the corporation’s status was updated to “Delinquent” for failing to file a periodic report. Huione and Xinbi have drawn attention to China’s underground banking system Marketplaces like Xinbi and Huione have grown to become key enablers of the global cyber scam epidemic as they equip scammers with the tools they need to conduct fraud on an industrial scale. Elliptic is reportedly monitoring around thirty other similar marketplaces, all of which leverage Telegram and stablecoin payments. So, while the shutdown of those two channels is commendable, it barely disrupts the status quo, as criminals could just move on to get what they need somewhere else. Such platforms have also provided a glimpse into what is essentially a China-based underground banking system, centered around stablecoins and other digital payments, which is being leveraged for money laundering on a significant scale. Elliptic has encouraged cryptoasset exchanges and other businesses to use its screening solutions to identify wallets and transactions linked to Xinbi and its vendors, ensuring that their funds cannot be laundered. Stablecoin operators are also urged to use these insights to monitor or block related transactions leveraging comprehensive Ecosystem Monitoring, while law enforcement can use Elliptic’s Investigator to trace payments with nefarious origins and pursue those responsible for online scams. Cryptopolitan Academy: Coming Soon - A New Way to Earn Passive Income with DeFi in 2025. Learn More
