A New Player Rivals HuiOne in the Shadow Economy

A Chinese-language marketplace called Xinbi Guarantee has quietly grown into a multibillion-dollar hub for illegal trade on Telegram, according to blockchain forensics firm Elliptic. The investigators say the platform, which began operating in 2022, has already processed at least $8.4 billion worth of transactions, making it the second enormous “guarantee” market to surface after the better-known HuiOne Guarantee. Both services get their nickname from a system in which a middleman—styled as a guarantor—holds crypto payments until a deal is finished, giving buyers and sellers a veneer of trust while keeping everything inside a private chat app.

Everyday Tools for Professional-Grade Crime

Unlike the older darknet sites that live on Tor, Xinbi runs completely on Telegram channels and group chats. Within those rooms, more than 233 000 registered users can browse merchants who promise practically any tool a scammer or money launderer might need. Elliptic’s review shows whole storefronts dedicated to swapping Tether (USDT), the dollar-pegged stablecoin that has become the currency of choice for underground finance. Other vendors openly advertise databases full of stolen ID numbers, fake passports, point-and-click phishing kits, and even Starlink satellite terminals—gear prized by gangs operating from remote compounds in Southeast Asia.

Telegram’s interface lets participants move from one service to the next with a tap, turning the app into a one-stop shopping mall for crime. Need fresh money mules? A channel promises bank accounts in someone else’s name. Want to scrape a target’s personal data? Another channel claims to supply nationwide household registration records. Still others offer muscle for hire inside China, threats of real-world violence, and exploitative “escort” or surrogacy arrangements, suggesting that the harm enabled by the market extends far beyond online fraud.

Big Numbers and Bigger Growth

The analysts highlight how quickly Xinbi is gaining ground. In the final quarter of 2024 alone, funds flowing into the market topped $1 billion, marking its busiest stretch yet. Elliptic notes that combined volumes on Xinbi and HuiOne now “dwarf” the totals once handled by first-generation darknet bazaars such as Silk Road, showing how the criminal economy has shifted from hidden onion sites to mainstream social platforms where onboarding is easier and law-enforcement scrutiny is scattered.

Links to North Korean Theft and Romance Scams

Some of the crypto moving through Xinbi appears to trace back to high-profile hacks. After the July 2024 breach of Indian exchange WazirX, roughly $220 000 in USDT siphoned from victims landed in wallets tied to the Telegram marketplace on November 12 of that year. Elliptic also connects Xinbi’s payment flows to money harvested by North Korea’s state-sponsored hackers, who have increasingly relied on stablecoins to turn stolen tokens into hard currency.

Meanwhile, Southeast Asian “pig-butchering” syndicates—romance scammers who groom and then gut their marks—are among Xinbi’s most active customers. They use the site not only to launder proceeds but to buy playbooks, spoofed caller IDs, and live databases that help them profile new victims. Investigators warn that the ease of tapping such resources lowers the bar for would-be criminals, allowing fraud to scale like a regular online business.

Corporate Shell in Colorado Raises Eyebrows

Adding an odd twist, Xinbi Guarantee markets itself as an “investment and capital-guarantee group company” officially incorporated in the U.S. state of Colorado. State filings list a Mohd Shahrulnizam Bin Abd Manap as the registrant and show the entity was formed in August 2022. The company is now flagged “Delinquent” for missing mandatory reports, but the paperwork has so far provided a thin veneer of legitimacy—enough for promoters to claim Xinbi is a registered American enterprise even while most activity occurs in Chinese-language Telegram chats far outside U.S. jurisdiction.

Telegram Takedowns and a Growing Underground Banking Network

In response to Elliptic’s findings, Telegram says it has removed thousands of channels tied to Xinbi and HuiOne, cutting off an enormous share of their public storefronts. That action echoes a recent move by the U.S. Treasury’s Financial Crimes Enforcement Network, which in March labeled Cambodia-based HuiOne Group a “primary money-laundering concern,” effectively blacklisting it from the American financial system.

Yet even as storefronts disappear, Elliptic argues the bigger trend is harder to quell: an informal China-centred underground banking system built on stablecoins, QR code payments, and social-media escrow. These channels let money flow across borders with few checks, making them attractive not only to scammers but to regular people who want to dodge capital controls. Cutting off a handful of Telegram rooms may slow business for a while, but researchers warn that new groups are likely to spring up unless regulators, exchanges, and chat platforms coordinate to choke off the wider ecosystem.

For now, Xinbi Guarantee stands as a stark example of how everyday apps can host industrial-scale crime, moving billions of dollars in little more than two years and offering fraudsters the same convenience—and customer service—that ordinary shoppers expect from legitimate e-commerce sites.