May 14, 2025 — In a shocking revelation about the global crypto crime ecosystem, a massive Chinese-language black market known as Xinbi Guarantee has been exposed as a major crypto crime hub involved in scams and money laundering. What makes the story even more surprising is that the organization is legally registered in Colorado, USA.
According to a new report released by blockchain analysis firm Elliptic, Xinbi Guarantee processed at least $8.4 billion in transactions since 2022, most of it linked to crypto investment scams. The marketplace operated mainly through Telegram, offering not just crypto-related services but a variety of illicit activities, including harassment-for-hire and possibly even human trafficking.
A Global Crime Bazaar Hidden in Plain Sight
Xinbi Guarantee functioned as an all-purpose underground platform catering to Chinese-speaking cybercriminals. Hosted on Telegram, the crypto crime hub offered:
- Money laundering for scammers
- Cash-out services for stolen crypto
- Services for North Korean hackers
- Stolen data and fraud tools
- Harassment-for-hire
- Listings for sex workers and surrogates, including disturbing underage offerings
Despite this extensive illegal activity, Xinbi Guarantee’s website boldly claimed it was registered in the United States, even featuring a Colorado business registration in Mandarin on its homepage.
Elliptic co-founder Tom Robinson said, “Xinbi Guarantee has served as a giant, purportedly US-incorporated illicit online marketplace for online scams that primarily offers money laundering services.”
Telegram Steps In, But Is It Too Late?
The timing of Elliptic’s report seems to have triggered action from Telegram. Just a day before the report’s public release, Telegram banned key administrator accounts and central channels linked to Xinbi Guarantee and its affiliate Huione Guarantee, another massive crypto crime hub previously exposed by Elliptic.
Telegram spokesperson Remi Vaughn confirmed the platform’s action, stating, “Criminal activities like scamming or money laundering are forbidden by Telegram’s terms of service and are always removed whenever discovered.”
This isn’t the first time Telegram has acted on such issues. In February, it took down several Huione Guarantee channels following an earlier Elliptic report. However, those accounts were quickly re-established, showing how resilient and adaptable these black markets can be.
Robinson warns that Xinbi and Huione may return under new branding. “These are very lucrative businesses, and they’ll attempt to rebuild in some way,” he said.
The $8.4 Billion Trail
Elliptic’s forensic blockchain research reveals that the $8.4 billion processed through Xinbi Guarantee likely includes funds stolen from scam victims across the world. The crypto crime hub facilitated services for so-called “pig butchering” scams, a type of long-term crypto fraud where victims are manipulated into investing in fake crypto schemes.
Vendors on Xinbi offered to:
- Receive victim payments into local bank accounts
- Convert fiat into Tether (USDT) or other cryptocurrencies
- Cash out funds into Chinese renminbi or other local currencies
Aside from fraud, vendors also offered help with SIM card registrations and Starlink internet accounts through proxies, which are helpful tools for criminals trying to stay anonymous.
In one high-profile case, $220,000 of crypto stolen from Indian exchange WazirX in July 2024 was traced to Xinbi. The WazirX hack, attributed to North Korean hackers, totaled $235 million in losses.
More Than Just Money Laundering
What’s particularly disturbing is the range of non-financial crimes advertised on the crypto crime hub. Elliptic investigators found:
- Listings for underage sex workers, with one vendor allegedly offering a 14-year-old girl
- Surrogate mother and egg donor ads, sometimes with faceless body photos
- Violent harassment services, including:
- Placing funeral wreaths at victims’ homes
- Graffiti and verbal threats
- Throwing feces
- Intimidation using people posing as AIDS patients
These shocking services were paid for in Tether, highlighting the stablecoin’s central role in this shadow economy.
A Colorado Connection
One of the most surprising aspects of the Xinbi Guarantee case is its legal U.S. registration.
Records from the Colorado Secretary of State show the company was incorporated in August 2022 in Aurora, Colorado, under the name Mohd Shahrulnizam Bin Abd Manap. There is no external branding at the listed address. The business is currently marked as “delinquent”, likely due to missed paperwork filings.
Experts say that registering in the U.S. is a tactic used by many Chinese companies, both legal and illegal, to appear legitimate. According to Harvard Asia Center fellow Jacob Sims, “If you have a U.S. presence, you can open bank accounts, hire staff, and create formal ties with American entities.”
However, the delinquent status may suggest that Xinbi tried and failed to establish formal operations in the U.S.
Tether’s Role in Crypto Crime
Like Telegram, Tether is under increasing pressure to monitor and limit criminal use of its stablecoin. Since Tether is centralized, it can freeze wallets tied to illegal activity, a feature not possible with decentralized cryptocurrencies like Bitcoin.
In response to WIRED’s inquiries, Tether stated:
“We are not passive observers, we are active players in the global fight against financial crime. If you’re considering using Tether for illicit purposes, think again: it is the most traceable asset in existence.”
Tether says it encourages firms like Elliptic to share data with law enforcement for swift action. Still, it’s unclear how often such measures are taken or how aggressively Tether polices criminal usage.
The Bigger Picture: A Chinese-Language Darknet
Xinbi and Huione aren’t alone. Elliptic says it’s monitoring close to 30 similar Chinese-language black markets using Telegram and Tether. These platforms have essentially built a new version of the darknet, one that’s public, brazen, and incredibly profitable.
Huione Guarantee, exposed in 2023, had processed $24 billion, according to Elliptic. The U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) recently designated Huione’s parent company as a money laundering threat.
Both Xinbi and Huione follow a “guarantee” model: third-party vendors pay a deposit to prove credibility and reduce fraud. This model, common in underground Chinese markets, allows a wide range of services to flourish unchecked.
What’s Next?
While Telegram’s bans and Tether’s warnings may slow these operations, experts believe the markets will resurface. The immense profits, billions of dollars, provide strong incentives for criminals to rebuild under new names.
With Xinbi Guarantee now exposed as a crypto crime hub, authorities face mounting pressure to crack down harder on crypto-related financial crimes. Whether that leads to arrests, asset seizures, or global regulatory changes remains to be seen.
For now, the Xinbi scandal serves as a stark reminder: the global crypto ecosystem still faces serious security and regulation challenges, especially in the fast-growing intersection of digital currency, anonymity, and cross-border crime.
