Telegram has recently shut down numerous channels linked to suspected Chinese crypto-crime marketplaces following new research findings from Elliptic. The closure comes on the heels of a report released by the blockchain analytics firm regarding the fast-growing Telegram-based marketplace known as Xinbi Guarantee.

According to Elliptic, Xinbi Guarantee, based in Colorado, has facilitated more than $8.4 billion in transactions using Tether’s USDT stablecoin since 2022. The platform provides services related to money laundering, running crypto scam operations, as well as other illegal activities like intimidation and sex trafficking. Elliptic’s report also reveals that there are around thirty similar marketplaces leveraging Telegram and stablecoin payments.

Despite the findings, Telegram has not yet responded to requests for comments. These marketplaces play a significant role in the global cyberscam crisis in Southeast Asia by equipping scammers with the necessary tools for large-scale fraud schemes.

Among these marketplaces, Huione Guarantee, identified by Chainalysis, offers services similar to Xinbi and is closely associated with Huione Group, linked to Cambodia’s ruling family. Elliptic estimates that Xinbi and Huione collectively account for $35 billion in illicit transactions.

In a recent move, the U.S. Treasury’s Financial Crimes Enforcement Network has designated Huione Group as a “primary money laundering concern,” citing its involvement in laundering at least $4 billion in illicit proceeds between 2021 and 2025.

Marketplaces like Xinbi and Huione are notorious for enabling widespread fraud across Southeast Asia, luring victims with the promise of well-paying IT jobs, only to enslave them and force them to partake in online pig butchering scams.

Elliptic’s research also highlights the sale of various items on Xinbi, including Starlink satellite internet equipment utilized by scam operations, fake IDs, and stolen personal information to target potential fraud victims. The report indicates a significant influx of funds from North Korean crypto heists and money laundering services, predominantly linked to pig butchering scams.

Furthermore, Elliptic discovered that approximately $220,000 in USDT originating from the $230 million WazirX theft in July was transferred to Xinbi, suggesting the involvement of vendors to help launder the stolen proceeds. Though the direct involvement of North Korean IT workers remains unclear, Elliptic suspects Chinese money laundering groups manage the funds by the time they enter platforms like Xinbi.

Notably, Xinbi stands out from similar marketplaces due to its association with the United States. The platform describes itself as an “investment and capital guarantee group company” registered as a Colorado-based corporation, despite its primary user base being fraudsters in Asia. This U.S. incorporation adds a layer of legitimacy to the marketplace, according to Elliptic.

Moreover, Robinson emphasized that the confidence inspired by a U.S. incorporation could help attract more customers to such marketplaces, despite the risk of exit scams. In January 2025, Xinbi Co., Ltd., the Colorado-based company associated with Xinbi, was flagged as delinquent for failing to file a periodic report.