Messaging app Telegram has closed thousands of channels belonging to suspected Chinese crypto-crime marketplaces after new research shed light on the situation, according to Elliptic.
The closure follows a report published by the blockchain analytics firm on Tuesday into the fast-growing Telegram-based marketplace called Xinbi Guarantee.
The Colorado-incorporated marketplace has processed over $8.4 billion worth of transactions using Tether’s USDT stablecoin since 2022. It facilitates services relating to money laundering, operating crypto scam compounds and other illicit services, such as intimidation and sex trafficking, according to Elliptic.
“Elliptic is tracking around thirty other such marketplaces, all leveraging Telegram and stablecoin payments,” the report said.
Telegram did not immediately respond to a request for comment.
Such marketplaces are a key part of the Southeast Asia-based global cyberscam epidemic by providing scammers with the tools needed to conduct fraud on an industrial scale.
One of the biggest such marketplaces is Huione Guarantee, according to Chainalysis, facilitates similar services to Xinbi. The firm behind it, Huione Group, has ties to Cambodia’s ruling family.
Xinbi and Huione, the two largest Telegram-based marketplaces, are responsible for a combined $35 billion in illicit transactions, Elliptic said.
On May 1, the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) designated Huione Group a “primary money laundering concern,” saying it helped launder at least $4 billion worth of illicit proceeds between August 2021 and January 2025.
Cyberscam epidemic
Services offered on marketplaces like Xinbi and Huione are infamous for enabling industrial-scale scam compounds across Southeast Asia.
These compounds attract victims with the promise of well-paid IT work. When they arrive they are trafficked, imprisoned and forced to carry out online pig butchering scams to pay off phony debts.
Xinbi vendors offer Starlink satellite internet equipment, which is often used by scam compounds, fake IDs and databases of stolen personal information used to target potential fraud victims, Elliptic said.
Another big driver of business is money laundering services, according to the report. Such services are mostly used to launder the proceeds of pig butchering scams, but funds from North Korean crypto heists are also in the mix.
Elliptic found about $220,000 in USDT originating from the $230 million WazirX theft in July was sent to Xinbi, indicating that vendors operating on the marketplace were employed to help launder proceeds of the heist.
It’s not clear whether North Korean IT workers are interacting with Xinbi vendors directly, though.
“Our hypothesis is that the funds are under the control of Chinese money laundering groups by the time they enter marketplaces such as Xinbi,” Tom Robinson, chief scientist and co-founder at Elliptic, told CoinDesk over email.
Colorado connection
What sets Xinbi apart from other similar marketplaces, however, is its connection to the U.S.
On its website, Xinbi describes itself as an “investment and capital guarantee group company” operating as a Colorado-based corporation, Elliptic said.
The Colorado corporate register shows a company called “Xinbi Co., Ltd” was incorporated in August 2022, with an office in Aurora, Colorado even though the Chinese-language marketplace is primarily used by fraudsters in Asia.
“These marketplaces depend on trust,” Robinson said. “A U.S. incorporation does bring some level of legitimacy.”
Robinson also noted that similar marketplaces have previously conducted exit scams, where a business stops shipping orders while still receiving payments, eventually walking away with the money. “Anything that inspires confidence will help attract customers,” he said.
In January 2025, the company’s status was updated to delinquent for failing to file a periodic report.
Read more: Cambodian Huione Group Received $98B in Crypto Leading to U.S. Crackdown: Elliptic
