A Colorado-registered company has facilitated $8.4 billion in illicit cryptocurrency transactions since 2022, operating as one of history's largest underground marketplaces for cybercriminals, according to a report released Wednesday by blockchain analytics firm Elliptic.
What to Know:
- The platform processed over $1 billion in illicit crypto assets during Q4 2024 alone
- User base nearly doubled from 119,000 to 233,000 between August and November 2024
- Telegram has banned multiple channels linked to the platform following the investigation
Xinbi Guarantee, operating primarily through Telegram channels, has become the second-largest illicit online market ever documented, serving predominantly Chinese-speaking criminals throughout Southeast Asia. The marketplace offers services ranging from money laundering to human trafficking, relying heavily on the stablecoin Tether (USDT) for transactions, investigators found.
"According to our analysis, Xinbi Guarantee is already the second largest illicit online market to have ever operated," Elliptic stated in its report. The investigation revealed a troubling growth trajectory, with transaction volumes accelerating rapidly throughout 2024.
The platform categorizes its merchants into nine distinct service areas, with money laundering representing the largest segment. These specialized operators process proceeds from various criminal schemes, including sophisticated "pig butchering" scams that combine romance deception with fraudulent investment opportunities.
Criminal Services and North Korean Connection
Elliptic researchers documented Xinbi Guarantee's involvement in laundering funds stolen during a major cryptocurrency exchange hack. In July 2024, Indian exchange WazirX lost approximately $235 million in digital assets.
On November 12, investigators traced approximately $220,000 in USDT moving through nine separate transactions to addresses connected to Xinbi Guarantee. This pattern demonstrates the platform's role in processing proceeds from high-profile cryptocurrency thefts.
Beyond money laundering, the marketplace offers an extensive catalog of criminal services. Vendors sell stolen personal data, counterfeit identification documents, and specialized technology like Starlink devices configured to support various scam operations.
The platform hosts particularly disturbing services including harassment-for-hire operations, stalking services marketed as products, and what appears to be human trafficking activities. Some merchants explicitly advertise access to surrogate mothers, egg donors, and other services consistent with sex trafficking operations, according to the investigation.
Despite catering to criminal enterprises, Xinbi Guarantee maintains an unusual level of corporate transparency. The company openly advertises its legal registration in Colorado on its website, a claim verified through public records.
"The Colorado corporate register confirms that 'Xinbi Co., Ltd' was incorporated in August 2022, with a principal office in Aurora, CO," the Elliptic report noted. "In January 2025 the corporation was updated to 'Delinquent' for failing to file a periodic report."
Regulatory Gaps and Platform Response
The marketplace's U.S. incorporation has raised significant questions about regulatory oversight and jurisdictional exploitation. By establishing legal entities in reputable jurisdictions while conducting operations through encrypted messaging platforms, such organizations can create challenging enforcement scenarios for authorities.
Xinbi Guarantee represents part of a broader pattern of illicit service marketplaces recently exposed by blockchain intelligence firms. In July 2024, Elliptic published findings on a similar operation called Huione Guarantee, revealing comparable service offerings and operational methods.
The investigation has prompted initial enforcement actions from at least one technology platform. Following Elliptic's research, Telegram banned several channels connected to both Xinbi Guarantee and Huione Guarantee from its messaging service. This removal represents a significant disruption to the marketplace's primary communication infrastructure.
However, the platform's $8.4 billion transaction volume since 2022 highlights the massive scale of cryptocurrency-facilitated crime even as regulatory frameworks continue developing. The operations demonstrate sophisticated exploitation of both technological and regulatory gaps.
Closing Thoughts
The exposure of Xinbi Guarantee reveals how criminal enterprises increasingly leverage legitimate business registrations alongside cryptocurrency technology to facilitate massive illicit operations. Despite initial enforcement actions from private platforms like Telegram, the marketplace's growth trajectory and billion-dollar quarterly transaction volumes indicate significant challenges ahead for regulators and law enforcement agencies worldwide.
