It is called the market based in Chinese telegrams. Xinbi Guaranteed It has facilitated more than $8.4 billion in trading since 2022, facilitating the exposure of the second major black market after the guarantee of Huione.
A report published by Blockchain Analytics company Elliptic shows that market merchants will learn technology, personal data and money laundering services.
“USDT Stablecoin is a major payment method and the market has so far received $8.4 billion in transactions,” the company said. “Some transactions can be linked to funds stolen by North Korea.”
Xinbi, like Huione, serves Southeast Asian scammers, including those in charge of the so-called romance bait scheme (formerly known as “pig slaughter”).
What is noteworthy about these criminal bazaars is that they operate entirely on Telegram and become a one-stop shop for a wide range of services to help you navigate online scams on an industrial scale, ranging from technical tools to money laundering services.
Xinbi Guarantee has 233,000 users per Elliptic, and merchants fall into a wide range of categories related to money laundering, Starlink satellite internet equipment, fake IDs, and databases of stolen personal information used to target potential victims.
Other vendors are taking it a step further by stealing and threatening selected targets within China, acting as egg donors or agents to women, or engage in sex trafficking, demonstrating illegal services beyond cyber fraud.
“The market is growing strongly — we’ve seen more than $1 billion inflows in the fourth quarter of the first quarter,” Elliptic said. “The volume of Chinese guaranteed markets such as Huione and Xinbi Guarantees will make the first generation market of TOR-based Darknet marketplaces a dwarf.”
But perhaps the most interesting aspect of Xinbi is that it claims to be an “Investment and Capital Guarantee Group Company” registered in Colorado by someone named Mohd Shahrulnizam Bin Abd Manap, registered in Colorado. The company was founded in August 2022, according to the state’s Corporate Register. It has since been marked as “delinquent” for failing to submit regular reports.
Both Xinbi and Huione guarantees have also been used to wash cryptocurrency assets stolen by North Korea following the hack of Indian cryptocurrency Exchange Wazirx last July, and on November 12, 2024, $220,000 was sent to the Wallet address managed by the former.
In response to the findings, Elliptic said Telegram has shut down thousands of channels belonging to the two services, effectively disrupting two biggest markets, over $35 billion in USDT trading.
The development comes weeks after the US financial system-based Fione Group designated the Cambodia-based Fione Group as “major money laundering concerns” to limit access to the US financial system.
“These platforms also offer windows to China-based underground banking systems based on stablecoins and other digital payments.
update
Huione/Haowang Guarantee said in a message posted to its website on May 13th that it has been suspended since “all NFTs, channels and groups were blocked by Telegram.” Development was first reported by Wired.
“All businesses in the Public Group are provided by third-party merchants, which have nothing to do with Herwan’s guarantee,” the company argued. “We only offer warranty services. We operate only on Telegram, and Telegram has been blocked by China for a long time. Mainland users cannot use Telegram, so our default customer is non-Mainland Chinese users.”
In a follow-up post, Elliptic noted that the guarantee market acts as an intermediary between merchants and customers, with managers controlling access and manipulating anti-fulard mechanisms such as seller deposits and escrow services.
The company further said that Telegram has taken action against Huione and Xinbi guarantees, removing the entire channel and banning related usernames. This action was equivalent to a domain seizure, which meant that administrators could no longer use it to direct users to new channels, making restarting much more difficult.
Huione Guarantee encourages its merchants and other users to move to another market named Tudou Guarantee, where the number of users has increased by 30%. Tom Robinson, co-founder and chief scientist of Elliptic, told Hacker News that “there are already signs that Xinbi is about to restart” under the name Xinbi 2.0.
“The closure of Xinbi and Huione shows that intensive services such as Telegram are unlikely to become safe shelters for the criminal market in the long term, which could encourage the development of decentralized alternatives,” Elliptic added. “These provide a way to communicate with censorship, along with payments that can withstand censorship, made possible by cryptocurrency.”
(The story was updated after publication to include additional insights from Elliptic.)
