Elliptic exposes $8.4B USDT-powered Telegram-based cybercrime hub by Colorado firm Xinbi

Telegram has cracked down on Xinbi Guarantee, a USDT-powered marketplace linked to crypto pig butchering scams and money laundering, after Elliptic had exposed $8.4B in illicit transactions.

On May 13, blockchain analytics firm Elliptic, reported that Xinbi Guarantee, a Telegram-based marketplace operated by Colorado-incorporated Xinbi Co. Ltd., has had thousands of its channels closed after Elliptic’s research exposed its involvement in large-scale cybercrime and money laundering.

Merchants on Xinbi Guarantee catered primarily to fraudsters in South East Asia, offering laundering services for proceeds of various online scams, including infamous crypto pig butchering scams. The marketplace also facilitated the sale of Starlink satellite equipment, fake IDs, and databases of stolen personal information used by fraudsters to target victims worldwide. The main method of payment for these products/services was Tether ( USDT ).

Elliptic’s investigation found that the marketplace had received at least $8.4 billion in USDT transactions since 2022, marking Xinbi Guarantee as one of the largest illicit markets of its kind. The platform showed rapid growth, with its user base expanding from 119K users in August 2024 to 233K users by May this year. This growth was accompanied by a sharp increase in transaction volumes, with the marketplace surpassing $1 billion in inflows during Q4 2024 alone.

Elliptic’s research also uncovered links between Xinbi Guarantee and the laundering of funds stolen by North Korea. In one instance, $235 million was stolen from the Indian crypto exchange WazirX in a hack attributed to North Korean actors. Elliptic’s analysis revealed that part of the stolen funds—approximately $220,000 in USDT—was funneled through Xinbi Guarantee addresses.

Following Elliptic’s findings, Telegram responded by closing down thousands of channels associated with both Xinbi Guarantee and Huione Guarantee , another major illicit marketplace also tracked by the firm.

Meanwhile, Elliptic continues to track over 30 similar illicit marketplaces that leverage Telegram’s infrastructure and stablecoin payments to enable a wide range of crypto fraud and other cybercrimes.