Telegram Torches Chinese Crypto Laundering Hubs in $8.4B USDT Crackdown

Telegram has removed thousands of channels connected to the Chinese-language marketplaces Xinbi Guarantee and Huione Guarantee, following a report by blockchain analytics firm Elliptic. These Telegram-based platforms are responsible for over $35 billion in illicit transactions, primarily using the Tether (USDT) stablecoin.

Elliptic has identified at least $8.4 billion in USDT flowing through Xinbi since 2022.

Huione, believed to have ties to Cambodia’s ruling elite, accounts for at least $27 billion and offers services ranging from money laundering and fake IDs to stolen personal data and intimidation-for-hire.

How Xinbi and Huione Operate: Telegram, Stablecoins, and Illicit Services

Xinbi Guarantee and Huione Guarantee have gained popularity by offering plug-and-play services to cybercriminals seeking to launder stolen funds, disguise identities, or target new victims.

Each operates as a marketplace within Telegram, using the platform’s encryption and group-based infrastructure to connect buyers and vendors at scale.

Huione Guarantee, first identified by Elliptic in July 2024, sells a range of services to cybercriminals , including stolen personal data, fake documents, and money laundering tools.

Operating under the umbrella of Cambodia-based Huione Group, the platform has been linked to the Cambodian ruling family and has provided similar illicit services, including the sale of personal data, bank accounts, burner phones, and malware.

Elliptic’s research further reveals that Xinbi Guarantee boasts more than 233,000 users, with vendors divided into nine categories, including document forgery, SIM card trafficking, database access, and crypto money laundering.

These vendors openly advertise their ability to “clean” proceeds from pig butchering scams, a type of social engineering fraud that tricks victims into sending large sums of crypto under the pretense of romantic or investment relationships.

Elliptic also discovered that the $220,000 in USDT stolen in the July 2024 WazirX exchange hack, believed to be linked to North Korean actors, was funneled through wallets tied to Xinbi.

The services offered by Xinbi and Huione also go far beyond simple money laundering.

For example, both platforms are reportedly connected to scam compounds spread across Southeast Asia, in countries like Cambodia, Laos, and Myanmar, where human trafficking victims are forced to carry out online fraud.

These compounds, often disguised as legitimate IT or customer service job offers, lure people from across Asia with promises of high-paying roles.

Once onsite, victims are held against their will, subjected to abuse, and coerced into executing romance scams, crypto fraud, and blackmail schemes under constant surveillance.

Both Xinbi and Huione used Telegram not just for communication, but also for reputation management, order fulfillment, and dispute resolution among vendors and clients. Telegram has not issued a formal statement regarding the removal of the Xinbi and Huione channels.

Telegram’s Shift from Messaging App to Cybercrime Marketplace

The removal of Xinbi and Huione channels shows how illegal activity is shifting from the darknet to encrypted apps like Telegram.

While built for privacy, Telegram’s encryption has made it a preferred tool for criminal networks, especially in Southeast Asia.

According to the United Nations, Telegram makes up to $36.5 billion a year through scams , money laundering, and stolen data sales, often using the USDT stablecoin. Criminals also promote deepfake tools and malware on the platform.

The UN has previously described Tether (USDT) as the stablecoin of choice for criminal networks in Asia.

In May 2025, the U.S. Treasury named Huione Group a major money laundering concern tied to $98 billion in crypto flows, some linked to North Korea’s Lazarus Group.

Elliptic now tracks over 30 similar Telegram-based marketplaces.

Telegram has started to respond by removing features like “People Nearby” and updating its FAQ, but experts say more action is needed to stop the app from being used for global crypto crime.