Xinbi Guarantee is an illicit, Chinese-language online marketplace that has facilitated nearly $20 billion in transactions as of early 2026. Primarily operating on Telegram, it serves as a central hub for money laundering, human trafficking, and industrial-scale scams in Southeast Asia.
The results, particularly through distributed payment systems like USDT (Tether), generate serious questions regarding the increasing role of crypto infrastructure in enabling worldwide crime. Xinbi’s operation emphasizes how quickly these under-marketplaces may grow and how challenging it may be for authorities to oversee them properly.
Big USDT Flows Support Illegal Trade
Xinbi’s operations focus on the stablecoin USDT, which accounts for most of its transactional activity. USDT is often utilized in illicit finance because of its dollar-pegging value and high liquidity, since it helps to enable speedy, cross-border value transfers with a reduced possibility of price volatility. Reportedly exchanging USDT for products and services ranging from phony identity documents to hacking tools and communication gear, including Starlink satellite equipment, criminal users on Xinbi seem to be buying.
According to Elliptic’s research, Xinbi handled over $1 billion in transactions in the fourth quarter of 2024 alone. This astounding number shows the scope. Sustainable Crypto Vision, the operation, and the growing sophistication of hackers who now use sophisticated blockchain technologies to go unseen.
Financial & Operational Metrics
- Transaction Volume: While initially reported in May 2025 to have handled $8.4 billion, more recent data from early 2026 shows it processed over $19.9 billion between 2021 and 2025.
- Currency of Choice: Nearly all business is conducted using the Tether (USDT) stablecoin.
- User Base: The platform has grown to approximately 500,000 users as of April 2026.
- Business Model: It uses an “escrow” or “guarantee” model where the marketplace acts as a middleman to facilitate trust between criminals, such as “pig butchering” scammers and money launderers.
Relationship to North Korean Hacking Activities
Elliptic’s investigation also highlights a concerning relationship between North Korean state-sponsored hacking operations and Xinbi. Tracing thousands of wallet addresses used on the network, analysts have discovered some are linked to laundering activities known to start from North Korea. These results imply that the platform is helping low-level scammers and offering financial support to sanctioned country governments involved in cyber theft.
Although North Korea’s involvement in crypto crime is not new, its connection to a U.S.-incorporated company like Xinbi raises significant concerns. Law enforcement authorities trying to stop illegal financial movements on the blockchain have difficulty using American legal systems to cover or justify such activities.
Illicit Services & Connections
- Money Laundering: Vendors openly advertise services to convert “scam funds” into clean capital. It has been used to launder proceeds from high-profile thefts, including roughly $220,000 from the 2024 WazirX hack attributed to North Korea.
- Scam Infrastructure: The market sells tools for cybercrime, including stolen personal data, spoofed caller IDs, and even Starlink satellite equipment for scam compounds.
- Human Rights Abuses: Xinbi is linked to the #8 Park scam compound in Cambodia, which reportedly houses up to 20,000 trafficked workers forced into labor. Other listings have included targeted harassment (e.g., throwing feces at victims) and sex trafficking of minors.
Demand better monitoring and control.
Law enforcement and blockchain security experts advocate for more worldwide cooperation to fight the increasing threat of distributed financial crime. Although on-chain analytics and wallet tracing are showing good success in spotting suspected activity, enforcement of these tools is challenging because of the anonymous and international character of cryptocurrencies.
The Xinbi case strongly reminds us that rules alone are insufficient. We need more involvement from exchanges, wallet providers, infrastructure builders, and other crypto players to prevent their platforms from facilitating illicit activity.
Keeping Alert in a Changing Threat Environment
The incentives for negative actors to exploit cryptocurrencies will also rise as their acceptance increases. The Xinbi Guarantee case marks a significant shift in the discourse surrounding illicit cryptocurrency markets and their linkages to traditional fraud networks and global crimes. This event serves as a crucial reminder for blockchain creators, legislators, and investors alike. Tech Crypto, Maintaining the integrity of the Bitcoin ecosystem will depend primarily on increased alertness, wise rules, and strong monitoring technologies.
