A Chinese-language, Telegram-based marketplace called Xinbi Guarantee has facilitated no less than $8.4 billion in transactions since 2022, making it the second major black market to be exposed after HuiOne Guarantee.
According to a report published by blockchain analytics firm Elliptic, merchants on the marketplace have been found to peddle technology, personal data, and money laundering services.
"The USDT stablecoin is the primary payment method, with the market having received $8.4 billion in transactions to date," the company said. "Some transactions can be linked to funds stolen by North Korea."
Xinbi, like HuiOne, has offered its services to scammers in Southeast Asia, including those responsible for so-called romance baiting schemes (formerly referred to as "pig butchering"), which has become one of the most lucrative forms of cybercrime in recent years.
What's notable about these criminal bazaars is that they are entirely run on Telegram, becoming a one-stop shop to avail a wide range of services, ranging from technical tools to money laundering services to pull off online fraud at an industrial scale.
Xinbi Guarantee, per Elliptic, has 233,000 users, with merchants broken down to broad categories related to money laundering, Starlink satellite internet equipment, fake IDs, and databases of stolen personal information used to target potential victims.
Other vendors go a step further by offering to stalk and intimidate any chosen target within China, provide women to act as egg donors or surrogates, or even engage in sex trafficking, indicating that the illicit services go beyond cyber scams.
"The marketplace is seeing strong growth - with Q4 2024 the first quarter to see inflows of more than $1 billion," Elliptic said. "Transaction volumes on Chinese-language Guarantee marketplaces such as Huione and Xinbi Guarantee dwarf those of the first generation of Tor-based darknet marketplaces."
But perhaps the most interesting aspect of Xinbi is that it claims to be an "investment and capital-guarantee group company" registered in the U.S. state of Colorado by someone named Mohd Shahrulnizam Bin Abd Manap. According to the state corporate register, the company was incorporated in August 2022. It has since been marked as "Delinquent" for failing to file its periodic reports.
Both Xinbi and HuiOne Guarantee have also been used to launder cryptocurrency assets stolen by North Korea following the hack of the Indian cryptocurrency exchange WazirX last July, with $220,000 in USDT sent to the wallet addresses controlled by the former on November 12, 2024.
In response to the findings, Elliptic said Telegram has shut down thousands of channels belonging to the two services, effectively disrupting the two largest marketplaces that have engaged in over $35 billion in USDT transactions.
The development comes weeks after the U.S. Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) designated Cambodia-based HuiOne Group as a "primary money laundering concern" in a bid to limit its access to the U.S. financial system.
"These platforms also provide a window onto a China-based underground banking system, based around stablecoins and other digital payments, which is being leveraged for money laundering on a significant scale," Elliptic said.
Update
HuiOne/Haowang Guarantee, in a message posted on its website on May 13, said it's ceasing its operations since "all our NFTs, channels and groups were blocked by Telegram." The development was first reported by WIRED.
"All business in the public group is provided by third-party merchants, which has nothing to do with Haowang's guarantee," the company claimed. "We only provide guarantee services. We only conduct business on telegram, and telegram has long been blocked by mainland China. Mainland users cannot use telegram, so our default customers are non-mainland Chinese users."
Elliptic, in a follow-up post, noted that guarantee marketplaces act as an intermediary between merchants and customers, with the administrator controlling access and operating anti-fraud mechanisms such as merchant deposits and escrow services.
The company further said that Telegram has been taking action against the HuiOne Guarantee and Xinbi Guarantee, deleting the entire channels and banning the associated usernames. This action, equivalent to a domain seizure, meant that the administrators could no longer use it to direct users to new channels, making it far more difficult to relaunch.
HuiOne Guarantee has since urged its merchants and other users to migrate to another marketplace named Tudou Guarantee, which has seen a 30% increase in user numbers. Tom Robinson, co-founder and chief scientist at Elliptic, told The Hacker News that "there are already signs that Xinbi is trying to relaunch" under the name Xinbi 2.0.
"The closure of Xinbi and Huione illustrate that centralised services such as Telegram are unlikely to ever be safe havens for criminal marketplaces in the long term, and this may spur the development of decentralized alternatives," Elliptic added. "These would provide censorship-resistant communications methods, alongside the censorship-resistant payments made possible by cryptocurrencies."
(The story was updated after publication to include additional insights from Elliptic.)
