Telegram Takes Action Against Alleged $8 Billion Chinese Crypto Crime Marketplace in Colorado

Illicit marketplaces play a significant role in the expanding global cyberscams sector, particularly in Southeast Asia, which is a prominent hub for such operations.

What to know:

Telegram has recently terminated thousands of channels associated with suspected Chinese crypto crime marketplaces, acting on insights from blockchain analytics firm Elliptic.
One of the implicated platforms, Xinbi Guarantee, set up in Colorado, has facilitated transactions exceeding $8.4 billion in suspected unlawful activities using Tether’s USDT stablecoin since 2022.
The Financial Crimes Enforcement Network (FinCEN) has flagged the Huione Group, another significant platform, as a primary money laundering risk.

Messaging service Telegram has responded decisively by closing down numerous channels tied to suspected Chinese crypto crime networks after new evidence emerged from research conducted by Elliptic.

The shutdown follows a report released by Elliptic concerning the rapidly expanding Telegram-centric marketplace named Xinbi Guarantee.

The Colorado-based platform has executed cryptocurrency transactions worth over $8.4 billion since 2022. It reportedly engages in services related to money laundering, operating crypto scam hubs, and other illegal activities, including intimidation and human trafficking.

Elliptic noted that it is monitoring around thirty additional similar marketplaces, all utilizing Telegram and stablecoin payments.

Telegram has not yet made a comment on the situation.

These illicit marketplaces are crucial to the global cyberscams crisis emanating from Southeast Asia by equipping fraudsters with essential tools for large-scale scams.

Huione Guarantee, identified as one of the leading marketplaces, is linked to the Cambodian elite and functions similarly to Xinbi, and collectively, they account for approximately $35 billion in illicit transfers according to Elliptic.

On May 1, FinCEN classified Huione Group as a “primary money laundering concern,” indicating it was involved in laundering at least $4 billion in illicit revenue from August 2021 to January 2025.

Cyberscam Epidemic

The services offered through Xinbi and Huione marketplaces are notorious for enabling extensive scam operations across Southeast Asia.

These operations lure victims with the promise of lucrative IT jobs, only to trap them for forced labor in online fraud schemes aimed at repaying fictitious debts.

Xinbi sellers provide equipment like Starlink satellite internet gear often used in scam locations, along with counterfeit documents and databases of stolen identities for potential fraud targets, as highlighted by Elliptic.

Another significant factor for revenue is money laundering, primarily linked to proceeds from fraudulent schemes but also involving funds from North Korean crypto heists.

Elliptic discovered about $220,000 in USDT from the $230 million theft at WazirX in July was traced back to Xinbi, suggesting that vendors on its platform facilitated the laundering of this stolen money.

However, the specifics of North Korean IT workers’ interactions with Xinbi vendors remain unclear.

“Our theory is that the funds are under the control of Chinese laundering syndicates by the time they reach marketplaces like Xinbi,” stated Tom Robinson, chief scientist and co-founder at Elliptic.

Colorado Connection

What differentiates Xinbi from many other similar platforms is its connection to U.S. infrastructure.

Its website claims to operate as an “investment and capital guarantee group company,” registered and incorporated in Colorado, according to Elliptic.

The Colorado business registry indicates that “Xinbi Co., Ltd” was established in August 2022, with a registered office in Aurora, Colorado, even though the service primarily attracts fraudsters from Asia.

“Such marketplaces rely on trust,” said Robinson. “Incorporation in the U.S. lends them a certain degree of credibility.”

Robinson added that similar platforms have previously engaged in exit scams, ceasing operations while continuing to accept payments, ultimately absconding with the revenue.

In January 2025, the company’s registration was updated to delinquent status for failing to submit necessary documentation.