$8.4 Billion Crypto Crime Operations Tied to Chinese Hub in Colorado

Research by Elliptic reveals Xinbi Guarantee, a Chinese-language marketplace, has facilitated $8.4 billion in illicit transactions since 2022. Registered in Colorado, the platform offers money laundering and services linked to scams and trafficking. Telegram banned associated channels, but their effectiveness in stopping the operations remains to be seen. Similar markets continue to thrive, raising concerns about the burgeoning underground economy.

In a troubling development, research from crypto-tracing firm Elliptic has revealed that a Chinese-language service, Xinbi Guarantee, is connected to at least $8.4 billion in illegal transactions. This service, operational since 2022 on the messaging platform Telegram, has facilitated a range of nefarious activities, including money laundering for scammers and North Korean hackers. What’s particularly striking is that Xinbi Guarantee is legally registered in Colorado, seemingly lending legitimacy to its criminal operations.

Elliptic co-founder Tom Robinson highlights that the bulk of this staggering amount is likely derived from money stolen from scam victims. The website of Xinbi Guarantee, purportedly US-based, boasts its registration, while simultaneously profiting from fraudulent schemes. Robinson remarks, “Xinbi Guarantee has served as a giant, purportedly US-incorporated illicit online marketplace.” The variety of illicit services offered by Xinbi is alarming, including harassment tools and potential trafficking, which underscores the breadth of this underground network.

Interestingly, this isn’t an isolated case. Elliptic also uncovered another illicit market, Huione Guarantee, based in Cambodia, which had racked up transactions of roughly $24 billion before facing scrutiny. Both platforms exemplify a growing trend wherein Chinese-based cybercrime operations thrive under the radar, exploiting the perceived credibility of US registration to gain trust among users.

Following inquiries from WIRED, Telegram took action, removing several channels associated with Xinbi Guarantee and Huione Guarantee. A spokesperson stated, “Criminal activities like scamming or money laundering are forbidden by Telegram’s terms of service.” While prior removals have been noted, it remains uncertain whether these actions will effectively incapacitate the marketplaces, as they have shown a tendency to re-establish themselves.

With Xinbi Guarantee employing a “guarantee” model requiring deposits from vendors, it has evaded mainstream attention, growing into a major hub for crypto-related crime. The nature of the transactions includes overly creative terminologies for scams, with offerings that allow scammers to cash out received funds in a way that obscures their tracks.

Notably, Elliptic found that North Korean cybercriminals are also utilising Xinbi Guarantee for their money laundering operations. Instances like the $220,000 from the Indian exchange WazirX flowing into Xinbi clearly indicate the service’s connection to broader global crime networks. Besides this, the platform also listed dubious services ranging from surrogacy arrangements to threats against personal targets, further demonstrating the darker sides of its functionalities.

Another concerning aspect is the presence of listings for extremely young sex workers identified on Xinbi Guarantee, with one vendor even claiming to offer a 14-year-old for illicit services. Such associations with child exploitation testify to the market’s necessary scrutiny. Despite being registered in a reputable jurisdiction, the dealings of Xinbi Guarantee challenge the legal and ethical boundaries of corporate registration.

Jacob Sims of Harvard University notes that registration in the US is a tactic often used to project an image of legitimacy. He mentions that such incorporation can facilitate illicit operations, allowing easier access to US banking and human resources. Yet, the company’s current delinquent status raises questions about its operational integrity.

While Xinbi Guarantee and Huione Guarantee benefit from Telegram for their communications and Tether for transactions, Elliptic reports tracking numerous similar illicit operations. With approximately 30 such platforms under their radar, the potential for further criminal activities is substantial. The recent purges by Telegram, while significant, may not be enough to thwart the pervasive rise of these marketplaces.

Tether, unlike decentralized cryptocurrencies, has the ability to freeze transactions that appear to be linked to criminal activities. However, the extent of action taken against the operations of Xinbi Guarantee remains questionable. Tether’s statement on this matter did encourage cooperation with law enforcement to combat financial crime but did not specify guarantees against its misuse in these operations.

In light of these revelations, it’s clear that despite the challenges posed by Telegram’s bans and Tether’s tracking capabilities, the cycle of crypto crime is unlikely to diminish anytime soon. With vast profits at stake, both Xinbi Guarantee and Huione Guarantee represent just part of a sprawling, defense against a steady influx of competition in the illicit crypto market.