Latest news with #XinbiGuarantee
WIRED
8 hours ago
- Business
- WIRED
Telegram Purged Chinese Crypto Scam Markets—Then Watched as They Rebuilt
Jun 23, 2025 12:48 PM Last month, Telegram banned black markets that sold tens of billions of dollars in crypto scam-related services. Now, as those markets rebrand and bounce back, it's done nothing to stop them. One month ago, the messaging app Telegram summarily beheaded the online industry of Chinese-language crypto scam services: It banned virtually all accounts related to the first and second most popular marketplaces for vendors offering money laundering, stolen data, and a variety of other illicit wares to the vast criminal enterprises carrying out investment scams from compounds across Southeast Asia. Then, Telegram watched impassively as those black marketeers rebranded, rebuilt, and returned to business as usual on the messaging service's platform. On Monday, crypto tracing firm Elliptic published a new report showing how the industry of Telegram-based Chinese-language black markets for crypto scammers has bounced back in the wake of Telegram's takedown last month of the two biggest of those bazaars, known as Haowang Guarantee and Xinbi Guarantee. Before Telegram banned the two markets' channels and usernames on May 13, they had together enabled a staggering $35 billion in transactions, much of which represented money laundering by crypto scam operations that steal billions from Western victims and force tens of thousands of people to carry out scams in forced labor compounds across Cambodia, Myanmar and Laos. Since Telegram's purge, however, Elliptic has found that other smaller markets have now grown to almost entirely fill the vacuum those two key marketplaces left behind—and Telegram appears to have no plans to stop them. In particular, one market called Tudou Guarantee, partially owned by Huione Group, the same parent company as the now-defunct Haowang Guarantee, has more than doubled in size, likely taking in many of the scammer-friendly services displaced by Telegram's bans and again enabling those fraudsters' billions of dollars a year in illicit revenue. Its main channel now has 289,000 users by Elliptic's count, close to the 296,000 users that Haowang Guarantee had at its peak. Xinbi Guarantee, too, has relaunched on new channels and regained hundreds of thousands of users, Elliptic says. In terms of sales, Tudou is now enabling around $15 million a day in crypto payments, close to the $16.4 million Haowang was facilitating daily, according to Elliptic. 'Telegram recognized this was illicit activity and the kind they didn't want to be hosting, and so they deleted the channels and banned the associated usernames. But it was clear that these people wouldn't just give up, that they would transfer to different marketplaces,' says Tom Robinson, Elliptic's cofounder. 'These scammers have inflicted misery on millions of victims around the world, stealing billions of dollars. Unless these marketplaces are actively pursued, they will continue to flourish.' Posts Elliptic shared with WIRED from Tudou Guarantee—now by some measures the biggest black market on the internet—show examples of money laundering services, offers of scam website development, and vendors selling stolen personal data that scammers use for targeting. Another Tudou post explicitly offers prostitution, including references to possible minors: 'Students, queens, lolita,' the post states next to pictures of young women. 'All available!!' WIRED reached out to Tudou Guarantee for comment via an administrator's Telegram account but didn't receive a response. Before they were taken down by Telegram, Xinbi Guarantee and Haowang Guarantee displayed similar posts offering explicitly illegal services in all those categories and more. Like the newly ascendant Tudou Guarantee, those other 'Guarantee' marketplaces didn't directly sell services, but instead offer escrow and deposit features that prevent vendors from defrauding customers. When WIRED asked Telegram in May about a report from Elliptic that focused on Xinbi Guarantee's criminal offerings, Telegram responded with a broad purge: It banned not only Xinbi's accounts but also those of Haowang Guarantee, the much larger market that had persisted for three years, enabled around $27 billion in transactions, and sold scam industry services as explicit as the batons and shackles used to imprison forced laborers in scam compounds. In a statement sent to WIRED at the time, Telegram spokesperson Remi Vaughn wrote that 'communities previously reported to us by WIRED or included in reports published by Elliptic have all been taken down,' and added that 'criminal activities like scamming or money laundering are forbidden by Telegram's terms of service and are always removed whenever discovered.' Since then, however, Elliptic has continued to share its findings about apparent money laundering activity on ten other markets, including Tudou Guarantee, in a Telegram group that included a WIRED reporter and a Telegram spokesperson. Yet Telegram didn't take down any of the accounts related to the black markets Elliptic highlighted. Xinbi Guarantee has, in fact, rebuilt at new accounts without even rebranding. It still hasn't faced new account bans, despite Telegram itself stating that the market's content violated its terms of service. In a statement to WIRED, a Telegram spokesperson defended the company's apparent decision not to ban the rebounding black markets. 'The channels in question predominantly involve users from China, where rigid capital controls often leave citizens with little choice but to seek alternative avenues for moving funds internationally,' the statement reads. "We assess reports on a case-by-case basis and categorically reject blanket bans—particularly when users are attempting to circumvent oppressive restrictions imposed by authoritarian regimes. We remain unwavering in our commitment to safeguarding user privacy and defending fundamental freedoms, including the right to financial autonomy.' Elliptic's Robinson rejects that argument. 'We've been researching these marketplaces for nearly two years now, and they're not about helping people achieve financial autonomy,' Robinson says. 'These are marketplaces that primarily facilitate money laundering for the proceeds of fraud and other illicit activity." Erin West, a former prosecutor who now leads the non-profit Operation Shamrock, an organization focused on disrupting crypto scam operations, states her accusation against Telegram more simply. 'These are bad guys, enabling bad guy business on their bad guy platform,' West argues. 'They have the ability to shut down a scam economy and the trafficking of human beings. Instead, they're hosting Craigslist for crypto scammers.' Telegram's seemingly inconsistent approach to banning crypto scam black markets may have less to do with its principles of 'financial autonomy' than with trying not to run afoul of the US government, says Jacob Sims, a visiting fellow at Harvard University's Asia Center. In early May, the US Treasury's Financial Crimes Enforcement Network officially labeled Huione Group a 'primary money laundering concern.' Sims argues that designation, which referred directly to Haowang Guarantee but not Tudou Guarantee, may have spurred Telegram to take action—and that it may take another similar move at the government level to push Telegram to act again. 'Ultimately, last month's crackdown shows how disruptive Telegram can be when it does cooperate, but it also shows how fast the scammers are going to adapt,' Sims says. 'There's no real legal culpability that tech companies have for what happens on their platform unless there's a specific case brought to their attention by law enforcement. And so, until that changes, I just don't know what incentive they have to be proactive.'
WIRED
13-05-2025
- Business
- WIRED
An $8.4 Billion Chinese Hub for Crypto Crime Is Incorporated in Colorado
May 13, 2025 10:00 AM Before a crackdown by Telegram, Xinbi Guarantee grew into one of the internet's biggest markets for Chinese-speaking crypto scammers and money laundering. And all registered to a US address. Photo-Illustration:As the underground industry of crypto investment scams has grown into one of the world's most lucrative forms of cybercrime, the secondary market of money launderers for those scammers has grown to match it. Amid that black market, one such Chinese-language service on the messaging platform Telegram blossomed into an all-purpose underground bazaar: It has offered not only cashout services to scammers but also money laundering for North Korean hackers, stolen data, targeted harassment-for-hire, and even what appears to be sex trafficking. And somehow, it's all overseen by a company legally registered in the United States. According to new research released today by crypto-tracing firm Elliptic, a company called Xinbi Guarantee has since 2022 facilitated no less than $8.4 billion in transactions via its Telegram-based marketplace prior to Telegram's actions in recent days to remove its accounts from the platform.. Money stolen from scam victims likely represents the 'vast majority' of that sum, according to Elliptic's co-founder Tom Robinson. Yet even as the market serves Chinese-speaking scammers, it also boasts on the top of its website—in Mandarin—that it's registered in Colorado. 'Xinbi Guarantee has served as a giant, purportedly US-incorporated illicit online marketplace for online scams that primarily offers money laundering services,' says Robinson. He adds, though, that Elliptic has also found a remarkable variety of other criminal offerings on the market: child-bearing surrogacy and egg donors, harassment services that offer to threaten or throw feces at any chosen victim, and even sex workers in their teens who are likely trafficking victims. Xinbi Guarantee is the second such crime-friendly Chinese-language market that Robinson and his team of researchers have uncovered over the last year. Last July, they published a report on Huione Guarantee, a similar Cambodia-based service that Elliptic said in January had facilitated $24 billion in transactions—largely from crypto scammers—making it the biggest illicit online marketplace in history by Elliptic's accounting. That market's parent company, Huione Group, was added to a list of known money laundering operations by the US Treasury's Financial Crimes Enforcement Network (FinCEN) earlier this month in an attempt to limit its access to US financial institutions. After WIRED reached out to Telegram last week about the illicit activity taking place on Xinbi Guarantee's and Huione Guarantee's channels on its messaging platform, Telegram appears to have responded Monday by banning many of the central channels and administrator accounts used by both Xinbi Guarantee and Huione Guarantee. 'Criminal activities like scamming or money laundering are forbidden by Telegram's terms of service and are always removed whenever discovered,' Telegram spokesperson Remi Vaughn wrote to WIRED in a statement. 'Communities previously reported to us by Wired or included in reports published by Elliptic have all been taken down.' Telegram had already banned several of Huione Guarantee's channels in February, following an earlier Elliptic report on the marketplace, but Huione Guarantee quickly recreated them, and it's not yet clear whether the new removals will prevent the two companies from rebuilding their presence on Telegram again, perhaps with new accounts or even new branding. 'These are very lucrative businesses, and they'll attempt to rebuild in some way,' Robinson said of the two marketplaces following Telegram's latest purge. Elliptic's accounting of the total lifetime revenue of the biggest online black markets. Courtesy of Elliptic Xinbi Guarantee didn't respond to multiple requests for comment on Elliptic's findings that WIRED sent to the market's administrators on Telegram. Like Huione Guarantee, Xinbi Guarantee has offered a similar 'guarantee' model of enabling third-party vendors to offer services by requiring a deposit from them to prevent fraud. Yet it's flown under the radar, even as it grew into one of the biggest hubs for crypto crime on the internet. In terms of sheer scale of transactions prior to Telegram's crackdown, it was second only to Huione's market, according to Elliptic. Both services 'offer a window into the China-based underground banking network,' Robinson says. 'It's another example of these huge Chinese-language 'guaranteed' marketplaces that have thrived for years.' On Xinbi Guarantee, Elliptic found numerous posts from vendors offering to accept funds related to 'quick kills,' 'slow kills,' and 'pig butchering" transactions, all different terms for crypto investment scams and other forms of fraud. In some cases, Robinson explains, these Xinbi Guarantee vendors offer bank accounts in the same country as the victim so that they can receive whatever payment they're tricked into making, then pay the scammer in the cryptocurrency Tether. In other cases, the Xinbi Guarantee merchants offer to receive cryptocurrency payments and cash them out in the scammer's local currency, such as Chinese renminbi. Aside from Xinbi Guarantee's central use as a cash-out point for crypto scammers, Elliptic also found that the market's vendors offered other wares for scammers such as stolen data that could be used for finding victims, as well as services for registering SIM cards and Starlink internet subscriptions through proxies. North Korean state-sponsored cybercriminals also appear to have made use of the platform for money laundering. Elliptic found through blockchain analysis, for instance, that about $220,000 stolen from the Indian cryptocurrency exchange WazirX—the victim of a $235 million theft in July of last year, widely attributed to North Korean hackers—had flowed into Xinbi Guarantee in a series of transactions last November. Those money laundering and scam-enabling services, however, are far from the only shady offerings found on Xinbi Guarantee's market. Elliptic also found listings for surrogate mothers and egg donors, with one post showing faceless pictures of the donor's body. Other accounts have offered services that will, for a payment in Tether, place a funeral wreath at a target's door, deface their home with graffiti, post damaging statements around their home, have someone verbally threaten them, throw feces at them, or even, most bizarrely, surround their home with AIDS patients. One posting suggested these AIDS patients would carry 'case reports and needles for intimidation." Other listings have offered sex workers as young as 18 years old, noting the specific sex acts that are allowed and forbidden. Elliptic says that one of its researchers was even offered a 14-year-old by a Xinbi Guarantee merchant. (The account holder noted, however, that no transaction for sex with someone below the age of 18 would be guaranteed by Xinbi. The legal age of consent in China is 14.) Exactly why Xinbi Guarantee is legally registered in the US remains a mystery. Its incorporation record on the Colorado Secretary of State's website shows an address at an office park in the city of Aurora with no external Xinbi branding. The company appears to have been registered there in August of 2022 by someone named 'Mohd Shahrulnizam Bin Abd Manap" (WIRED connected that name with several people in Malaysia but couldn't determine which one might be Xinbi Guarantee's registrant.) The listing is currently marked as 'delinquent,' perhaps due to failure to file more recent paperwork to renew it. For fledgling Chinese companies—legitimate and illegitimate—incorporating in the US is an increasingly common tactic for 'projecting legitimacy,' says Jacob Sims, a visiting fellow at Harvard's Asia Center who focuses on transnational Chinese crime. 'If you have a US presence, you can also open US bank accounts,' Sims says. 'You could potentially hire staff in the US. You could in theory have more formalized connections to US entities.' But he notes that the registration's delinquent status may mean Xinbi Guarantee tried to make some sort of inroads in the US in the past but gave up. While Telegram has served as the chief means of communication for the two markets, the stablecoin cryptocurrency Tether has served as their primary means of payment, Elliptic found. And despite Telegram's new round of removals of their channels and accounts, Xinbi Guarantee and Huione Guarantee are far from the only companies to use Tether and Telegram to create essentially a new, largely Chinese-language darknet: Elliptic is tracking close to 30 similar marketplaces, Robinson says, though he declined to name others in the midst of the company's investigations. Just as Telegram shows new signs of cracking down on that sprawling black market, Tether, too, has the ability to disrupt criminal use of its services. Unlike other more decentralized cryptocurrencies such as Bitcoin, Tether can freeze payments when it identifies bad actors. Yet it's not clear to what degree Tether has taken measures to stop Chinese-language crypto scammers and others on Xinbi Guarantee and Huione Guarantee from using its currency. When WIRED wrote to Tether to ask about its role in those black markets, the company responded in a statement that it encourages 'firms like Elliptic and other blockchain intelligence providers to share critical data with law enforcement so we can act swiftly and in coordination.' 'We are not passive observers—we are active players in the global fight against financial crime,' the Tether statement continued. 'If you're considering using Tether for illicit purposes, think again: it is the most traceable asset in existence. We will identify you, and we will work to ensure you are brought to justice.' Despite that promise—and Telegram's new effort to remove Huione Guarantee and Xinbi Guarantee from its platform—both tools have already been used to facilitate tens of billions of dollars in theft and other black market deals, much of it occurring in plain sight. The two largely illegal and very public markets have been 'remarkable for both the scale at which they're operating and also the brazenness,' says Harvard's Jacob Sims. Given that brazenness and the massive criminal fortunes at stake, expect both markets to attempt a revival in some form—and plenty of competitors to try to take their place atop the Chinese-language crypto crime economy.
