$8.4 Billion Crypto-Laundering Network on Telegram Tied to U.S.-Registered Company, Elliptic Report Finds

In a disturbing new revelation that underscores the scale and sophistication of global crypto-fueled cybercrime, blockchain analytics firm Elliptic has uncovered a vast Chinese-language money laundering operation—allegedly responsible for more than $8.4 billion in illicit transactions, operating openly on Telegram and linked to a company registered in the United States.

The network, operated under the name Xinbi Guarantee, functioned as an underground financial marketplace for crypto investment scammers, North Korean hackers, and an array of criminal actors. It offered a suite of services ranging from laundering stolen cryptocurrency to facilitating sex trafficking, harassment-for-hire, and illegal surrogacy and egg donation services.

While the marketplace catered primarily to Chinese-speaking cybercriminals, the company curiously advertises on its website, written in Mandarin, that it is legally registered in the U.S. state of Colorado.

“Xinbi Guarantee has served as a giant, purportedly U.S.-incorporated illicit online marketplace for online scams that primarily offers money laundering services,” said Tom Robinson, co-founder of Elliptic, in a statement accompanying the firm’s latest research. “But our findings show the platform enabled a shocking variety of other criminal enterprises as well.”

Among those were services offering to intimidate victims, including threats or even flinging feces—alongside recruitment for surrogate pregnancies and teen sex workers, the latter pointing strongly to human trafficking.

The findings come as Telegram, the encrypted messaging app at the heart of many cybercriminal communities, has taken steps to dismantle channels linked to the illicit marketplace. Telegram removed several of Xinbi Guarantee’s accounts in recent days, echoing similar enforcement actions taken in February after Elliptic’s earlier report.

Still, Elliptic warns that these actions may only temporarily disrupt the marketplace. “These are very lucrative businesses, and they’ll attempt to rebuild in some way,” Robinson cautioned. Past takedowns have seen criminal enterprises swiftly rebrand and relaunch under new aliases or domains.

The revelation underscores a growing challenge facing law enforcement and regulators: the entanglement of legitimate corporate frameworks with cross-border cybercriminal ecosystems. The use of a U.S.-registered entity lends an alarming air of legitimacy to a shadowy operation fueling some of the world’s most pressing cyber threats.

With crypto scams, fraud, and laundering rising sharply worldwide, and state-affiliated actors like North Korea leveraging these tools for sanctions evasion and revenue generation, the pressure is mounting on regulators and tech platforms alike to close loopholes that allow such networks to thrive.

As for Xinbi Guarantee, its future on Telegram may be uncertain, but Elliptic warns that the true test lies in whether global cooperation can effectively dismantle the infrastructure behind the digital facade.

Thomas Lin
UCW Newswire