The $24 Billion Laundromat: Inside Xinbi Guarantee, the Crypto Black Market Fuelling Human Trafficking and North Korean Theft

A Telegram-based marketplace processed more money than most national banks - servicing scam compounds built on human slavery, laundering proceeds for Pyongyang's hackers, and surviving every enforcement action thrown at it.

The digital underground: Xinbi Guarantee operated in plain sight on Telegram, processing $24 billion for criminals worldwide. Photo: Pexels

Somewhere between a Telegram channel and a Cambodian prison compound holding 20,000 trafficked workers, there exists a financial pipeline that has processed more illicit cryptocurrency than the GDP of most small nations. Its name is Xinbi Guarantee. And until March 26, 2026, no government on Earth had formally sanctioned it.

That changed when the United Kingdom's Foreign, Commonwealth and Development Office designated Xinbi under its Global Human Rights sanctions regime - the first country to do so. The action froze the platform's ability to interact with the legitimate crypto ecosystem, seized London properties linked to its network, and sent a signal that the era of trillion-dollar impunity for crypto-enabled crime syndicates is narrowing. Whether it is closing fast enough is another question entirely.

Xinbi Guarantee, according to blockchain analytics firm TRM Labs, has processed $24.2 billion in total transaction volume since launching in 2022. Elliptic, a competing analytics firm, pins the figure at $19.7 billion. Chainalysis, a third, settles on $19.9 billion. Whatever the precise number, the scale is staggering. This is not a dark web marketplace selling pills and fake passports. This is an industrialized financial infrastructure servicing the largest organized crime networks in human history - a machine that turns human suffering into clean cryptocurrency with terrifying efficiency.

Xinbi Guarantee by the numbers: a timeline of growth, enforcement, and resilience.

I. The Architecture of a Criminal Supermarket

Xinbi's operators built a full-service criminal marketplace on Telegram's infrastructure. Photo: Pexels

To understand Xinbi, you first need to understand the concept of a "guarantee marketplace" - a term that sounds almost quaint for what it actually describes. In the Chinese-language cybercrime ecosystem, a guarantee service functions as an informal escrow provider, a marketplace connecting buyers and sellers of illicit services, and a coordination hub for money mule networks. Think Amazon, but instead of books and electronics, the products are stolen identities, money laundering services, deepfake AI tools, and satellite internet equipment used to contact scam victims from remote jungle compounds.

Xinbi emerged on Telegram around 2022, initially operating as one of several Chinese-language guarantee services in the region. Its competitors included Huione Guarantee, Haowang Guarantee, and Tudou Guarantee - names that would become infamous in law enforcement circles as the financial backbones of Southeast Asia's industrial-scale scam economy. But Xinbi distinguished itself through something its rivals lacked: resilience.

The marketplace's listings, documented extensively by Elliptic and TRM Labs, read like a catalog of criminal capability. Merchants on Xinbi openly advertise their willingness to launder the proceeds of "pig butchering" scams - the romance and investment frauds that have become the signature crime of the 2020s. They sell stolen personal data harvested from breaches across the globe. They offer fake identification documents good enough to pass Know Your Customer checks at legitimate exchanges. They provide AI-powered deepfake tooling that allows scam operators to create convincing video calls with victims. And they sell Starlink satellite internet equipment - the hardware that keeps scam compounds connected to the outside world even when local authorities cut their internet lines.

The breadth of services is what makes Xinbi not merely a marketplace but an ecosystem. A scam compound operator can come to Xinbi and procure everything needed to run a fraud factory: the data to identify targets, the technology to deceive them, the communications infrastructure to reach them, and the financial plumbing to launder the proceeds. It is, in the words of one crypto-tracing researcher, "a one-stop shop for industrial-scale human exploitation."

The marketplace operated through channels and accounts on Telegram, the messaging platform founded by Russian-born Pavel Durov. At its peak, Xinbi's largest channel had approximately 175,000 subscribers. Its escrow service retained roughly 435,690 subscribers across multiple channels. The platform collected fees from merchants for the privilege of being listed and from buyers for the assurance that their criminal transactions would be completed as promised - the "guarantee" that gave it its name.

II. The Compounds: Where Trafficking Meets Tech

Cryptocurrency became the circulatory system of Southeast Asia's scam economy. Photo: Pexels

The money flowing through Xinbi does not originate from abstract cybercrime. It comes from a physical infrastructure of human suffering that has been documented by the United Nations, the FBI, and dozens of investigative journalists who have risked their lives to expose it.

Across Cambodia, Myanmar, Laos, and other parts of Southeast Asia, hundreds of compounds house workers - many of them trafficking victims - who are forced to run online scams day and night. They are lured from countries across Asia, Africa, and Latin America with promises of legitimate employment. When they arrive, their passports are confiscated. Those who refuse to work are beaten, tortured with electrified shackles, or sold to other compounds. WIRED has documented cases of workers being subjected to electric shocks for failing to meet daily fraud quotas. The United Nations estimates that hundreds of thousands of people are trapped in these operations.

The largest known compound is #8 Park, located in Cambodia. The UK government's sanctions documentation describes it as having capacity to accommodate 20,000 trafficked workers. It is operated by Legend Innovation Co., whose director, Eang Soklim, was sanctioned alongside Xinbi on March 26. The compound is linked to the Prince Group conglomerate, whose chairman Chen Zhi was arrested and extradited to China in January 2026 following coordinated US-UK sanctions against 146 entities and individuals connected to the organization in October 2025.

Elliptic published research in February 2026 that provided the first public evidence of #8 Park's connection to the Prince Group. Their analysts identified cryptocurrency addresses used by merchants operating inside the compound - a supermarket, a bakery, food stalls - that accepted USDT payments from workers. They could trace a wallet owner known to be associated with fraud purchasing food from merchants inside the compound, and a separate individual who sold leaked law enforcement data on both the Xinbi and Tudou marketplaces buying from other merchants within the compound's walls. The blockchain, it turns out, is a remarkably detailed map of criminal geography.

Five days after Elliptic published their research, reports emerged that those within #8 Park had been instructed to vacate by February 13. Videos circulated showing large-scale evacuations. Blockchain data corroborated the reports: incoming payments to compound merchants dropped sharply starting February 9 and ceased almost entirely by February 13. The compound did not disappear because its operators had a change of heart. It evacuated because the blockchain made it visible, and visibility is the one thing these operations cannot survive.

But Xinbi's connections to #8 Park represent only a fraction of its network. The marketplace serviced scam compounds across the region, providing the financial infrastructure that allowed stolen funds to move from victims' bank accounts through layers of cryptocurrency wallets and out the other side as clean money. Gregory Heeb, the FBI's deputy assistant director of the criminal division, testified before the US Senate in March 2026 that reported dollar losses from digital scams have increased roughly 350 percent since 2019. The FBI's Internet Crime Complaint Center received approximately 456,000 complaints in 2025, with reported losses exceeding $17.7 billion. And those are just the reported cases - the actual figures are believed to be vastly higher.

The laundering pipeline: how stolen funds flow through Xinbi's ecosystem of merchants, wallets, and no-KYC payment apps.

III. North Korea's Shopping Cart

Xinbi did not just serve scam operators. North Korean state hackers used it to launder stolen crypto. Photo: Pexels

If the connection to human trafficking compounds were not damning enough, Xinbi's client list includes another category of customer that elevates the marketplace from a regional crime problem to a matter of international security: the Democratic People's Republic of Korea.

Elliptic's analysis traced some proceeds from the $235 million hack of Indian cryptocurrency exchange WazirX - attributed to North Korean state-linked hackers - to addresses controlled by Xinbi merchants. The UK government's sanctions documentation explicitly states that Xinbi "facilitated the laundering of cryptoassets stolen by North Korea." This is not a vague association. It is a direct financial pipeline between a Telegram marketplace and a nuclear-armed state's illicit finance apparatus.

North Korea's Lazarus Group and affiliated hacking units have stolen billions of dollars in cryptocurrency over the past decade, using the proceeds to fund weapons programs and circumvent international sanctions. A March 2026 analysis by 38 North, a think tank focused on North Korea, documented how DPRK actors employ sophisticated laundering chains to move stolen funds through mixers, decentralized exchanges, and - critically - guarantee marketplaces like Xinbi that offer over-the-counter services with no meaningful identity verification.

The US Treasury Department designated the broader Huione Group as a "primary money-laundering concern" in 2025, restricting any connections between US financial institutions and the Cambodian conglomerate. But that action targeted Huione specifically. Xinbi, which had absorbed much of Huione's market share after the latter's channels were banned from Telegram, continued to operate unimpeded until the UK moved against it in March.

The gap between the Huione designation and the Xinbi sanctions - roughly a year - represents a window during which North Korean laundering operations had a fully functional, growing alternative. TRM Labs data shows that between May 2025, when Telegram banned Xinbi's channels, and December 2025, Xinbi's daily inflows nearly doubled. The platform did not merely survive the Telegram crackdown. It thrived. While Huione and Haowang saw volumes fall by nearly 100 percent, and Tudou Guarantee declined 74 percent before shutting down entirely, Xinbi expanded its market share and consolidated its position as the dominant criminal marketplace in the ecosystem.

John Wojcik, a former official at the United Nations Office on Drugs and Crime who now works as a threat researcher at security company Infoblox, put it bluntly in testimony to the US Senate: "The scale of scamming, money laundering, and closely linked online casinos operating out of Asia is not like anything we have ever seen before. The critical vulnerability here is not at the point of the multibillion-dollar cybercrime and scam operations themselves, but in the underground banking and money-laundering infrastructure that has supercharged it."

IV. The Hydra Problem: Why Xinbi Will Not Die Easily

Enforcement actions have struggled to keep pace with Xinbi's ability to rebuild and migrate. Photo: Pexels

The UK sanctions against Xinbi are significant. They will make it harder for the platform, its merchants, and its users to spend or exchange cryptocurrency that has passed through the marketplace. Tom Robinson, chief scientist and co-founder of Elliptic, confirmed that the designation will isolate Xinbi from the legitimate crypto ecosystem. Any virtual asset service provider processing transactions linked to Xinbi wallets now faces potential sanctions violation risk under UK law, with extraterritorial implications for institutions operating in or connected to UK markets.

But there is a problem. Xinbi saw this coming.

Months before the UK sanctions landed, Xinbi's operators had already begun building alternative infrastructure designed to survive exactly this kind of enforcement action. In June 2025, the platform started promoting SafeW - a proprietary secure messaging application developed by SafeW Technology Co., Ltd. - as an alternative to Telegram. Simultaneously, it launched NewPay, also known as XinbiPay, a no-KYC cryptocurrency payment application supporting USDT transactions across TRC20, ERC20, BEP20, and other blockchain networks.

The numbers tell the story of how seriously Xinbi took the migration. NewPay's withdrawal hot wallet processed over $94.6 million in total inflows within its first month of activation in December 2025. By March 2026, that wallet had approximately $250 million in inflow volume, with total volume approaching $500 million. The SafeW messaging app had attracted over 20,909 subscribers by March 2026, while Xinbi's Telegram escrow service still retained approximately 435,690 subscribers.

Neither SafeW nor NewPay were included in the UK sanctions package.

This is the hydra problem that haunts every enforcement action against crypto-enabled crime. You cut off one head - the Telegram channels, the primary wallet infrastructure - and two more grow in its place. Xinbi demonstrated this pattern after the Telegram ban in May 2025. It simply created new Telegram channels and continued its activity. Now, with proprietary messaging and payment infrastructure in place, it has an even more robust fallback position.

There is precedent for sanctions working. When the UK sanctioned BYEX, another cryptocurrency platform used to launder scam proceeds, it shut down entirely. But BYEX was smaller, less sophisticated, and lacked the diversified infrastructure that Xinbi has built. The question is whether Xinbi's proprietary systems can sustain the platform's operations at scale, or whether the loss of access to the legitimate crypto ecosystem will gradually strangle its utility.

Karen Seifert, director of the Scam Center Strike Force within the United States Attorney's Office for the District of Columbia, identified the core challenge in Senate testimony: "The network of the money launderers is, for the most part, separate from the network of the compounds itself. Even if I can crack the code on who's leading the compound at the regional level, that person is totally divorced from the money-laundering network, and that's a whole separate case. So we're spending a lot of resources on both sides of the problem."

V. The Sanctions Web: From London Penthouses to Cambodian Prisons

The UK froze London properties and crypto assets linked to the scam compound network. Photo: Pexels

The March 26 sanctions targeted five entities and individuals beyond Xinbi itself. Legend Innovation Co. and its director Eang Soklim were designated as the operators of #8 Park. Thet Li was identified as a key lieutenant of Prince Group chairman Chen Zhi who managed the group's international financial network, including operations in Taiwan. Hu Xiaowei, described as a long-term associate of Chen Zhi operating under three different aliases, was also sanctioned.

The UK government seized London properties as part of the action, including a reported nine-million-pound penthouse. These seizures add to substantial UK assets already frozen by previous enforcement actions against the Prince Group network, including a 100-million-pound office block in the City of London, two multi-million-pound mansions, and a helicopter. The total value of frozen assets now exceeds one billion pounds.

The scale of the property seizures reveals something important about how scam compound proceeds are laundered. The money does not stay in cryptocurrency. It flows through Xinbi and similar marketplaces, gets converted to USDT and other stablecoins, passes through layers of over-the-counter exchanges with no meaningful KYC requirements, and eventually finds its way into the traditional financial system - where it is used to purchase luxury real estate in London, Singapore, Dubai, and other global property markets.

The UK's Fraud Strategy 2026-2029, published earlier in March, explicitly identifies cryptoasset-enabled fraud as a growing risk and calls for more systematic use of blockchain analytics and international sanctions to disrupt the criminal networks behind it. The strategy also announces the launch of a new Online Crime Centre in April 2026, backed by 31 million pounds in funding for improved intelligence-sharing between law enforcement, national security agencies, and private-sector partners.

But enforcement remains fragmented. The US sanctioned the Huione Group. The UK sanctioned Xinbi. Cambodia arrested Chen Zhi - but only after years of the Prince Group operating with apparent impunity from Phnom Penh. The challenge is coordination. These criminal networks operate across jurisdictions by design. They incorporate in Colorado while operating from the Golden Triangle. They use Telegram servers hosted in multiple countries. They move money through blockchain networks that exist everywhere and nowhere simultaneously.

Cambodian authorities have claimed significant progress since the October 2025 sanctions. They estimate that 2,500 sites have been raided, hundreds of scam centers closed, and tens of thousands of foreign nationals released. But on-the-ground reporting by journalists and NGOs suggests the picture is more complicated. Many compounds have simply relocated to Myanmar, Laos, or more remote parts of Cambodia. The workers are moved. The infrastructure is rebuilt. The Telegram channels reopen under new names. And the money keeps flowing.

The guarantee marketplace landscape: Xinbi leads after competitors were sanctioned or shut down.

VI. The Blockchain Paradox: Transparency as Weapon and Shield

Blockchain analytics firms can trace illicit flows - but criminals adapt faster than regulators can act. Photo: Pexels

There is a deep irony at the heart of the Xinbi story. The same technology that enables the marketplace to operate - cryptocurrency, with its pseudonymous transactions and borderless transfers - is also the technology that allows investigators to trace the money with unprecedented precision. Every transaction on the blockchain is permanent and public. Elliptic can identify wallet addresses used by merchants inside #8 Park. TRM Labs can calculate that Xinbi processed $24.2 billion. Chainalysis can trace North Korean hack proceeds to specific Xinbi-linked wallets.

This transparency is genuinely powerful. It was blockchain analysis that connected #8 Park to the Prince Group before any government had made that link officially. It was on-chain intelligence that documented Xinbi's survival and growth after the Telegram ban. It is blockchain data that compliance teams at legitimate exchanges now use to screen transactions and flag Xinbi-linked activity.

But transparency without enforcement is observation without consequence. The analytics firms can see the money flowing. They can publish reports with precise dollar figures. They can present their findings to regulators and prosecutors. The question is whether governments can act quickly enough on that intelligence to meaningfully disrupt operations before the criminals adapt.

The evidence so far is mixed. The UK sanctions against Xinbi came approximately four years after the marketplace launched. During those four years, $24 billion flowed through the platform. The Huione Group operated for even longer before being designated. Chen Zhi built a criminal empire spanning multiple countries over more than a decade before being arrested. The gap between intelligence and action is measured in years and billions of dollars.

Xinbi's development of proprietary infrastructure - SafeW for messaging, NewPay for payments - represents the next evolution in this arms race. By moving off Telegram and building its own payment rails, Xinbi is attempting to create a closed ecosystem that is harder for analytics firms to monitor and harder for platform operators to shut down. If Xinbi's operators can internalize enough of the transaction flow within their own infrastructure, the blockchain transparency that currently benefits investigators may be partially neutralized.

TRM Labs notes that when funds move through guarantee-managed wallets, "the visible transaction trail reflects the service's own infrastructure rather than the individual actors behind it, requiring analysis of the platform's on-chain architecture to identify consolidation points and exit paths." In plain English: the criminals are building their own financial system, and it is getting harder to see inside.

VII. The Human Cost: Numbers That Breathe

Behind the billions in crypto flows are hundreds of thousands of trafficking victims and scam targets worldwide. Photo: Pexels

It is easy to lose the human element in a story dominated by billion-dollar figures and blockchain analytics. So consider what $24 billion in Xinbi transactions actually represents in human terms.

Each dollar that flowed through the marketplace originated from one of two sources: a scam victim who was deceived into sending their savings to a fake investment platform, or a trafficking victim who was forced to perpetrate that deception under threat of violence. The FBI's 2025 data - 456,000 complaints, $17.7 billion in losses - represents individual Americans who lost their retirement savings, their children's college funds, their homes. And those are just the ones who reported it. Studies suggest that scam victims report at rates as low as 5 to 15 percent, meaning the true scale of losses could be ten times higher.

On the other side of the transaction are the compound workers. Mekong Independent has published first-person accounts from trafficking victims trapped inside #8 Park. They describe 16-hour shifts running scam scripts, confiscated passports, beatings for failing to meet quotas, and the constant threat of being sold to a different compound for insufficient "performance." Some victims have been held for years. Some have died in custody. The UN's International Labour Organization estimates that forced labor in the scam economy generates $36 billion annually - a figure that places it among the most profitable criminal enterprises in human history.

The victims on both sides share one thing in common: they are predominantly from developing countries. The scam targets are disproportionately elderly, isolated, and financially unsophisticated. The trafficking victims are disproportionately young, from poor backgrounds, and desperate for economic opportunity. The criminal networks that run the compounds and use Xinbi to launder the proceeds extract wealth from the most vulnerable people on both ends of the transaction. The profits flow upward to oligarchs, organized crime bosses, and their enablers in the legitimate financial system.

When British Foreign Office minister Stephen Doughty said the sanctions "send a clear message" that those running scam compounds will face consequences, the question that lingers is whether a clear message is sufficient for a crisis that has already consumed hundreds of thousands of lives and tens of billions of dollars. The UK's action is the strongest enforcement tool any government has deployed against Xinbi specifically. But it comes late, and the marketplace has already demonstrated an extraordinary capacity to survive, adapt, and grow.

VIII. What Comes Next: The Illicit Finance Summit and Beyond

The UK's sanctions against Xinbi are part of a broader strategic framework that will be tested in the coming months. The country's Illicit Finance Summit, scheduled for June 2026, is expected to bring together international enforcement agencies, blockchain analytics firms, and financial regulators to coordinate the next phase of the crackdown on crypto-enabled crime.

The priorities are clear. First, closing the gap between intelligence and enforcement. Analytics firms can trace illicit flows in near-real-time. Government sanctions and prosecutions take months or years. That gap is where criminal networks build their resilience. Second, addressing the jurisdictional fragmentation that allows operations like Xinbi to incorporate in one country, operate from another, and move money through a third. Third, tackling the demand side - the scam victims who unwittingly fund the entire ecosystem by sending money to fraudulent platforms.

The US Treasury's 2026 National Risk Assessments, published in March, document the guarantee marketplace typology as a known laundering methodology and signal that further enforcement actions are likely. Prosecutors may argue that exchanges that fail to screen for Xinbi-linked transactions are on notice, and that failure to act beyond filing Suspicious Activity Reports constitutes willful blindness.

Meanwhile, the guarantee marketplace ecosystem continues to evolve. Smaller platforms are absorbing market share from the larger ones that have been sanctioned or shut down. New entrants are launching with proprietary infrastructure from day one, learning from Xinbi's example. The model - informal escrow, merchant listings, no-KYC payments - is being replicated and refined.

The ultimate question is whether the international community can dismantle the financial infrastructure faster than it can be rebuilt. The history of the past four years suggests that, so far, the criminals are winning the race. Xinbi processed $24 billion before any government sanctioned it. Its operators had already built alternative infrastructure before the sanctions landed. The compounds continue to operate. The trafficking continues. The scams continue.

But the blockchain is also permanent. Every transaction that flowed through Xinbi is recorded, immutable, and traceable. The challenge is not seeing the money. The challenge is acting on what we see, fast enough, and with enough international coordination, to make the cost of operating these networks greater than the profits they generate. Until that equation changes, the laundromats will keep washing.