Thousands of channels closed on Telegram, disrupting major illicit marketplaces

Two major illicit marketplaces, Xinbi Guarantee and Huione Guarantee, have been hit as Telegram closed "thousands" of channels belonging to these cybercriminals.

According to blockchain analysis company Elliptic, Telegram took action after Elliptic’s investigation into the above-mentioned marketplaces, which are said to have collectively engaged in more than $35 billion in tether (USDT) stablecoin transactions.

While Huione Guarantee was exposed by Elliptic earlier, Xinbi Guarantee is said to be a Chinese-language, Telegram-based marketplace used by fraudsters in Southeast Asia, where merchants on the marketplace sell technology, personal data, and money laundering services. Moreover, according to the researchers, some transactions can be linked to funds stolen by the infamous North Korean hackers.

Interestingly, the investigation has shown that Xinbi, which is deemed to be "the second largest illicit online market to have ever operated," is managed via a Colorado-incorporated company, Xinbi Co. Ltd., which is described as an "investment and capital guarantee group company."

According to Elliptic, Xinbi Guarantee has 233,000 users, which is 96% more than in August 2024. Meanwhile, its merchants operate in nine categories. Four of them are responsible for the largest share of transactions and are engaged in various money laundering services.

While some advertise their services using words such as "material" instead of "money" and "white capital," meaning that the money would be laundered, others openly state their readiness to launder proceeds of the so-called pig butchering scams.

Meanwhile, the rest of the Xinbi merchants offer Starlink satellite internet equipment, which is used by scam compounds, fake IDs, and databases of stolen personal information. Other vendors also offer niche illicit services unrelated to cyber scams, such as stalking and intimidating anyone within China that a buyer specifies, sex trafficking, and other illegal activities.

The research showed that crypto addresses used by Xinbi Guarantee have received at least $8.4 billion in USDT since 2022.

"Transaction volumes on Chinese-language Guarantee marketplaces such as Huione and Xinbi Guarantee dwarf those of the first generation of Tor-based darknet marketplaces. This reflects the enormous scale of cyber scams compared to the online illicit drugs trade, which was the focus of those earlier markets," Elliptic concluded.