Xinbi Guarantee

Background

Xinbi is a Chinese-language guarantee marketplace that emerged on Telegram around 2022 and has since grown into one of the largest and most resilient illicit service platforms in the crypto ecosystem. Since its establishment, Xinbi has processed approximately USD 17.9 billion in total transaction volume — with USD 8.9 billion in observed inflows — serving as a critical facilitator for scam operations, money laundering networks, and cybercrime syndicates operating across Southeast Asia and beyond.

Guarantee services like Xinbi play a distinctive role in illicit finance. They operate simultaneously as informal escrow providers, marketplaces connecting buyers and sellers of illicit services, and coordination hubs for money mule networks. By offering transaction assurance with minimal due diligence, they lower the barrier to entry for financial crime and have become central nodes in the laundering chain rather than passive intermediaries. Xinbi likely operates from the Golden Triangle region spanning Myanmar, Thailand, and Laos.

Unlike several of its peer platforms, Xinbi has demonstrated a capacity to absorb enforcement pressure and continue operating, making it one of the most consequential guarantee services currently active.

Xinbi’s response to enforcement pressure

Telegram emerged as the central hub for Chinese-language guarantee services beginning in 2019, with services like Huione, Haowang, Tudou, and Xinbi leveraging its encrypted channels, integrated wallet features, and programmable bots to manage user balances, escrow accounts, and cryptocurrency transactions at scale.

This ecosystem came under sustained pressure in spring 2025, following FinCEN's May 2025 Section 311 finding targeting Huione Guarantee and Haowang Guarantee — the first major US enforcement effort focused specifically on Chinese-language guarantee marketplaces. A Section 311 designation identifies a foreign entity as a primary money laundering concern, enabling the US Treasury to impose special measures that can effectively isolate it from the US financial system. Telegram subsequently banned large channel clusters linked to Haowang and Xinbi.

The enforcement response produced sharply divergent outcomes. Huione and Haowang attempted to migrate users to the ChatMe platform, but adoption remained limited and transaction volumes fell precipitously. Xinbi, by contrast, rapidly reconstituted its Telegram presence and simultaneously began laying groundwork for migration to alternative infrastructure.

As early as June 2025, Xinbi began promoting SafeW — a secure messaging application developed by SafeW Technology Co., Ltd. — as an alternative coordination platform, citing the risk of future Telegram bans. Xinbi simultaneously launched XinbiPay, also referred to as NewPay wallet, a cryptocurrency payment application developed by Anwen Technology Co., Ltd. XinbiPay supports no-KYC (Know Your Customer) sending and receiving of USDT across TRC20, ERC20, BEP20, ETH, and TRX blockchains, though its exchange feature requires government-issued identification. Both applications are available on the Apple App Store.

User migration to SafeW accelerated significantly in January 2026, coinciding with the announced closure of Tudou Guarantee and the arrest of Prince Group chairman Chen Zhi, who used Huione Pay and Haowang Guarantee services to launder funds connected to scam compound activity. As of late January 2026, Xinbi's Telegram escrow service retained approximately 346,156 subscribers, while the new SafeW escrow service had grown to over 18,557 subscribers since its promotion began in late December 2025. Xinbi operates distinct security deposit and withdrawal hot wallets across its Telegram and SafeW platforms; however, all wallets are interconnected via their on-chain footprint.

Volumes show Xinbi unaffected by the Telegram crackdown

While Haowang and Huione saw transaction volumes fall by nearly 100% following Telegram's spring 2025 bans, and Tudou's activity declined by approximately 74%, Xinbi continued to expand. Between May 12, 2025 — one day before its Telegram removal — and December 22, 2025, Xinbi's daily inflows nearly doubled, reflecting close to a 100% increase over that period.

In early December 2025, Xinbi's Telegram wallet service saw weekly inflows drop sharply from a peak of nearly USD 10 million to near zero, with only outflows continuing — a pattern consistent with deliberate migration of activity to new infrastructure. XinbiPay's withdrawal hot wallet processed over USD 94.6 million in total inflows within its first month of activation, underscoring the speed and scale of the platform transition.

This divergence underscores Xinbi's operational adaptability. As Huione-linked services declined, Xinbi and a growing group of smaller guarantee services absorbed an increasing share of ecosystem volume. Rather than dismantling the guarantee service model, enforcement has reshaped the landscape — driving fragmentation and consolidation around more resilient operators.

On-chain footprint and connections to the illicit crypto ecosystem

Xinbi has established connections to a broad range of illicit actors and networks. TRM analysis identifies on-chain links between Xinbi and Prince Group entities, JinBei Casino, and Prince Group-associated Telegram-based guarantee services. The platform has been used to launder proceeds from pig butchering networks and other fraud operations, and hosted listings offering services including stolen data sales, fake identification documents, AI deepfake tooling, and Chinese-language over-the-counter cryptocurrency exchanges that facilitate online scams.

Xinbi publicly claimed to be registered with FinCEN in the US and FINTRAC in Canada — assertions used to project legitimacy to users despite the platform's role facilitating illicit activity.

Operational model

Xinbi and similar guarantee services operate through a structured vendor and escrow model. Prospective vendors contact platform administrators to register and post a security deposit calibrated to the type of service offered — ranging from thousands of USDT for cybercrime services to tens of thousands for money laundering and cash-out operations. Once approved, vendors receive a dedicated channel where transactions are executed under administrator supervision, with funds held in escrow until delivery is confirmed.

Many participants transact using wallets issued directly by the guarantee service. These wallets carry no meaningful KYC requirements and are integrated into Xinbi's internal payment infrastructure, keeping transactions within the platform ecosystem and limiting interaction with external services. This internalization of flows obscures the full transaction path — a primary reason guarantee services are attractive to illicit actors.

When funds move through guarantee-managed wallets like XinbiPay, investors must analyze the service's internal wallet architecture to identify consolidation points and exit paths. When vendors instead publish external wallet addresses not controlled by the guarantee service, tracing is more straightforward. Removing facilitators like Xinbi from the laundering ecosystem significantly improves investigators' ability to trace funds and attribute activity.

Law enforcement and regulatory response

In May 2025, FinCEN issued a Section 311 finding targeting Huione Guarantee and Haowang Guarantee, marking the first US enforcement action focused specifically on Chinese-language guarantee marketplaces. While Xinbi was not directly named in that action, Telegram's contemporaneous enforcement removed Xinbi's channel clusters alongside those of the designated platforms.

In January 2026, Tudou Guarantee was shut down and Prince Group chairman Chen Zhi was arrested in connection with money laundering tied to scam compound activity facilitated through Huione Pay and Haowang Guarantee. These developments accelerated user migration to Xinbi's alternative platforms and heightened expectations of additional enforcement action across the guarantee service ecosystem.