Xinbi Marketplace Remains Active with USD 17.9 Billion in Total Volume Despite Enforcement Actions

Key takeaways:

• On-chain data indicates guarantee marketplace Xinbi was unaffected by Telegram’s spring 2025 crackdown, but expanded activity into late 2025, with inflows nearly doubling over that period to USD 8.9 billion, while activity at competitors Haowang Guarantee dropped almost 100% and Tudou Guarantee dropped more than 70%.
• The January 2026 acceleration of Xinbi’s migration coincided with broader enforcement, including the closure of Tudou Guarantee and the arrest of Prince Group chairman Chen Zhi, who used Huione Pay and Haowang Guarantee services to launder funds related to scam compound activity.
• Guarantee services attract illicit actors by offering informal escrow, wallet services, and marketplaces with minimal due diligence, making them a critical laundering facilitator layer.
• Targeting guarantee services remains a high-impact strategy for disrupting crypto-enabled crime, as funds become easier to trace once these facilitators are removed from the laundering chain.

‍

{{horizontal-line}}

Chinese language marketplace Xinbi is adapting to enforcement pressure by shifting operations away from Telegram and onto a new secure messaging platform called SafeW, while simultaneously launching a new affiliated wallet service known as XinbiPay. Xinbi, which is likely based in the Golden Triangle region spanning Myanmar, Thailand, and Laos, has historically operated as a Telegram based marketplace and wallet provider. The service plays a significant role in laundering proceeds for scam operations and cybercrime syndicates. As of the time of writing, wallets associated with Xinbi have received approximately USD 8.9 billion and processed roughly USD 17.9 billion in total transaction volume.

Guarantee services like Xinbi serve multiple functions within illicit ecosystems. They operate as informal escrow providers, marketplaces that connect buyers and sellers of services and cryptocurrency, and coordination hubs for money mule networks that convert funds between crypto and cash. These platforms offer varying degrees of transaction assurance but are frequently used by illicit actors because they allow funds to be moved quickly and informally without meaningful customer due diligence. For less technically sophisticated criminals, guarantee marketplaces provide turnkey access to laundering services and trusted counterparties, significantly lowering the barrier to entry for financial crime.

Participation in these transactions is financially attractive for guarantee operators. In addition to earning fees on exchanges and escrow services, involvement in illicit activity allows them to cultivate and control money mule networks that facilitate off chain cash movement. This dual role has turned guarantee marketplaces into central nodes for laundering activity rather than passive intermediaries.

Telegram crackdowns on guarantee services

Telegram emerged as a central hub for Chinese-language guarantee services beginning in 2019, with Kaer Guarantee as the earliest known example. Services such as Huione, Haowang, Tudou, and Xinbi leveraged Telegram’s encrypted channels, integrated wallet features, and programmable bots that allowed operators to manage user balances, monitor escrow accounts, and facilitate USDT and cryptocurrency transactions directly within chat environments. These capabilities drove rapid adoption, initially among cybercriminal networks that used guarantee services to support illicit transactions at scale.

This ecosystem came under sustained pressure in spring 2025, following FinCEN’s May 2025 Section 311 finding and proposed rule targeting Huione Guarantee and Haowang Guarantee. The action marked the first major US enforcement effort focused specifically on Chinese-language guarantee marketplaces. A Section 311 designation enables the U.S. Treasury to identify a foreign entity or class of transactions as a primary money laundering concern and impose special measures that can effectively isolate it from the U.S. financial system. Shortly thereafter, Telegram banned large channel clusters linked to Haowang and Xinbi.

The enforcement response produced sharply divergent outcomes. Huione and Haowang attempted to migrate users to the ChatMe platform, but adoption remained limited and transaction volumes fell precipitously, ultimately contributing to operational shutdowns. Xinbi, by contrast, rapidly reconstituted its Telegram presence using its original channels and identifiers, while simultaneously laying the groundwork for migration to alternative infrastructure.

As early as June 2025, Xinbi began promoting SafeW and its associated wallet service, XinbiPay, also referred to as NewPay wallet. User migration was initially modest but accelerated significantly in January 2026, coinciding with the announced closure of Tudou Guarantee and the arrest of Prince Group chairman Chen Zhi. These events likely heightened expectations of additional enforcement, prompting users to shift platforms more decisively.

On-chain activity reflects this transition. Wallet flows associated with Xinbi’s Telegram bot declined in December, followed by a sharp increase in January as activity moved to SafeW and XinbiPay. This rapid restructuring illustrates how Chinese-language guarantee services are evolving in response to enforcement pressure by distributing operations across multiple platforms, including proprietary systems, to enhance operational resilience and reduce vulnerability to future takedowns.

Volumes show Xinbi unaffected by the Telegram crackdown

Haowang, Huione, and Tudou have all experienced sharp declines in activity following enforcement actions in 2025. Both Haowang and Huione saw transaction volumes fall by nearly 100 percent after Telegram’s spring 2025 takedowns, while Tudou’s activity declined by approximately 74 percent. On alternative messaging platforms, administrators have acknowledged operational strain, citing overwhelming workloads and warning users that service speed and quality would likely deteriorate.

By contrast, Xinbi has continued to expand despite Telegram enforcement. Transaction data shows a steady increase in activity even after the platform was banned. Between May 12, 2025, one day before its removal from Telegram, and December 22, 2025, Xinbi’s daily inflows nearly doubled, reflecting close to a 100 percent increase over that period. This divergence underscores Xinbi’s ability to adapt operationally and maintain user activity while peer platforms struggled to recover.

The chart illustrates a clear redistribution of guarantee service activity over time. Huione-linked services dominated the ecosystem through 2024, but their share declined sharply following enforcement actions in 2025. As that activity recedes, Xinbi and an expanding group of smaller guarantee services absorb a growing share of volume, demonstrating how enforcement has reshaped the landscape by driving fragmentation and operational adaptation rather than dismantling the guarantee service model itself.

How does Xinbi fit into the larger Chinese-language guarantee service ecosystem?

Xinbi emerged on Telegram around 2022 and quickly established itself as a central marketplace for cash out and laundering services used by pig butchering networks and other illicit actors. Alongside similar platforms such as Huione, Haowang, and Tudou, Xinbi has been linked to a broad range of criminal activity, including large scale fraud, money laundering, sales of personally identifiable information, cybercrime services, AI deepfake tooling, and Chinese language over the counter cryptocurrency exchanges that facilitate online scams.

TRM Labs estimates that since 2022, Xinbi has processed at least USD 16.4 billion in transaction volume. During that period, the platform hosted listings advertising services such as laundering illicit proceeds, selling stolen data, providing fake identification documents, and offering other forms of scam enablement infrastructure. Xinbi also publicly claimed to be registered with FinCEN in the United States and FINTRAC in Canada, assertions that were used to project legitimacy to users despite the platform’s role in facilitating illicit activity.

‍

Guarantee services: Step-by-step

Here’s how Xinbi and similar guarantee services typically operate in practice.

When a threat actor wants to offer services through a guarantee marketplace, they first contact a platform administrator or customer service channel to register as a vendor. As part of that process, the vendor is required to post a security deposit, with the amount calibrated to the type of service being offered. Deposits for cybercrime-related services often run into the thousands of USDT, while services tied to money laundering, cash-out, or exchange activity can require deposits in the tens of thousands or more.

Once approved, the vendor is given a dedicated chat space where customers can engage with them. When a transaction is agreed, the buyer, seller, and a guarantee administrator move into a shared room where the deal is executed under the administrator’s supervision. Funds are transferred into escrow, and the service is delivered. If a dispute arises, the administrator can resolve it by releasing or refunding funds, drawing on the vendor’s security deposit when necessary. This structure provides users with a degree of assurance while allowing the platform to maintain control over transactions.

Many participants also rely on wallets provided directly by the guarantee service. These wallets typically have no meaningful KYC requirements and are integrated into the platform’s internal payment infrastructure. Transactions often remain within the guarantee service’s wallet ecosystem, limiting interaction with external services and obscuring the full transaction path. This internalization of flows makes it more difficult to trace the ultimate origin and destination of funds, which is a key reason these services are attractive to illicit actors.

‍

Targeting illicit guarantee services 

Targeting threat actors that rely on guarantee services presents a distinct investigative challenge. Once funds enter a guarantee service’s on-chain ecosystem, tracing becomes more complex because control over wallets is obscured by shared infrastructure, internal transfers, and platform-managed custody. The visible transaction trail often reflects the activity of the service itself rather than the individual actors operating behind it.

‍

That said, there are on-chain signals that can still support attribution and tracing. When a money laundering group uses wallets issued or managed by the guarantee service, such as XinbiPay, investigators must analyze the service’s internal wallet architecture and transaction flows to understand how funds move through that system. This requires mapping patterns within the platform’s on-chain structure to identify consolidation points, operational behavior, and potential exit paths. By contrast, when vendors publish external wallet addresses in their channels that are not controlled by the guarantee service, tracing is more straightforward. In those cases, investigators can more easily follow funds end to end and identify downstream endpoints.

For this reason, disrupting facilitators is central to countering crypto-enabled illicit activity, including cybercrime networks, professional money launderers, and state-aligned actors engaged in sanctions evasion. Removing services like Huione from the laundering ecosystem significantly improves investigators’ ability to track actors and follow illicit proceeds. 

Effective disruption matters because these platforms depend on trust. When users lose access to sellers, experience fund losses, or see communication channels break down, confidence erodes, usage declines, and the broader illicit ecosystem becomes more exposed.

‍

{{horizontal-line}}

Frequently asked questions

1. What is Xinbi Guarantee?

Xinbi is a Chinese-language guarantee service that operates as a guarantee marketplace, primarily facilitating transactions between buyers and sellers of crypto-related services. It has been closely associated with scam and cybercrime enablement, including money laundering, illicit cash-out services, and fraud infrastructure.

2. What are Chinese-language guarantee services?

Chinese-language guarantee services act as informal escrow providers and marketplaces, hosting vendor listings, promotions, and wallet services. While they may advertise security or dispute resolution, many operate with minimal due diligence, making them attractive to illicit actors seeking fast and opaque fund movement.

3. Why did Telegram take action against guarantee services?

Telegram began shutting down guarantee services in spring 2025 following increased regulatory scrutiny, including the May 2025 FinCEN Section 311 finding targeting major Chinese-language escrow services. These actions marked the first major US financial system response focused specifically on this facilitator layer.

4. How did Xinbi respond to Telegram enforcement?

Xinbi adapted by maintaining its Telegram presence while simultaneously promoting a migration to the secure messaging app SafeW and launching a new wallet service, XinbiPay. This multi-platform approach helped preserve user access and transaction continuity.

5. What is SafeW, and why is it relevant?

SafeW is a secure messaging application that Xinbi promoted as an alternative coordination platform following Telegram enforcement. Its adoption illustrates how guarantee services increasingly diversify across platforms to reduce dependency on a single communication channel.

6. What is XinbiPay?

XinbiPay is a wallet service associated with Xinbi Guarantee that allows users to transact within Xinbi’s on-chain ecosystem. Like other guarantee-provided wallets, it does not appear to require meaningful Know Your Customer (KYC) checks, complicating attribution and tracing efforts.

7. What does on-chain data show about Xinbi’s activity after the crackdown?

On-chain analysis indicates that Xinbi experienced sustained and, in some periods, increased transaction volumes after the Telegram ban. Wallet inflows dipped briefly in December 2025 but surged in January 2026 as activity shifted more decisively to SafeW and XinbiPay.

8. How does Xinbi compare to other guarantee services like Huione or Tudou?

While Huione, Haowang, and Tudou have seen declining activity following enforcement actions, Xinbi has shown relative resilience. Its ability to migrate users and operations quickly appears to have contributed to continued growth.

9. Why are guarantee services difficult to disrupt?

Once funds enter a guarantee service’s on-chain network, they often move through internal wallet structures that obscure origin and destination. This makes tracing more challenging compared to transactions that pass directly through external wallets or regulated intermediaries.

10. Why do guarantee services matter for crypto crime prevention?

Guarantee services function as a critical facilitator layer for scams, money laundering, and cybercrime. Targeting these services can significantly degrade illicit actors’ ability to cash out and move funds, improving traceability and enforcement outcomes across the broader crypto ecosystem.