Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Xinbi Guarantee was reported as a Chinese-language Telegram marketplace used by vendors serving online fraud and money laundering in Southeast Asia. Elliptic’s widely cited $8.4 billion figure is a lower-bound estimate of USDT traced to addresses associated with the marketplace since 2022—not a court finding, victim-loss total, or proof that every transaction was criminal.
What was Xinbi Guarantee?
Elliptic described Xinbi Guarantee as a Chinese-language marketplace operating through Telegram and serving fraudsters in Southeast Asia. Vendors advertised services and goods that could support online crime, including money laundering, stolen personal data, fake identification and satellite-internet equipment. USDT was reported as the primary payment method.
Elliptic’s initial investigation reported 233,000 users, compared with 119,000 in August 2024. A user count does not show how many people bought illicit services, nor does it establish that every transaction had the same purpose.
Services linked to fraud operations
- Vendors advertised laundering for proceeds from “pig-butchering” and other chat-based scams.
- Stolen contact data could help operators identify and approach prospective victims.
- Fake identity documents and other enabling services were listed alongside financial services.
These were offers Elliptic said it observed and analyzed. They should not be read as proof that all Xinbi users or merchants participated in every category of crime.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
What does Elliptic’s $8.4 billion figure measure?
Elliptic said it identified thousands of crypto addresses used by Xinbi Guarantee and its merchants, then measured at least $8.4 billion in USDT received since 2022. The company characterized that amount as a lower bound because it covered only addresses it could attribute to the marketplace and its vendors.
The estimate measures traced on-chain inflows. It is not:
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
- a tally of scam victims’ losses;
- a finding that all $8.4 billion represented criminal proceeds;
- a court judgment covering every Xinbi transaction; or
- a count of unique users or transactions.
Elliptic’s initial chart showed activity through the first quarter of 2025 and identified the fourth quarter of 2024 as the first quarter in which traced inflows exceeded $1 billion. Those are analytics estimates tied to the addresses and period in that investigation.
Why do later reports cite $19.7 billion or $24 billion?
Those figures use different asset categories, address sets and measurement methods. They should not be added together or treated as revised measurements of one identical pool.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
| Figure and source | What it covers | How to interpret it |
|---|---|---|
| At least $8.4 billion Elliptic’s initial investigation |
USDT received since 2022 by thousands of addresses Elliptic associated with Xinbi and its merchants | Lower-bound traced inflows; not victim losses or a finding that every dollar was illicit |
| More than $19.7 billion Elliptic, March 2026 |
Cryptoasset inflows in Elliptic’s later assessment | A later estimate with a different reporting date and scope from the initial $8.4 billion figure |
| More than $24 billion U.S. Treasury estimate as relayed by Chainalysis |
Digital assets and fiat currency processed since around 2022 | Broader asset scope than a USDT-only or crypto-only inflow estimate |
| More than $8.4 billion Chainalysis account of 52 OFAC-designated addresses |
Stablecoins received by a defined set of sanctioned addresses | A restricted address population, not the entire marketplace’s activity |
When comparing a new Xinbi number, check four things: the asset scope, the addresses included, the measurement period and whether the number describes inflows, processed value, seized assets or restrained assets.
How did romance scams connect to Xinbi?
Elliptic reported that Xinbi vendors openly advertised laundering proceeds from pig-butchering scams and other online relationship or chat fraud. Merchant materials used Chinese-language labels that were rendered in English as terms such as “sha pig” and “chat.” Because those labels were machine-translated, their wording should be treated as an approximate rendering rather than a precise legal classification.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
In a related laundering pattern, Chainalysis described specialized “Black U” vendors. Its analysis said these vendors accepted traceable funds linked to North Korean thefts and provided stablecoins sourced from separate illicit streams, including pig-butchering and romance-scam proceeds. The substitution mixes stolen funds into a wider illicit pool; it does not erase the original blockchain history.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Chainalysis presented that as a laundering typology. It does not establish that every Xinbi transaction, vendor or customer used the Black U method.
Best Value
- All your digital assets in one place. You can manage thousands of crypto including Bitcoin, Ethereum, Solana, Tether and more.
- Defend your identity against hackers: secure your online accounts with passwordless, hardware backed, 2FA logins for all your favorite apps and websites.
- Connectivity: USB-C cable connection only. No Bluetooth.Compatible with the Ledger Wallet crypto app, both desktop (Windows, macOS, Linux) and mobile (Android only). Not compatible with iOS.
- Protect your digital assets with the industry's best security: keep your private keys offline in your private signer, battle-tested by the Donjon's white hat hackers, CC EAL 6+ certified Secure Element, constantly updated Ledger OS.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
How were North Korea-linked thefts tied to Xinbi?
A directly traced WazirX transfer
In July 2024, $235 million was stolen from the Indian exchange WazirX. Elliptic and other investigators attributed the breach to actors linked to North Korea. Elliptic traced approximately $220,000 in USDT across nine transactions on November 12, 2024 from the theft to an address associated with Xinbi.
That tracing supports a specific connection between part of the WazirX proceeds and one Xinbi-associated address. It does not show that Xinbi handled the entire theft or that all marketplace funds came from North Korea.
Chainalysis’s broader network assessment
Chainalysis later reported that North Korea-linked actors moved tens of millions of dollars stolen in major hacks, including Bybit and WazirX, through Xinbi’s vendor network. This is a broader network analysis and estimate, distinct from Elliptic’s nine-transfer, approximately $220,000 tracing result.
What enforcement actions were reported by September 30, 2026?
- May 2025: Elliptic reported that Telegram closed thousands of channels associated with Xinbi and Huione. Elliptic said it continued tracking more than 30 similar marketplaces, so channel closures did not demonstrate that the wider ecosystem had permanently disappeared.
- March 2026: Elliptic reported that the United Kingdom sanctioned Xinbi and said the UK described Xinbi as facilitating the laundering of cryptoassets stolen by North Korea.
- September 7, 2026: The U.S. Department of Justice said a federal court authorized seizure of the Telegram channels hosting the marketplace. Authorities seized two wallets used to collect vendor payments, containing approximately $12 million, and sought restraint of 47 additional wallets.
- By the DOJ’s September 2026 release: More than $52 million in cryptocurrency had been restrained across Xinbi and its vendor network. Tether assisted law enforcement, according to the DOJ.
The DOJ figures describe a specific court-authorized seizure and restraint operation. They are not a measurement of Xinbi’s total historical inflows, and the action alone does not prove that every related channel or successor marketplace stopped operating permanently.
What remains unproven?
- No reviewed source establishes a confirmed victim count for Xinbi-linked romance or pig-butchering scams.
- The reported billions are analytics estimates, not adjudicated totals of criminal proceeds or victim losses.
- The North Korea connection is based on traced transactions and broader blockchain analysis; the sources do not say that all Xinbi activity was DPRK-linked.
- Restrained or seized assets represent enforcement results, not the marketplace’s full balance or lifetime transaction volume.
How to read future Xinbi coverage
Give every number its label. A USDT inflow estimate, a cryptoasset total, a digital-assets-plus-fiat processing estimate, a sanctioned-address balance and a DOJ restraint figure answer different questions. Likewise, a directly traced transfer is narrower evidence than a network-wide laundering estimate. Keeping those distinctions prevents the $8.4 billion headline from being mistaken for a victim tally or a judgment covering every transaction.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
