Free tools Windows power users keep installed
One-click scans. No signup required.
Xinbi Guarantee was reported as a Chinese-language Telegram marketplace for illicit services, not a conventional exchange. Elliptic’s widely cited $8.4 billion figure is a lower-bound estimate of USDT received since 2022 by thousands of addresses that Elliptic associated with Xinbi and its merchants. It is not a court finding, a count of victims, or a measure of total scam losses.
What Xinbi Guarantee was reported to be
Elliptic described Xinbi Guarantee as a Chinese-language marketplace on Telegram that served fraudsters in Southeast Asia. Vendors advertised money laundering, stolen personal data, fake identification and satellite-internet equipment, among other goods and services. Elliptic identified USDT as the primary payment method and reported about 233,000 users, compared with 119,000 in August 2024.
The marketplace listings included offers to launder proceeds from “pig-butchering” scams and other online chat-based fraud. Stolen contact data could help operators identify and approach prospective victims. Those findings describe offers Elliptic observed; they do not establish that every user, vendor or transaction had the same purpose.
What Elliptic’s $8.4 billion number actually measures
In its initial investigation, Elliptic said Xinbi-associated addresses had received at least $8.4 billion in USDT since 2022. The estimate came from tracing thousands of addresses that Elliptic identified as belonging to Xinbi or its merchants. Elliptic called the total a lower bound because its address attribution could not capture every related wallet or transaction.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors#1 Best Overall
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
The number therefore represents traced crypto inflows to an attributed address set. It does not mean that $8.4 billion was proven to be criminal proceeds, that victims lost $8.4 billion, or that a court has adjudicated every transfer. Elliptic said the fourth quarter of 2024 was the first quarter in which inflows exceeded $1 billion; its chart ran through the first quarter of 2025.
Why later totals are not interchangeable
Later reporting used different asset baskets, address sets and measurement periods. Comparing the figures requires asking what was counted, which addresses were included and whether the amount describes inflows, broader processing, or government restraint.
| Figure | What it measures | Attribution and qualification |
|---|---|---|
| At least $8.4 billion | USDT received since 2022 by thousands of Xinbi-associated addresses | Elliptic’s initial investigation; a lower-bound analytics estimate, not victim losses |
| More than $19.7 billion | Cryptoasset inflows | Elliptic, March 2026; later estimate with a different reporting scope |
| More than $24 billion | Digital assets and fiat currency processed since around 2022 | U.S. Treasury estimate as relayed by Chainalysis; broader asset scope than the USDT figure |
| More than $8.4 billion | Stablecoins received by 52 OFAC-designated addresses | Chainalysis’s separate analysis; a defined sanctioned-address set, not the whole marketplace |
| More than $52 million | Cryptocurrency restrained across Xinbi and its vendor network | U.S. Department of Justice, September 2026 enforcement action |
| Approximately $12 million | Funds in two wallets used to collect vendor payments | Wallets seized under the DOJ action; this is a subset of the broader restraint figure |
How Xinbi was connected to romance-scam proceeds
“Pig-butchering” scams typically build trust through extended online conversations before persuading a target to send money to a fake investment or trading operation. Elliptic reported that Xinbi vendors openly advertised laundering proceeds from these scams and other chat-based fraud. Some merchant descriptions used Chinese-language terms rendered in English as “sha pig” and “chat”; those labels were machine-translated, so their wording should not be treated as a formal classification.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Chainalysis described a laundering typology involving specialized vendors it called “Black U.” In that analysis, a customer could provide traceable funds linked to a North Korean theft and receive stablecoins sourced from a separate illicit stream, such as pig-butchering or romance-scam proceeds. The substitution mixes the stolen assets into a wider illicit pool; it does not erase the original blockchain history. Chainalysis presented this as a network pattern, not as proof that every Xinbi transaction used that method.
What the North Korea-linked crypto connection shows
The directly traced WazirX transfers
Elliptic said attackers linked by Elliptic and other investigators to North Korea stole about $235 million from India-based exchange WazirX in July 2024. Elliptic traced approximately $220,000 in USDT from that theft to a Xinbi-associated address in nine transactions on November 12, 2024.
That tracing supports a specific connection between part of the WazirX proceeds and one address associated with Xinbi. It does not show that Xinbi handled the entire theft or that all marketplace activity was North Korea-linked.
Rank #3
- Quality Materials: these crypto wallets are made of aluminum with a melting point of over 2500 degrees Fahrenheit and can serve you for a long time
- Products quantity: you will receive a 2-in-1 set of steel bitcoin wallets with matching lock screws, and 1 piece of metal plate marking pen, which is a matching set to help you protect your codes, passwords, and further importantly, your cryptocurrency
- Functions: with these steel crypto wallets you can record information such as fieldworks passphrase in tandem with the BIP39 word list, and they are also compatible with 12 or 24-word seed in most languages, suitable to store your private cryptocurrency information or for many instances where you may need a private cold storage system
- Suitable size: the cold wallet backups are compatible with BIP39 wallets, can work with most hardware wallets, supports up to 24 mnemonics seed phrases, convenient for you to use in coordination with other crypto seed storage devices and wallets
- Multiple ways of locking: you can use the matching screws to lock up the steel bitcoin wallets; You can also lock them up and hide them in other places if you still feel unsafe; The hole on the bitcoin wallet measures 6 mm/ 0.24 inch in diameter, suitable for hanging
The broader vendor-network estimate
Chainalysis later reported that North Korea-linked actors moved tens of millions of dollars stolen in major hacks, including Bybit and WazirX, through Xinbi’s vendor network. This is a broader network analysis and estimate, not the same measurement as Elliptic’s nine-transfer tracing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Enforcement reported by September 30, 2026
UK sanctions and earlier Telegram closures
Elliptic reported in March 2026 that the United Kingdom had sanctioned Xinbi and said the UK described Xinbi as facilitating the laundering of cryptoassets stolen by North Korea. Elliptic had earlier reported that Telegram closed thousands of channels associated with Xinbi and Huione in May 2025. Elliptic also said it continued tracking more than 30 similar marketplaces, indicating that channel closures did not necessarily eliminate the wider ecosystem.
U.S. seizure and restraint action
On September 7, 2026, a federal court authorized the seizure of Telegram channels hosting the marketplace, according to the U.S. Department of Justice. The DOJ said investigators seized two wallets that Xinbi used to collect vendor payments, containing approximately $12 million, and sought restraint of 47 additional wallets. The department reported more than $52 million in cryptocurrency restrained across Xinbi and its vendor network, with assistance from Tether.
Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
“After scamming money from hardworking Americans, criminals operating overseas laundered it through the Xinbi Guarantee network, which operated under the false assumption that they were out of the reach of U.S. law enforcement,” said Tara McLeese, Special Agent in Charge of the U.S. Secret Service Washington Field Office.
The reported court order establishes channel seizure and asset restraint. The cited action does not establish that every related channel, wallet or vendor permanently stopped operating.
How to interpret Xinbi figures without overstating them
- Check the asset scope: USDT, stablecoins, all cryptoassets, or cryptoassets plus fiat are different baskets.
- Check the address scope: an address set attributed to Xinbi is not the same as 52 designated addresses or the entire vendor ecosystem.
- Check the period and report date: the initial Elliptic estimate, the March 2026 update and the Treasury figure cover different reporting frames.
- Check what the number counts: inflows and processed value are not the same as seized or restrained assets.
- Keep tracing separate from modeling: the roughly $220,000 in nine WazirX-related transfers is direct transaction tracing, while Chainalysis’s tens-of-millions figure is broader network analysis.
What has not been established
The cited reporting does not provide a confirmed victim count for Xinbi-linked romance scams. It also does not establish total scam losses attributable specifically to Xinbi, a court finding that every dollar passing through associated addresses was criminal, or that all Xinbi users and transactions were connected to North Korea. The billions-dollar figures are analytics estimates, while the DOJ’s $52 million figure describes a specific enforcement operation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
