Why Xinbi replaced Huione and became the new backbone of the shadow crypto market

Last year, U.S. authorities and international regulators struck a major blow against Asia’s money laundering infrastructure. Their actions dismantled Huione Group, a well-known organization in criminal circles. But the vacuum did not last long. A new player has now emerged in the region. GetBlock AML Research explains how the Xinbi platform managed to capture the shadow market for illicit financial operations.

New Rules

The Chinese-language platform Xinbi has been adapting to growing regulatory pressure. It has been gradually moving away from Telegram and shifting communications to a new secure platform called SafeW. At the same time, the service launched a related wallet, XinbiPay. Xinbi is believed to be based in the so-called “Golden Triangle,” a region spanning parts of Myanmar, Thailand, and Laos.

Historically, Xinbi operated as a marketplace and wallet within Telegram and played a significant role in laundering funds generated by online scams and cybercriminal groups. At the time of writing, wallets linked to Xinbi had received around $8.9 billion and processed transactions totaling approximately $17.9 billion.

Guarantee services like Xinbi serve multiple functions in the shadow economy. They act as informal intermediaries in deals, marketplaces for buying and selling services and cryptocurrencies, and coordination hubs for networks of money mules who move funds between digital assets and cash. These platforms offer a certain level of “assurance” while allowing fast, informal transfers without meaningful identity checks.

For criminals with limited technical expertise, such services provide ready-made infrastructure for laundering money and finding “trusted” counterparties. This significantly lowers the barrier to entry for financial crime.

For operators of guarantee services, participation in these schemes is highly profitable. Beyond transaction fees and escrow commissions, they gain control over networks of individuals involved in cashing out and moving funds off-chain. As a result, these platforms become central nodes in laundering networks rather than passive intermediaries.

Pressure on Telegram-Based Guarantee Services

Telegram became the main hub for Chinese-language guarantee services around 2019. One of the earliest projects was Kaer Guarantee. Later, services such as Huione, Haowang, Tudou, and Xinbi actively used encrypted Telegram channels, built-in wallets, and bots that allowed them to manage user balances, control “safe deals,” and conduct crypto transactions directly within chats. These features fueled rapid growth, especially among criminal networks that needed scalable infrastructure for illegal activity.

In spring 2025, this ecosystem came under serious pressure. U.S. authorities launched measures targeting several of these services, focusing for the first time specifically on Chinese-language guarantee platforms. These actions effectively cut some platforms off from the international financial system. Shortly afterward, Telegram blocked major groups and channels linked to Haowang and Xinbi.

The outcomes varied. Huione and Haowang attempted to migrate users to an alternative platform called ChatMe, but interest was weak and transaction volumes collapsed, ultimately forcing them to shut down. Xinbi, by contrast, quickly restored its presence on Telegram under the same names while simultaneously preparing a transition to other technical solutions.

By June 2025, Xinbi had begun actively promoting the SafeW platform and the associated XinbiPay wallet, also known as NewPay. User migration was initially slow, but it accelerated sharply in January 2026. This coincided with the shutdown of Tudou Guarantee and the arrest of Chen Zhi, likely heightening expectations of further enforcement and pushing users to move more decisively.

Transaction data confirms this shift. Activity in wallets linked to Xinbi’s Telegram bot declined in December, followed by a sharp increase in January within the SafeW and XinbiPay ecosystem. This illustrates how such services distribute their infrastructure across platforms to improve resilience and reduce the risk of total shutdown.

Transaction volumes show that Xinbi was largely unaffected by Telegram blocks. While Haowang, Huione, and Tudou saw steep declines after the 2025 events—nearly to zero for the first two and about a 74% drop for Tudou—Xinbi continued to grow. Administrators of competing services on alternative platforms openly admitted they were overloaded and warned users about slower speeds and degraded service quality.

Xinbi, by contrast, demonstrated steady growth even after being blocked on Telegram. From May 12, 2025, one day before its removal, to December 22, 2025, daily inflows nearly doubled. This highlights Xinbi’s ability to adapt and retain users while competitors failed to recover.

Charts clearly show a redistribution of activity among guarantee services. Until 2024, the ecosystem was largely dominated by Huione-linked projects. After enforcement actions, their share dropped sharply. Xinbi and several smaller services moved into the vacant space. This suggests that regulatory pressure did not eliminate the guarantee-service model but instead fragmented it and forced it to evolve.

Xinbi’s Role in the Broader Chinese-Language Guarantee Ecosystem

Xinbi appeared on Telegram around 2022 and quickly became one of the central platforms for cashing out and laundering funds used by scam networks and other criminal groups. Alongside Huione, Haowang, and Tudou, the platform was linked to large-scale financial fraud, money laundering, the trade in personal data, cybercrime services, tools for creating fake videos and images, and informal crypto exchange services supporting online scams.

Since 2022, at least $16.4 billion has passed through Xinbi. The platform hosted ads for money laundering services, sales of stolen data, forged documents, and other elements of scam infrastructure. At the same time, Xinbi publicly claimed to be registered in the United States and Canada, using these assertions to project legitimacy despite the true nature of its operations.

Xinbi’s links to Prince Group companies, JinBei casino, and other Telegram-based guarantee services. Visualization: TRM Labs

How Guarantee Services Work: Step by Step

In practice, Xinbi and similar services operate as follows. When an individual or group wants to offer services on the platform, they first contact administrators and register as a seller. This requires posting a security deposit. The size of the deposit depends on the type of service: cybercrime services may require thousands of dollars, while money laundering or currency exchange operations can require tens of thousands or more.

Once approved, the seller receives a dedicated chat to communicate with clients. When a deal is agreed upon, the buyer, seller, and administrator move to a shared chat where the transaction is conducted under the platform’s supervision. Funds are temporarily held by the service, the service is delivered, and in case of a dispute, the administrator decides whether to release or refund the funds, using the seller’s deposit if necessary. This structure creates a sense of trust while allowing the platform to retain control.

Many users also rely on wallets provided directly by the guarantee service. These wallets typically require little or no identity verification and are integrated into the platform’s internal payment system. Transactions often remain within this ecosystem, obscuring the full flow of funds and making it difficult to determine their true origin and destination. This is a key reason such services are so attractive to criminals.

Example: Using a Guarantee Wallet Without a Deposit

A small, informal Chinese exchange sends 10,500 USDT to a guarantee service’s deposit wallet to open its own channel. The prior transfer of 2.8 USDT is a typical test amount used to verify the address and security.

Using Xinbi as a guarantee service. Visualization: TRM Labs

Countering Illegal Guarantee Services

Fighting criminals who rely on guarantee services is extremely challenging. Once funds enter a service’s internal system, tracing becomes difficult because wallet management is hidden behind shared infrastructure, internal transfers, and custodial storage by the platform itself. The visible transaction chain often reflects the service’s aggregate activity rather than the actions of specific individuals.

Example of a laundering network using Xinbi guarantee wallets. Visualization: TRM Labs

Funds move through the platform’s internal structure, and only a small portion of the path remains visible.

Example of a network not using guarantee services. Visualization: TRM Labs

In this case, tracking funds to their endpoints is much easier.

That said, certain indicators still enable analysis. When groups use wallets issued or controlled by the service itself, investigators must study the internal wallet architecture and intra-platform flows to identify concentration points and potential exit routes. When sellers publish external addresses not controlled by the guarantee service, tracing becomes significantly easier.

This is why dismantling such intermediaries is critical in combating crypto-enabled crime—from cyber fraud to professional money laundering. When these services disappear, fund flows become more transparent, trust within illicit ecosystems breaks down, and access to vendors is disrupted. Communication failures and financial losses undermine user confidence, reduce activity, and make the entire system far more vulnerable