Crypto Scams: The $24 Billion Supermarket of Fraudsters Under Chainalysis's Microscope

A crime hypermarket open day and night on Telegram. Xinbi Guarantee sold stolen personal data, deepfake software, and money laundering services to scam centers. Chainalysis released a map of these flows on October 14, a month after the platform was seized by U.S. authorities.

The marketplace is estimated to have processed over $24 billion since 2022. Among its clients were scam complexes from Southeast Asia and North Korean hackers.

Key Points

• Online scams cost residents of 42 countries $442 billion in 2025, according to the Global Anti-Scam Alliance.
• Chainalysis's scheme tracks the money from scam complexes to the platform's wallets.
• Washington sanctioned Xinbi on September 9 and froze over $52 million in cryptocurrencies.
• Competing markets are already emptying their wallets to escape freezes.

Xinbi, a Comprehensive Catalog for Urgent Scammers

According to the Global Anti-Scam Alliance, cited by Bloomberg on October 10, residents of 42 countries lost $442 billion to online scammers in 2025. This is more than some estimates of the global cocaine market. And AI is lowering the entry ticket. According to cybersecurity firm ZeroFox, phishing pages hosted on free offerings from nine AI app generators have more than quadrupled in two years, reaching 10,600.

Xinbi provided the rest. On hundreds of Chinese Telegram channels, sellers offered personal data files, ready-to-use accounts, deepfake software for video calls, hosting of fake investment sites, and ultimately, money laundering of stolen funds. The platform acted as a trusted third party by blocking payment until delivery (an escrow service).

A tasty detail, Xinbi claimed to operate through a company registered in Colorado in August 2022. The state registry classified it as in default since January 2025 for failing to file a report. From scam complexes to Xinbi, all laundering flows converge on the platform. Source: Chainalysis

Xinbi, the Terminus of All Flows

The diagram published by Chainalysis reads from top to bottom. At the top, independent operators and complexes like KK Park in Myanmar inject cryptocurrencies to buy their tools. The money then passes through intermediate wallets that manage escrow deposits and multiply transfers to obscure the trail.

Then it gets distributed. Sellers of accounts and data, web developers, hosts, and AI software providers share the pie. At the top level, services called "Black U" (the U refers to Tether's USDT) exchange the tainted crypto for more presentable funds at a discount. All these channels lead to Xinbi.

The clients were not all small fry. According to Chainalysis's investigation, actors linked to North Korea funneled tens of millions of stolen dollars through it, including part of the Bybit hack ($1.5 billion) and the WazirX hack. Jonathan Levin, co-founder of Chainalysis, sees phishing and scams as the main challenge posed by AI, a problem that he believes extends far beyond crypto to become "global."

Xinbi Seizure: $52 Million Frozen, Market Moves

On September 7, a federal court authorized the seizure of the Telegram channels of the platform. Two days later, the U.S. Treasury designated Xinbi as a transnational criminal organization and sanctioned two companies. SafeW Technology, based in Singapore, operates the encrypted messaging service to which Xinbi migrated in June 2025. Anwen Technology, located in Cambodia, manages the XinbiPay wallet.

The Scam Center Strike Force of the Department of Justice, established in November 2025, seized two wallets containing approximately $12 million. It requested the freezing of 47 others. In total, over $52 million is blocked, with the assistance of Tether.

Xinbi itself was a drop point. According to the Treasury, criminals had retreated there after FinCEN (the U.S. Treasury's anti-money laundering unit) designated Huione Pay as a major money laundering concern. The scenario is repeating. According to the analysis firm Bitrace, Fulilai Guarantee has begun to exclude money laundering merchants from its public groups, and its wallet has recorded approximately $9.3 million in outflows since the announcement of the sanctions.

Crypto Scams: U.S. Justice Hits Brooklyn Too

U.S. authorities are also targeting networks closer to home. The Brooklyn District Attorney and the FBI in New York announced on October 14 the seizure of 241 domains and 112 servers linked to fake crypto investment platforms. The network primarily targeted Russian speakers in Brooklyn, approached through Russian-language Facebook ads and then followed up by fake advisors. Losses are estimated in the tens of millions of dollars. Approximately $300,000 has been recovered at this stage.

The 52 addresses listed by OFAC alone received over $8.4 billion in stablecoins. Compared to the annual losses of $442 billion, the $52 million frozen represents about 0.01%. The UK had already sanctioned Xinbi as early as March 26, without shutting down the outlet. Elliptic had already warned that the marriage between AI and crypto crime was just beginning.