It’s 2025, and North Korean cybercriminals aren’t hiding in the shadows anymore — they’re laundering stolen crypto through online marketplaces registered in the U.S.
According to a new report from blockchain analytics firm Elliptic, actors linked to the North Korean regime funneled over $220,000 in stolen crypto through a Telegram-based platform called Xinbi Guarantee in November 2024.
Here’s the kicker: Xinbi is legally registered in Aurora, Colorado under the name Xinbi Co. Ltd — a detail that raises serious questions about oversight and regulatory enforcement in the U.S.
A New Hub for Illicit Crypto Activity
Elliptic describes Xinbi Guarantee as the second-largest illicit crypto market ever, just behind the notorious Cambodia-based Haowang Guarantee. And while $220K might sound small, it’s just a slice of a much bigger pie: Xinbi has reportedly processed over $8.4 billion in crypto since 2022.
The marketplace primarily deals in Tether (USDT) and openly advertises its services for money laundering, cyber fraud, and converting “dirty” funds into “white capital.”
Despite its U.S. registration, Xinbi was labeled “delinquent” in January 2025 for failing to file reports — but not before attracting over 233,000 users, according to Elliptic.
Tracing the Funds Back to WazirX
Elliptic traced the November 2024 funds back to the $235 million hack of India-based WazirX, which was previously linked to North Korean threat groups. The use of Xinbi Guarantee reinforces Pyongyang’s increasingly sophisticated laundering techniques and growing reliance on gray-market platforms to evade sanctions.
This development follows last year’s revelation that Haowang Guarantee processed over $98 billion in illicit transactions, including $37 million stolen by North Korean hackers.
U.S. Authorities Finally Take Action
After months of mounting evidence, the U.S. Treasury’s FinCEN designated Haowang’s parent company Huione Group as a “financial institution of primary money laundering concern” — a move that effectively severed its access to the U.S. banking system.
The pressure worked: Haowang Guarantee announced this week it would cease operations after Telegram banned its accounts. Following Elliptic’s latest report, Telegram has now blocked several Xinbi Guarantee channels as well.
But Xinbi’s website remains online, and Elliptic says over 30 similar laundering marketplaces are still operating.
Crypto’s Laundering Problem Isn’t Going Away
Despite crackdowns, the rise of legally registered but criminally operated platforms like Xinbi highlights a new challenge for global crypto oversight. For governments and regulators, gray-market platforms are the new dark web.
Crypto laundering is no longer happening in the shadows — it’s happening on platforms with LLCs in Colorado.
For law enforcement, this isn’t just about cybercrime — it’s about national security.
2 Comments