Telegram Is Still Hosting a Sanctioned $21 Billion Crypto Scammer Black Market | WIRED

Overview

Telegram Is Still Hosting a Sanctioned $21 Billion Crypto Scammer Black Market

For three and a half years, the messaging platform Telegram has served as the home of a sprawling black market known as Xinbi Guarantee, an anarchic, Chinese-language bazaar offering money laundering services to crypto scammers, products like electrified batons and tasers for those same scammers' human trafficking operations, and even at times other assorted criminal services ranging from harassment-for-hire to teen prostitution. Despite WIRED and crypto crime researchers repeatedly pointing out that blatantly criminal activity to Telegram, the company nonetheless allowed Xinbi Guarantee to grow into the biggest black market on the internet, one that's facilitated a staggering $21 billion in total transactions.

Details

The full extent of Telegram's failure to eradicate the scam marketplace was put to the test since late last in March when the UK government officially sanctioned Xinbi Guarantee and designated it a facilitator of human trafficking. Yet now, nearly three weeks later, Telegram still hasn't removed Xinbi's accounts on its service, facilitating more than half a billion dollars’ worth of illicit deals in the time just since those sanctions were put in place.

According to cryptocurrency tracing firm Elliptic, Xinbi Guarantee carried out $505 million in transactions in the 19 days after the British government's sanctions and added tens of thousands more users to reach nearly half a million buyers and sellers in total. Elliptic says it has seen no signs that Telegram has taken any action to ban the market or its accounts. “Xinbi is still going strong,” says Elliptic's cofounder and chief scientist Tom Robinson. “They're on track to become the largest market of this kind that's ever existed.”

Telegram's apparent refusal to remove the black market—just one in an industry of Chinese-language black markets that operates on Telegram in full public view—represents an appalling lack of accountability, says Gary Warner, a security researcher who has tracked Xinbi Guarantee as director of intelligence at the cybersecurity firm Dark Tower. “It boggles my mind,” Warner says. “There's literally no legitimate company in the world that hosts this level of criminal activity and is so open about it. There's nothing that even comes close.”

Telegram didn't respond to WIRED's multiple requests for comment on its hosting of Xinbi Guarantee following the UK's sanctioning. In June of last year, however, a Telegram spokesperson justified Telegram's hosting of Xinbi Guarantee and other Chinese-language black markets by arguing that they allow Chinese citizens “to seek alternative avenues for moving funds internationally” despite China's rigid financial controls.

“We assess reports on a case-by-case basis and categorically reject blanket bans—particularly when users are attempting to circumvent oppressive restrictions imposed by authoritarian regimes,” read Telegram's statement to WIRED at the time. "We remain unwavering in our commitment to safeguarding user privacy and defending fundamental freedoms, including the right to financial autonomy.”

That description of Xinbi Guarantee as an innocuous “alternative avenue” for international money transfers had already been undermined by Elliptic's findings that Xinbi was predominantly used as a money laundering service for the vast crypto scam industry, including Chinese-run organized syndicates that control compounds across Myanmar, Cambodia, and Laos that enslave hundreds of thousands of human trafficking victims forced to work as scammers. Elliptic found listings as recently as the past month that offer products that appear intended for those human trafficking operations, including electrified batons, tasers, and handcuffs.

enslave hundreds of thousands of human trafficking victims

On March 26, the UK's Foreign, Commonwealth and Development Office officially sanctioned Xinbi for its alleged role in scamming and human trafficking. “Xinbi has enabled and profited from the operation of scam centers in Southeast Asia,” the sanctions notice read. “The treatment of individuals in these scam centers amounts to a serious abuse of the right not to be subjected to cruel, inhumane, or degrading treatment or punishment, and of the right to be free from slavery, not to be held in servitude or required to perform forced or compulsory labour.”

Xinbi Guarantee has also hosted a wide variety of other black market offerings, including harassment services that threaten or throw feces at a victim for a fee, and even sex workers as young as 14 who are likely trafficking victims. One listing Elliptic shared with WIRED, found just in recent weeks, offered a 16-year-old sex worker, including the girl's body size measurements and available sex acts.

As clearly as all of those examples contradict Telegram's arguments for hosting Xinbi Guarantee, though, the UK government's official sanctions against Xinbi are even more clearcut, says Elliptic's Robinson. “It was already a weak argument, but the sanctioning of Xinbi makes the argument much weaker,” Robinson says. “There is now this official recognition that Xinbi is predominantly an illicit actor.”

Perhaps aware of its vulnerability to another Telegram ban, Xinbi Guarantee has asked its users to transition to another platform called Safe W. But the vast majority of Xinbi Guarantee's activity has remained on Telegram, and Elliptic's Robinson argues that the market will have a tough time moving users to Safe W. “Xinbi benefits from Telegram's huge installed user base, something that would be very challenging for Safe W to replicate,” Robinson says.

For now, of course, Xinbi Guarantee doesn't have to go anywhere, given Telegram hosting its blatantly criminal activity in plain sight. Dark Tower's Warner argues that represents an inexcusable lack of attention to Telegram's enabling of Chinese-language black markets, both on the part of Telegram itself and law enforcement agencies worldwide.

When Russian cybercriminals have hosted black markets selling malicious software and stolen data, Warner points out, international law enforcement coalitions targeted those criminals and their infrastructure, leading to repeated seizures and arrests. Given how openly Telegram has hosted an even bigger criminal ecosystem, the company and its founder and CEO Pavel Durov deserve that same treatment, Warner argues. (Durov was, in fact, arrested and charged in France in 2024 but has since been released while the French government’s investigation reportedly continues.)

“He should be the subject of an international task force,” claims Warner. “He should be hunted down and arrested. He should be forced to be held accountable.”

In your inbox: Will Knight's AI Lab explores advances in AI

Unmasking the paramilitary agents behind Trump’s immigration crackdown

Big Story: Opposing ICE might save the country—or ruin your life

WIRED@Night: Hear Andy Greenberg discuss the facts and fiction of crypto

Key Takeaways

Telegram Is Still Hosting a Sanctioned $21 Billion Crypto Scammer Black Market
For three and a half years, the messaging platform Telegram has served as the home of a sprawling black market known as Xinbi Guarantee, an anarchic, Chinese-language bazaar offering money laundering services to crypto scammers, products like electrified batons and tasers for those same scammers' human trafficking operations, and even at times other assorted criminal services ranging from harassment-for-hire to teen prostitution
The full extent of Telegram's failure to eradicate the scam marketplace was put to the test since late last in March when the UK government officially sanctioned Xinbi Guarantee and designated it a facilitator of human trafficking
According to cryptocurrency tracing firm Elliptic, Xinbi Guarantee carried out $505 million in transactions in the 19 days after the British government's sanctions and added tens of thousands more users to reach nearly half a million buyers and sellers in total
Telegram's apparent refusal to remove the black market—just one in an industry of Chinese-language black markets that operates on Telegram in full public view—represents an appalling lack of accountability, says Gary Warner, a security researcher who has tracked Xinbi Guarantee as director of intelligence at the cybersecurity firm Dark Tower