China-linked Xinbi Processed $17.9B in Crypto Flows as Guarantee Services Moved Off Telegram

A TRM Labs analysis attributes approximately $17.9 billion in gross on‑chain movement to wallets connected with a Chinese‑language guarantee marketplace operating under the Xinbi identifier. The total reflects deposits, withdrawals and internal transfers through the marketplace’s escrow-style architecture and is not presented as confirmed criminal profit. After clusters on Telegram were targeted and disrupted, operators appear to have migrated user coordination to other messaging services and spun up an affiliated hosted wallet, XinbiPay, which on‑chain signals show regained activity in early 2026. That tactical shift illustrates a common operational playbook: reputation‑based escrow systems inside encrypted chats pair with bespoke wallet infrastructure to preserve liquidity and continuity even after takedowns. The Xinbi case dovetails with broader findings from blockchain‑forensics research showing a marked escalation in crypto-enabled laundering services over recent years and the growing role of language‑specific networks in routing high volumes of value. Those wider analyses document rising volumes, more professional intermediaries (brokers, mule networks and OTC venues), and increasing reliance on dense wallet clusters and custodial rails that compress interdiction windows. For investigators, Xinbi’s new hosted wallet offers fresh attribution signals but also widens the surface for abuse—hot wallet activity is visible on‑chain, yet off‑chain coordination and onboarding pathways remain opaque and resilient. For exchanges and compliance teams, the episode underscores the limits of single‑platform takedowns: removing accounts or groups on one messaging app often results in rapid dispersion rather than permanent cessation. The practical consequence is that enforcement wins tend to be incremental unless action couples on‑chain tracing with targeted disruption of cash‑out rails, sanctions on service providers, and expedited intelligence sharing across platforms and borders. Policymakers and industry defenders must therefore recalibrate from tactical removals to integrated strategies that pair private analytics, law enforcement cooperation and platform engagement to raise the cost of reuse and close systemic choke points. Absent such coordination, guarantee services like Xinbi are likely to continue operating in functionally similar forms despite repeated takedowns.