Telegram Shuts Down Alleged $8B Chinese Crypto Scam Operation—Based in Colorado
Messaging platform Telegram just axed a massive crypto crime marketplace—one that allegedly laundered $8 billion from Chinese investors while operating out of Colorado. Talk about globalized financial crime.
How it worked: The group used Telegram channels to coordinate pump-and-dump schemes, fake mining ops, and outright theft. Classic crypto grift, scaled up with Silicon Valley efficiency.
Why it matters: This isn’t some dark web backwater. These guys were brazen enough to base operations in the U.S.—until Telegram pulled the plug. Regulators? Still playing catch-up, as usual.
Bottom line: Another day, another nine-figure crypto scam. But hey, at least the SEC will get around to investigating… in 2027.
Cyberscam epidemic
Services offered on marketplaces like Xinbi and Huione are infamous for enabling industrial-scale scam compounds across Southeast Asia.
These compounds attract victims with the promise of well-paid IT work. When they arrive they are trafficked, imprisoned and forced to carry out online pig butchering scams to pay off phony debts.
Xinbi vendors offer Starlink satellite internet equipment, which is often used by scam compounds, fake IDs and databases of stolen personal information used to target potential fraud victims, Elliptic said.
Another big driver of business is money laundering services, according to the report. Such services are mostly used to launder the proceeds of pig butchering scams, but funds from North Korean crypto heists are also in the mix.
Elliptic found about $220,000 in USDT originating from the $230 million WazirX theft in July was sent to Xinbi, indicating that vendors operating on the marketplace were employed to help launder proceeds of the heist.
It’s not clear whether North Korean IT workers are interacting with Xinbi vendors directly, though.
“Our hypothesis is that the funds are under the control of Chinese money laundering groups by the time they enter marketplaces such as Xinbi,” Tom Robinson, chief scientist and co-founder at Elliptic, told CoinDesk over email.
Colorado connection
What sets Xinbi apart from other similar marketplaces, however, is its connection to the U.S.
On its website, Xinbi describes itself as an “investment and capital guarantee group company” operating as a Colorado-based corporation, Elliptic said.
The Colorado corporate register shows a company called “Xinbi Co., Ltd” was incorporated in August 2022, with an office in Aurora, Colorado even though the Chinese-language marketplace is primarily used by fraudsters in Asia.
“These marketplaces depend on trust,” Robinson said. “A U.S. incorporation does bring some level of legitimacy.”
Robinson also noted that similar marketplaces have previously conducted exit scams, where a business stops shipping orders while still receiving payments, eventually walking away with the money. “Anything that inspires confidence will help attract customers,” he said.
In January 2025, the company’s status was updated to delinquent for failing to file a periodic report.
