For over three years, the messaging app Telegram has been the platform for a vast and notorious black market known as Xinbi Guarantee. This Chinese-language marketplace operates openly on Telegram, offering a range of illicit services that include money laundering for cryptocurrency scammers, the sale of weapons like electrified batons and tasers linked to human trafficking operations, and other criminal activities such as harassment-for-hire and the trafficking of underage sex workers. Despite repeated reports from investigative outlets like WIRED and crypto crime researchers highlighting the illegal nature of Xinbi Guarantee's operations, Telegram has continued to allow the market to flourish unchecked. Today, Xinbi Guarantee stands as the largest black market on the internet, having facilitated an estimated $21 billion in transactions.
The severity of Telegram's inaction became particularly evident in late March 2024, when the UK government officially sanctioned Xinbi Guarantee, designating it as a facilitator of human trafficking. However, nearly three weeks after these sanctions were imposed, Telegram had not removed any of the marketplace's accounts or taken visible steps to shut it down. During this period, Xinbi Guarantee reportedly completed over $505 million in illicit transactions and expanded its user base by tens of thousands, reaching nearly half a million active buyers and sellers.
Cryptocurrency tracing firm Elliptic, which closely monitors Xinbi Guarantee's activities, confirmed that Telegram shows no signs of curbing the market's operations. Tom Robinson, Elliptic's cofounder and chief scientist, noted, "Xinbi is still going strong. They're on track to become the largest market of this kind that's ever existed." This ongoing tolerance of criminal activity on Telegram is particularly troubling given the platform's massive reach and influence.
Security experts have expressed shock at Telegram's apparent indifference. Gary Warner, director of intelligence at cybersecurity firm DarkTower, described the situation as "appalling" and "boggle[ing]" that a legitimate company would host such blatant criminal enterprises so openly. Warner emphasized that no other company tolerates this level of illicit activity on its platform.
When approached for comment following the UK's sanctions, Telegram did not respond. However, in June 2023, a spokesperson from Telegram defended the platform's hosting of Xinbi Guarantee and similar Chinese-language markets. The spokesperson claimed these markets provide Chinese citizens "alternative avenues for moving funds internationally," circumventing China's strict financial controls. Telegram stated that it evaluates reports individually and rejects "blanket bans," especially when users are trying to bypass "oppressive restrictions imposed by authoritarian regimes." The company reaffirmed its commitment to protecting user privacy and defending "fundamental freedoms," including the right to financial autonomy.
This justification, however, is contradicted by detailed findings from Elliptic. The firm's research reveals that Xinbi Guarantee primarily serves as a money laundering hub for a vast-and often violent-crypto scam industry. Many of these scams are run by Chinese-organized syndicates operating in compounds across Southeast Asia, including Myanmar, Cambodia, and Laos. These compounds enslave hundreds of thousands of victims, forcing them to work as scammers under brutal conditions. Elliptic has also documented that Xinbi Guarantee's marketplace sells items likely used in these operations, such as electrified batons, tasers, and handcuffs.
On March 26, 2024, the UK's Foreign, Commonwealth and Development Office (FCDO) issued official sanctions against Xinbi Guarantee. The sanctions cited Xinbi's role in enabling and profiting from scam centers in Southeast Asia involved in serious human rights abuses. The FCDO described the treatment of individuals in these centers as "a serious abuse of the right not to be subjected to cruel, inhumane, or degrading treatment or punishment, and of the right to be free from slavery, not to be held in servitude or required to perform forced or compulsory labour."
Beyond money laundering and human trafficking, Xinbi Guarantee also facilitates a range of other criminal activities. According to Elliptic, the marketplace lists harassment services that include threatening victims or even throwing feces at them for a fee. Disturbingly, the platform also hosts advertisements for sex workers as young as 14 years old, who are likely victims of trafficking. One recent listing identified by Elliptic offered a 16-year-old sex worker, including detailed physical measurements and descriptions of available sexual services.
These facts starkly undermine Telegram's earlier position that Xinbi Guarantee is simply an "alternative avenue" for financial transfers. Elliptic's Robinson points out that the UK government's sanctions make Telegram's justification even less credible. "There is now this official recognition that Xinbi is predominantly an illicit actor," he says.
Telegram's tolerance of Xinbi Guarantee is particularly perplexing because the company has demonstrated it can and will remove such markets when pressured. In 2023, after WIRED inquired about Elliptic's findings on Xinbi Guarantee and a similar but larger market called Huione Guarantee, Telegram took swift action by deleting the accounts associated with both markets. At that time, Telegram spokesperson Remi Vaughn told WIRED, "Criminal activities like scamming or money laundering are forbidden by Telegram's terms of service and are always removed whenever discovered."
Despite this initial crackdown, Elliptic's ongoing monitoring revealed that Telegram did not continue enforcement. Over the following month, Elliptic shared further evidence of money laundering activity within Telegram groups that included a Telegram spokesperson and a WIRED reporter. However, beyond the initial bans, Telegram did not remove any new accounts linked to these black markets. Xinbi Guarantee quickly reestablished its presence, continuing its illicit operations despite violating Telegram's terms of service.
Aware of the risk of another ban, Xinbi Guarantee has recently encouraged its users to migrate to an alternative platform called SafeW. Nevertheless, most of the market's activity remains on Telegram, which benefits from a massive global user base that SafeW lacks. Elliptic's Robinson notes that Xinbi Guarantee's reliance on Telegram's large audience makes it unlikely that the market will successfully transition away anytime soon.
The ongoing presence of Xinbi Guarantee on Telegram reflects a broader failure by the messaging platform and global law enforcement agencies to address Chinese-language black markets operating openly online. Warner draws a sharp contrast with the international response to Russian cybercrime, where coordinated law enforcement efforts have led to seizures of infrastructure and arrests of key criminals involved in black markets selling malware and stolen data.
Given that Telegram hosts a criminal ecosystem even larger and more brazen than those targeted Russian networks, Warner argues that Telegram's founder and CEO Pavel Durov should face similar scrutiny and legal consequences. Notably, Durov was arrested and charged in France in 2024 but was subsequently released while the investigation continues.
Warner concludes forcefully, "He should be the subject of an international task force. He should be hunted down and arrested. He should be forced to be held accountable."
In summary, Telegram's continued hosting of Xinbi Guarantee-a massive black market facilitating billions of dollars in illicit activity including human trafficking, money laundering, and other serious crimes-exposes a glaring lack of corporate accountability. Despite official sanctions and abundant evidence of wrongdoing, Telegram has failed to take meaningful action to shut down the marketplace, allowing it to thrive publicly on its platform. This situation raises critical questions about the responsibilities of technology companies in policing illegal activity and protecting vulnerable victims exploited through their services.