- North Korea-linked actors routed Bybit and WazirX funds through Xinbi vendors.
- Black U services exchanged traceable crypto for stablecoins from other illicit pools.
- US authorities restrained over $52 million across Xinbi-linked wallets.
North Korea-linked actors moved tens of millions in stolen cryptocurrency through vendors operating inside Xinbi Guarantee, according to Chainalysis. The traced funds included proceeds from the Bybit and WazirX exchange hacks.
US authorities sanctioned Xinbi on September 9 and restrained more than $52 million across its vendor network. Officials described Xinbi as a Chinese-language marketplace supporting scams, cybercrime, and money laundering.
Xinbi Sold Laundering Services Through Telegram
Xinbi operated through hundreds of Chinese-language Telegram channels linking criminal customers with specialized vendors. Sellers advertised money laundering, stolen data, fake investment websites, malware, bank cards, and identity-check bypass services.
The platform also offered escrow. Xinbi held payments until vendors completed their contracted work, reducing settlement risk between criminals who lacked established relationships.
Treasury said Xinbi processed more than $24 billion in digital assets and fiat currency since emerging around 2022. Its customers included scam operators, laundering networks, cybercrime groups, and entities previously sanctioned by OFAC.
Xinbi also absorbed users from other disrupted platforms. Treasury said cybercriminals shifted activity there after FinCEN targeted Huione Pay as a primary money-laundering concern.
Black U Vendors Replaced Traceable Crypto
Chainalysis said North Korea-linked customers used Xinbi vendors known as “Black U” laundering services. These operators used substitution instead of relying only on mixers or long transfer chains.
The customer sent cryptocurrency carrying direct links to a theft. A vendor then supplied stablecoins drawn from separate illicit pools, including romance and investment-scam proceeds.
This exchange placed the stolen assets inside a wider pool of criminal funds. Meanwhile, the hacker received stablecoins without the same direct transaction path from the original theft.
Chainalysis said the recipients could convert those stablecoins through unlicensed over-the-counter desks. The replacement assets were still connected to illicit activity and were not lawful funds.
Exchange Hack Proceeds Entered Xinbi’s Network
Chainalysis connected Xinbi vendors with funds from the $1.5 billion Bybit hack and the $235 million WazirX theft. The FBI separately attributed the Bybit attack to North Korea’s TraderTraitor actors.
A broader Chainalysis study found Chinese-language laundering networks processed $16.1 billion during 2025. Researchers estimated these services handled 20% of known illicit crypto laundering over five years.
That research found Black U services frequently split large transfers across more wallets. Transactions above $10,000 cleared in an average of 1.6 minutes during the fourth quarter of 2025.
Chainalysis said 52 addresses later identified by OFAC received more than $8.4 billion in stablecoins. That figure measures aggregate inflows, not the amount attributed to North Korean actors.
US Agencies Targeted Wallets and Infrastructure
A federal court authorized the seizure of Xinbi’s Telegram channels on September 7. The Justice Department also seized two vendor-payment wallets containing approximately $12 million.
Investigators sought restraints against 47 additional wallets tied to Xinbi and its vendors. Coordinated actions restrained over $52 million, while Tether assisted the investigation.
OFAC designated Xinbi as a transnational criminal organization. It also sanctioned SafeW Technology and Anwen Technology for providing messaging and cryptocurrency-payment applications.
Treasury said Xinbi began moving merchants onto SafeW around June 2025 amid growing enforcement scrutiny. Anwen developed XinbiPay, also called NewPay, for cryptocurrency payments and wallet services.
The designations block covered property under US jurisdiction and require US persons to report it. Britain had already sanctioned Xinbi in March over its links to Southeast Asian scam centers.
Related: Tether Freezes $39M USDT in Xinbi-Linked Tron Wallets, MistTrack Says
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
