Telegram continues to host a sophisticated, sanctioned crypto scammer black market despite public commitments to purge criminal activity from its platform. At the center of this ecosystem is Xinbi Guarantee, an illicit escrow service that facilitates high-value fraud and money laundering, operating in plain sight of both the company’s moderators and international regulators.
The presence of this network highlights a persistent gap between Telegram’s stated terms of service and its actual enforcement. Even as the platform has previously claimed that criminal activities are “always removed whenever discovered,” evidence suggests a pattern of temporary bans followed by rapid rebuilding, allowing the market to maintain its grip on a massive user base.
The scale of the problem is not merely a matter of policy violations. Xinbi Guarantee is now subject to official sanctions by the UK government, which recognizes the entity as a predominantly illicit actor. This legal designation transforms the platform’s hosting of the market from a moderation failure into a potential compliance crisis involving sanctioned entities.
The Mechanics of a Digital Black Market
Xinbi Guarantee functions as a “guarantee” or escrow service, a critical piece of infrastructure for online scams. In these transactions, Xinbi acts as a trusted third party, holding cryptocurrency until the buyer confirms they have received the promised (and usually fraudulent) goods or services. This system reduces the risk for the scammer and provides a veneer of security for the victim.
But, the market’s offerings extend far beyond financial fraud. Blockchain analytics firm Elliptic has identified a disturbing array of illicit services hosted within the network. These include harassment services—where individuals are paid to threaten or physically harass victims—and the trafficking of minors. Reports indicate listings for sex workers as young as 14, including detailed physical measurements and descriptions of available acts.
The resilience of the market is tied to Telegram’s architecture. Because the platform boasts a massive, established user base, it provides a ready-made audience for criminals. While Xinbi has attempted to migrate some users to a separate platform called SafeW, the vast majority of its operations remain on Telegram, where the friction of moving users to a new app outweighs the risk of a temporary ban.
A Cycle of Enforcement and Evasion
Telegram’s approach to these markets has been characterized by “whack-a-mole” enforcement. In a sequence of events documented by investigators, the platform did summarily purge accounts associated with Xinbi Guarantee and a similar market, Huione Guarantee, after being alerted to their existence.
At the time, a Telegram spokesperson, Remi Vaughn, stated that criminal activities like scamming or money laundering are forbidden and removed upon discovery. Yet, this enforcement proved fleeting. Within a month of the initial purge, Xinbi Guarantee had rebuilt its marketplace on the same platform, continuing its operations despite the previous violations.
| Event Phase | Action Taken | Outcome |
|---|---|---|
| Initial Discovery | Elliptic identifies money laundering hubs | Telegram purges associated accounts |
| Policy Statement | Spokesperson cites Terms of Service | Public commitment to remove scams |
| Reconstruction | Market rebuilds within one month | Operations resume in plain sight |
| Legal Escalation | UK Government imposes sanctions | Xinbi designated as an illicit actor |
The Legal Stakes for Pavel Durov
The persistence of these markets comes at a precarious time for Telegram’s founder and CEO, Pavel Durov. The platform’s perceived tolerance for illicit activity has already drawn the attention of European authorities. In 2024, Durov was arrested and charged in France, with investigators focusing on the platform’s alleged complicity in allowing criminal activity to flourish.
While Durov has since been released, the French government’s investigation reportedly continues. The contrast in how different criminal ecosystems are handled is a point of contention for security experts. For instance, international coalitions have historically targeted the infrastructure of Russian cybercriminals with seizures and arrests.
Critics argue that Telegram and its leadership should be held to the same standard. The argument is that by providing the infrastructure and the user base for a sanctioned $21 billion crypto scammer black market ecosystem, the platform is no longer a neutral tool but an enabler of organized crime.
Broader Implications for Crypto Regulation
The Xinbi case underscores the difficulty of policing decentralized finance (DeFi) and encrypted messaging. When illicit actors use cryptocurrency for escrow, they bypass traditional banking safeguards, making the “guarantee” service the only point of failure in the transaction chain.
For regulators, the focus is shifting toward the “off-ramps”—the points where crypto is converted to fiat currency—and the platforms that host the coordination of these scams. The UK’s decision to sanction Xinbi is a signal that governments are moving beyond targeting individual scammers to targeting the infrastructure that makes scamming scalable.
Disclaimer: This article is for informational purposes only and does not constitute financial, legal, or investment advice.
The next critical juncture for the platform will be the progression of the French judicial proceedings against Pavel Durov, which may force a fundamental shift in how Telegram handles sanctioned entities and illegal marketplaces. Further updates on the French investigation are expected as the case moves toward trial.
Do you think messaging platforms should be legally responsible for the illicit markets hosted on their servers? Share your thoughts in the comments below.
