Telegram bans groups while Xinbi pushes users to SafeW

Xinbi, the Chinese-language crypto platform tied to scams, pig butchering rings, and cybercrime, has still processed $17.9 billion worth of transactions even after getting kicked off Telegram and being targeted by U.S. regulators.

TRM Labs tracked the numbers and confirmed the wallets linked to Xinbi took in $8.9 billion in crypto so far. The service is now operating mostly on SafeW, a lesser-known messaging app, with a connected wallet system called XinbiPay.

Both were rolled out after Telegram started deleting the group’s channels. The people running Xinbi didn’t disappear; they doubled down. After Telegram banned it in May 2025, the group came right back using the same usernames and channels.

Newly established XinbiPay Wallet service hot wallet inflow and outflow since December 24, 2025. Source: TRM Labs

At the same time, they started pushing users to download SafeW and use XinbiPay, which also goes by NewPay. Traffic started to drop in December, but by January, users were sending large volumes through the new system.

The arrest of Chen Zhi, the head of Prince Group, and the collapse of Tudou Guarantee in January 2026 made users nervous. That’s when most people started jumping to SafeW, because by then, Xinbi already had everything in place.

Xinbi is believed to be based around the Golden Triangle, where Myanmar, Thailand, and Laos meet. It’s long been used by fraud networks to wash money and cash out stolen crypto.

Telegram bans groups while Xinbi pushes users to SafeW

Telegram used to be the core of the Chinese-speaking guarantee service world. Since around 2019, groups like Huione, Haowang, and Tudou have been using bots, escrow features, and built-in wallets to handle anonymous crypto deals inside chat windows.

Source: TRM Labs

Xinbi joined that list in 2022 and quickly became like the top channel for criminals to swap funds without identity checks, according to TRM Labs.

But that all changed in May 2025 when FinCEN called Huione and Haowang the primary money laundering risks. The U.S. Treasury then used Section 311 to cut them off from the global financial system. Soon after, Telegram deleted huge clusters of channels, including ones tied to Xinbi.

Huione and Haowang tried to move to ChatMe, but barely anyone followed. Users complained about delays, vanished admins, and stuck funds. Both platforms eventually shut down, according to TRM, but Xinbi handled it differently, in that it actually never told users to leave Telegram right away.

Instead, it slowly introduced SafeW and XinbiPay while keeping the old channels active.

Xinbi absorbs users while rivals shut down

From May to December 2025, Xinbi’s inflows nearly doubled, even after Telegram kicked it off. Meanwhile, Haowang and Huione saw their activity drop almost 100 percent. Tudou lost about 74 percent. These numbers came straight from TRM Labs’ on-chain tracking. Xinbi didn’t just avoid collapse. It took advantage of the chaos and pulled in more users.

That growth happened because Xinbi’s system is built to handle volume fast. Anyone offering shady services needs to send a security deposit to the admin team, sometimes as high as tens of thousands of USDT, depending on what they’re selling.

Once approved, they get a private channel. Deals are done in shared chat rooms with an admin acting as escrow. If something goes wrong, the admin uses the vendor’s deposit to settle it.

Once crypto lands inside XinbiPay, TRM Labs said it becomes a pain to trace, because the wallets are managed by the platform, not individuals.

TRM says investigators have to study the movement patterns inside the system. They watch for areas where large amounts of crypto gather, or where it exits the system.

Since 2022, Xinbi has handled at least $16.4 billion in transactions. Some of its listings included stolen data, fake IDs, deepfake tools, and money laundering services. Xinbi even claimed it was registered with FinCEN in the U.S. and FINTRAC in Canada. That gave it a fake sense of credibility, even though it was being used by fraud groups.

The smartest crypto minds already read our newsletter. Want in? Join them.