A Colorado-incorporated firm has been linked to a Chinese illicit marketplace that has served scammers in Southeast Asia and has been used to channel billions of dollars worth of crypto.

The marketplace, called Xinbi Guarantee, has received $8.4 billion, primarily in Tether (USDT) stablecoin transactions to date, blockchain security firm Elliptic reported on May 13. 

Merchants on the Chinese-language, Telegram-based illicit marketplace sell technology, personal data, and money laundering services to Southeast Asian scammers who target victims using pig butchering scams. 

On its website, Xinbi describes itself as an “investment and capital guarantee group company” and claims to operate through Xinbi Co. Ltd, a Colorado-incorporated company incorporated in 2022. 

Screenshots showing Xinbi Co. Ltd’s incorporation in the US state of Colorado. Source: Elliptic 

“In January 2025, the corporation was updated to ‘Delinquent’ for failing to file a periodic report,” Elliptic reported.

Key services offered on the black marketplace are money laundering services, which are the largest category, as well as technology such as Starlink equipment for scammers, stolen personal data for targeting victims and fake IDs and other fraudulent documents.

Xinbi is the second-largest illicit online marketplace discovered so far, with transaction volume growing rapidly. Q4 2024 saw over $1 billion transacted, and evidence links the platform to North Korean hackers laundering stolen funds, the Elliptic researchers said. 

Related: Largest ‘illicit online marketplace’ has grown 51% in 6 months: Elliptic

Elliptic identified thousands of crypto addresses used by Xinbi Guarantee and the merchants on it, and stated that the $8.4 billion in transactions “should be considered as lower bounds of the true volume of transactions on the platform.”

The platform, which has 233,000 users, operates on a “guarantee model,” requiring vendor deposits to prevent fraud. 

Second to Huione Guarantee

In July 2024, Elliptic exposed a similar Telegram-based Chinese marketplace known as Huione Guarantee.

The firm found that the wider Huione Group of companies had facilitated over $98 billion in crypto transactions.

In early May, it was designated by the US Treasury as a money-laundering operation and was to be severed from the US banking system. 

Illicit marketplace crypto transaction volumes. Source: Elliptic

These platforms also provide a window into a “China-based underground banking system,” based around stablecoins and other digital payments, “which is being leveraged for money laundering on a significant scale,” Elliptic concluded. 

Magazine: Metric signals $250K Bitcoin is ‘best case,’ SOL, HYPE tipped for gains: Trade Secrets

Disclaimer: This article contains a video that may be disturbing for some readers.

A brazen attempt to kidnap the daughter and grandson of Pierre Noizat, the co-founder and CEO of French crypto exchange Paymium, was foiled after the daughter and passersby reportedly fought off the kidnappers.

Three masked men attacked Noizat’s daughter and a male partner on May 13 while she was walking with her son in Paris’ 11th district. The assailants tried to force Noizat’s daughter and her son into a waiting van, the French state-owned media outlet France24 reported on May 13.

The accompanying male partner was assaulted when he tried to intervene, but Noizat’s daughter resisted and managed to take one of the guns off an assailant in a scuffle and throw it away, police said.

En plein Paris, un homme a été violenté par des individus cagoulés, habillés tout en noir. Ils tentaient de l’enlever. Un homme a surgi, extincteur à la main, pour les faire fuir. →https://t.co/P0qV6PR40v pic.twitter.com/9f4r2Gi7ho

— Le Figaro (@Le_Figaro) May 13, 2025

Eventually, people passing by intervened, and the masked assailants fled in the van, which was found nearby. All three victims suffered injuries and were taken to a local hospital.

Local outlet Le Parisien reported that the botched daylight kidnapping is being investigated by the Brigade for the Suppression of Banditry, a special police unit of the French Ministry of the Interior.

Michael Englander, co-founder and CEO of Polish crypto exchange Plasbit, says this incident should serve as a wake-up call for the rest of the industry.

“If you’re in crypto and still flaunting it online, you’re not just stupid, you’re putting your family in danger,” he said in a May 13 post to X.

Offline crypto-linked attacks grow

Crypto-focused lawyer Sasha Hodder said on X that “crypto theft is evolving. It’s not just social engineering or SIM swaps anymore.”

In May, Las Vegas police said three teenagers had allegedly kidnapped a man at gunpoint who was returning from a local crypto event and robbed him of $4 million in crypto and non-fungible tokens (NFTs).

On May 3, Paris police freed the father of a crypto entrepreneur who was held for several days in connection with a 7 million euro ($7.8 million) kidnapping plot.

At the start of the year, David Balland, co-founder of crypto hardware wallet manufacturer Ledger, was abducted from his home in central France during the early hours of Jan. 21. He was held captive until a police operation on the night of Jan. 22 secured his release. 

Related: Crypto broker breaks ankles while fleeing kidnappers in Spain

Jameson Lopp, a cypherpunk and co-founder of self-custodial firm Casa, has created a list on GitHub recording dozens of offline crypto robberies, with 22 incidents of in-person crypto-related theft so far this year.

A University of Cambridge study in September found these so-called “wrench attacks” are often underreported due to revictimization fears and involve a diverse group of attackers ranging from organized crime groups to friends and family.

Magazine: Bitcoiner sex trap extortion? BTS firm’s blockchain disaster: Asia Express

Stablecoin issuer Tether bought $458.7 million worth of Bitcoin for Twenty One Capital, a Bitcoin investment firm it backed that’s awaiting the completion of a Special Purpose Acquisition Company (SPAC) merger with Cantor Equity Partners.

Tether snapped up 4,812.2 Bitcoin (BTC) at $95,319 each and transferred it to an escrow wallet on May 9, Cantor Equity Partners disclosed in a May 13 filing with the US Securities and Exchange Commission.

It brings Twenty One’s total Bitcoin holdings to 36,312 BTC, as Cantor Equity Partners holds 31,500 BTC on behalf of the firm, which will trade under the ticker XXI once the SPAC merger is complete.

Twenty One’s CEO, Jack Mallers, said on May 13 that they’re already in the approval process of the merger, but didn’t give an exact estimate on when the transaction would be complete.

Twenty One is already the third largest corporate Bitcoin holder, trailing only Strategy and Bitcoin mining firm MARA Holdings at 568,840 Bitcoin and 48,237 Bitcoin, respectively, BitcoinTreasuries.net data shows.

Tether is a majority stakeholder in Twenty One alongside crypto exchange Bitfinex. The Wall Street heavyweight Cantor Fitzgerald is sponsoring the merger, providing financial advisory services and securing $585 million in funding to support Twenty One’s Bitcoin investments.

Japanese investment holding firm SoftBank also invested $900 million into Twenty One, which is led by Strike CEO Jack Mallers.

Strategy may have a legitimate competitor

Twenty One said in an April presentation to the SEC that is looking to supplant Michael Saylor’s Strategy, formerly MicroStrategy, to become the “superior vehicle” for investors seeking “capital-efficient Bitcoin exposure.”

The company is among many Bitcoin buying firms, but promises to be a “pure play” for investors seeking Bitcoin exposure with Bitcoin-native operations and more flexibility for strategic capital raises. 

Twenty One Capital’s comparison of its Bitcoin treasury plan to that of Strategy’s. Source: SEC

Twenty One said its key success metric will be Bitcoin per share and not the traditional earnings per share metric, as it will prioritize buying up Bitcoin over making a profit.

Related: Nakamoto Holdings merges with KindlyMD to build Bitcoin treasury

Twenty One is aiming to reach 42,000 Bitcoin by the time it launches. Earlier filings showed that 23,950 Bitcoin is expected to come from Tether, 10,500 Bitcoin from Softbank and about 7,000  Bitcoin from Bitfinex, which will be converted into equity at $10 per share.

Cantor Equity Partners’ (CEP) share price soared from $10.65 to $59.73 on May 2 but has since fallen back to $29.84, Google Finance data shows. CEP rose another 5.2% in after-hours following the recent purchase.

Magazine: Crypto wanted to overthrow banks, now it’s becoming them in stablecoin fight