North Korean Hackers Laundered Crypto Through $24B Xinbi Market

North Korean hackers moved tens of millions of dollars stolen from major crypto platforms through Xinbi Guarantee, a sprawling cybercrime marketplace that processed more than $24 billion in digital assets and fiat currency, according to Chainalysis.

The blockchain analytics firm linked the activity to funds stolen in major attacks, including the $1.5 billion Bybit breach and the $235 million WazirX hack.

DPRK-linked threat actors reportedly relied on vendors offering specialized laundering services to exchange traceable stolen assets for stablecoins derived from other criminal operations.

On Sept. 9, the US Treasury Department’s Office of Foreign Assets Control sanctioned Xinbi, alongside technology providers SafeW Technology and Anwen Technology.

The Justice Department also seized Xinbi’s online infrastructure and helped freeze or restrain more than $52 million in cryptocurrency connected to the marketplace and its vendors.

New Trending Crypto Wallet Offers

North Korean Hackers Used ‘Black U’ Crypto Launderers

Chainalysis said North Korean threat actors used vendors known as “Black U” launderers to clean stolen cryptocurrency through asset substitution.

Instead of attempting to conceal the origin of the stolen tokens through conventional mixing techniques, these vendors accepted the traceable assets and replaced them with stablecoins sourced from separate illicit revenue streams.

Chainalysis' investigation of Xinbi Guarantee finds that DPRK-linked threat actors moved tens of millions in stolen crypto through the newly-sanctioned cybercriminal marketplace.

To launder stolen cryptocurrency, DPRK-linked threat actors have used specialized vendors known as… pic.twitter.com/bullZDl4vk

— Chainalysis (@chainalysis) September 9, 2026

Those funds reportedly included proceeds from pig-butchering operations, romance scams and other fraudulent schemes.

The process allowed the stolen crypto to disappear into Xinbi’s broader pool of criminal transactions. Meanwhile, the North Korean actors received nominally cleaner stablecoins that they could send to unlicensed over-the-counter trading desks and convert into fiat currency.

The model illustrates how interconnected criminal revenue streams can make blockchain tracing more difficult. Funds from hacking, investment fraud and romance scams effectively become interchangeable within the same underground financial system.

Xinbi Processed More Than $24 Billion

Xinbi emerged around 2022 and developed into a major Chinese-language marketplace supporting organized cybercrime and Southeast Asia’s scam economy.

According to the US Treasury, the platform processed more than $24 billion in cryptocurrency and fiat transactions.

Its vendors operated through hundreds of Telegram channels and advertised services including money laundering, fraudulent bank cards, stolen personal information, know-your-customer verification bypasses, malware and custom-built scam websites.

Xinbi Guarantee on-chain ecosystem — Reactor graph of Xinbi Guarantee’s on-chain ecosystem. | Credit: Chainalysis

Xinbi also provided cash delivery, surveillance equipment and recruitment services linked to Southeast Asian scam compounds. Authorities say trafficked workers at some of these compounds have faced forced labor, physical confinement and torture.

The marketplace used an escrow system to hold vendor deposits and facilitate payments. That structure created a layer of trust between otherwise unconnected criminals, allowing illicit businesses to operate at scale.

Chainalysis estimates that Chinese-language laundering networks processed around 20% of known illicit crypto flows over the past five years, including approximately $16 billion during 2025 alone.

Authorities Freeze $52 Million in Crypto

A US federal court authorized the seizure of Telegram channels hosting Xinbi’s marketplace on Sept. 7. Under the same warrant, the Justice Department’s Scam Center Strike Force seized two wallets containing approximately $12 million in cryptocurrency.

Authorities also restrained another 47 wallets associated with Xinbi, bringing the total value of frozen or seized crypto above $52 million. Tether reportedly assisted law enforcement during the investigation.

Thanks to today’s actions against the Chinese run Xinbi Guarantee network and the restraining of $52 million in a single day, the Scam Center Strike Force counter has officially reached $938 Million in total restrained funds.

We remain relentless in dismantling transnational… pic.twitter.com/bLC8TJolRZ

— U.S. Attorney DC (@USAO_DC) September 9, 2026

OFAC separately identified 52 cryptocurrency addresses that had received more than $8.4 billion in stablecoins. The latest US measures follow sanctions imposed by the UK Foreign, Commonwealth and Development Office in March.

The coordinated crackdown targeted Xinbi’s financial infrastructure, communications network and supporting technology providers, disrupting a marketplace that connected crypto hackers, money launderers, scammers and human-trafficking operations.

North Korean Hackers Used $24B Xinbi Marketplace to Launder Stolen Crypto, Chainalysis Finds

North Korean Hackers Used ‘Black U’ Crypto Launderers

Xinbi Processed More Than $24 Billion

Authorities Freeze $52 Million in Crypto

Related