The UK has become the first country to formally sanction Xinbi, one of South East Asia’s largest illicit crypto marketplaces.
The recent UK action against the Xinbi marketplace marks an important step in disrupting large-scale scam infrastructure. However, it also highlights a broader reality: sanctions alone are inherently reactive.
At NOMINIS, we have been tracking Xinbi and its surrounding ecosystem over an extended period, including its operational overlap with parallel marketplaces such as Huione and Tudou. While these entities are not formally the same company, our analysis shows they function as interconnected nodes within a broader informal financial network, sharing vendors, buyers, wallets, and infrastructure.
This ecosystem operates through a layered structure. At the top sits a “price group” marketplace layer, where illicit goods and services are advertised, including stolen data, compromised accounts, and crypto scam services. These groups facilitate discovery and pricing, but do not handle transactions.
Transactions are then executed through separate escrow or “guarantee” platforms such as XinbiPay, HuionePay, and Tudou Guarantee. These services act as informal intermediaries, holding funds and resolving disputes based on community enforcement rather than legal protections.
Crucially, these platforms demonstrate high operational resilience:
- The same vendors and buyers routinely operate across multiple platforms
- Infrastructure and coordination overlap significantly
- Platforms cross-promote one another
- When enforcement pressure disrupts one platform, activity rapidly migrates to another (e.g., Huione activity shifting to Tudou as a fallback channel)
- VIP and backup groups ensure continuity even when primary channels are shut down
A single transaction may originate in one marketplace, be executed through one escrow service, and resolved through another, highlighting the shared nature of this infrastructure.
The scale of this ecosystem is substantial. NOMINIS has identified hundreds of private Telegram groups, including hundreds of core operational channels and many more that rotate or re-emerge after bans. Individual groups often contain tens of thousands of members, with users frequently participating across multiple groups. In total, this represents hundreds of thousands of unique users, and well over one million total memberships when accounting for overlap, underscoring the vast, highly interconnected user base underpinning this network.
NOMINIS analysis indicates that more than $30 billion in volume has been associated with this broader interconnected ecosystem, including Xinbi and its related networks.
NOMINIS Head of Intelligence explains ‘Most analyses focus on wallets, transactions, and group sizes, but the hidden power of Xinbi is behavioral: Xinbi does not operate as a truly decentralized marketplace. Instead, it functions as a selectively centralized system built on controlled visibility and intentional information fragmentation.’
Information within the ecosystem is deliberately dispersed. No single group, channel, or interface provides a complete view of the marketplace. Instead, core functions such as listings, escrow coordination, dispute resolution, and reputation tracking, split across multiple Telegram groups, bots, and private chats.
Bots act as invisible infrastructure, facilitating payment coordination and transaction flows. However, this data is not publicly queryable, and histories can be altered, deleted, or selectively presented, reinforcing a system where transparency is structurally limited by design.
Meanwhile, top vendors and escrows naturally police lower-tier participants. This internal social control reduces the need for enforcement or external oversight, and their “market” enforces itself via predictable behavioral incentives.
At its core, Xinbi has effectively operationalized information asymmetry as a service. The system depends on maintaining vendor reputation across a fragmented network. However, this creates a fundamental structural weakness: reputation cannot propagate consistently or in real time across all groups and channels.
Updates occur unevenly: some groups reflect new information immediately, while others lag by minutes, hours, or even days, and private chats often lag further still.
As a result, a flagged scammer in one group can continue operating in other out-of-sync groups that have not yet been updated, exploiting these delays to maintain activity and credibility.
This has direct implications for enforcement effectiveness. Even when parts of the ecosystem respond to regulatory pressure, such as exchanges or counterparties reacting to sanctions, other segments of the network can remain active and “alive,” continuing to facilitate transactions using outdated or incomplete information.
In practice, this means that sanctioning Xinbi as a single entity cannot fully neutralize the network, because the system itself is designed to distribute, obscure, and delay critical information across parallel channels. Its design ensures structural integrity at its core, while the edges appear fragile, facing legal pressure or sanctions.
This issue demonstrates where traditional compliance frameworks fall short. By the time an entity is officially sanctioned, significant volumes of funds have already moved through the system, and its design prevents a complete cessation of activity as a result of sanctioning.
For compliance operations, a purely sanctions list-based approach cannot keep pace with rapidly evolving, multi-platform scam infrastructures that continuously refine their structure, rebrand and redistribute activity.
Using heuristic and behavioral intelligence models, NOMINIS identifies risk exposure at the network level, across entities, typologies, and transaction patterns, often well before formal designation. This enables our clients to proactively avoid exposure, rather than reacting after the fact.
The UK’s move against Xinbi is a step in the right direction, but reinforces the need for a more dynamic model of financial crime prevention; one that combines regulatory action with proactive, intelligence-led analysis to effectively combat resilient and adaptive illicit financial networks.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
.jpg)
