Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Chinese money ecosystem shift changes threat-actor operations

Threat Actor Meta
First reported
Last updated
Happening score
H score 28
2 unique sources, 2 articles

Summary

Hide ▲

Chinese money laundering networks (CMLNs) now include Xinbi, a Chinese-language marketplace the UK’s FCDO sanctioned for selling stolen data and satellite internet equipment to Southeast Asian scam networks. The same action also targeted #8 Park and Legend Innovation Co, while Chainalysis says Xinbi processed over $19.9 billion between 2021 and 2025 and is believed to have helped North Korean threat actors launder stolen cryptocurrency. The update reinforces how the illicit crypto laundering ecosystem is being used to monetize pig butchering and related scams.

Related Happenings

Treasury sanctions Prince Group-linked entities and FinCEN designates H-Pay Service

Regulatory/Legal Action
H score17 First: 24.06.2026 11:55 Last: 24.06.2026 11:55 Sources 1

About this happening: The **U.S. Treasury** imposed fresh sanctions on **nine individuals** and **26 entities** linked to **Prince Group**, while **FinCEN** designated **H-Pay Service PLC** as a **prim...

Open Happening

OFAC sanctions Nobitex and designates executives

Regulatory/Legal Action
H score21 First: 03.06.2026 23:31 Last: 03.06.2026 23:31 Sources 1

About this happening: **OFAC sanctioned Nobitex** and designated **its executives and founders**, freezing covered U.S.-jurisdiction assets and blocking U.S. business with the exchange and its leaders....

Open Happening

Austrian-Albanian cryptocurrency fraud ring takedown

Law Enforcement
H score64 First: 29.04.2026 17:27 Last: 29.04.2026 17:27 Sources 1

About this happening: Austrian and Albanian authorities **dismantled** a **cryptocurrency investment fraud ring**, escalating a cross-border cyberfraud case that allegedly caused **over €50 million** i...

Open Happening

UK FCDO sanctions Xinbi and #8 Park scam-centre network

Public Sector Action
H score30 First: 26.03.2026 17:42 Last: 26.03.2026 17:42 Sources 1

How related: "The UK is also the first country to sanction Xinbi, one of the largest illicit marketplaces in Southeast Asia, which provides cryptocurrency-based services to scam centres – including #8 Park."

About this happening: On **2026-03-26**, the **UK FCDO** sanctioned **Xinbi**, a marketplace tied to **stolen data sales** and **crypto laundering** that supported scam centres in **Southeast Asia**. T...

Open Happening

2025 Ransomware payments decline as victim counts surge

Trend
H score45 First: 02.03.2026 12:45 Last: 02.03.2026 12:45 Sources 1

About this happening: **Ransomware victim counts** surged **50% YoY in 2025** even as total payments fell **8% to $820m**, showing that extortion volume rose while monetization weakened. The **payment...

Open Happening

Timeline

  1. 26.03.2026 17:42 1 articles · 3mo ago

    UK sanctions Xinbi marketplace and related scam-network operators

    Legal Policy Action Update

    The UK’s FCDO sanctioned Xinbi, a Chinese-language online marketplace that sells stolen data and satellite internet equipment to scam networks in Southeast Asia, and also targeted #8 Park and Legend Innovation Co as part of the same action; Xinbi is believed to have helped North Korean threat actors launder cryptocurrency stolen in large heists, and Chainalysis says it processed over $19.9 billion between 2021 and 2025.

    Show sources
    Open in new tab
  2. 28.01.2026 12:30 2 articles · 5mo ago

    Chainalysis report says Chinese money laundering networks dominate illicit crypto flows

    Initial Disclosure

    Chainalysis says Chinese money laundering networks (CMLNs) now dominate global illicit cryptocurrency laundering, with Chinese-language launderers processing 20% of tracked funds over the past five years and an estimated $16bn last year across 1,799+ active wallets; the broader laundering ecosystem grew from $10bn in 2020 to over $82bn last year, CMLNs are increasingly preferred to centralized exchanges that can freeze suspect funds, and the networks are marketed through platforms such as Huione Guarantee and Xinbi with escrow-like infrastructure, ratings, and reviews.

    Show sources
    Open in new tab