Chinese money ecosystem shift changes threat-actor operations
Threat Actor Meta
Summary
Hide ▲
Show ▼
Chinese money laundering networks (CMLNs) now include Xinbi, a Chinese-language marketplace the UK’s FCDO sanctioned for selling stolen data and satellite internet equipment to Southeast Asian scam networks. The same action also targeted #8 Park and Legend Innovation Co, while Chainalysis says Xinbi processed over $19.9 billion between 2021 and 2025 and is believed to have helped North Korean threat actors launder stolen cryptocurrency. The update reinforces how the illicit crypto laundering ecosystem is being used to monetize pig butchering and related scams.
Related Happenings
Austrian-Albanian cryptocurrency fraud ring takedown
Law Enforcement
First: 29.04.2026 17:27
Last: 29.04.2026 17:27
Sources 1
About this happening:
Austrian and Albanian authorities **dismantled** a **cryptocurrency investment fraud ring**, escalating a cross-border cyberfraud case that allegedly caused **over €50 million** i...
Austrian-Albanian cryptocurrency fraud ring takedown
Law EnforcementAbout this happening: Austrian and Albanian authorities **dismantled** a **cryptocurrency investment fraud ring**, escalating a cross-border cyberfraud case that allegedly caused **over €50 million** i...
UK FCDO sanctions Xinbi and #8 Park scam-centre network
Public Sector Action
First: 26.03.2026 17:42
Last: 26.03.2026 17:42
Sources 1
How related:
"The UK is also the first country to sanction Xinbi, one of the largest illicit marketplaces in Southeast Asia, which provides cryptocurrency-based services to scam centres – including #8 Park."
About this happening:
On **2026-03-26**, the **UK FCDO** sanctioned **Xinbi**, a marketplace tied to **stolen data sales** and **crypto laundering** that supported scam centres in **Southeast Asia**. T...
UK FCDO sanctions Xinbi and #8 Park scam-centre network
Public Sector ActionHow related: "The UK is also the first country to sanction Xinbi, one of the largest illicit marketplaces in Southeast Asia, which provides cryptocurrency-based services to scam centres – including #8 Park."
About this happening: On **2026-03-26**, the **UK FCDO** sanctioned **Xinbi**, a marketplace tied to **stolen data sales** and **crypto laundering** that supported scam centres in **Southeast Asia**. T...
2025 Ransomware payments decline as victim counts surge
Target Trend
First: 02.03.2026 12:45
Last: 02.03.2026 12:45
Sources 1
About this happening:
**Ransomware victim counts** surged **50% YoY in 2025** even as total payments fell **8% to $820m**, showing that extortion volume rose while monetization weakened. The **payment...
2025 Ransomware payments decline as victim counts surge
Target TrendAbout this happening: **Ransomware victim counts** surged **50% YoY in 2025** even as total payments fell **8% to $820m**, showing that extortion volume rose while monetization weakened. The **payment...
INTERPOL Operation Red Card 2.0 cybercrime arrests and takedowns
Law Enforcement
First: 19.02.2026 19:50
Last: 19.02.2026 19:50
Sources 1
About this happening:
**Operation Red Card 2.0** led to **651 arrests** and the seizure of **2,341 devices** and **1,442 malicious IPs, domains, and servers**, disrupting an **online-scam** network acr...
INTERPOL Operation Red Card 2.0 cybercrime arrests and takedowns
Law EnforcementAbout this happening: **Operation Red Card 2.0** led to **651 arrests** and the seizure of **2,341 devices** and **1,442 malicious IPs, domains, and servers**, disrupting an **online-scam** network acr...
Chinese-language money alliance reshapes ransomware ecosystem operations
Threat Actor Meta
First: 16.02.2026 12:30
Last: 16.02.2026 12:30
Sources 1
About this happening:
**Trafficking-linked crypto payments** are increasingly routed through **Telegram-based CMLN services**, **scam compounds**, and **online casinos**, expanding the scale and resili...
Chinese-language money alliance reshapes ransomware ecosystem operations
Threat Actor MetaAbout this happening: **Trafficking-linked crypto payments** are increasingly routed through **Telegram-based CMLN services**, **scam compounds**, and **online casinos**, expanding the scale and resili...
Timeline
-
26.03.2026 17:42 1 articles · 2mo ago
UK sanctions Xinbi marketplace and related scam-network operators
Legal Policy Action UpdateThe UK’s FCDO sanctioned Xinbi, a Chinese-language online marketplace that sells stolen data and satellite internet equipment to scam networks in Southeast Asia, and also targeted #8 Park and Legend Innovation Co as part of the same action; Xinbi is believed to have helped North Korean threat actors launder cryptocurrency stolen in large heists, and Chainalysis says it processed over $19.9 billion between 2021 and 2025.
Show sources
- UK sanctions Xinbi marketplace linked to Asian scam centers — www.bleepingcomputer.com — 26.03.2026 17:42
-
28.01.2026 12:30 2 articles · 3mo ago
Chainalysis report says Chinese money laundering networks dominate illicit crypto flows
Initial DisclosureChainalysis says Chinese money laundering networks (CMLNs) now dominate global illicit cryptocurrency laundering, with Chinese-language launderers processing 20% of tracked funds over the past five years and an estimated $16bn last year across 1,799+ active wallets; the broader laundering ecosystem grew from $10bn in 2020 to over $82bn last year, CMLNs are increasingly preferred to centralized exchanges that can freeze suspect funds, and the networks are marketed through platforms such as Huione Guarantee and Xinbi with escrow-like infrastructure, ratings, and reviews.
Show sources
- Chinese Money Launderers Drive Global Ecosystem Worth $82bn — www.infosecurity-magazine.com — 28.01.2026 12:30
- Chinese Money Launderers Drive Global Ecosystem Worth $82bn — www.infosecurity-magazine.com — 28.01.2026 12:30