North Korean cybercriminals used a U.S.-registered Chinese-language online marketplace to launder stolen cryptocurrency, according to a blockchain analysis firm, highlighting Pyongyang’s increasing reliance on such platforms to evade sanctions.

In a report published on Tuesday, Elliptic revealed that North Korean actors sent virtual currency worth around $220,000 in Nov. 2024 to addresses controlled by the Telegram-based Xinbi Guarantee, which it described as “the second-largest illicit online market to have ever operated” after Cambodia-based Haowang Guarantee.

The U.K.-based Elliptic traced the funds back to the theft of $235 million from the Indian cryptocurrency exchange WazirX last year, an attack that was