US authorities have moved against Xinbi Guarantee, the Chinese-language Telegram marketplace that investigators say supplies the tools, data and laundering services behind industrial-scale scam operations worldwide, freezing $52.8 million in crypto and designating the platform a significant transnational criminal organization.
The coordinated action combined Treasury sanctions, Justice Department seizures and a Secret Service freeze executed with blockchain intelligence from Elliptic, which said it has tracked Xinbi's wallet infrastructure for several years.
The Freeze
Beginning at 8am UTC on September 8, the Secret Service froze 52 wallets belonging to the marketplace and its merchants, all holding Tether's USDT. Two of those wallets, containing roughly $12 million, were seized outright under a warrant unsealed by the Justice Department, which is also seeking restraints against 47 additional wallets believed to be connected to money laundering across the network.
The DOJ said the US District Court for the District of Columbia authorized the seizure of the Telegram channels hosting the marketplace on September 7. According to the unsealed warrant, vendors used the channels to advertise money laundering, custom scam-investment websites and recruitment services for scam compounds in Southeast Asia. The DOJ credited stablecoin issuer Tether with assisting the investigation.
A $24 Billion Black Market
Elliptic's research places Xinbi as the second-largest illicit online marketplace ever tracked, with at least $24 billion processed by the marketplace and its merchants since 2022 — primarily in USDT on TRON. A closely linked payments service, Xinbi Pay, has processed a further $6 billion. Only Huione Guarantee, which closed in May 2025 after Elliptic exposed its activity, handled more, at $31 billion.
TRM Labs Global Head of Policy Ari Redbord put the figure even higher, telling Cointelegraph that Xinbi "became the go-to escrow and cash-out layer for Southeast Asia's scam compounds" after Huione's closure, "moving more than USD 36 billion."
The marketplace operates as an escrow system for criminals: merchants post guarantee deposits in crypto, and buyers who feel cheated can be compensated from those deposits. Vendors openly sell stolen personal data for targeting victims, communications infrastructure for running scams at scale, and laundering services — with some explicitly advertising willingness to handle pig-butchering proceeds, according to machine-translated screenshots published by Elliptic.
Treasury said the platform has also been used by North Korean hackers and entities connected to the sanctioned Prince Group.
Sanctions Designations
On Wednesday, the Treasury's Office of Foreign Assets Control designated Xinbi a significant transnational criminal organization — the same category used for drug cartels — alongside Singapore-based SafeW Technology and Cambodia-based Anwen Technology. According to Treasury, Xinbi began moving its merchant and money-laundering networks onto SafeW's encrypted messaging application around June 2025 as law-enforcement scrutiny intensified, while Anwen developed XinbiPay, also known as NewPay, the crypto wallet used by the marketplace.
The UK sanctioned Xinbi in March 2026. Following the US action, Telegram deleted the central channels used by the marketplace and banned its associated usernames, Elliptic reported.
Xinbi's Response
Xinbi did not accept the freeze quietly. The marketplace condemned the "arbitrary freezing" of its funds and promised to compensate affected customers. It also announced a shift away from USDT toward USDD, a stablecoin launched by TRON founder Justin Sun that lacks the central freeze capability built into USDT — and swapped roughly $2.8 million of its remaining USDT into USDD through a decentralized exchange.
The workaround has a wrinkle: USDD is partly collateralized with the very USDT whose freeze function Xinbi is trying to escape, leaving it exposed to freezing risk at the reserve layer.
Wider Enforcement Context
Wednesday's operation was part of a broader day for the DOJ's Scam Center Strike Force, which deployed agents to Madagascar to help local authorities take down 13 Chinese-run scam compounds and process evidence from nearly 400 arrestees and more than 3,200 seized devices. The Strike Force, launched in November 2025, says it has now seized roughly $938 million in scam-linked cryptocurrency.
Elliptic also documented Xinbi's physical footprint: a store the marketplace opened in June 2025 inside the Yatai New City scam-compound complex in Myanmar, which Myanmar's military raided in late 2025. Subsequent footage shows the store partially destroyed.
All criminal conduct described above remains alleged pending judicial proceedings; the sanctions designations and seizures are official government actions.
TrustGrade covers enforcement and the security ecosystem around digital assets. For verified trust data on the platforms and firms shaping it, see trustgrade.ai.