The U.S. Treasury Department and the Justice Department moved in tandem on September 9, 2026, against Xinbi Guarantee, a Chinese-language online marketplace that by then counted more than 650,000 users, according to the South China Morning Post, and that federal officials say bankrolled a sprawling network of scam operations targeting Americans. The U.S. action followed the United Kingdom’s Foreign, Commonwealth & Development Office, which had already sanctioned Xinbi Guarantee outright on March 26, 2026, making Washington’s move part of a broader international pressure campaign rather than a standalone strike. Treasury’s Office of Foreign Assets Control (OFAC) designated Xinbi as a Transnational Criminal Organization, while the DOJ’s Scam Center Strike Force seized Telegram channels and cryptocurrency wallets tied to the platform. Separately, stablecoin issuer Tether froze more than $39 million in USDT linked to Xinbi-associated wallets on the Tron blockchain, according to blockchain analytics firm MistTrack.
For a platform that blockchain analysis firm Elliptic says has processed more than $24 billion in crypto and fiat transactions since 2022, the roughly $52 million restrained in this action is a fraction of one percent of its lifetime volume. That gap between the headline dollar figure and the platform’s actual scale is the story software engineers, fraud teams, and payments infrastructure builders need to understand: sanctions and seizures against Telegram-based “guarantee” marketplaces are becoming a recurring pattern, not a one-off event, and the technical architecture behind these markets is built specifically to survive them.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: Treasury and DOJ Target Xinbi Guarantee
Xinbi Guarantee, written in Chinese as 新币担保, operated primarily through Telegram as an escrow-style marketplace connecting buyers and sellers of illicit goods and services, according to the Treasury designation published on OFAC’s recent actions page. U.S. officials describe the platform as a hub that supported cyber scams, fraud, and money laundering, with listings tied to Southeast Asian scam centers operating out of Myanmar, Thailand, and Laos.
The Treasury Department wrote in its official announcement that “Today, Treasury’s Office of Foreign Assets Control sanctioned Transnational Criminal Organization Xinbi Guarantee, a Chinese-language platform used extensively by Chinese cybercriminals to support cyber scams, fraud, money laundering, and other criminal activity targeting Americans,” according to the Treasury Department’s public statement.
Alongside Xinbi itself, OFAC named two supporting entities in that September 2026 action, Anwen Technology and SafeW Technology, which Treasury said provided financial, material, or technological support to what it formally designated a significant transnational criminal organization. That structure matters for anyone tracking how these networks are built: the sanctions did not just target one storefront, they targeted the vendors who built the tooling underneath it.
The Numbers: $52 Million Seized Against a $24 Billion Network
The DOJ’s Scam Center Strike Force said it restrained approximately $52 million in cryptocurrency in a single day on September 9, a figure corroborated across multiple outlets tracking the action. That total includes roughly $12 million in two cryptocurrency wallets seized directly by the Strike Force alongside two Telegram channels associated with Xinbi’s operations, and U.S. authorities simultaneously sought to block an additional 47 wallets tied to the platform that same day, according to Forklog. Tether’s separate freeze of 39,273,713 USDT, worth about $39.27 million, spanned 10 Tron-network addresses that MistTrack linked to Xinbi.
Set against Elliptic’s estimate that Xinbi has processed more than $24 billion in cryptoasset and fiat transactions since roughly 2022, the combined enforcement action touches well under one percent of the platform’s alleged historical throughput. Some financial commentary described the freeze as a “rounding error” relative to the scale of the underlying scam economy, underscoring a structural problem: seizing wallets after the fact does little to interrupt a marketplace generating billions annually in transaction volume.
| Metric | Figure | Source |
|---|---|---|
| Total crypto restrained by DOJ Strike Force | ~$52 million | DOJ Scam Center Strike Force |
| USDT frozen by Tether (10 Tron addresses) | $39,273,713 | MistTrack blockchain analysis |
| Wallets seized directly by DOJ | ~$12 million (2 wallets) | DOJ Strike Force reporting |
| Xinbi’s alleged lifetime transaction volume | $24+ billion since 2022 | Elliptic |
| Entities sanctioned alongside Xinbi | 2 (Anwen Technology, SafeW Technology) | OFAC designation |
| Countries named in OFAC listing | Myanmar (Burma), Thailand, Laos | OFAC recent actions |
How “Guarantee” Marketplaces Work
Guarantee marketplaces are a distinct category of illicit online commerce that emerged largely on Telegram over the past several years. Rather than operating a centralized storefront the way a traditional dark web market would, a guarantee marketplace functions more like an escrow layer: vendors selling stolen data, fake identification documents, money laundering services, or scam-website templates list their offerings, and the platform operator takes a cut for verifying that both sides of a transaction follow through. Buyers get a degree of trust that a pure peer-to-peer deal on an open Telegram channel would not offer.
Elliptic, the blockchain analytics firm that has tracked this ecosystem closely, said it is currently monitoring more than 30 active guarantee marketplaces, with Xinbi positioned as the leading platform in the space after the earlier takedown of Huione Guarantee. That earlier case is the direct precedent for the Xinbi action: Huione Guarantee was a similar Chinese-language marketplace that U.S. and international authorities targeted in a prior enforcement wave, and Elliptic’s research noted that Xinbi effectively absorbed much of the same vendor base and sold the same categories of scam-enablement services once Huione came under pressure.
That succession pattern is the central technical and policy challenge here. Removing one platform does not remove the vendor network, the buyer base, or the underlying demand for laundering rails. It just forces a migration to the next platform, which is precisely what analysts expect could happen again following the Xinbi action.
Stablecoins as the Chokepoint: Tether’s Role and Xinbi’s Response
The most technically interesting thread in this story is the stablecoin angle. USDT on the Tron network has become the dominant settlement rail for Southeast Asian scam operations because of its low transaction fees, fast settlement times, and wide acceptance among over-the-counter crypto brokers in the region. That popularity is also what makes it a natural enforcement lever: Tether, as the issuer, retains the technical ability to freeze specific wallet addresses on-chain, which it exercised against the 10 addresses MistTrack identified.
According to reporting from The Record, Xinbi administrators responded to the freeze by telling users on Telegram they would begin shifting operations toward USDD, a stablecoin issued on the Tron network by the Tron DAO Reserve that is structurally harder for a single centralized issuer to freeze the way Tether can freeze USDT. That pivot illustrates a cat-and-mouse dynamic developers and compliance teams building on public blockchains should recognize: centralized stablecoin issuers are becoming de facto law enforcement partners simply because their token design allows for it, and illicit actors are actively selecting for stablecoins that lack that same freeze capability.
Financial analysis site AInvest characterized the broader dynamic bluntly, noting that the roughly $52 million frozen sits against an estimated $8.4 billion in stablecoin rail volume tied to the same scam ecosystem that enforcement action left untouched. Whether or not that specific $8.4 billion figure holds up to scrutiny over time, the underlying point, that enforcement dollar amounts trail platform throughput by orders of magnitude, is consistent across every outlet that covered the story.
Who Said What: Officials and Industry React
Treasury Secretary Scott Bessent framed the action as part of a sustained campaign against overseas fraud networks. “Scam centers in Southeast Asia steal billions of dollars from American victims each year,” Bessent said, according to Treasury’s press release on the sanctions. He added that “the Trump Administration is united in its efforts to dismantle these overseas criminal enterprises, and Treasury will continue using its tools to disrupt the networks behind this egregious fraud and protect Americans,” per the same release.
Ari Redbord, a compliance industry commentator who tracks Treasury enforcement actions closely, summarized the scope of the designation, writing that “today, the US Treasury sanctioned Xinbi Guarantee today, one of Southeast Asia’s largest illicit crypto marketplaces, designating it as a significant transnational criminal organization alongside the two developers that built its core tooling,” according to his public post reacting to the action.
Treasury’s own statement, distributed publicly, described the scope of the marketplace directly: “Today, Treasury’s Office of Foreign Assets Control sanctioned Transnational Criminal Organization Xinbi Guarantee, a Chinese-language platform used extensively by Chinese cybercriminals to support cyber scams, fraud, money laundering, and other criminal activity targeting Americans,” the department wrote in its official public announcement.
Historical Context: From Huione to Xinbi
The Xinbi action did not happen in isolation. It follows the earlier enforcement push against Huione Guarantee, a marketplace that U.S. authorities and blockchain investigators previously linked to the same category of Southeast Asian scam infrastructure, and it was itself preceded by the UK’s Foreign, Commonwealth & Development Office, which sanctioned Xinbi Guarantee outright on March 26, 2026, more than five months before Treasury and the DOJ acted. Elliptic’s research into the FBI’s Huione case, published on its insights page, documented how that platform served the same vendor community, selling stolen data, fraudulent identification services, and laundering pipelines before it came under sustained investigative pressure.
What makes the Xinbi case notable within that history is speed and scale of transition. Elliptic’s tracking suggests Xinbi became the leading guarantee marketplace precisely because it absorbed displaced Huione vendors, meaning the ecosystem’s transaction volume did not shrink so much as it relocated. With more than 30 active guarantee marketplaces still operating by Elliptic’s count, Xinbi’s removal is likely to trigger a similar migration rather than a collapse in the underlying scam economy.
This pattern mirrors dynamics tech-insider.org has covered in other corners of the cybersecurity and crypto-crime landscape, including the Liquid Network hack that drained $320 million and the smaller but similarly structured XRPL wallet breach that drained 267,000 XRP. In both cases, the technical response, freezing assets, tracing on-chain flows, and coordinating across exchanges, followed a similar playbook to what Treasury and Tether executed against Xinbi.
Enforcement Approach Comparison
The table below lays out how the Xinbi action compares with the broader categories of enforcement tools U.S. and industry actors have available when confronting crypto-enabled scam infrastructure.
| Enforcement Lever | Who Controls It | Speed | Limitation |
|---|---|---|---|
| OFAC sanctions designation | U.S. Treasury | Immediate legal effect, slow to change behavior | Only binds U.S. persons and institutions directly |
| DOJ wallet/channel seizure | U.S. Department of Justice | Fast once a warrant is secured | Requires identifying specific wallets in advance |
| Stablecoin issuer freeze (Tether) | Tether Limited | Near-instant on-chain action | Only works on centralized, freezable tokens like USDT |
| Blockchain analytics tracing | Firms like Elliptic, MistTrack, Chainalysis | Ongoing, cumulative | Identifies flows but cannot itself freeze funds |
| Platform migration by bad actors | Xinbi and successor marketplaces | Days to weeks | Erodes the impact of any single enforcement action |
Why This Matters for Developers and Security Teams
For engineers building payments infrastructure, KYC pipelines, or fraud detection systems, the Xinbi case is a live example of why on-chain compliance tooling has become a core part of the crypto stack rather than an afterthought. Any platform that accepts USDT on Tron, or any stablecoin with a centralized issuer, needs to account for the reality that addresses can be frozen after the fact, sometimes retroactively affecting counterparties who transacted with a wallet before it was flagged.
Fraud and trust-and-safety teams at exchanges, payment processors, and identity verification vendors should treat this as a signal to tighten monitoring around Telegram-adjacent crypto flows, particularly transactions touching Tron-based USDT that route through over-the-counter brokers in Southeast Asia. The same guarantee-marketplace model that powered Xinbi has also been linked by researchers to the broader pig-butchering and romance-scam economy that has drained victims across the U.S., meaning downstream fraud losses at consumer-facing platforms are directly connected to the wholesale infrastructure this action targeted.
This is also a reminder for teams tracking ransomware and cybercrime economics that the financial rails underneath both ransomware and scam-center fraud increasingly overlap, a pattern also visible in the ongoing wave of attacks tracked by researchers covering Medusa ransomware’s hits on critical infrastructure. Chinese-language guarantee marketplaces, Southeast Asian scam centers, and Tron-based stablecoin laundering are now recurring elements across multiple categories of cybercrime, not isolated incidents.
The China Angle and Geopolitical Backdrop
Xinbi’s designation as a Chinese-language platform, rather than a Chinese state-linked one, is a distinction Treasury was careful to draw. Officials described Xinbi as a platform used extensively by Chinese cybercriminals rather than a state-sponsored operation, which keeps this action in the same bucket as prior transnational organized crime sanctions rather than the kind of state-attribution dispute seen in other recent U.S.-China technology disputes. Still, the physical infrastructure named in the OFAC listing, spanning Myanmar, Thailand, and Laos, places this squarely within the broader Southeast Asian scam-center crisis that has drawn scrutiny from regional governments over forced-labor conditions inside scam compounds.
Market Impact: Crypto Prices and Compliance Costs
The direct market reaction to the Xinbi announcement was muted compared with the scale of the headlines it generated. Bitcoin was trading in the neighborhood of $77,000 in the days surrounding the action, with broader crypto markets responding more to macro signals like U.S. jobs data and Federal Reserve rate expectations than to a single enforcement action against an OTC-adjacent marketplace. That is consistent with how the market has treated prior guarantee-marketplace takedowns: these actions move compliance budgets and monitoring requirements at exchanges and stablecoin issuers far more than they move token prices.
Where the real cost lands is inside compliance and fraud-operations teams. Exchanges accepting Tron-based USDT now face pressure to tighten transaction monitoring on flows touching addresses adjacent to sanctioned wallets, and identity verification vendors serving financial institutions will likely see increased due-diligence requirements tied to Southeast Asian counterparties. Tether itself faces a reputational balancing act: freezing $39.27 million in USDT demonstrates it can act on illicit activity, but the scale mismatch against Xinbi’s alleged $24 billion lifetime volume also highlights how much of that flow may have moved through USDT undetected for years before this action.
What Comes Next: 5 Predictions
- Vendors displaced from Xinbi will migrate to one or more of the roughly 30 other guarantee marketplaces Elliptic is tracking, likely causing a visible volume spike on at least one successor platform within weeks.
- Xinbi’s stated pivot toward USDD signals a broader trend of illicit platforms favoring stablecoins with decentralized or harder-to-freeze issuance models, a shift compliance teams should watch across Tron and other chains.
- Expect additional OFAC designations targeting supporting technology vendors, following the pattern of naming Anwen Technology and SafeW Technology alongside Xinbi itself, rather than sanctioning marketplaces in isolation.
- Tether and other centralized stablecoin issuers will face continued pressure, from both regulators and industry critics, to demonstrate faster and larger-scale freezing capability given the gap between $39.27 million frozen and billions in estimated illicit flow.
- Additional joint DOJ-Treasury actions against Southeast Asian scam-center infrastructure are likely before the end of 2026, building on the precedent set by both the Huione and Xinbi cases.
How Guarantee Marketplace Takedowns Compare Over Time
| Aspect | Huione Guarantee (prior case) | Xinbi Guarantee (Sept. 2026) |
|---|---|---|
| Primary channel | Telegram-based escrow marketplace | Telegram-based escrow marketplace |
| Vendor base | Stolen data, fake IDs, laundering services | Same categories, absorbed part of Huione’s vendor base |
| Enforcement lead | FBI-led investigation | DOJ Scam Center Strike Force + Treasury OFAC |
| Stablecoin response | Tracked by blockchain analytics firms | Tether froze $39.27M in USDT directly |
| Market position after action | Vendor migration to successor platforms, including Xinbi | Migration to one of 30+ tracked guarantee marketplaces expected |
The Compliance Playbook This Action Reinforces
For teams building anti-fraud and transaction monitoring systems, the Xinbi case reinforces a specific set of engineering priorities. Real-time wallet screening against OFAC’s Specially Designated Nationals list needs to extend beyond the directly sanctioned entity to associated infrastructure, since Treasury explicitly named supporting technology vendors rather than only the marketplace brand. Systems that only screen against a static sanctions list updated weekly will miss the window between an OFAC designation and when downstream platforms update their own blocklists.
Blockchain forensics providers like MistTrack and Elliptic played a direct role in surfacing the specific wallet addresses tied to Xinbi before and after the freeze, which is a reminder that off-chain intelligence feeds are as important as on-chain transaction data for any fraud detection pipeline operating in the stablecoin space. Companies relying solely on their own historical transaction data, without external threat intelligence feeds, are structurally behind on detecting these networks.
Code Example: Screening Wallet Addresses Against Sanctions Feeds
Engineering teams building transaction monitoring for stablecoin flows typically implement a screening layer that checks incoming and outgoing addresses against updated sanctions and threat-intelligence feeds before allowing a transfer to settle. A simplified version of that check looks like this:
def screen_wallet(address, sanctions_list, threat_feed):
if address in sanctions_list:
return "BLOCK: OFAC sanctioned address"
risk_score = threat_feed.get_risk_score(address)
if risk_score > 0.8:
return "FLAG: high-risk address, manual review required"
return "ALLOW"
In production, that sanctions_list needs to refresh far more frequently than a weekly batch job, and the threat_feed lookup should pull from multiple blockchain analytics providers rather than a single source, given how quickly addresses tied to marketplaces like Xinbi can be recycled or migrated once one is frozen.
Frequently Asked Questions
What is Xinbi Guarantee?
Xinbi Guarantee is a Chinese-language online marketplace that operated largely through Telegram, connecting vendors of illicit services including stolen data, fraudulent identity documents, and money laundering with buyers, according to Treasury’s OFAC designation published September 9, 2026.
How much money was frozen in the Xinbi Guarantee action?
The DOJ’s Scam Center Strike Force restrained approximately $52 million in cryptocurrency, while Tether separately froze $39,273,713 in USDT across 10 Tron-network addresses linked to the platform, according to MistTrack’s blockchain analysis.
How much crypto has Xinbi Guarantee allegedly processed in total?
Blockchain analytics firm Elliptic estimates Xinbi has processed more than $24 billion in cryptoasset and fiat transactions since around 2022, making the roughly $52 million enforcement action a small fraction of its alleged historical volume.
Who else was sanctioned alongside Xinbi Guarantee?
OFAC also designated two supporting entities, Anwen Technology and SafeW Technology, which Treasury said provided financial, material, or technological support to Xinbi’s core operations.
What is a guarantee marketplace?
A guarantee marketplace is a Telegram-based escrow platform where vendors of illicit goods and services list offerings, and the platform operator verifies transactions between buyers and sellers. Elliptic tracks more than 30 active guarantee marketplaces, with Xinbi identified as the leading platform after the earlier Huione Guarantee takedown.
Why did Xinbi say it would move to USDD?
According to reporting reviewed by The Record, Xinbi administrators told users on Telegram they would shift toward USDD, a Tron-based stablecoin, because it is structurally harder for a single centralized issuer to freeze compared with Tether’s USDT.
Is this related to the earlier Huione Guarantee case?
Yes. Elliptic’s research found that Xinbi absorbed much of Huione Guarantee’s vendor base and sold similar categories of scam-related services after Huione came under prior enforcement pressure, making Xinbi effectively a successor platform.
What should security and compliance teams do in response?
Security teams should tighten transaction monitoring on Tron-based USDT flows, integrate multiple blockchain threat-intelligence feeds rather than relying on a single source, and update sanctions screening more frequently than weekly to catch newly designated addresses and successor wallets faster.
