U.S. authorities have hit Xinbi Guarantee, a Chinese-language crypto marketplace tied to scam operations and laundering, with a broad enforcement sweep: wallet seizures, sanctions, and pressure on the apps and channels that kept the network running.
- [DOJ moved on wallets](https://crypto.news/?p=14482365) linked to Xinbi activity
- OFAC sanctioned Xinbi, SafeW Technology, and Anwen Technology
- Targeted the infrastructure: payments, messaging, escrow-like services
- Xinbi’s scale shows how industrialized scam markets have become
The important part here is not just the size of the freeze, but the target. U.S. agencies are no longer pretending that scam compounds and laundering networks can be disrupted by chasing only the most visible operators. They are going after the plumbing: wallets, chat tools, payment apps, and the marketplace layer that connects fraud vendors with scam crews.
That is the right instinct. These networks do not survive on hype. They survive on boring infrastructure.
Xinbi was described by investigators and blockchain intelligence researchers as a Chinese-language “guarantee marketplace”, basically a criminal escrow-style market. In legitimate commerce, escrow holds money until both sides do what they promised. In Xinbi’s world, that same mechanism was repurposed to grease dirty business: money laundering, scam support, fake IDs, custom fraudulent websites, deepfake tools, and recruitment for scam compounds in Southeast Asia.
According to the DOJ, authorities restrained more than $52 million in cryptocurrency tied to Xinbi-linked activity, seized two wallets holding roughly $12 million, and sought restraints against 47 additional wallets linked to suspected money laundering. Tether also assisted investigators, and earlier in the week froze $39.3 million in USDT across 10 Tron addresses linked to Xinbi.
The timeline matters. On Sept. 7, the U.S. District Court for the District of Columbia authorized seizure of Telegram channels hosting the marketplace. On Sept. 9, the DOJ announced the wallet actions. The same day, Treasury’s OFAC sanctioned Xinbi and two companies investigators say helped keep the network operational: Singapore-based SafeW Technology, which built the encrypted messaging app SafeW, and Cambodia-based Anwen Technology, which developed XinbiPay, also known as NewPay.
OFAC said Xinbi is a significant transnational criminal organization. That label is not just bureaucratic noise. It means the platform is being treated as part of a cross-border criminal apparatus, not merely as a shady website with bad vibes and a few rogue sellers.
Chasing a single number can miss the point, but scale still matters. Treasury said digital asset and fiat transactions processed through Xinbi and associated platforms totaled more than $24 billion since around 2022. TRM Labs, which has tracked the marketplace closely, puts the figure at more than $36 billion in digital assets and fiat since around the same period. The exact number depends on what gets counted and how much of the activity can be traced, but either way this was not a small-time fraud bazaar.
Xinbi appears to have grown as rival guarantee networks came under pressure. Huione Guarantee, later known as Haowang Guarantee, was one of the largest of these markets before Telegram shut it down in May 2025. Telegram later removed thousands of channels tied to Xinbi and Huione, but TRM Labs says both networks resurfaced under new channels and names soon afterward.
That is the ugly truth about this part of the internet: takedowns do not always end the game. They often just force a rebrand.
TRM Labs says Xinbi adapted by shifting toward SafeW and XinbiPay after Telegram disruptions. That makes sense. If one messaging channel gets burned, criminals move to another. If one payment route gets noisy, they reroute the money. If one brand becomes toxic, they slap on a new label and keep selling the same rotten product.
One reason these markets are such a headache is that they are layered. You need the marketplace to advertise services, the chat app to coordinate, the payment rail to move funds, and the escrow logic to create trust among crooks who would happily scam each other if given the chance. Cut one layer and the others can keep going for a while.
OFAC’s sanctions also hit the wider vendor ecosystem. Treasury said Xinbi’s platform had been used by North Korean hackers and by several previously sanctioned entities, including companies linked to Cambodia’s scam compounds in Southeast Asia. U.S. prosecutors have accused Prince Group and chairman Chen Zhi of operating crypto investment fraud, money laundering, and forced-labor scam compounds. Authorities have also sought forfeiture of more than 127, 000 Bitcoin connected to Chen and associates. Prince Group has denied the allegations.
That overlap is the disturbing part. These platforms do not exist in neat little boxes. A marketplace that supports one scam crew can easily become useful to another. Once a service proves it can move money, recruit workers, or hide criminal activity, it becomes infrastructure for the whole parasite economy.
This is also why sanctioning SafeW Technology and Anwen Technology matters. Regulators are signaling that the companies building the encrypted messaging layer and the payment app are not just passive vendors if their tools are built into the machinery of fraud. Neutral on paper. Filthy in application.
The action fits into a broader campaign by the DOJ’s Scam Center Strike Force, which says it has restrained approximately $938 million linked to scam money laundering operations. The Strike Force recently spent two weeks in Madagascar helping local authorities dismantle 13 scam centers allegedly run by Chinese organized crime groups. Investigators processed more than 3, 200 electronic devices and interviewed people among nearly 400 arrests. About 30 of those arrested were Chinese leaders later repatriated to China by the Chinese government.
That broader effort is telling. The U.S. is increasingly treating scam ecosystems as transnational criminal networks, not as isolated fraud shops. That is the correct frame. These are industrialized operations built on coercion, laundering, and digital payment rails. Pretending otherwise only helps the people cashing in on the misery.
Still, nobody should confuse a major seizure with a clean kill shot. Sanctions block property and interests in property in the U.S. or controlled by U.S. persons, and they prohibit most transactions involving designated entities. That is meaningful pressure, but criminal networks can rename themselves, rotate wallets, switch apps, and keep moving unless the pressure is sustained.
The real lesson is simple: scam markets live or die by infrastructure. Messaging channels, escrow systems, stablecoin rails, and payment apps are not side details. They are the business model. If authorities, exchanges, and compliance teams keep hitting those layers, the cost of running these operations rises fast.
For readers sorting through the jargon, here’s the short version. Escrow is normally a system where a third party holds funds until both sides of a deal are satisfied. In Xinbi’s hands, that mechanism was used to facilitate fraud and laundering. Money laundering means disguising the origin of illicit funds. OFAC is the U.S. Treasury office that imposes sanctions. And USDT is Tether’s dollar-pegged stablecoin, which moves quickly across blockchains like Tron and is widely used in both legitimate and illicit transfers.
The uncomfortable truth is that crypto’s best features, speed, borderless movement, and low-friction settlement, are exactly what make it useful to scammers too. That is not an argument against Bitcoin, stablecoins, or decentralized finance. It is an argument for calling the bad actors what they are, then cutting off the rails they depend on.
For more context on how the U.S. is pressing on these networks, see the DOJ targets Xinbi Guarantee network, restrains over $52M in, along with The US Sanctions Xinbi, One of Southeast Asia's Largest and the OFAC guidance on Questions on Virtual Currency.
The same pressure campaign has also shown up in other cases, including U.S. sanctions expand as Tether freezes $131 million USDT and Tether Freezes USDT in 131 TRON Wallets Linked to ISIS-K. On the corporate compliance side, even stablecoin issuers are feeling the squeeze, especially in places like Europe, where MiCA Forces USDT Squeeze in Europe as USDC Gains Ground.
And for the intelligence angle, TRM’s broader 2026 Crypto Crime Report is a useful reminder that these operations are not random chaos; they are organized, iterative, and increasingly global.
Key questions and takeaways
-
What did U.S. authorities target?
They went after Xinbi-linked wallets, the marketplace itself, and the messaging and payment tools that helped the network operate. -
Why does Xinbi matter?
It appears to have been a major scam-enabling marketplace, with Treasury saying activity through Xinbi and related platforms topped more than $24 billion and TRM Labs placing it above $36 billion since around 2022. -
Does this shut Xinbi down?
Not necessarily. It can disrupt operations and raise costs, but networks like this tend to rebrand, shift wallets, and move to new apps. -
Why are SafeW and XinbiPay important?
They show how criminal marketplaces adapt when one communication channel or payment rail gets pressured. If those tools remain available, operators can often keep part of the network alive. -
What does this mean for crypto?
It shows enforcement is increasingly focused on the rails around crime, not just the headline scammers. That is better for the market, even if it also means more scrutiny for stablecoin flows, exchanges, and infrastructure providers.
Xinbi is a reminder that the darkest corners of crypto are often powered by mundane tools: wallets, messaging apps, escrow, and payment rails. That is exactly why regulators are aiming there. The scams were built like a business. The response has to be aimed at the business model, not just the people smiling for mugshots.
Further reading
A couple of useful references that do not fit neatly into the body:
