US authorities have restrained more than $52 million in cryptocurrency tied to Xinbi Guarantee and its vendor network while seizing wallets and Telegram channels used by the Chinese-language marketplace.
- US authorities restrained more than $52 million in crypto linked to Xinbi Guarantee and its vendor network.
- The DOJ seized two wallets holding roughly $12 million and sought restraints against another 47 wallets tied to suspected money laundering.
- US authorities seized Telegram channels where Xinbi vendors advertised money laundering, scam websites and recruitment services for Southeast Asian scam compounds.
- OFAC sanctioned Xinbi, SafeW Technology and Anwen Technology over their alleged roles in supporting the marketplace.
The US Department of Justice said on Sept. 9 that its Scam Center Strike Force seized two crypto wallets containing approximately $12 million and sought restraints against another 47 wallets believed to be connected to money laundering through Xinbi and vendors serving scam operators.
The two seized wallets were used by Xinbi to collect payments for vendors operating through its marketplace. Combined with the other restraints, the operation placed more than $52 million in crypto beyond the reach of Xinbi and its vendor network, according to the DOJ.
Tether assisted investigators with the operation, the department said. The stablecoin issuer had separately frozen $39.3 million in USDT across 10 Tron addresses linked to Xinbi earlier this week, crypto.news previously reported.
US seizes Xinbi wallets and Telegram channels
Court action against Xinbi extended beyond its cryptocurrency infrastructure.
On Sept. 7, the US District Court for the District of Columbia authorized the seizure of Telegram channels hosting the marketplace. A subsequently unsealed warrant described Xinbi as a Chinese-language marketplace where vendors advertised services to operators of scam centers.
According to the DOJ, the services included laundering money stolen through wire fraud, building custom websites for fraudulent investment schemes and recruiting workers for scam compounds in Southeast Asia.
Xinbi served as an intermediary in transactions between vendors and their customers. The marketplace held funds intended for vendors until the purchased services had been delivered, providing an escrow system for transactions arranged through the platform.
Investigators said funds belonging to US victims were traced to specific vendors that advertised money laundering services and posted cryptocurrency addresses for payments in Xinbi’s Telegram channels.
The enforcement action came after Xinbi continued operating despite previous attempts to remove its communications infrastructure. Telegram removed thousands of channels connected to Xinbi and Huione Guarantee in May 2025, but TRM Labs found that both networks began resurfacing under new channels and names soon afterward.
Xinbi subsequently moved parts of its operation away from Telegram as scrutiny of guarantee marketplaces increased.
Treasury sanctions Xinbi Guarantee and two technology providers
Alongside the DOJ operation, the US Treasury Department’s Office of Foreign Assets Control designated Xinbi as a significant transnational criminal organization.
OFAC described the marketplace as a service connecting transnational criminal groups and scam center operators with merchants providing technology, financial services and other products used in cybercrime.
Treasury data put the value of digital asset and fiat transactions processed through Xinbi and its associated platforms at more than $24 billion since the marketplace emerged around 2022. Much of the activity took place in Southeast Asia.
Earlier estimates had put Xinbi’s transaction volume lower as blockchain investigators identified more addresses tied to the operation. TRM Labs estimated in February that Xinbi had processed approximately $17.9 billion since mid-2025 as activity continued despite enforcement against Telegram-based marketplaces.
OFAC said Xinbi’s platform has been used by North Korean hackers and several previously sanctioned entities, including companies linked to Cambodia’s Prince Group.
US prosecutors have accused Prince Group and its chairman, Chen Zhi, of operating a network involving crypto investment fraud, money laundering and forced-labor scam compounds. Authorities previously sought forfeiture of more than 127,000 Bitcoin connected to Chen and his associates in a case that involved one of the largest Bitcoin seizure actions pursued by US authorities.
Prince Group has denied allegations against the company.
SafeW and Anwen sanctioned over Xinbi services
OFAC sanctioned two technology companies accused of providing services that supported Xinbi’s operations.
Singapore-based SafeW Technology developed SafeW, an encrypted messaging application that Xinbi began using for its merchant and money laundering networks around June 2025, according to the Treasury.
The move came as law enforcement attention on Xinbi increased. Users were encouraged to use SafeW to coordinate transactions between buyers and sellers, reducing the marketplace’s reliance on Telegram.
Cambodia-based Anwen Technology developed XinbiPay, which was also known as NewPay. Treasury described the product as a cryptocurrency payment and digital wallet application used by Xinbi.
TRM Labs had previously documented Xinbi’s move toward SafeW and XinbiPay as the marketplace rebuilt its infrastructure following disruptions to Telegram channels. On-chain data reviewed by the blockchain intelligence company showed a brief drop in Xinbi activity in December 2025 before transaction flows rebounded in early 2026.
OFAC designated SafeW Technology and Anwen for materially assisting or providing financial, technological or other support to Xinbi.
The sanctions require property and interests belonging to the three designated entities that are in the United States or controlled by US persons to be blocked and reported to OFAC. Entities owned 50% or more by blocked persons are subject to the same restrictions.
Transactions involving their property are generally prohibited for US persons unless exempt or authorized by OFAC.
Xinbi expanded after pressure on rival marketplaces
Xinbi’s development into a major guarantee marketplace accelerated as authorities and technology companies targeted other networks used by Southeast Asian scam operations.
Blockchain investigators have described guarantee marketplaces as escrow-based platforms where merchants advertise services ranging from money laundering and payment processing to stolen information and infrastructure used by online scammers.
Huione Guarantee, later known as Haowang Guarantee, had become one of the largest networks operating under the model before Telegram shut down its marketplace in May 2025.
Treasury said cybercriminals moved parts of their activity toward Xinbi after US authorities targeted Huione Pay. Xinbi continued offering similar services to an overlapping customer base.
The UK had already targeted Xinbi on March 26, when the government sanctioned the marketplace over its alleged role in scam and money laundering operations. The restrictions froze assets connected to Xinbi in the UK and cut designated parties off from the country’s financial system.
The latest DOJ operation formed part of the Scam Center Strike Force’s campaign against networks supporting overseas scam compounds. The unit was launched in November 2025 to investigate cryptocurrency investment fraud, cyber-enabled fraud, human trafficking and money laundering tied to scam centers.
According to the DOJ, the Strike Force has now restrained approximately $938 million linked to scam money laundering operations.
Its work has expanded outside Southeast Asia. A Strike Force team recently spent two weeks in Madagascar assisting local authorities with the takedown of 13 scam centers allegedly operated by Chinese organized crime groups.
Investigators helped process more than 3,200 electronic devices recovered during the operation and interviewed people among nearly 400 arrests. The DOJ said approximately 30 of those arrested were Chinese leaders of the scam compounds who were later repatriated to China by the Chinese government.
