The Justice Department has seized the Telegram channels that hosted Xinbi Guarantee, a Chinese-language marketplace where vendors sold services to scam operations. Roughly $52 million in cryptocurrency was restrained in one day.
The action explains a sequence that has been visible on-chain since Monday. The Crypto Times reported on September 8 that Tether had frozen roughly 39.27 million USDT across ten Tron addresses linked to Xinbi; the Strike Force’s announcement thanks Tether for proactive assistance in the investigation.
US Attorney Jeanine Ferris Pirro announced the actions on September 9, taken by the Department of Justice’s Scam Center Strike Force alongside the Treasury Department, with the US District Court for the District of Columbia authorizing the channel seizures on September 7.
What Xinbi Sold
According to the unsealed seizure warrant, Xinbi operated primarily in Chinese on Telegram as a marketplace where vendors advertised services to scam center operators.
Those services included building custom scam investment websites, laundering money obtained from wire fraud victims, and soliciting trafficking victims to work in scam compounds in Southeast Asia.
The organization’s function was escrow. When a scammer purchased a service, Xinbi held the payment until the vendor completed the work, giving buyers assurance that vendors would perform. The warrant alleges numerous instances in which US victims’ funds were traced to specific vendors advertising laundering services on the channel, with payment wallets posted publicly.
The Wallets
Under the same warrant, the Strike Force seized two cryptocurrency wallets Xinbi used to collect vendor payments, holding approximately $12 million between them.
Law enforcement also sought restraint of 47 further wallets believed to be associated with laundering across Xinbi’s network and with vendors who had worked for scammers. The combined effect was more than $52 million restrained in a day, bringing the Strike Force’s cumulative total to roughly $938 million.
OFAC Designates Xinbi and Two App Developers
Treasury’s Office of Foreign Assets Control designated Xinbi Guarantee as a significant transnational criminal organization, saying the marketplace has processed the equivalent of over $24 billion in digital assets and fiat currency since its inception around 2022, primarily across Southeast Asia.
The designation describes Xinbi as a central node connecting scam center operators with merchants supplying financial services, technology, and other goods, providing escrow through its platform. Treasury says it has reportedly been used by North Korean hackers and by several already-designated entities, including Jin Bei Group and parts of the Prince Group transnational criminal organization.
Two enablers were designated alongside it. Around June 2025, in response to growing law enforcement scrutiny, Xinbi began migrating its merchant and money-laundering networks to SafeW, an end-to-end encrypted messaging application developed by Singapore-based SafeW Technology Co., Ltd. At the same time, it launched XinbiPay, also known as NewPay, a cryptocurrency payment and wallet application built by Cambodia-based Anwen Technology Co., Ltd. Both companies were designated for materially supporting Xinbi.
The action was taken under Executive Order 13581 as amended by Executive Order 13863, in furtherance of Executive Order 14390 of March 6, 2026. All property and interests in property of the three entities within US jurisdiction are blocked and must be reported.
Xinbi Grew Because Huione Was Shut Down
Treasury states plainly why the marketplace scaled. After FinCEN listed Huione Pay as a financial institution of primary money laundering concern in October 2025, cybercriminals attempted to preserve their operations by moving activity to Xinbi, which continued offering substantially similar services to an overlapping customer base.
The same pattern has repeated within Xinbi’s own history. Telegram removed it in May 2025, and it resurfaced under the same name with a 90% rise in daily crypto flow. The UK’s Foreign, Commonwealth and Development Office sanctioned it in March, citing more than $19.9 billion in transactions, after which it moved to SafeW and launched its own payment tool.
Treasury frames today’s action as complementing that UK designation rather than as a standalone move.
The On-Chain Aftermath
The freezes have not ended the activity. Blockchain analytics firm Bitrace reported that a replacement Xinbi business address activated on September 8 was frozen again, but that 1.8 million USDT had already moved out, with only 37,839 USDT caught.
Bitrace said the address subsequently began testing incoming and outgoing USDD transfers and that funds were being routed through JustLend, converting between stablecoins in a way that lengthens the on-chain trail. It also said the laundering path matched one used by a merchant group in an earlier theft from Gate, suggesting shared infrastructure between Xinbi and its vendors.
Madagascar
Pirro also announced that the Strike Force is expanding beyond Southeast Asia and that a team deployed to Madagascar for two weeks to assist local authorities.
Treasury Secretary Scott Bessent said scam centers in Southeast Asia steal billions of dollars from American victims each year and that the Treasury would continue using its tools to disrupt the networks behind the fraud.
That operation resulted in the takedown of 13 scam centers operated by Chinese organized crime syndicates. The team helped process more than 3,200 electronic devices, and investigators have opened their own cases based on interviews with nearly 400 arrestees. Approximately 30 of those were Chinese leaders of the compounds and were repatriated to China by the Chinese government.
The Scale of the Underlying Fraud
The Strike Force was launched in November 2025 to address Chinese organized crime syndicates running scam centers, targeting cryptocurrency investment fraud, cyber-enabled fraud, human trafficking, and money laundering.
FBI figures give the scale. Cyber-enabled fraud accounted for almost 85% of all losses reported to the Internet Crime Complaint Center during 2025. Reported losses from cryptocurrency investment fraud rose from $4.57 billion in 2023 to $8.65 billion in 2025, an increase of 89%—figures the Justice Department says are likely understate real losses, since most victims never report.
President Trump signed an executive order on March 6, 2026, directing the administration to prioritize cybercrime and fraud schemes targeting American savings.
The Strike Force is directed by Assistant US Attorney Karen P. Seifert and includes the FBI, Secret Service, Postal Inspection Service, IRS Criminal Investigation, and Homeland Security Investigations, alongside US Attorney’s Offices in Alaska, Hawaii, Rhode Island, and Western Washington. It announced a joint alliance with UK prosecutors and the National Crime Agency on September 3.
