ZachXBT asked UPay a simple question in public this week: why does it look like the company let a sanctioned criminal marketplace put its brand on a Visa crypto card?
A day later, UPay’s chief executive answered. Owen Yang said he had never opened the private message ZachXBT sent first and that the company has started an internal investigation.
The exchange took place on X on October 2, 2026. ZachXBT, a blockchain investigator, asked UPay to clarify why it appeared the company “potentially allowed Xinbi (sanctioned illicit marketplace) to whitelabel its Visa crypto card with you,” noting he had received no reply to a direct message. He described Xinbi as having primarily supported pig butchering, fraud, money laundering, and human trafficking, and attached what appeared to be a card and a TRM Labs research page on the marketplace.
Owen Yang, UPay’s chief executive, replied, “Yeah I found I didn’t open the chat before that why no notification for your message at very beginning. We already started internal investigation. Will update soon.”
What Has and Has Not Been Established
ZachXBT framed his post as a question rather than a finding, and that distinction matters. Nothing published so far establishes that Xinbi issued or launched a card or that UPay knowingly provided services to it.
What is established is that UPay offers the kind of service described. Its public materials advertise crypto payment cards along with white-label and API card issuance, which is the arrangement under which one company’s cards are sold under another company’s brand.
Yang’s reply does not confirm a relationship with Xinbi, deny one, or say what the investigation covers. It commits only to an update.
Visa has not commented publicly. Card issuance typically runs through a chain of a network, an issuing bank, a program manager, and the branded front end, so which party held which obligations would need establishing before anyone’s exposure is clear.
Who Xinbi Is
The sanctions are not in dispute. The US Treasury’s Office of Foreign Assets Control designated Xinbi Guarantee on September 9, 2026, as a significant transnational criminal organization, describing it as a Chinese-language platform used extensively by Chinese cybercriminals to run an illicit online marketplace supporting cyber scams, fraud, and money laundering targeting Americans.
Blockchain intelligence firm TRM Labs puts its throughput higher, at more than $36 billion since around 2022, including $17 billion in inflows, and notes it expanded as enforcement pushed rivals including Huione and Haowang out of the market.
TRM describes Xinbi as running an escrow-backed marketplace connecting scam syndicates with vendors selling stolen data, fake identity documents, deepfake tools, and cash-out services, settling primarily in USDT on TRON. Xinbi’s SDN listing included 52 cryptocurrency addresses, all on TRON.
Two affiliated developers were designated alongside it: Anwen Technology Co., Ltd., which OFAC identifies as the Cambodia-based developer of the XinbiPay wallet, also marketed as NewPay, and SafeW Technology Co., Ltd., the Singapore-based developer of the SafeW messaging app. Telegram banned Xinbi the same day.
The UK’s Foreign, Commonwealth and Development Office sanctioned Xinbi in March 2026, six months before the US action.
Xinbi operates as a guarantee marketplace—a platform that acts as an escrow between criminal service providers and their customers, holding funds until both sides confirm delivery. TRM Labs has described it as among the largest and most resilient such platforms, noting its ability to absorb enforcement pressure and continue operating.
Why the Question Matters
A designation under OFAC blocks US persons from dealing with the named entity and exposes non-US firms that transact with it to secondary consequences, including loss of access to the US financial system.
For a payments company, the question is not only whether it dealt with a sanctioned entity directly but also whether its infrastructure was used by one. White-label arrangements make that harder to see, because the customer-facing brand is not the company operating the program.
That is the gap ZachXBT’s question points at, and the one UPay’s investigation would have to close.
Also Read: India’s Jaipur Police Arrest 2 in ₹100 Crore Crypto Investment Scam
