US disrupts Xinbi Guarantee marketplace fueling the cyber scam economy
The U.S. government took action on Wednesday against a Telegram-based illicit marketplace facilitating billions of dollars in transactions connected to cyber scams, money laundering, human trafficking and other crime.
The Treasury Department announced sanctions on the Chinese-language platform, Xinbi Guarantee, and two businesses it accused of supporting the marketplace’s operations. The government also carried out a seizure of $52.8 million from 52 wallets connected to the platform. The sanctions follow a similar designation by the U.K. in March.
Xinbi’s main Telegram channel was no longer available on Wednesday and many associated usernames appeared to have been deactivated. According to a DOJ release, a district court on Monday authorized the seizure of Telegram channels hosting the marketplace.
“Yesterday, my office issued a signed warrant to seize the Telegram channels where these vendors conduct their business and hawk their service to scammers,” Jeanine Pirro, U.S. attorney for the District of Columbia, said at a press conference on Wednesday.
Created in 2022, Xinbi has processed at least $24 billion in transactions, making it the second-largest illicit online marketplace in history, according to the blockchain intelligence firm Elliptic, which helped the Secret Service to carry out the wallet seizures. It is a cornerstone of the cybercrime landscape in Southeast Asia, offering an array of services to carry out pig butchering and other scams.
Vendors use its channels to offer everything from money laundering services to stolen personal data to deepfake technology, with all payments made through the platform in Tether’s USDT stablecoin. The marketplace acts as an escrow service, guaranteeing that providers are paid for their services.
Xinbi grew out of the takedown by Telegram of Huione Guarantee following international pressure, which saw $31 billion in activity before it closed down. Despite pleas by researchers for Telegram to take action against Xinbi as well, it did not, and criminals gravitated to it.
According to the cyber intelligence company DarkTower, as of last week there were more than 4,600 crime-as-a-service vendors on the platform.
The actions against Xinbi were performed by the DOJ’s Scam Center Task Force — an interagency effort created last November to crack down on cyber scams carried out largely by Chinese organized crime groups based in Southeast Asia. With Tether’s cooperation, it seized two cryptocurrency wallets holding $12 million used to collect vendor payments, as well as dozens of others allegedly associated with money laundering and other scamming activity.
According to Elliptic, Xinbi administrators responded to Tether’s freezing of the funds by announcing that it would be moving to USDD, a stablecoin operating on the TRON blockchain that is harder to seize.
“Xinbi strongly condemns Tether's arbitrary freezing of addresses,” they told users in a Telegram post. “The process of unlocking large amounts of USDT and ensuring compliance is far more difficult and lengthy than anticipated, and we are deeply saddened and frustrated.”
Elliptic cofounder Tom Robinson told The Record he expects the platform to try to adapt.
“It's likely that Xinbi will try to rebuild and relaunch, but it will be very challenging in the face of these sanctions,” he said.
The Treasury Department also went after two entities it accuses of assisting Xinbi’s operations — Anwen Technology, the Cambodia-based developer of a cryptocurrency payment app called XinbiPay, and SafeW Technology Co., maker of an encrypted messaging application allegedly used by Xinbi’s money-laundering and merchant networks.
While announcing the actions against Xinbi Guarantee, the DOJ said its strike force would “expand its scope to attack scam compounds globally” and had recently deployed a team to Madagascar to work with local law enforcement. The operation resulted in the takedown of 13 scam centers operated by Chinese organized crime syndicates and arrests of dozens of alleged leaders, who according to Pirro were “interestingly quickly repatriated to China.”
Jonathan Greig contributed to this story.
References in this story
- Treasury Cracks Down on Transnational Criminal Organization Behind Cyber Scam Operations Targeting Americans home.treasury.gov **WASHINGTON** — Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Transnational Criminal Organization (TCO) **Xinbi Guarantee**, a Chinese-language platform used…
- UK crackdown on vile scam centres steps up with sanctions on illicit crypto network www.gov.uk The UK has taken further action against a network that operates illegal scam centres across Southeast Asia.
- www.justice.gov
- Elliptic helps the U.S. Secret Service freeze $52.8 million Xinbi scam marketplace assets | Elliptic www.elliptic.co Elliptic worked with the U.S. Secret Service to freeze $52.8 million in cryptoassets linked to Xinbi Guarantee, the second-largest illicit marketplace ever.
- US wants to cut off key player in Southeast Asian cybercrime industry therecord.media The Treasury Department issued the proposed rulemaking Thursday, stating that Huione Group has helped launder funds from North Korean state-backed cybercrime operations and investment scams originating in Southeast Asia.
- DarkTower reviews 4,693 criminal vendors at Xin Bi | Gary Warner www.linkedin.com In August 2025, DarkTower evaluated eight major Chinese-language Telegram-based "Guarantee Syndicates" and found that they had 8,800 "Crime-as-a-Service" vendors. Xin Bi (New Coin) is the largest active Guarantee…
- US announces ‘strike force’ to counter Southeast Asian cyber scams, sanctions Myanmar armed group therecord.media The U.S. is establishing a "strike force" to counter cyber scam compounds across Southeast Asia that have stolen billions from Americans over the last five years.
- Advanced Cyber Threat Intelligence | Recorded Future www.recordedfuture.com Get real-time, actionable cyber threat intelligence with Recorded Future. Mitigate cyber risks, prioritize threats, and proactively secure your organization.
- Advanced Cyber Threat Intelligence | Recorded Future www.recordedfuture.com Get real-time, actionable cyber threat intelligence with Recorded Future. Mitigate cyber risks, prioritize threats, and proactively secure your organization.
- James Reddick (@jredd66) on X twitter.com Audio and print journalist in Boston. Currently editing @therecord_media. Bylines: @capradio @mmfa @snapjudgment Previously in Cambodia @phnompenhpost
