U.S. Seizes $52.8 Million in Crypto and Disrupts Xinbi Guarantee Scam Marketplace

U.S. authorities have taken coordinated action against Xinbi Guarantee, a Telegram-based criminal marketplace accused of providing infrastructure and services to online scam operations around the world.

The operation resulted in the seizure and freezing of approximately $52.8 million in cryptocurrency linked to 52 wallets, the disruption of Telegram channels associated with Xinbi, and sanctions targeting entities connected to the marketplace.

Investigators say Xinbi has become a major component of the cybercrime economy, providing services that allow criminal groups to operate large-scale investment scams, launder stolen cryptocurrency, obtain victim data and recruit workers for scam compounds.

What Is Xinbi Guarantee?

Xinbi Guarantee is an illicit marketplace that operates primarily through Telegram.

Rather than directly conducting every scam, the platform functions as an intermediary connecting scam operators with vendors offering specialized criminal services.

These services reportedly include:

• Cryptocurrency money laundering
• Stolen personal information
• Fake investment websites
• Communications infrastructure
• Fraud-related services
• Recruitment of workers for scam compounds
• Other crime-as-a-service offerings

Xinbi uses a guarantee or escrow-style model in which payments are held until a vendor completes an agreed service. This gives criminal buyers and sellers a degree of transactional trust despite operating outside the legitimate financial system.

Elliptic estimates that Xinbi and its merchants have processed at least $24 billion in cryptocurrency transactions since 2022, making it one of the largest illicit marketplaces identified to date.

$52.8 Million in Cryptocurrency Frozen

The U.S. Secret Service, working with blockchain intelligence company Elliptic, identified and froze cryptocurrency held in 52 wallets associated with Xinbi and its network of merchants.

The wallets contained approximately:

$52.8 million in cryptocurrency, primarily Tether's USDT stablecoin.

Two wallets used directly by Xinbi to collect vendor payments were also seized. Those wallets reportedly contained approximately $12 million.

The action demonstrates how blockchain transaction analysis can be used to trace cryptocurrency movements across criminal networks and identify wallets associated with illicit marketplaces.

Telegram Infrastructure Taken Down

The Justice Department also obtained authorization to seize Telegram channels used by Xinbi vendors to advertise their services.

Following the enforcement action, Xinbi's primary Telegram infrastructure became unavailable, while numerous usernames associated with the marketplace were also disabled.

The disruption is significant because Telegram has been a central communication and marketplace layer for the criminal ecosystem surrounding Xinbi.

By removing the communication infrastructure alongside financial assets, investigators targeted both the marketplace's operational and financial capabilities.

Xinbi's Role in Pig-Butchering Scams

One of Xinbi's most significant roles has been supporting cryptocurrency investment and romance scams, commonly referred to as pig-butchering operations.

These scams typically begin with attackers establishing contact with victims through:

• Social media
• Dating platforms
• Messaging applications
• Online communities

After establishing trust, criminals gradually introduce investment opportunities and direct victims toward fraudulent cryptocurrency platforms.

Victims may initially see fabricated profits displayed on fake investment websites. When they attempt to withdraw their money, scammers often demand additional payments for taxes, fees or account verification.

Xinbi provided infrastructure that helped these operations scale beyond individual scammers.

Criminal Services Offered Through the Marketplace

The marketplace effectively operated as a crime-as-a-service ecosystem.

Criminal groups could obtain specialized capabilities without developing every component themselves.

For example, an operator could purchase:

Service	Potential Criminal Use
Stolen personal data	Identifying and targeting potential victims
Fake investment websites	Operating fraudulent investment schemes
Money laundering	Moving and disguising stolen cryptocurrency
Communications services	Managing large-scale victim interactions
Scam infrastructure	Supporting fraudulent campaigns
Recruitment services	Obtaining workers for scam compounds

This specialization allows criminal organizations to operate more efficiently while reducing the technical expertise required by individual scam groups.

Xinbi Processed Billions in Crypto

According to Elliptic, Xinbi Guarantee began operating around 2022 and has processed at least $24 billion in transactions.

A related payment service known as Xinbi Pay, or XPay, has processed an additional estimated $6 billion.

The scale places Xinbi among the largest illicit marketplaces associated with online fraud.

The marketplace expanded after Telegram shut down Huione Guarantee and Tudou Guarantee, two related criminal marketplaces that previously served similar functions.

Huione Guarantee reportedly processed approximately $31 billion before its closure in 2025. Xinbi subsequently became a major destination for merchants and criminal customers from that ecosystem.

USDT Was the Marketplace's Primary Payment Method

Xinbi historically relied heavily on Tether's USDT stablecoin, particularly on the TRON blockchain.

Stablecoins are attractive to criminal networks because they can be transferred internationally without relying on conventional banking systems.

However, USDT also has an important characteristic for law enforcement: Tether can freeze specific addresses.

This capability played a central role in the latest operation.

The ability to identify the wallets associated with Xinbi and coordinate with the stablecoin issuer allowed authorities to prevent criminals from freely moving the targeted funds.

Xinbi Attempts to Move to USDD

Following the freezing of its USDT holdings, Xinbi reportedly attempted to move some of its remaining cryptocurrency into USDD, another dollar-pegged stablecoin.

Elliptic said approximately $2.8 million in USDT was exchanged for USDD through a decentralized exchange following the wallet freezes.

The move appears intended to reduce exposure to the type of centralized wallet-freezing mechanism available with USDT.

However, switching assets does not eliminate the blockchain trail associated with the transactions.

Elliptic also noted that USDD has exposure to USDT because part of its collateral consists of the Tether-issued stablecoin.

U.S. Treasury Sanctions Xinbi

The enforcement operation was accompanied by action from the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC).

Treasury accused Xinbi and associated entities of facilitating cyber scams, fraud, money laundering and other criminal activity affecting victims, including Americans.

U.S. officials emphasized that scam centers operating in Southeast Asia have become a major source of financial losses for American victims.

The sanctions add financial restrictions to the law-enforcement seizure, potentially making it more difficult for associated individuals and organizations to access the legitimate financial system.

Xinbi's marketplace has also faced international scrutiny. The United Kingdom sanctioned Xinbi in March 2026, citing its role in supplying services to scam centers.

Links to Other Criminal Organizations

U.S. authorities said Xinbi's infrastructure has been used by multiple criminal groups and sanctioned entities.

Reported users include:

• North Korean-linked actors
• Jin Bei Group-related entities
• Entities connected to the Prince Group transnational criminal organization
• Operators involved in Southeast Asian scam compounds

The connections demonstrate how criminal marketplaces can serve multiple independent groups simultaneously, creating a shared infrastructure layer for cybercrime and financial fraud.

Scam Center Strike Force Targets Madagascar Operations

The Justice Department also announced activity beyond the Xinbi marketplace itself.

The Scam Center Strike Force expanded its operations to Madagascar, where authorities disrupted 13 scam compounds reportedly operated by Chinese organized crime groups.

Investigators seized more than 3,200 electronic devices and opened investigations based on interviews with nearly 400 people who were arrested.

Approximately 30 individuals identified as Chinese leaders of scam compounds were reportedly repatriated to China.

The operation demonstrates the U.S. government's broader strategy of targeting not only online financial infrastructure but also the physical locations where large-scale scams are conducted.

Why the Operation Matters

The disruption could have a significant impact on the criminal ecosystem surrounding online scams.

Xinbi's business model depended heavily on trust between criminal participants.

Because participants cannot rely on courts or legitimate dispute-resolution systems, the marketplace's guarantee mechanism provided an alternative form of escrow.

The freezing of merchant wallets creates a new risk for criminal users: their funds may be identified and frozen even when they believe they are operating anonymously.

That uncertainty could undermine confidence in the marketplace and make it harder for vendors and scam operators to conduct transactions.

Blockchain Transparency Becomes a Law-Enforcement Tool

The operation also demonstrates the increasing importance of blockchain intelligence in cybercrime investigations.

Although cryptocurrency transactions can appear pseudonymous, public blockchains preserve transaction histories that investigators can analyze over long periods.

In this case, Elliptic said its researchers had tracked Xinbi's wallet infrastructure for years.

Investigators were able to map relationships between:

• Marketplace wallets
• Merchants
• Money-laundering services
• Scam operations
• Cryptocurrency transactions

That intelligence helped the Secret Service identify wallets that could subsequently be frozen.

Implications for Cryptocurrency Businesses

Cryptocurrency exchanges, stablecoin providers and other digital-asset businesses should consider the case a reminder of the importance of transaction monitoring.

Organizations should pay particular attention to:

• Wallets connected to sanctioned entities
• Rapid movement of funds between stablecoins
• High-risk transaction patterns
• Cryptocurrency flows associated with known scam infrastructure
• Repeated interactions with suspicious wallets
• Transactions involving illicit marketplaces
• Unusual cross-chain transfers

Blockchain analytics can help identify relationships that may not be visible through traditional customer-account monitoring alone.

What Users Should Watch For

Individuals should remain cautious when approached online with investment opportunities involving cryptocurrency.

Warning signs include:

• Strangers offering investment advice
• Romantic contacts recommending cryptocurrency investments
• Guaranteed or unusually high returns
• Pressure to transfer cryptocurrency quickly
• Requests to pay additional taxes or fees before withdrawing funds
• Investment platforms with no verifiable regulatory information
• Requests to transfer funds to unfamiliar wallets
• Customer-support accounts communicating exclusively through messaging applications

If someone believes they have been targeted by a cryptocurrency scam, preserving wallet addresses, transaction hashes, messages, websites and screenshots can help investigators trace the activity.

A Major Blow to the Scam Economy

The action against Xinbi Guarantee represents more than the seizure of cryptocurrency.

By targeting the marketplace's Telegram infrastructure, financial wallets and associated criminal ecosystem, U.S. authorities have attempted to disrupt the services that allow scam groups to operate at scale.

The operation also highlights an important advantage for investigators: criminal organizations may attempt to hide behind pseudonymous cryptocurrency addresses, but their transactions remain recorded on public blockchains.

For Xinbi, the combination of financial freezes and infrastructure disruption could significantly weaken the marketplace's role in the global scam economy.

As governments increasingly combine blockchain intelligence, sanctions, cryptocurrency seizures and international law-enforcement operations, illicit marketplaces that once appeared difficult to reach are facing growing pressure.

The latest action demonstrates that cryptocurrency may provide criminals with new ways to move money—but the digital trail they leave behind can also become a powerful tool for investigators.