United States authorities have restrained more than 52 million USD in cryptocurrency linked to Xinbi Guarantee and its vendor network in a coordinated operation against the scam marketplace, marking one of the most aggressive enforcement actions to date against the infrastructure behind industrial-scale fraud in Southeast Asia.
On Wednesday, the US Justice Department said its Scam Center Strike Force seized two wallets used by Xinbi to collect vendor payments containing about 12 million USD. Law enforcement also sought restraints against 47 additional wallets believed to be connected to money laundering across the marketplace’s network.
The DOJ said the US District Court for the District of Columbia authorized the seizure of Telegram channels hosting the marketplace on September 7. According to the unsealed warrant, vendors used the channels to advertise money laundering services, custom scam-investment websites and recruitment services for scam compounds in Southeast Asia.
Targeting the marketplace, not just the scammers
The operation targets the financial and communications infrastructure supporting scam centers, expanding enforcement beyond individual operators to the marketplaces and service providers that allow these networks to function. The DOJ credited stablecoin issuer Tether with assisting in the investigation.
The structure of the takedown matters. Rather than pursuing individual fraudsters, US authorities are going after the escrow layers, payment apps and communications channels that make large-scale scam operations possible, a playbook that mirrors the approach that dismantled the Huione ecosystem in 2025.
Treasury designates Xinbi as transnational criminal organization
In a coordinated action on Wednesday, the US Treasury Department’s Office of Foreign Assets Control designated Xinbi as a significant transnational criminal organization. OFAC also sanctioned Singapore-based SafeW Technology and Cambodia-based Anwen Technology for allegedly providing technological and financial support to the marketplace.
According to Treasury, Xinbi began moving its merchant and money-laundering networks to SafeW’s encrypted messaging application around June 2025 as law-enforcement scrutiny intensified. Anwen allegedly developed XinbiPay, also known as NewPay, a crypto wallet and payment application used by the marketplace.
OFAC sanctioned Xinbi for good reason, TRM Labs Global Head of Policy Ari Redbord told Cointelegraph. When Huione went down, Xinbi became the go-to escrow and cash-out layer for Southeast Asia’s scam compounds and did it at industrial scale, moving more than 36 billion USD, Redbord said.
Treasury said Xinbi has processed over 24 billion USD in crypto and fiat since around 2022, primarily through Southeast Asia. The department said the platform has been used by North Korean hackers and entities connected to the sanctioned Prince Group.
The sanctions block Xinbi’s US property and interests and generally prohibit US persons from transacting with the designated entities.
A pattern of escalating pressure
The latest US action follows UK sanctions imposed against Xinbi on March 26, when the British government moved to cut the platform off from crypto access, freezing UK assets connected to the marketplace and barring it from the country’s financial, trade and travel networks.
The operation also fits a broader enforcement trend. US and UK authorities launched a joint alliance targeting crypto scam centers earlier this year, and the Treasury Department’s own reporting has flagged tens of billions of dollars in proceeds flowing through overseas scam compounds. Tether, for its part, froze 39.3 million USD in USDT tied to Xinbi addresses on Tron earlier this month, an action that foreshadowed this week’s larger coordinated takedown.
For the crypto industry, the action is double-edged. Stablecoins remain the dominant rail for scam-center cash-outs, but issuers are increasingly positioned as indispensable partners for the very agencies pursuing those networks. The DOJ’s decision to credit Tether in its announcement underscores how enforcement now depends on cooperation from the companies operating the rails.
What comes next
With Telegram channels seized, wallets restrained and OFAC designations in place, the practical effect is to raise the cost of operating gray-market escrow platforms dramatically. The key question is whether Xinbi’s vendors and launderers simply migrate again, as they did from Huione to SafeW’s messaging app, or whether the simultaneous targeting of technology providers closes the exits.
Based on precedent, displacement is likely. But each cycle narrows the options available to scam operators, pushes them toward less liquid rails, and leaves a clearer evidentiary trail for the investigators who have made these marketplaces their priority.
Bitcoin traded around 77,100 USD, ether near 2,446 USD and solana around 100 USD at the time of writing.
going after the escrow and comms layers instead of individual scammers is the only approach that works. huione proved the playbook
agreed on the playbook but safew will just rebrand and keep going. cambodia isnt exactly rushing to arrest anyone over this
huione to safew in one quarter when the heat picked up. seize these channels and another telegram marketplace pops up before the paperwork clears
52 million restrained against 24 billion processed since 2022. rounding error for these guys, but taking the telegram channels and 47 wallets hurts more than the money
24 billion processed since 2022 and 52 million gets restrained. the wallets sting but the scam compounds have not slowed a single shift
they moved from Huione to SafeW messaging in june 2025 once heat picked up. expect the same vendor shuffle again in a few months
vendors migrate faster than warrants clear, safew to whatever comes next. still, losing the telegram channels breaks their escrow trust for a while
12m seized in two wallets and 47 more under restraint. someone running xinbi treasury is having a very bad quarter lol
52 million restrained against 24 billion processed since 2022. hitting the escrow and comms layer hurts them more than the money, thats the right target
tether assisted the investigation and somehow usdt is still the settlement rail for the scam payments in the first place. nobody finds that awkward?
the loop is the point though. tether freezes wallets when asked, which is more than you can say for the banking rails those compounds used for years
doj credits tether while usdt is the main cashout rail. funny loop we’re in
those two seized wallets alone held 12 mil and the other 47 are still just “sought” in court papers. the restraint paperwork moves slower than the vendors do lol