1. What Washington did on 9 September

On 9 September 2026 the Treasury's Office of Foreign Assets Control (OFAC) designated Xinbi Guarantee as a "significant transnational criminal organization" under Executive Order 13581. Treasury describes it as a Chinese-language online marketplace that cybercriminals use for scams, fraud and money laundering, and that "serves as a central node connecting transnational criminal syndicates" with merchants offering financial services, technology and other goods.

Two companies were designated with it for allegedly giving it material support. One is Anwen Technology Co., Ltd, a Cambodian company that Treasury says developed XinbiPay, also called the NewPay wallet. The other is SafeW Technology Co., Ltd, a Singaporean company that developed SafeW, an encrypted messaging app. Treasury says Xinbi began moving its merchants and laundering networks to SafeW around June 2025. TRM Labs reports that the sanctions list entry includes 52 addresses, all on the TRON blockchain.

The money moved first. Elliptic, a London-based blockchain analytics firm, says it worked with the US Secret Service to identify 52 wallets belonging to the marketplace and its merchants, and that freezing began at 8am UTC on 8 September. The wallets held $52.8m in USDT. The Justice Department says the federal court in Washington authorised the seizure of the Telegram channels hosting the marketplace on 7 September. Its Scam Center Strike Force seized two wallets holding about $12m that Xinbi used to collect payments for vendors, sought to restrain 47 more, and says it restrained more than $52m from Xinbi and its vendor network in total. The department thanked Tether for its assistance; The Record reports the seizure was made with Tether's cooperation.

The Strike Force, launched in November 2025, has now restrained about $938m in crypto from scam schemes, according to the Justice Department. In the same release it said a team deployed to Madagascar for two weeks had supported local authorities in taking down 13 scam centres run by Chinese organised crime syndicates. Nearly 400 people were arrested, and about 30 Chinese leaders of the compounds were repatriated to China.

2. What a guarantee marketplace is

The "guarantee" (danbao) markets are Chinese-language bazaars that run mostly inside Telegram groups and channels. Their core product is trust between criminals who do not know each other. The platform acts as escrow: according to the Justice Department, Xinbi holds the buyer's payment until the vendor completes the service. Elliptic described Huione Guarantee in 2024 as a guarantor or escrow provider for all transactions. Payment is mainly in USDT on TRON.

What is sold has been documented in Elliptic's reports and in government releases. Laundering services are the largest category. The Justice Department's seizure warrant alleges that Xinbi vendors also built custom fake investment websites for scammers and recruited trafficking victims for the compounds. Other listings include databases of stolen personal data used to pick victims, fake identity documents and satellite internet equipment of the kind used by scam compounds. Elliptic's 2024 report on Huione Guarantee found listings for electric shock shackles. Its 2025 report on Xinbi found vendors offering to stalk and intimidate people in China, and a significant number apparently engaged in sex trafficking, with victims as young as 14.

3. Huione: the template

Elliptic exposed Huione Guarantee on 9 July 2024, putting its volume at over $11bn since 2021. The market belonged to Huione Group, a Cambodian conglomerate whose payment arm, Huione Pay, counted among its directors Hun To, a cousin of Prime Minister Hun Manet. Huione Pay told Reuters in 2024 that his role did not include day-to-day oversight, according to OCCRP. Elliptic found that one of the group's own subsidiaries acted as a merchant on the market, offering to handle scam proceeds.

The US response came through its anti-money-laundering powers rather than sanctions at first. On 1 May 2025 FinCEN found Huione Group to be of "primary money laundering concern" under section 311 of the USA PATRIOT Act. It said the group laundered at least $4bn of illicit proceeds between August 2021 and January 2025, including at least $37m from North Korean cyber heists. The final rule, announced on 14 October 2025, bars US banks from keeping correspondent accounts for Huione or processing its transactions through foreign banks' accounts.

Huione had changed the market's name before any US action. In autumn 2024 it rebranded the market Haowang Guarantee (Elliptic dates this to September, FinCEN to October) and launched its own stablecoin, USDH. In December 2024 it took a 30% stake in a rival, Tudou Guarantee, according to Elliptic.

4. Telegram's ban, and where the trade went

On 13 May 2025, less than two weeks after FinCEN's finding, Telegram removed thousands of channels and accounts linked to Haowang and Xinbi. Telegram confirmed the enforcement to Wired, Decrypt reported. Haowang posted a notice on its website saying it would "cease operation from now". Elliptic's co-founder Tom Robinson called it "a huge win".

It did not last. Elliptic says Tudou's user base more than doubled within weeks of Huione's closure, and its volumes approached Huione's peak. FinCEN's June 2026 filing says Haowang's customers were redirected to Tudou. Tudou itself wound down in January 2026, after more than $12bn in transactions, in the days after Chen Zhi, chairman of the sanctioned Prince Group, was arrested and sent to China. Elliptic links the two events through on-chain activity; it has not shown that Chen controlled Tudou.

Xinbi was the main winner. TRM Labs says Huione and Haowang volumes fell by nearly 100% after the Telegram ban and Tudou's by about 74% before it closed, while Xinbi's daily inflows nearly doubled between 12 May and 22 December 2025. Elliptic now says Telegram later refused to close Xinbi despite clear evidence of illicit activity; The Record reports that Telegram did not act against Xinbi despite researchers' pleas. Telegram did not respond to that criticism in any source we found. Xinbi's main channel was offline on 9 September, but the reporting differs on who acted: TRM and Elliptic say Telegram banned or deleted it, while the Justice Department says a court authorised the channels' seizure. Neither the department's release nor any report we found includes a statement from Telegram.

5. Xinbi: a Colorado company, a Myanmar shop, its own app

Xinbi's paperwork is surprisingly American. Elliptic found that "Xinbi Co., Ltd" was incorporated in Colorado in August 2022, describing itself as an "investment and capital guarantee group company", and was marked delinquent in January 2025 for failing to file a report. Its operations, according to TRM Labs, are likely in the Golden Triangle where Myanmar, Thailand and Laos meet. Elliptic says Xinbi announced a physical store in Yatai New City in Myanmar in June 2025, and that the complex was raided by Myanmar's military late that year

Elliptic tied the market to North Korea in its May 2025 report: on 12 November 2024, about $220,000 in USDT from the $235m theft at the exchange WazirX, which Elliptic and others attribute to North Korean hackers, reached Xinbi addresses. Treasury says Xinbi was also used by entities it had already sanctioned, including Jin Bei Group and companies in the Prince Group network.

6. The customers: scam compounds

The guarantee markets exist because of the scam compounds of Southeast Asia, where trafficked workers are forced to run romance and fake-investment frauds. A UNODC report in April 2025 estimated that hundreds of industrial-scale scam centres generate just under $40bn in annual profits, according to the Associated Press. The Justice Department said in November 2025 that recent reporting put losses to Americans at nearly $10bn a year. The FBI's Internet Crime Complaint Center recorded 181,565 cryptocurrency-related complaints in 2025, with losses of about $11.4bn.

The compounds and the markets are linked in official records. The UK's March 2026 package sanctioned Xinbi alongside Legend Innovation Co., which it says operates #8 Park, believed to be Cambodia's largest scam compound with room for 20,000 trafficked workers. FinCEN says a Huione Pay branch inside #8 Park was replaced by H-Pay, reportedly made the compound's mandatory payment platform. In October 2025, US prosecutors in Brooklyn indicted Chen Zhi, alleging that Prince Group compounds in Cambodia worked as violent forced labour camps, and filed to forfeit about 127,271 bitcoin, then worth about $15bn.

Cambodia has since acted at home. The UK government cites Cambodian estimates of 2,500 sites raided. Li Xiong, chairman of Huione Group, was extradited to China on 1 April 2026, where state media say he faces charges including fraud and handling the proceeds of crime. OCCRP notes those charges are unproven. Depositors were also caught up: AFP reported in April that dozens of Chinese nationals protested outside Cambodia's central bank over H-Pay accounts frozen since December.

7. The chokepoints: Tether, Telegram and Treasury

The record shows three points where pressure works. The first is the stablecoin. USDT can be frozen by its issuer, Tether, and most guarantee-market trade settles in it. In September 2026 the analytics firm MistTrack separately reported a Tether freeze of $39.27m across ten TRON addresses linked to Xinbi; Tether did not say why. How that relates to Elliptic's $52.8m in 52 wallets, or to the Justice Department's two seized and 47 restrained wallets, is not clear from public sources.

Xinbi's reaction shows the limits. Its administrators said on Telegram that the market "strongly condemns Tether's arbitrary freezing of addresses", The Record reported, and Decrypt reports that it promised to compensate customers. Within hours it swapped about $2.8m into USDD, a TRON-based stablecoin without USDT's freezing function. Elliptic notes that USDD is partly backed by USDT, so it is not fully out of reach. Bitrace later reported that a newly activated Xinbi business address was frozen again, but only after 1.8m USDT had left it, leaving 37,839 USDT caught.

The second chokepoint is the messaging platform, and the third is the legal system's reach into the companies behind it. FinCEN's June 2026 proposal shows the problem: after Huione Pay lost its licence, FinCEN says H-Pay took over its branches and signage, and it now wants the rule to cover any "successor entity". Treasury's Xinbi package follows the same logic by naming the companies behind the replacement app and wallet, not just the marketplace.

8. ZachXBT's question: the card layer

The newest thread came from ZachXBT, the pseudonymous on-chain investigator. On 2 October he asked the crypto payment company UPay on X to "clarify why it looks like your company UPay potentially allowed Xinbi (sanctioned illicit marketplace) to whitelabel its Visa crypto card with you", attaching what appeared to be an image of a card, Crypto Times reported. He said he had received no reply to a direct message.

UPay's chief executive, Owen Yang, replied that he had not opened the earlier message and wrote, according to Crypto Times: "We already started internal investigation. Will update soon." He neither confirmed nor denied any relationship. Visa has not commented publicly. Nothing published so far shows that Xinbi issued a card, or that UPay knowingly served it. UPay does advertise white-label card issuance, the type of service ZachXBT described.

The question matters because cards are the one place where crypto meets the regulated payment networks directly. A sanctioned marketplace that can put USDT on a card used in shops would not need Telegram at all.


9. Le Détroit's analysis

What is established: Xinbi is under US and UK sanctions; US authorities froze or seized tens of millions of dollars in USDT held by Xinbi and its vendors; Huione is cut off from the US financial system and its chairman was extradited to China in April; Tudou has stopped trading through its public groups. What is alleged: that these markets knowingly served scam compounds, North Korean hackers and traffickers, which rests on government findings and analytics firms' tracing rather than court verdicts.

The weak spots remain the same. Stablecoin freezes work only on assets still sitting in a freezable token, and money moves fast, as the Bitrace figures show. Platforms act under pressure rather than by default. And the sums dwarf the recoveries: $52.8m frozen against a market Elliptic sizes at $24bn. The next tests are whether Xinbi rebuilds and relaunches, as Robinson told The Record it is likely to try, and whether regulators follow the money onto cards and wallets.