The US Treasury’s Office of Foreign Assets Control has sanctioned Xinbi Guarantee, a Chinese-language marketplace that investigators say became a major hub for scam services and cryptocurrency laundering. The action, announced on September 9, targets what officials described as a key part of the financial infrastructure used to move illicit funds at scale.

In a parallel step, the US Justice Department said it seized about $12 million in cryptocurrency linked to Xinbi and helped restrain millions more. The measures follow earlier UK sanctions in March 2026 and focus on a network that researchers say processed more than $24 billion in digital assets and fiat currency since about 2022.

Treasury names wallets and related firms

OFAC identified 52 cryptocurrency wallet addresses associated with Xinbi that had received more than $8.4 billion in stablecoins. The Treasury action also sanctioned SafeW Technology and Anwen Technology, which were described as developers of messaging and crypto payment applications that supported Xinbi’s operations.

According to the source analysis, Xinbi operated through hundreds of Chinese-language Telegram channels where vendors advertised money-laundering services, scam website creation, stolen personal data and recruitment tied to scam compounds in Southeast Asia. The marketplace allegedly used an escrow model that held vendor deposits and managed payments, creating a trusted framework for criminal vendors and customers to transact.

Marketplace allegedly supported broad criminal services

Researchers said Xinbi’s vendor network covered much more than fund transfers. Services advertised across the ecosystem included cash delivery, bank card fraud, KYC bypass tools, scam platform development, surveillance equipment and malware offerings.

The article describes the platform as part of the infrastructure behind Southeast Asia’s scam economy. It says Chinese-language laundering services now account for an estimated 20% of known illicit crypto laundering over the past five years, including $16 billion in 2025, though those figures were presented as Chainalysis analysis rather than official government totals.

Investigators link DPRK-linked laundering to the network

The source says DPRK-linked actors moved tens of millions of dollars in stolen cryptocurrency through vendors operating on Xinbi, including funds tied to the Bybit breach and the WazirX theft. The laundering method described was based on substitution rather than direct obfuscation.

Under that model, so-called Black U launderers would take traceable stolen assets and replace them with stablecoins drawn from other illicit revenue streams, including pig butchering and romance scams. The article says that process made the original stolen funds harder to follow while giving the recipients stablecoins that appeared cleaner and could then be converted to fiat through unlicensed over-the-counter desks.

Seizures, restrained wallets and the next step

The Justice Department’s Scam Center Strike Force said the investigation traced funds stolen from US victims to vendors advertising laundering services on Xinbi. On September 7, a federal court authorized the seizure of Telegram channels hosting the marketplace. Authorities then seized two wallets containing roughly $12 million in cryptocurrency and restrained 47 additional wallets associated with Xinbi.

Combined with those restraints, more than $52 million in cryptocurrency tied to Xinbi and its wider network was disrupted, according to the source. Tether assisted law enforcement during the investigation. The latest confirmed steps are the OFAC sanctions, the seizure of the Telegram infrastructure and the ongoing restraint of wallets linked to the alleged marketplace network.

Source: www.chainalysis.com