The U.S. Secret Service froze $52.8 million in cryptocurrency linked to Xinbi Guarantee on September 8, a Chinese-language marketplace that runs on Telegram and sells the tools scammers need to defraud people worldwide.
The government agents worked with Blockchain analytics firm Elliptic to identify and freeze the funds. “Elliptic has been tracking Xinbi and its wallet infrastructure for several years, and our intelligence directly enabled the freezing action, as well as the sanctions imposed on Xinbi today by the United States,” the company said today in a statement.
Fifty-two wallets were frozen beginning at 8am UTC on Sept 8, all holding USDT, Tether's dollar-pegged stablecoin. Two of those wallets, containing roughly $12 million, were seized outright under a warrant unsealed today by the Department of Justice. The rest were frozen pending further action.
A guarantee marketplace runs on trust between criminals, and crypto is a very popular payment method. Xinbi isn't a marketplace in the normal sense but more an escrow system where vendors post crypto deposits so operators trust they'll get what they paid for, from stolen personal data to the money-laundering services that turn stolen funds back into cash.
Buyers who feel cheated can be reimbursed from that deposit, which is the entire reason criminals use it instead of just trusting each other.
Since 2022, Xinbi and its merchants have processed at least $24 billion in transactions, according to Elliptic, making it the second-largest illicit online marketplace ever tracked. Only Huione Guarantee moved more, processing $31 billion before Telegram shut it down in May 2025 after years of exposure by Elliptic.
That came days after a separate Treasury finding that Huione's parent group was a primary money laundering concern. Xinbi absorbed much of that traffic once its predecessor vanished.
Much of the money that flows through platforms like this starts with "pig butchering," a scam where a stranger builds a fake romance or friendship online for weeks or months, then convinces the victim to pour savings into a bogus investment app that shows fabricated profits until the account is drained.
Treasury's Office of Foreign Assets Control—the Treasury unit that blocks assets tied to national security and crime threats—designated Xinbi as a transnational criminal organization on September 9, the same category used for drug cartels. Two more firms, Singapore-based SafeW Technology and Cambodia-based Anwen Technology, were sanctioned alongside it for supporting Xinbi's operations. The UK had already sanctioned Xinbi in March.
Xinbi didn't take the crypto freeze quietly. The marketplace posted a statement condemning the "arbitrary freezing" of its funds and promised to compensate its customers.
Xinbi seems to be shifting away from USDT toward USDD, a stablecoin launched by Tron founder Justin Sun that has no central issuer able to freeze wallets. It has already swapped about $2.8 million of its remaining USDT into USDD through a decentralized exchange.
There's just one problem. USDD markets itself as decentralized, but part of its own reserves are backed by USDT—the very asset with the freeze switch Xinbi is trying to escape.
Wednesday's action was part of a bigger day for the DOJ's Scam Center Strike Force, which also deployed agents to Madagascar to help local authorities take down 13 Chinese-run scam compounds and process evidence from nearly 400 arrestees, including more than 3,200 seized devices.
The Strike Force, launched in November 2025, has seized roughly $938 million in scam-linked cryptocurrency since it began operating—and Xinbi's outstanding balance is still on the board.
