The U.S. Secret Service froze $52.8 million in cryptocurrency tied to Xinbi Guarantee on Sept. 8, according to Decrypt. Xinbi is a Chinese-language marketplace that operates on Telegram and sells the tools and services scammers use to target victims around the world.
52 USDT wallets were frozen, with two seized under warrant
Government agents worked with blockchain analytics firm Elliptic to identify and freeze the funds. In a statement published the same day, Elliptic said: “Elliptic has been tracking Xinbi and its wallet infrastructure for several years, and our intelligence directly enabled the freezing action, as well as the sanctions imposed on Xinbi today by the United States.”
The freeze covered 52 wallets starting at 8:00 UTC on Sept. 8. All of them held USDT, Tether’s dollar-pegged stablecoin. Two of those wallets, containing roughly $12 million, were seized outright under a warrant unsealed by the Department of Justice on Wednesday. The remaining wallets were frozen pending further action.
Xinbi functioned as a criminal escrow and guarantee system
The report describes guarantee marketplaces as systems built on trust between criminals, with crypto used as a common payment rail. Xinbi was not a marketplace in the ordinary retail sense. It operated more like an escrow structure in which vendors posted crypto deposits so operators could trust that purchases would be fulfilled. Those purchases ranged from stolen personal data to money-laundering services designed to turn stolen funds back into cash.
When buyers believed they had been cheated, they could be reimbursed from those deposits. That mechanism, the report said, is why criminals use the system instead of relying only on direct trust with one another.
Elliptic says Xinbi processed at least $24 billion since 2022
Elliptic said Xinbi and its merchants have processed at least $24 billion in transactions since 2022. That made it the second-largest illicit online marketplace ever tracked by the firm. Only Huione Guarantee handled more, with $31 billion processed before Telegram shut it down in May 2025 after years of exposure by Elliptic.
The report added that the shutdown came days after a separate Treasury finding that Huione’s parent group was a primary money laundering concern. After that earlier platform disappeared, Xinbi absorbed much of the traffic, according to the report.
Funds on the platform often trace back to pig-butchering scams
A large share of the money moving through platforms like Xinbi begins with pig-butchering scams, the report said. In those schemes, a stranger spends weeks or months building a fake friendship or romantic relationship online, then persuades the victim to put savings into a fraudulent investment app. The app displays fabricated profits until the account is emptied.
OFAC designated Xinbi as a transnational criminal organization
The Treasury Department’s Office of Foreign Assets Control, the agency unit that blocks assets tied to national security and criminal threats, designated Xinbi as a transnational criminal organization on Sept. 9. The report noted that the same category is used for drug cartels. Two additional firms were sanctioned alongside it: Singapore-based SafeW Technology and Cambodia-based Anwen Technology, both accused of supporting Xinbi’s operations. The United Kingdom had already sanctioned Xinbi in March.
Xinbi responded publicly after the freeze. The marketplace posted a statement condemning the “arbitrary freezing” of its funds and said it would compensate customers.
Xinbi appears to be shifting from USDT to USDD
The report said Xinbi appears to be moving away from USDT and into USDD, a stablecoin launched by Tron founder Justin Sun. Unlike USDT, USDD does not have a central issuer that can freeze wallets. Xinbi has already swapped about $2.8 million of its remaining USDT into USDD through a decentralized exchange.
But the move may not solve the problem entirely. The report noted that while USDD markets itself as decentralized, part of its reserves are backed by USDT, the same asset Xinbi is trying to avoid because of its wallet-freeze capability.
Bitrace posted an on-chain update on Sept. 9
The article also cited a Sept. 9 update from Bitrace. According to that post, Xinbi Guarantee’s business address, which had just been activated on Sept. 8, 2026, was frozen again. Bitrace said 1.8 million USDT had already escaped, while only 37,839 USDT remained frozen. The post added that on-chain data showed the address was testing.
DOJ also backed anti-scam operations in Madagascar
Wednesday’s action was part of a broader day for the Department of Justice’s Scam Center Strike Force. The unit also sent agents to Madagascar to assist local authorities in taking down 13 Chinese-run scam compounds and processing evidence linked to nearly 400 arrestees, including more than 3,200 seized devices.
The Strike Force was launched in November 2025. Since then, it has seized roughly $938 million in scam-linked cryptocurrency. The report said Xinbi’s outstanding balance is still on the board.