The US Department of Justice and OFAC have coordinated a sweeping operation against Xinbi Guarantee, an online fraud marketplace active across Southeast Asia. Two wallets have been seized, 47 additional addresses are subject to freeze requests, bringing the total of restricted crypto assets above $52 million.
🔑 Key takeaways
- OFAC designated Xinbi Guarantee as a major transnational criminal organization, simultaneously sanctioning SafeW Technology and Anwen Technology.
- Two payment-collection wallets containing roughly $12 million in digital assets have been seized.
- 47 additional wallets are subject to freeze requests, bringing total exposure above $52 million.
- Treasury estimates Xinbi processed over $24 billion in crypto and fiat since 2022, mainly across Southeast Asia.
- Stablecoin issuer Tether cooperated with the investigation, according to the DOJ.
A coordinated strike against the fraud infrastructure
The US Department of Justice (DOJ), through its Scam Center Strike Force, and the Treasury’s Office of Foreign Assets Control (OFAC) acted simultaneously to dismantle the financial and communications infrastructure of the Xinbi Guarantee fraud marketplace. The US District Court for the District of Columbia authorized, on September 7, the seizure of the Telegram channels hosting the marketplace.
According to the warrant, vendors on these channels advertised money-laundering services, customized fraudulent investment websites, and recruitment for large-scale scam compounds in Southeast Asia. Seizing the Telegram channels cuts off one of the organization’s primary communication and recruitment vectors.
OFAC designated Xinbi as a « major transnational criminal organization, » triggering the blocking of all its US-based assets and a general prohibition on US persons transacting with the entity or its representatives.
Two tech providers in the crosshairs
The action targets more than just Xinbi. Treasury also sanctioned SafeW Technology, a Singapore-based firm operating an encrypted messaging application, and Anwen Technology, based in Cambodia, accused of developing XinbiPay (also known as NewPay), the crypto-asset wallet and payment app used by the marketplace.
According to Treasury, Xinbi began migrating its merchant and laundering networks to SafeW’s app around June 2025, as law enforcement pressure intensified. This opportunistic shift to alternative communication tools explains why US authorities chose to sanction the messaging operator in parallel, in order to cut off the communication rails before they were reinvested elsewhere.
Volumes processed: an industrial-scale ecosystem
The scale of the sanctions mirrors the scale of the flows. Treasury estimates Xinbi processed over $24 billion in crypto and fiat since approximately 2022, predominantly in and out of Southeast Asia. Ari Redbord, Global Head of Policy at TRM Labs, puts circulation even higher, at more than $36 billion since the fall of the Huione marketplace, which until then had been the dominant online fraud venue.
« The OFAC sanctioned Xinbi for good reason. When Huione fell, Xinbi became the default escrow and funds-conversion layer for Southeast Asian scam centers and did it at industrial scale, moving more than $36 billion. »
Ari Redbord, Global Head of Policy, TRM Labs
The platform was reportedly also used by North Korean hackers and by entities linked to the already-sanctioned Prince Group. This overlap with other sanctioned networks illustrates the convergence between state-sponsored cybercrime, pig-butchering scams (long-term romance-style fraud), and crypto-native financial services, a hybridization that significantly complicates investigators’ work.
Breakdown of seized and freeze-targeted assets
DOJ seized two specific wallets used by Xinbi to collect vendor payments. The department is now seeking to freeze 47 additional addresses identified during the investigation. Combining the two seizures and the freeze requests, the total of affected funds exceeds $52 million.
| Category | Detail |
|---|---|
| Wallets seized (DOJ) | 2 addresses, ~$12M |
| Wallets targeted (freeze request) | 47 additional addresses |
| Total exposure | > $52M in crypto |
| Treasury estimate since 2022 | > $24B processed |
| TRM Labs estimate since Huione’s fall | > $36B moved |
DOJ also credited stablecoin issuer Tether for cooperating in tracing flows and identifying implicated addresses, illustrating the growing role of stablecoin issuers in financial crime investigations, at a time when USDT remains one of the primary value rails used by scam networks.
A strategic shift: targeting infrastructure, not individuals
This action is part of a recent series of operations deliberately targeting the technical and financial infrastructure of crypto-asset fraud rather than individual operators. Sanctioning messaging providers, wallet developers, and payment services amounts to cutting off the tools on which criminal networks depend, rather than playing a cat-and-mouse game with disposable accounts.
The UK precedent reinforces this logic. On March 26, the United Kingdom imposed its own sanctions on Xinbi, freezing platform-linked assets on British soil and barring access to the country’s financial, commercial, and travel networks. Transatlantic convergence of sanctions regimes significantly complicates fiat exit points for scammers and reduces the jurisdictional safe havens available to them.
For blockchain investigators and exchange compliance teams, the designation also delivers a clear operational signal: any interaction with the associated addresses exposes US persons to secondary sanctions risk, pushing exchanges to tighten their address-screening procedures (automated filtering against sanctions lists).
Conclusion: coordinated pressure on the rails of the scam
The Xinbi operation illustrates the maturation of enforcement strategies against crypto-native crime. By combining criminal seizures, OFAC designations, and UK sanctions, US authorities and their allies are simultaneously targeting communication layers (Telegram, SafeW), payment tools (XinbiPay), and escrow and fiat-conversion rails, something no isolated intervention had been able to achieve until now.
Near-term scenarios remain open: Xinbi could migrate to new messaging channels and technical providers, as it already did in 2025 with SafeW, suggesting a permanent cycle of adaptation. Regulatory pressure may nonetheless erode its vendor base and complicate fiat conversions, gradually slowing flows. For investors, platforms, and issuers, the operational takeaway is clear: systematically monitoring OFAC sanctions lists and UK designations is becoming a non-negotiable compliance prerequisite, even for actors most isolated from the traditional financial system.
Sources
- Cointelegraph
- Atlabyte
- TradingView (Cointelegraph feed)
- US Department of the Treasury / OFAC press releases
- TRM Labs
This article is published for informational and educational purposes only. It does not constitute investment advice. Do your own research (DYOR) before making any decision.
