The United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a comprehensive set of sanctions on September 9, 2026, targeting Xinbi Guarantee, a prolific Chinese-language illicit marketplace that has become a cornerstone of the global scam and money laundering economy. This coordinated international effort, involving the U.S. Department of Justice (DOJ) and the United Kingdom’s Foreign, Commonwealth & Development Office (FCDO), represents one of the most significant strikes against the financial infrastructure supporting Southeast Asian scam compounds and state-sponsored cyber-theft.
Xinbi Guarantee, which emerged as a major player in the illicit digital asset space around 2022, is accused of facilitating the movement of more than $24 billion in digital assets and fiat currency. According to federal investigators, the platform functioned as a "guarantee" or escrow service, providing a layer of enforced trust that allowed disparate criminal actors to trade stolen data, laundering services, and specialized malware without the need for prior relationships. By neutralizing this central node, authorities aim to fracture the ecosystem that connects North Korean state-sponsored hackers with the "pig butchering" scam operations that have victimized thousands of individuals globally.
The Architecture of a $24 Billion Criminal Hub
Xinbi Guarantee did not operate as a traditional website but rather as a sprawling network of hundreds of Chinese-language Telegram channels. Within this digital bazaar, vendors advertised a comprehensive suite of services necessary for the "full lifecycle" of cyber-enabled fraud. These services included the sale of stolen personal identifiable information (PII), the development of bespoke fraudulent investment platforms, the provision of "Know Your Customer" (KYC) bypass tools, and the recruitment of individuals for Southeast Asian labor camps.
The "guarantee" model was the platform’s primary innovation. In the world of transnational organized crime, trust is a scarce commodity. Xinbi solved this by holding vendor deposits in escrow and managing payments between parties. This ensured that if a money launderer failed to deliver clean funds or a developer provided a faulty scam script, the platform could mediate or penalize the bad actor. This institutionalized reliability allowed the marketplace to scale rapidly, eventually processing an estimated 20% of all illicit cryptocurrency funds globally over the past five years.
The scale of the operation is underscored by the financial data released by the Treasury. OFAC identified 52 specific cryptocurrency addresses associated with Xinbi that collectively received over $8.4 billion in stablecoins. These stablecoins, primarily pegged to the U.S. dollar, served as the primary medium of exchange due to their liquidity and perceived stability compared to more volatile digital assets.
The North Korean Connection: From Hacks to "Black U"
One of the most alarming aspects of the Xinbi investigation is the platform’s role in laundering funds for the Democratic People’s Republic of Korea (DPRK). Blockchain analysis conducted by forensic firms and federal investigators revealed that DPRK-linked threat actors, often associated with the Lazarus Group, moved tens of millions of dollars in stolen cryptocurrency through Xinbi’s vendor network.
These funds originated from high-profile security breaches, most notably the $1.5 billion exploit of the Bybit exchange and the $235 million theft from the Indian exchange WazirX. To obscure the trail of these highly visible, "tainted" funds, North Korean actors utilized a method known as "Black U" laundering. In this scheme, specialized vendors on Xinbi accept traceable, stolen cryptocurrency and replace it with stablecoins sourced from entirely different criminal activities, such as the proceeds of romance scams or fraudulent investment schemes.
This process of "substitution" rather than simple "obfuscation" makes the funds significantly harder for traditional law enforcement tools to track. By the time the DPRK-linked actors receive the substituted stablecoins, the assets appear to be the proceeds of localized fraud rather than international state-sponsored cyber-terrorism. These "cleaner" assets are then moved through unlicensed over-the-counter (OTC) desks and converted into fiat currency to fund the North Korean regime’s prohibited weapons programs.
Coordinated Seizures and Global Enforcement
The September 9 action was not limited to financial sanctions. The Justice Department’s Scam Center Strike Force (SCSF) executed a series of seizures aimed at dismantling Xinbi’s operational capacity. Following a federal court authorization on September 7, authorities seized the Telegram channels that hosted the marketplace, effectively de-platforming the organization.
Simultaneously, the SCSF seized two primary wallets used by Xinbi to collect administrative fees and vendor deposits, netting approximately $12 million in various cryptocurrencies. Beyond these direct seizures, law enforcement moved to "restrain" an additional 47 wallets linked to the network, effectively freezing more than $40 million in assets. In total, the coordinated action has sidelined over $52 million in criminal capital.
The U.S. Treasury also extended its sanctions to the technological architects of the Xinbi ecosystem. OFAC designated SafeW Technology and Anwen Technology, two firms responsible for developing the messaging and crypto-payment applications that underpinned Xinbi’s operations. By targeting the developers, the U.S. government is signaling a broader strategy to hold software creators accountable when their platforms are built specifically to facilitate illicit financial activity.
Human Rights Implications and International Response
The crackdown on Xinbi Guarantee is as much a human rights initiative as it is a financial one. The marketplace was a primary recruitment and logistical hub for scam compounds in countries like Myanmar, Cambodia, and Laos. These compounds are notorious for using trafficked labor, where individuals are lured by false job advertisements only to be held captive, subjected to torture, and forced to conduct "pig butchering" scams against Western targets.
Recognizing these atrocities, the United Kingdom’s Foreign, Commonwealth & Development Office (FCDO) had previously sanctioned Xinbi in March 2026 under its Global Human Rights sanctions regime. Following the U.S. announcement, the FCDO updated its designations to include dozens of additional cryptocurrency addresses identified in the joint investigation.
"These scam centers are a blight on the international community, fueled by human suffering and industrial-scale theft," a spokesperson for the FCDO stated. "By cutting off the financial oxygen provided by platforms like Xinbi, we are protecting potential victims of fraud and those held in forced labor alike."
Timeline of the Xinbi Investigation and Takedown
The downfall of Xinbi Guarantee was the result of a multi-year effort by global cyber-task forces. The following chronology outlines the key milestones in the investigation:
- Early 2022: Xinbi Guarantee emerges on Telegram, catering to the growing Southeast Asian scam economy.
- Late 2023: Blockchain investigators begin noticing a pattern of DPRK-linked stolen funds flowing into a specific cluster of Chinese-language escrow wallets.
- March 2026: The UK Government becomes the first major power to sanction Xinbi, citing its ties to human rights abuses and forced labor in scam compounds.
- April-August 2026: The U.S. Scam Center Strike Force (SCSF) conducts an intensive "follow-the-money" investigation, linking Xinbi to the Bybit and WazirX hacks.
- September 7, 2026: A U.S. federal court authorizes the seizure of Xinbi’s digital infrastructure, including Telegram channels and primary payment wallets.
- September 9, 2026: OFAC officially sanctions Xinbi, its developers (SafeW and Anwen), and 52 associated cryptocurrency addresses. Over $52 million is restrained or seized globally.
Implications for the Future of Illicit Finance
The action against Xinbi Guarantee marks a shift in how Western authorities approach the "scam-as-a-service" industry. For years, individual scam centers were targeted with limited success, as new compounds would quickly replace those shuttered by local police. By targeting the "Guarantee" platforms—the financial glue that holds the various criminal vendors together—authorities are attacking the scalability of the entire model.
Furthermore, the involvement of major stablecoin issuers like Tether in assisting law enforcement highlights an increasing level of cooperation between the private sector and government agencies. As stablecoins become the preferred tool for money launderers, the ability of issuers to freeze assets at the request of the Treasury is becoming a critical component of the global anti-money laundering (AML) framework.
Industry analysts suggest that while the Xinbi takedown is a major victory, the vacuum left behind may lead to further fragmentation of the market. Criminal actors may move toward even more decentralized or encrypted communication platforms. However, the loss of $52 million in working capital and the public exposure of the "Black U" laundering method will likely impose a significant "tax" on criminal operations for the foreseeable future, making it more expensive and riskier for North Korean actors and scam syndicates to operate within the global financial system.
As of the date of the sanctions, all property and interests in property of the designated entities that are in the United States or in the possession or control of U.S. persons are blocked. The Treasury has warned that any financial institutions or persons that engage in certain transactions or activities with the sanctioned entities may expose themselves to enforcement actions or secondary sanctions.
