In a decisive strike against the financial infrastructure supporting global cybercrime, the United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced comprehensive sanctions on September 9, 2026, against Xinbi Guarantee. This Chinese-language illicit marketplace has emerged as a cornerstone of the Southeast Asian scam economy, facilitating the laundering of billions of dollars in stolen cryptocurrency and providing the technical tools necessary for transnational organized crime syndicates to operate at an industrial scale. The action, coordinated with the Department of Justice (DOJ) and international allies, highlights the evolving sophistication of digital money laundering and the persistent threat posed by state-sponsored actors, particularly those linked to the Democratic People’s Republic of Korea (DPRK).
The Rise of Xinbi Guarantee: A $24 Billion Criminal Hub
Since its emergence around 2022, Xinbi Guarantee has grown from a niche service into a massive, multi-faceted marketplace. According to data released by the U.S. Treasury, the platform has processed more than $24 billion in digital assets and fiat currency. Unlike traditional darknet markets that focus on narcotics or weapons, Xinbi specialized in "infrastructure as a service" for the burgeoning scam industry. It functioned as a trusted intermediary for criminal entities that otherwise would have no reason to trust one another.
The platform operated primarily through hundreds of Chinese-language channels on the messaging app Telegram. This ecosystem allowed vendors to advertise a wide array of illicit services, including money laundering, the sale of stolen personal data, the development of custom-built scam websites, and the recruitment of workers for scam compounds. These compounds, often located in special economic zones in Myanmar, Cambodia, and Laos, have become notorious for human rights abuses, including human trafficking and forced labor.
Xinbi’s success was built on its "escrow" or guarantee model. In this system, the platform holds deposits from vendors and manages payments between parties. This creates an enforced layer of trust, allowing criminal vendors to scale their operations without the need for personal relationships. If a vendor failed to deliver a promised service—such as a successful money laundering transaction or a functional malware package—Xinbi could arbitrate the dispute using the held deposits.
The North Korean Connection: Laundering the Spoils of High-Stakes Heists
Perhaps the most alarming aspect of Xinbi’s operations was its utility to state-sponsored threat actors. Forensic analysis of Xinbi’s on-chain footprint revealed that actors linked to the North Korean government moved tens of millions of dollars in stolen cryptocurrency through the platform’s vendor network. These funds were traced back to some of the largest cryptocurrency heists in recent history, including the $1.5 billion breach of the Bybit exchange and the $235 million theft from WazirX.
The laundering process utilized by DPRK-linked actors through Xinbi is known as "substitution" rather than simple obfuscation. Specialized vendors on the platform, referred to in criminal circles as "Black U" (Black USDT) launderers, play a pivotal role. These launderers accept highly "tainted" or traceable cryptocurrency—such as the funds stolen by North Korean hackers—and replace them with "cleaner" stablecoins.
These replacement funds are often sourced from other illicit revenue streams flowing through the same marketplace, such as the proceeds of "pig butchering" (Sha Zhu Pan) scams or romance fraud. By swapping stolen assets for assets derived from fraud, the North Korean actors effectively blend their loot into a much larger pool of global illicit activity. This makes it significantly more difficult for law enforcement to trace the funds to their ultimate destination. Once the swap is complete, the DPRK-linked actors receive stablecoins that can be moved through unlicensed over-the-counter (OTC) desks and converted into hard fiat currency, providing the regime with the capital necessary to fund its weapons programs and bypass international sanctions.
Strategic Enforcement and the Seizure of Assets
The sanctions announced on September 9 were part of a multi-pronged enforcement strategy involving both administrative and judicial actions. OFAC’s designation targeted not only Xinbi Guarantee but also the technological backbone of its operations. This included sanctions against SafeW Technology and Anwen Technology, the developers behind the messaging and cryptocurrency payment applications that supported the Xinbi ecosystem.
In total, OFAC identified and sanctioned 52 specific cryptocurrency wallet addresses associated with these entities. Analysis of these addresses showed they had collectively received over $8.4 billion in stablecoins. By blacklisting these wallets, the U.S. government effectively freezes any assets held within them that come into contact with the U.S. financial system and prohibits U.S. persons or entities from transacting with them.
Simultaneously, the Department of Justice’s Scam Center Strike Force (SCSF) executed a series of seizures. A federal court authorized the SCSF to seize the Telegram channels that hosted the Xinbi marketplace, effectively decapitating the platform’s primary communication and operational infrastructure. Furthermore, the DOJ seized approximately $12 million in cryptocurrency from two wallets used by Xinbi to collect payments on behalf of its vendors. In a coordinated effort involving the stablecoin issuer Tether, authorities were able to restrain an additional 47 wallets, bringing the total amount of restrained or seized cryptocurrency to more than $52 million.
A Timeline of Global Pressure
The September 2026 actions represent the culmination of a year-long international effort to dismantle the Xinbi network. The timeline of major events includes:
- January 2026: Investigative journalists and blockchain analytics firms begin publishing reports detailing the massive scale of Chinese-language money laundering services operating in Southeast Asia, identifying Xinbi as a primary actor.
- March 2026: The United Kingdom’s Foreign, Commonwealth & Development Office (FCDO) takes the lead in international enforcement by sanctioning Xinbi under its Global Human Rights sanctions regime. The UK focused heavily on the link between Xinbi and the "vile scam centres" involving human trafficking.
- April – August 2026: U.S. and UK authorities share intelligence on the DPRK’s use of the platform, leading to a broadened scope of investigation that moved beyond human rights into national security and state-sponsored cybercrime.
- September 7, 2026: A U.S. federal court authorizes the seizure of Xinbi’s digital infrastructure and the freezing of associated crypto assets.
- September 9, 2026: The U.S. Treasury officially announces the designation of Xinbi, SafeW, and Anwen Technology. In a show of solidarity, the UK’s FCDO updates its sanctions list to include the dozens of new cryptocurrency addresses identified by U.S. investigators.
The Broader Context: The Dominance of Chinese Money Laundering Services
The crackdown on Xinbi highlights a significant shift in the landscape of illicit finance. According to recent industry reports, Chinese-language money laundering services now dominate known cryptocurrency laundering activity. It is estimated that these services have processed approximately 20% of all illicit cryptocurrency funds over the past five years. In 2025 alone, these networks were responsible for moving an estimated $16 billion.
These organizations have evolved to meet the demands of the modern criminal economy. They provide a bridge between the high-tech world of cryptocurrency and the traditional world of underground banking. By offering "KYC bypass" (Know Your Customer) services and fraudulent bank cards, they allow criminals to move money across borders with relative ease, bypassing the safeguards intended to prevent money laundering.
Implications for Global Security and the Crypto Industry
The dismantling of Xinbi Guarantee is a significant victory for law enforcement, but experts warn that the underlying problem remains. The "scam center" model in Southeast Asia continues to thrive, fueled by economic instability and the increasing accessibility of digital assets.
The involvement of North Korea in these marketplaces demonstrates that cybercrime is no longer just a matter of financial loss for individuals or companies; it is a critical component of geopolitical tension and national security. The ability of a sanctioned state to use private criminal marketplaces to launder hundreds of millions of dollars poses a direct challenge to the effectiveness of the global financial regulatory framework.
For the cryptocurrency industry, these actions signal an era of heightened scrutiny and cooperation between private issuers and government agencies. The role of Tether in assisting the DOJ to restrain funds suggests that the era of "untraceable" stablecoin transactions is rapidly coming to an end. Exchanges and financial institutions will likely face increased pressure to monitor for "Black U" patterns and other substitution-based laundering techniques.
As the dust settles on the Xinbi seizure, the focus of global regulators is expected to turn toward the messaging platforms that facilitate these marketplaces. While Telegram has historically been resistant to such interventions, the seizure of channels by the DOJ indicates that law enforcement is finding new ways to penetrate encrypted or semi-private digital spaces. The battle against the Southeast Asian scam economy is far from over, but the fall of Xinbi Guarantee marks a turning point in the global effort to reclaim the digital financial system from organized crime and hostile state actors.
