U.S. authorities have taken coordinated action against Xinbi Guarantee, a Chinese-language illicit marketplace allegedly used to enable cyber-enabled fraud, cryptocurrency laundering, and the operation of scam compounds. The case is a notable example of how enforcement agencies are increasingly targeting not only the fraudsters themselves, but also the online infrastructure and financial-service layers that allow industrial-scale scams to operate.
On September 9, 2026, the U.S. Department of Justice’s Scam Center Strike Force announced seizures connected to Xinbi Guarantee. At the same time, the Treasury Department’s Office of Foreign Assets Control (OFAC) designated it a significant transnational criminal organization. The action included the seizure of Telegram channels used by the marketplace and two cryptocurrency wallets. In addition, authorities restrained more than $52 million in crypto assets linked to Xinbi and associated vendors.
Xinbi Guarantee: a marketplace for scam operations
According to the DOJ, Xinbi operated primarily through Chinese-language Telegram channels.
Vendors allegedly advertised a broad range of services to scam-center operators. These included fraudulent investment websites, crypto “cleaning” or laundering services, recruitment of personnel for scam compounds, and other operational support.
The alleged business model resembled an escrow marketplace.
Xinbi Guarantee reportedly held funds until a vendor completed the service purchased by a scam operator. As a result, it reduced counterparty risk within the criminal ecosystem. This is an important detail. It suggests that the platform was not merely a communications channel. Instead, it acted as a coordination and payment layer that helped professionalize criminal service delivery.
For investigators, such marketplaces create high-value disruption points. They can connect infrastructure providers, laundering vendors, recruiters, wallet services, and scam operators in one environment. Therefore, they make it possible to map relationships that may otherwise remain fragmented across separate Telegram groups, wallet clusters, and jurisdictions. This is the kind of mapping our OSINT and evidence analysis team performs.
Crypto tracing at the core of the Xinbi Guarantee case
This enforcement effort underscores how crucial blockchain intelligence has become in dissecting sophisticated fraud networks. Federal prosecutors noted that they mapped victim capital directly to service providers offering laundering options inside Xinbi channels. Those channels publicly listed wallet addresses for settlement.
A pair of primary addresses used by the platform for fee collection contained approximately $12 million. Consequently, federal agents pursued the freezing of 47 supplementary wallets tied to affiliated money movers and merchants.
Furthermore, the inquiry highlights why on-chain address mapping must remain a dynamic discipline. Addresses linked to underground networks fulfill distinct operational tasks. For example, they absorb illicit funds, harvest administrative cuts, and secure escrow balances. Others compensate contractors, execute cross-chain transfers, or funnel assets into liquid exchanges and private brokers.
Mapping these specific operational roles offers far deeper analytical utility than simply tagging an address as high risk. Our fraud, money laundering and asset tracing work relies on this approach.
The economic sanctions applied by OFAC also introduce significant regulatory compliance duties. American citizens and firms may not engage with sanctioned targets. In turn, they must freeze and disclose any assets falling under domestic jurisdiction.
Regulatory enforcement extended to two corporate entities charged with bolstering Xinbi Guarantee’s infrastructure. In short, regulators showed a clear willingness to target supporting commercial networks alongside the primary platform.
A wider scam-center response
The intervention against Xinbi Guarantee represents a single element in an expanded American campaign. That campaign targets syndicated fraud facilities tied to East Asian criminal rings, particularly those operating across Southeast Asia.
Disclosures from the Strike Force confirmed active collaboration with law enforcement in Madagascar to neutralize 13 Asian-managed fraud compounds. Moreover, the effort supported the forensic analysis of over 3,200 hardware units. It also included interviews following nearly 400 detentions.
Such organized syndicates primarily execute deceptive investment schemes, commonly described as romance-based financial fraud.
The magnitude of financial damage suffered by victims is immense. Federal reporting from the FBI IC3 shows that recorded losses from crypto investment schemes surged from $4.57 billion in 2023. By 2025, they had reached $8.65 billion.
Compliance implications of the Xinbi Guarantee action
For digital asset exchanges, stablecoin issuers, virtual financial providers, and traditional institutions, these enforcement actions deliver several operational priorities:
- Continuously screen for exposure to designated wallet groups, intermediary vendors, and connected downstream addresses – extending beyond explicitly listed identifiers.
- Analyze operational signals. These include swift fund layering, stablecoin conversions, inter-chain bridging, reliance on unlisted liquidity providers, and transfer rhythms consistent with escrow settlements.
- Incorporate encrypted messaging commercial activity into investigative open-source intelligence frameworks whenever legally permitted.
- Escalate overlapping signals linking stolen proceeds, scam compound networks, and labor exploitation indicators. Avoid evaluating each threat vector independently.
Dismantling Xinbi Guarantee will not instantly eliminate the broader fraud-compound sector.
Nevertheless, it reflects a far more sophisticated enforcement blueprint. It pairs on-chain tracing, chat seizures, financial blocking, and cross-border partnerships. It also adds targeted legal moves against the operational service layers that make systemic financial crime feasible.
For compliance leaders and chain analysis specialists, the core lesson stands out. Following transactional footprints remains vital. However, investigators ultimately win impactful cases by dismantling the supporting infrastructure that enables, launders, and sustains those flows. Firms reviewing their own exposure can start with our KYC and AML compliance services.