US Sanctions Xinbi Scam Hub, Seizes Telegram Channels and $52M Crypto

The US Justice Department has restrained more than $52 million in cryptocurrency tied to Xinbi Guarantee and seized the marketplace's Telegram channels as part of a sweeping operation targeting Southeast Asia's industrial-scale scam networks. On Wednesday, the DOJ's Scam Center Strike Force said it seized two wallets used by Xinbi to collect vendor payments, holding roughly $12 million, while seeking restraints against 47 additional wallets believed to be connected to money laundering across the platform. A US District Court for the District of Columbia warrant, unsealed the same day, authorized the seizure of Xinbi's Telegram channels on September 7, cutting off a communications hub that vendors used to advertise money laundering services, custom scam-investment websites, and recruitment for Southeast Asian scam compounds.

In a coordinated action, the Treasury Department's Office of Foreign Assets Control (OFAC) designated Xinbi as a significant transnational criminal organization and sanctioned two technology providers accused of enabling the network. Singapore-based SafeW Technology allegedly hosted Xinbi's merchant and laundering operations on an encrypted messaging platform after the marketplace migrated there around June 2025 under intensifying law enforcement pressure. Cambodia-based Anwen Technology was sanctioned for developing XinbiPay, also known as NewPay, a crypto wallet and payment application that powered marketplace transactions. Stablecoin issuer Tether was credited by the DOJ for assisting with the investigation.

According to Treasury, Xinbi has processed more than $24 billion in crypto and fiat since around 2022, with TRM Labs Global Head of Policy Ari Redbord noting the marketplace moved over $36 billion at industrial scale after rival Huione was taken down, becoming the primary escrow and cash-out layer for Southeast Asian scam compounds. The Treasury added that Xinbi's platform has been used by North Korean hackers and entities tied to Pyongyang's revenue-generation efforts. The operation reflects a broader US strategy of targeting the financial and communications infrastructure that sustains transnational scam operations rather than pursuing individual scammers, following a recent joint US-UK alliance aimed at crypto scam centers across the region.