Two wallets, about $12 million, and a set of Telegram channels: that was the haul when a federal court authorised the seizure of the channels hosting Xinbi Guarantee’s marketplace on September 7. Two days later, on September 9, 2026, the US Treasury’s Office of Foreign Assets Control sanctioned Xinbi itself.
Xinbi is a Chinese-language marketplace that links criminal networks with money laundering, scam infrastructure and stolen data. According to Treasury, it has processed more than $24 billion in digital assets and fiat currency since it emerged around 2022.
Trust among thieves
The central piece is escrow. Xinbi holds vendor deposits and manages payments, which gives criminal buyers and sellers a layer of enforced trust. They can do business at scale without knowing one another. Chainalysis, which analysed the network, mapped a vendor ecosystem on Telegram offering cash delivery, bank card fraud, personal data, KYC bypass, scam platform development, surveillance equipment and malware.
OFAC also sanctioned two developers that supported the operation: SafeW Technology, which made a messaging app, and Anwen Technology, which made a crypto payment app. It listed dozens of associated wallets. The 52 designated addresses received more than $8.4 billion in stablecoins, according to Chainalysis.
North Korean money in the mix
Chainalysis found that actors linked to North Korea pushed tens of millions of dollars in stolen funds through Xinbi’s vendors. The money came from major thefts, including the $1.5 billion Bybit breach and the $235 million WazirX theft.
The method was substitution rather than disguise. Vendors known as “Black U” launderers took the traceable stolen coins and handed back stablecoins drawn from other illicit income, such as pig butchering and romance scams. The stolen funds vanished into a bigger pool, and the recipients could cash out through unlicensed over-the-counter desks.
What was frozen
Under the same warrant that covered the Telegram channels, the Justice Department’s Scam Center Strike Force seized the two wallets Xinbi allegedly used to collect payments for vendors. It also restrained another 47 wallets believed to be linked to the network. In all, more than $52 million in cryptocurrency tied to Xinbi and its vendors was seized or restrained. Tether assisted law enforcement.
Britain’s Foreign, Commonwealth and Development Office had already sanctioned Xinbi in March 2026, and it widened its listing to cover dozens more crypto addresses alongside the US action.
Chainalysis noted that Chinese-language laundering services now handle an estimated 20 percent of illicit crypto funds over the past five years, including $16 billion in 2025.
