United States federal authorities have executed a significant enforcement action against Xinbi Guarantee, an illicit cryptocurrency marketplace accused of facilitating massive money-laundering operations. The operation resulted in the restraint of more than $52 million in digital assets and the seizure of critical technical infrastructure used to coordinate the platform’s activities. This move marks a major escalation in efforts to dismantle underground financial networks operating within the Southeast Asian economy.
On September 7, 2026, a federal court authorized the seizure of several Telegram channels that served as the primary communication hubs for the marketplace. The US Treasury Department has officially designated Xinbi Guarantee as a significant transnational criminal organization, citing its role in processing an estimated $24 billion in digital assets and fiat currency since its emergence around 2022. The enforcement action also targeted the service providers that enabled the marketplace to function under the radar of global regulators.
Key Developments in the Xinbi Guarantee Case
- Federal authorities restrained over $52 million in cryptocurrency and seized Telegram-based infrastructure following a court order.
- The US Treasury Department designated the marketplace as a transnational criminal organization and sanctioned two technology providers, SafeW Technology and Anwen Technology.
- Blockchain analysis indicates that North Korea-linked threat actors utilized the platform to move tens of millions of dollars in stolen digital assets.
- The enforcement action triggered a massive wave of withdrawals, with daily USDT outflows from linked platforms peaking at $1.81 million shortly after the announcement.
The Scale of Xinbi Guarantee’s Operations
Since its inception in 2022, Xinbi Guarantee has grown into a cornerstone of the underground digital economy. Investigators believe the platform has processed approximately $24 billion in total volume, acting as a transaction-guarantee market for various illicit activities. The marketplace specialized in providing a layer of anonymity for actors involved in the underground economy, particularly in Southeast Asia, where it facilitated the exchange of traceable assets for cleaner stablecoins.
One of the primary services offered by the platform involved the laundering of what is known as “Black U”—tether (USDT) tokens that have been flagged or traced to criminal activity. According to blockchain forensics, Xinbi Guarantee hosted launderers who would swap these traceable stolen assets for stablecoins sourced from separate illicit streams, such as pig-butchering scams. This circular economy allowed criminals to distance themselves from the original theft while maintaining liquidity in the crypto market.
To maintain its operational security, the marketplace underwent several technical shifts. In June 2025, the organization began moving its coordination efforts from public messaging platforms to the encrypted SafeW application. Furthermore, the introduction of XinbiPay, also known as NewPay, was designed to further obscure the flow of funds and evade the scrutiny of international law enforcement agencies. These maneuvers suggest a sophisticated understanding of blockchain monitoring and a concerted effort to bypass traditional financial controls.
Law Enforcement Action and Sanctions
The recent crackdown involved a multi-pronged approach targeting both the assets and the infrastructure of the organization. Beyond the seizure of Telegram channels, investigators successfully took control of two digital wallets containing approximately $12 million. However, the scope of the investigation remains broad, as authorities are currently seeking the restraint of 47 additional blockchain addresses believed to be tied to the marketplace’s operations.
The US Treasury Department’s involvement highlights the perceived threat the organization poses to the international financial system. By designating Xinbi Guarantee as a transnational criminal organization, the US government has effectively cut off the entity from the legitimate global economy. This designation was accompanied by sanctions against SafeW Technology and Anwen Technology, two firms accused of providing the messaging and payment infrastructure that allowed the marketplace to operate.
These sanctions are intended to serve as a deterrent to other technology providers who may be tempted to offer specialized services to illicit markets. By targeting the technical backbone of the operation, authorities aim to make it increasingly difficult for such marketplaces to maintain the uptime and reliability required to facilitate high-volume laundering.
Connections to State-Sponsored Cybercrime
Perhaps the most concerning aspect of the Xinbi Guarantee investigation is the platform’s alleged connection to state-sponsored threat actors. Blockchain analysis conducted by firms such as Chainalysis and Bitrace indicates that groups linked to North Korea moved tens of millions of dollars in stolen cryptocurrency through the platform. These actors are known for high-profile exchange hacks and decentralized finance (DeFi) exploits, using the proceeds to fund sanctioned state activities.
The use of Xinbi Guarantee by North Korean groups suggests that the marketplace was a vital node in the global network used to off-ramp stolen digital assets. The platform’s ability to handle large volumes of USDT and its willingness to facilitate high-risk transactions made it an ideal partner for state-sponsored hackers looking to obfuscate the trail of their loot. This connection elevates the case from a standard financial crime investigation to a matter of national security.
Previous pressure on Xinbi’s USDT network had reportedly prompted the marketplace to explore alternative stablecoins, such as USDD, in an attempt to diversify its risk. However, the recent enforcement action suggests that shifting between different blockchain protocols may not be enough to escape the reach of modern blockchain forensics and international legal cooperation.
Market Reaction and Industry Impact
The announcement of the enforcement action sent shockwaves through the underground crypto ecosystem. Data from Bitrace shows that daily USDT withdrawals from platforms linked to Xinbi rose sharply following the news. Prior to the crackdown, daily withdrawals typically ranged between $389,000 and $564,000. By September 9, 2026, that figure had spiked to a peak of $1.81 million as users scrambled to move their funds before further seizures could take place.
The impact was not limited to Xinbi Guarantee alone. A rival marketplace, Fulilai Guarantee, reportedly began taking defensive measures to avoid similar scrutiny. Reports indicate that Fulilai started removing money-laundering merchants from its public groups in an attempt to sanitize its image. Despite these efforts, the platform recorded approximately $9.3 million in outflows following the sanctions on Xinbi, suggesting a broader loss of confidence among users of these underground guarantee services.
This ripple effect demonstrates how targeted enforcement against one major player can disrupt the entire landscape of illicit digital finance. As users flee compromised platforms, the resulting transparency and movement of funds often provide investigators with new leads and data points to track the flow of criminal proceeds across the blockchain.
What Happens Next
The investigation into Xinbi Guarantee is far from over. US authorities are currently focused on the legal process required to restrain the 47 additional addresses identified during the initial phase of the operation. If successful, this could lead to the recovery of millions more in illicitly obtained funds. The data gathered from the seized Telegram channels and the infrastructure of SafeW and Anwen Technology is likely to provide a wealth of information regarding the identities of the marketplace’s operators and its most active users.
Furthermore, the focus on Southeast Asian underground markets is expected to intensify. The success of this operation may serve as a blueprint for future actions against similar entities that facilitate the “Black U” trade and pig-butchering scams. As blockchain analysis tools become more sophisticated, the window of opportunity for these marketplaces to operate in the shadows appears to be narrowing.
The international community will also be watching to see if other jurisdictions follow the US lead in sanctioning the technology providers associated with these networks. The outcome of this case could set a significant precedent for how the global financial system handles the intersection of encrypted messaging, offshore technology firms, and the illicit use of stablecoins.