Treasury sanctions Xinbi Guarantee for facilitating billions in cybercrime

The US Treasury just put a target on one of the largest illicit marketplaces most people have never heard of. On September 9, the Office of Foreign Assets Control sanctioned Xinbi Guarantee, a Telegram-based operation that functioned as a kind of dark Amazon for cybercriminals, facilitating money laundering, fraud, and scams aimed squarely at Americans.

Treasury designated Xinbi as a significant transnational criminal organization under Executive Order 13581. It also designated two supporting companies, but they supplied different tools: Singapore-based SafeW Technology developed an encrypted messaging app used for coordination, while Cambodia-based Anwen Technology developed the XinbiPay, also called NewPay, crypto wallet.

The scale of the operation

Treasury says Xinbi’s marketplace processed the equivalent of more than $24 billion in digital assets and fiat currency since its inception around 2022. That is marketplace volume, not a count of confirmed victim losses.

The marketplace operated primarily through Telegram channels, functioning as a peer-to-peer escrow service. Buyers and sellers of stolen data, scam toolkits, and money laundering services could transact with a layer of trust typically reserved for legitimate e-commerce.

The Justice Department said its Scam Center Strike Force restrained approximately $52 million in cryptocurrency involved in scam money laundering in one day. That brought the Strike Force’s total restrained funds to approximately $938 million. Agents also seized two Xinbi payment wallets holding about $12 million and sought restraint of 47 more wallets.

International coordination and prior action

The US action followed a March 26 UK sanction against Xinbi. The UK described it as a crypto-based marketplace serving Southeast Asian scam centers, including Cambodia’s #8 Park. The UK also described the trafficking and coercion of workers in the wider scam-center network.

Treasury says Xinbi provided escrow services and connected scam operators with merchants offering financial services, technology, and other support. The UK says its crypto-based services were used by scam centers. Those findings describe Xinbi’s role in the network without attributing every trafficking offense to the platform itself.

The Treasury’s action also aligns with an executive order on cybercrime issued by President Trump in March 2026, signaling that dismantling digital crime networks has become a stated priority across multiple government agencies.

A resilient adversary

Treasury says Xinbi encouraged users to move coordination to SafeW around June 2025 and launched the Anwen-developed XinbiPay wallet as law-enforcement scrutiny grew. Treasury also says some users of the Huione Pay network moved activity to Xinbi after earlier US action. These accounts do not establish that the shifts caused minimal disruption.

The crypto connection is specific, not incidental. Treasury says Xinbi processed digital assets alongside fiat currency, and Anwen built its payment wallet. The Justice Department traced victim funds to vendors who advertised crypto wallets on Telegram and seized two wallets Xinbi used to collect vendor payments. SafeW supplied messaging, not the wallet.

What the crackdown signals

For crypto businesses, the key distinction is between a designated person and a wallet merely associated with the case. Treasury says property and interests in property of Xinbi, SafeW Technology, and Anwen that are in the US or controlled by US persons are blocked and must be reported. Unless licensed or exempt, US persons generally cannot transact in property involving those designated entities. An address is not automatically blocked simply because it is mentioned alongside them.