Loading story…
The UK government sanctioned Xinbi, a Chinese-language cryptocurrency marketplace, under its Global Human Rights sanctions regime for allegedly enabling large-scale online fraud, money laundering, and human exploitation linked to scam centers in Southeast Asia. Authorities said Xinbi supported #8 Park in Cambodia, a major scam compound reportedly housing up to 20,000 trafficked or indentured workers and associated with pig-butchering and other cyber-enabled fraud schemes. The UK also sanctioned Legend Innovation Co, identified as the operator of #8 Park, along with two officials connected to the Prince Group.
Blockchain analysis cited by the government said Xinbi processed more than $19.9 billion in cryptocurrency between 2021 and 2025 and served as a central hub for escrow services, unlicensed OTC trading, sales of compromised personal data, and other scam-enabling services. Researchers also linked the platform to other illicit Chinese-language marketplaces including Huione and Tudou, and said Xinbi remained resilient after 2025 Telegram takedowns by shifting to the SafeW messaging app and launching XinbiPay. The move marks a notable escalation in efforts to disrupt the financial infrastructure behind transnational scam operations rather than targeting only individual fraudsters.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
Following the UK's 2026-03-26 sanctions, Elliptic said Xinbi Guarantee remained active on Telegram, processed about $505 million in transactions over the next 19 days, and grew to nearly 500,000 users. The report indicated there was no visible Telegram enforcement action against the marketplace during that period.
On 2026-03-26, the UK government said earlier sanctions against the Prince Group network had contributed to the shutdown of the BYEX crypto platform. The statement framed BYEX's closure as a concrete enforcement outcome of prior action against the scam-centre ecosystem.
As part of the same 2026 UK crackdown on Xinbi and associated scam-compound figures, British authorities seized London properties connected to the network. The action extended the response beyond sanctions designations to asset seizure tied to alleged online fraud and human rights abuses.
As part of the 2026 UK action against the scam-compound ecosystem, British authorities also sanctioned Hu Xiaowei, Li Thet, and Wang Xiaoyan, alleging links to Prince Group leader Chen Zhi. The designations broadened the crackdown to additional individuals tied to the financial and operational infrastructure behind Southeast Asian scam centers.
As part of the same sanctions action, the UK also designated Legend Innovation Co, identified as the operator of #8 Park, along with two officials linked to the Prince Group. The measures expanded the response beyond the marketplace to entities and individuals allegedly connected to scam-compound operations.
On or before 2026-03-26, the UK Foreign, Commonwealth and Development Office designated Xinbi under the Global Human Rights sanctions regime. The action linked the marketplace to large-scale online fraud and to Cambodia's #8 Park scam compound, which was associated with pig butchering, forced labor, and abuse of trafficked workers.
After the 2025 Telegram takedowns, Xinbi quickly rebuilt its communications channels, expanded onto the SafeW messaging app, and launched XinbiPay. The developments were cited as evidence of the platform's operational resilience.
In 2025, Telegram removed Xinbi-related channels as part of platform takedowns affecting the marketplace's communications presence. The disruption did not end operations, according to Chainalysis.
Between 2021 and 2025, Xinbi operated as a Chinese-language guarantee marketplace and crypto-enabled hub for money laundering, unlicensed OTC trading, stolen data sales, and scam-related services. Chainalysis said the platform processed more than $19.9 billion in cryptocurrency over this period.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
7 references tracked. Mallory keeps watching after this page renders.
wired.com
Open sourcetrmlabs.com
Open sourceoccrp.org
Open sourcechainalysis.com
Open sourcewired.com
Open sourcetherecord.media
Open sourcegov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Treasury designated **Xinbi Guarantee** a significant transnational criminal organization for operating a Chinese-language marketplace that allegedly enabled Southeast Asian cyber-scam syndicates, cryptocurrency investment fraud, money laundering, and sales of stolen data, forged documents, deepfake tools, and cash-out services. Xinbi reportedly used escrow-backed transactions and processed more than **$36 billion** since about 2022; U.S. officials also alleged links to North Korean hackers and other criminal groups. The Justice Department’s Scam Center Strike Force seized Xinbi-linked Telegram infrastructure and digital-asset wallets under a federal court order, while prosecutors restrained **$52 million** in cryptocurrency and OFAC listed 52 associated TRON addresses. OFAC also sanctioned Cambodia-based Anwen Technology, tied to the XinbiPay/NewPay wallet, and Singapore-based SafeW Technology, developer of an encrypted messaging app, for allegedly supporting Xinbi; Telegram banned the marketplace. Separately, U.S. and Malagasy authorities shut 13 alleged scam centers, arresting 500 people, as the U.S. reported restraining $938 million connected to related crypto-scam schemes.
Sep 12, 2026
The UK imposed a new sanctions package targeting Russia’s sanctions-evasion infrastructure, naming 18 entities and individuals tied to crypto-enabled finance, the Kremlin-backed **A7 network**, and a Kyrgyz bank suspected of facilitating payments for Russia’s war economy. The measures also designated **Huobi Global S.A.**, the entity behind crypto exchange **HTX**, over allegations that it helped channel funds to Russia, alongside three Georgia-based companies operating Russia-focused exchanges and other actors linked to illicit financial flows. Subsequent blockchain analysis said HTX continued operating under the same brand after the designation while rapidly rotating hot wallets and funding addresses across **TRON**, **Ethereum**, **BNB Smart Chain**, and **Solana**, complicating sanctions screening based on static wallet blocklists. The reporting tied the action to alleged support for **A7 LLC** and **Garantex** and to the UK National Crime Agency-led **Operation Destabilize**, underscoring compliance risks for firms that rely only on fixed address lists rather than behavior-based attribution and enhanced due diligence.
Jul 24, 2026
The United States imposed a new round of sanctions on Cambodia’s **Prince Group** network, targeting nine individuals and 26 companies over alleged involvement in cyber scams, forced labor, human trafficking, and human rights abuses tied to scam compounds in Southeast Asia. Treasury identified **Hu Xiaowei**, described as Prince Group’s second-in-command, along with figures including **Chen Bo**, **Brendon Luo**, **Qiu Wei Ren**, and **Fang Zhizhen**, and entities such as **CCU Commercial Bank PLC** and **White Horse Hotel Management Group**. U.S. officials said the operations lured workers with fake job offers, confiscated passports, and coerced victims through debt bondage, violence, and threats into running online fraud schemes, including digital-asset investment scams that contributed to at least **$10 billion** in losses to Americans in 2024. The Justice Department also seized a cloud computing account used as backend infrastructure by subsidiaries of Cambodia-based **Huione Group**, which authorities described as a major criminal marketplace and laundering hub linked to scam centers and cyber-enabled theft. Officials said the infrastructure supported **Huione Guarantee** or **Haowang Guarantee**, which allegedly facilitated money laundering, stolen-data sales, malware-enabled theft, cryptocurrency escrow services, and other criminal activity. The enforcement action came as Japanese police arrested Hu Xiaowei in Osaka on suspicion of filing a fraudulent address change while living under the Cypriot identity **"Hu Shi"** and seeking permanent residency, adding to mounting international pressure on Prince Group and associated networks, which have denied the allegations and said their businesses are legitimate.
Jun 29, 2026