Loading story…
The U.S. Treasury designated Xinbi Guarantee a significant transnational criminal organization for operating a Chinese-language marketplace that allegedly enabled Southeast Asian cyber-scam syndicates, cryptocurrency investment fraud, money laundering, and sales of stolen data, forged documents, deepfake tools, and cash-out services. Xinbi reportedly used escrow-backed transactions and processed more than $36 billion since about 2022; U.S. officials also alleged links to North Korean hackers and other criminal groups.
The Justice Department’s Scam Center Strike Force seized Xinbi-linked Telegram infrastructure and digital-asset wallets under a federal court order, while prosecutors restrained $52 million in cryptocurrency and OFAC listed 52 associated TRON addresses. OFAC also sanctioned Cambodia-based Anwen Technology, tied to the XinbiPay/NewPay wallet, and Singapore-based SafeW Technology, developer of an encrypted messaging app, for allegedly supporting Xinbi; Telegram banned the marketplace. Separately, U.S. and Malagasy authorities shut 13 alleged scam centers, arresting 500 people, as the U.S. reported restraining $938 million connected to related crypto-scam schemes.
See the reporting duties and controls this puts on the clock.
12 events from the most recent confirmed update back to the earliest known activity.
Telegram officially banned Xinbi, temporarily disrupting the marketplace's primary Telegram-based operations.
The DOJ Scam Center Strike Force, under federal-court authorization in Washington, D.C., seized Xinbi-linked infrastructure and Telegram channels and restrained $52 million in cryptocurrency held across Xinbi-associated wallets.
OFAC designated Xinbi Guarantee as a significant transnational criminal organization and designated Cambodia-based Anwen Technology and Singapore-based SafeW Technology for materially supporting it. The action listed 52 TRON addresses and blocked designated parties' U.S.-jurisdiction property while generally barring U.S.-person transactions.
A federal court authorized U.S. authorities to seize Telegram channels hosting Xinbi Guarantee's marketplace. The authorization preceded the coordinated enforcement action that disrupted Xinbi infrastructure and wallets.
The UK Foreign, Commonwealth, and Development Office designated Xinbi Guarantee, making the United States the second jurisdiction reported to sanction the marketplace.
The U.S. issued Executive Order 14390 concerning efforts to combat cybercrime, fraud, and predatory schemes targeting American citizens.
XinbiPay's withdrawal hot wallet received $94.6 million, illustrating the scale of funds moving through the wallet service associated with Xinbi.
Around June 2025, Xinbi began moving merchant and money-laundering networks to the SafeW encrypted messaging application in response to law-enforcement scrutiny.
In May 2025, Telegram removed thousands of channels associated with Xinbi Guarantee and the Huione Guarantee network. TRM Labs reported that the marketplaces soon resumed operations under new names after the removals.
TRM Labs assessed that Xinbi Guarantee processed more than $36 billion in digital assets and fiat currency from approximately 2022 onward while operating a Chinese-language marketplace for scam syndicates and illicit-service vendors.
After Tether froze funds linked to Xinbi Guarantee, the marketplace's administrators announced plans to migrate payment activity to the USDD stablecoin on the TRON blockchain.
With assistance from the Scam Center Strike Force and FBI, Malagasy authorities shut down 13 alleged scam centers, arrested 500 people, and repatriated 30 alleged Chinese leaders to China.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
16 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcexakep.ru
Open sourcenknews.org
Open sourceinfosecurity-magazine.com
Open sourceelliptic.co
Open sourcehome.treasury.gov
Open sourcerusi.org
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK government sanctioned **Xinbi**, a Chinese-language cryptocurrency marketplace, under its Global Human Rights sanctions regime for allegedly enabling large-scale online fraud, money laundering, and human exploitation linked to scam centers in Southeast Asia. Authorities said Xinbi supported **#8 Park** in Cambodia, a major scam compound reportedly housing up to 20,000 trafficked or indentured workers and associated with pig-butchering and other cyber-enabled fraud schemes. The UK also sanctioned **Legend Innovation Co**, identified as the operator of #8 Park, along with two officials connected to the **Prince Group**. Blockchain analysis cited by the government said Xinbi processed more than **$19.9 billion** in cryptocurrency between 2021 and 2025 and served as a central hub for escrow services, unlicensed OTC trading, sales of compromised personal data, and other scam-enabling services. Researchers also linked the platform to other illicit Chinese-language marketplaces including **Huione** and **Tudou**, and said Xinbi remained resilient after 2025 Telegram takedowns by shifting to the **SafeW** messaging app and launching **XinbiPay**. The move marks a notable escalation in efforts to disrupt the financial infrastructure behind transnational scam operations rather than targeting only individual fraudsters.
Jun 29, 2026
U.S. authorities and private-sector partners disrupted transnational scam compounds in Southeast Asia that were tied to **pig-butchering cryptocurrency fraud**, broader confidence scams, and human trafficking networks used to supply forced labor. Reporting says the **Scam Center Strike Force**, led by the U.S. Attorney’s Office for the District of Columbia with support from the DOJ, FBI, Secret Service, Treasury, and State Department, helped neutralize **1.4 million malicious accounts**, disable supporting infrastructure, and seize more than **500 fake investment domains**. Meta, Microsoft, the U.S. Department of Justice, and other partners were also identified as participants in the disruption effort. The campaign was paired with financial and enforcement actions aimed at the ecosystem enabling the fraud. According to public reporting, U.S. authorities froze more than **$832 million** in cryptocurrency and seized major Telegram recruitment channels allegedly used to traffic workers into scam compounds. Treasury also announced sanctions against a Burma-based armed group and associated companies linked to organized crime targeting Americans, underscoring a broader U.S. effort to pressure entities accused of protecting or facilitating the scam-center industry.
Jul 18, 2026
The U.S. Department of Justice, in collaboration with federal law enforcement and interagency partners, has intensified efforts to combat large-scale cryptocurrency-enabled fraud originating from Southeast Asia. This includes the creation of the Scam Center Strike Force, which targets scam compounds that use forced labor to perpetrate investment fraud, and the designation of groups such as the Democratic Karen Benevolent Army (DKBA) and companies like Trans Asia and Troth Star for their roles in these operations. The U.S. government estimates that Americans lost at least $10 billion to such scams in 2024, a significant increase from previous years, and has already seized over $401 million in cryptocurrency assets, with further forfeiture actions underway. A notable case in this crackdown involves the Prince Group, led by Chen Zhi, which operated forced-labor scam compounds in Cambodia. The U.S. Department of Justice unsealed an indictment against Chen Zhi for wire fraud and money laundering, and filed a civil forfeiture complaint for approximately 127,271 Bitcoin—proceeds from these illicit activities. The Chinese National Computer Virus Emergency Response Center (CVERC) has alleged that the U.S. may have acquired these bitcoins from a 2020 attack on the LuBian bitcoin mining pool, raising geopolitical tensions. The Prince Group action is seen as a landmark in the ongoing U.S. campaign to disrupt the infrastructure behind Southeast Asian pig butchering scams and related cybercrime.
Jul 12, 2026