On September 9, 2026, US authorities took action against Xinbi Guarantee, a Chinese-language marketplace investigators describe as a central hub for Southeast Asia’s industrial-scale online fraud economy.
The Treasury Department’s Office of Foreign Assets Control (OFAC) listed the platform as a significant transnational criminal organization and also designated two firms that built tools around it: Cambodia-based Anwen Technology, developer of the XinbiPay wallet also marketed as NewPay, and Singapore-based SafeW Technology, creator of the encrypted SafeW messaging app.
Fifty-two TRON addresses were added to the Specially Designated Nationals list.
The same day, the Justice Department’s Scam Center Strike Force seized related infrastructure and digital asset wallets.
Officials said they seized or restrained more than $52 million in cryptocurrency tied to Xinbi and its vendor network, and took down Telegram channels used to advertise laundering, fake investment sites, and compound recruitment.
Telegram also banned Xinbi.
Treasury said the marketplace has, since about 2022, processed the equivalent of more than $24 billion in digital assets and fiat, mostly across Southeast Asia.
Blockchain analytics firms put the figure higher: TRM Labs estimates more than $36 billion in throughput and about $17 billion in inflows, while Chainalysis notes that the 52 designated addresses alone received more than $8.4 billion in stablecoins.
Settlements have been concentrated in USDT on TRON.
XinbiPay’s withdrawal hot wallet took in $94.6 million in December 2025, according to TRM Labs.
Xinbi did not function as a conventional exchange.
It operated as an escrow “guarantee” service linking scam-compound operators with vendors selling stolen personal data, forged identity documents, deepfake tools, satellite internet gear, unlicensed over-the-counter cash-out services, and custom fake brokerage websites.
After a buyer paid, Xinbi held funds until the seller delivered—an arrangement that lowered friction for criminal counterparties who would otherwise struggle to trust one another.
Investigators place much of this activity in the Golden Triangle spanning Myanmar, Thailand, and Laos, with compounds that have used trafficked workers lured by false job offers.
The marketplace expanded as rivals were squeezed.
After FinCEN targeted Huione Pay as a primary money laundering concern, and after Telegram restrictions and earlier crackdowns hit Huione, Haowang, and Tudou Guarantee, a large share of remaining volume migrated to Xinbi.
TRM Labs reported that daily inflows nearly doubled between May and December 2025.
Around June 2025, facing rising scrutiny, Xinbi pushed merchants onto SafeW and launched the no-KYC XinbiPay wallet supporting USDT on TRC-20, ERC-20, and BEP-20.
Designating those developers was meant to hit that fallback infrastructure, not only the public storefront.
US officials also tied the platform to a wider national-security picture.
Treasury said North Korean-linked actors and previously designated groups, including entities associated with the Prince Group and Jin Bei Group, used Xinbi.
Chainalysis reported that DPRK-linked wallets moved tens of millions of dollars from major exchange thefts, including the Bybit and WazirX hacks, through Xinbi vendors that swapped tainted coins for cleaner stablecoins.
The US action follows a UK designation of Xinbi in March 2026 and earlier US measures against the Prince Group and Huione.
For compliance teams, the effect is immediate.
Property of the designated parties that is in the United States or controlled by US persons is blocked and must be reported. Any company owned 50 percent or more by blocked persons is also blocked.
US persons generally cannot deal with them, and civil penalties can apply on a strict-liability basis.
Platforms that continue to process flows linked to Xinbi, XinbiPay, SafeW, or the listed wallets now face sanctions exposure even if the original Telegram shopfront is gone. The episode underscores a pattern: when one guarantee market is dismantled, another absorbs the demand unless the wallets, apps, and escrow rails are targeted together.