U.S. Department of Justice and Global Task Forces Dismantle Xinbi Guarantee Cryptocurrency Scam Marketplace

In a major escalation of the international campaign against organized cyber-criminal syndicates, the United States Department of Justice (DoJ) has executed a series of high-impact operations against Xinbi Guarantee, a sprawling, Telegram-based illicit marketplace that has served as a central nervous system for transnational "pig butchering" scams and financial laundering operations. The crackdown, conducted in coordination with the Scam Center Strike Force and international partners, marks a critical blow to the criminal infrastructure that has facilitated billions of dollars in losses for victims worldwide.

The operation involved the seizure of critical digital infrastructure, including Telegram channels used to coordinate illicit transactions, and the freezing of cryptocurrency wallets containing tens of millions of dollars in illicit proceeds. Beyond the digital front, the U.S. government extended its reach into physical territory, with the Scam Center Strike Force coordinating the disruption of 13 separate scam compounds located in Madagascar. This multi-pronged strategy represents a significant shift in how law enforcement is tackling the rise of decentralized, cross-border criminal marketplaces that have proliferated in the wake of previous regulatory actions.

The Rise and Structure of Xinbi Guarantee

Xinbi Guarantee emerged as the primary successor to a lineage of illicit "guarantee" marketplaces, filling the void left by the shuttering of its predecessors, HuiOne Guarantee and Tudou Guarantee, throughout 2024 and 2025. These platforms operated as high-tech, black-market intermediaries, facilitating the "business-to-business" exchange of services required to sustain massive, industrial-scale romance and investment scams.

At its core, Xinbi functioned as a one-stop-shop for criminal entrepreneurs. Operators of scam centers—often organized crime syndicates—used the platform to procure essential tools of the trade. This included the purchase of custom-coded investment websites, the acquisition of stolen personal data for targeted phishing, and the procurement of satellite internet equipment designed to circumvent local infrastructure and contact victims globally. Furthermore, the marketplace served as a human trafficking nexus, where operators could solicit and trade victims to work in forced-labor scam compounds across Southeast Asia and beyond.

The "guarantee" element of the platform was its most innovative and dangerous feature. Xinbi acted as an escrow service, holding funds in cryptocurrency until the contracted service—such as the completion of a fraudulent website or the laundering of stolen proceeds—was confirmed. This trust-based mechanism provided a layer of professional legitimacy to criminal transactions, effectively incentivizing vendors to provide high-quality services to scam operators.

Chronology of Operations and Regulatory Pressure

The crackdown on Xinbi is the culmination of years of intelligence gathering and inter-agency cooperation. The timeline of the rise and fall of these platforms illustrates the persistent "whack-a-mole" dynamic that characterizes modern cybercrime enforcement:

• 2022: Xinbi Guarantee is established, operating primarily on Telegram and utilizing Tether (USDT) on the TRON blockchain for payments.
• 2024–2025: Following intense pressure on precursors like HuiOne and Tudou, Xinbi solidifies its position as the market leader, with transaction volumes eventually reaching an estimated $30 billion since its inception.
• March 2026: The United Kingdom takes the lead in international sanctions, becoming the first nation to formally blacklist Xinbi for its role in distributing stolen personal data and illicit technical equipment.
• June 2026: The U.S. Department of Justice formally announces coordinated seizures. The Scam Center Strike Force deploys to Madagascar to dismantle 13 physical compounds.
• July 2026: The U.S. Treasury’s Office of Foreign Assets Control (OFAC) imposes comprehensive sanctions on Chinese-language media outlets suspected of facilitating these criminal enterprises.

Financial Impact and Technical Disruption

According to blockchain analytics firm Elliptic, which collaborated closely with the U.S. Secret Service, the impact of the most recent operation was immediate. Authorities successfully identified and froze 52 wallets associated with the marketplace, resulting in the restraint of $52.8 million in Tether (USDT). This brings the total amount restrained by the Scam Center Strike Force since its inception to approximately $938 million.

The technical disruption was compounded by the seizure of Telegram usernames and the permanent banning of channels that served as the platform’s storefront. However, the resilient nature of these criminal networks was highlighted shortly after the seizure. In a desperate attempt to maintain liquidity, Xinbi operators initiated a shift away from Tether—which contains centralized "freeze" functions that allow issuers like Tether to blacklist specific addresses—toward USDD (Decentralized USD). While USDD markets itself as a decentralized stablecoin, experts remain skeptical of its long-term viability as a safe harbor for criminals, noting that the asset remains partially collateralized by freezable assets, maintaining a persistent risk of future asset seizure.

Official Responses and Strategic Implications

Secretary of the Treasury Scott Bessent emphasized the gravity of the threat posed by these networks during the announcement of the sanctions. "Scam centers in Southeast Asia steal billions of dollars from American victims each year," Bessent stated. "The Trump Administration is united in its efforts to dismantle these overseas criminal enterprises, and the Treasury will continue using its tools to disrupt the networks behind this egregious fraud and protect Americans."

The operation in Madagascar, which led to the arrest of nearly 400 individuals and the seizure of over 3,200 electronic devices, signals a broader pivot for U.S. law enforcement. The Scam Center Strike Force has signaled its intent to expand its scope beyond digital marketplaces, moving toward a global strategy that addresses the physical, brick-and-mortar compounds where victims are often held under duress. The repatriation of approximately 30 high-ranking Chinese leaders of these compounds back to China suggests a level of diplomatic cooperation between Washington and Beijing regarding the suppression of transnational cyber-fraud.

Analysis: A Severe Setback for the "Guarantee" Ecosystem

The dismantling of Xinbi represents more than just a financial loss for the criminal syndicates involved; it represents a significant degradation of the "trust architecture" upon which these marketplaces rely. In the illicit world, reputation and escrow reliability are the primary currencies. By successfully penetrating the payment layers of these platforms, law enforcement has introduced a new variable of risk that will likely increase the costs of doing business for scam operators.

Dr. Tom Robinson, Founder and Chief Scientist at Elliptic, noted that these actions undermine the core mechanism these marketplaces rely on to function. "Merchants and users of these services will now be operating with the knowledge that their wallets may be identified and frozen at any time," Robinson stated. "This uncertainty undermines the trust that merchants and criminal users have in these marketplaces."

The implications for the broader cryptocurrency ecosystem are also profound. As illicit actors scramble to find assets that cannot be frozen, they are pushed toward more obscure, potentially volatile, and less liquid assets, which often makes them easier to track. Furthermore, the increased scrutiny on Telegram-based marketplaces serves as a warning to other platforms that provide infrastructure for criminal activity.

As the Scam Center Strike Force continues to scale its operations, the focus is likely to remain on the intersection of physical infrastructure and digital finance. The success of the Madagascar operation serves as a blueprint for future interventions, proving that when law enforcement combines advanced blockchain forensics with international diplomatic pressure, they can effectively challenge even the most entrenched organized crime syndicates. For now, the closure of Xinbi stands as a testament to the evolving capacity of global authorities to strike back against the digital facilitators of modern slavery and financial fraud.