The Xinbi Freeze and Seizure
On September 8, 2026, the United States Secret Service successfully froze approximately $52.8 million in cryptocurrency assets associated with Xinbi Guarantee 2. This enforcement action targeted a Chinese-language marketplace operating on the Telegram platform, which provides infrastructure and tools for global scam operations 2. The Secret Service collaborated with the blockchain analytics firm Elliptic to trace and isolate the illicit funds 2. According to Elliptic, their multi-year tracking of Xinbi's wallet infrastructure directly facilitated both the freezing action and the subsequent sanctions 2.
The operation commenced at 8:00 AM UTC on September 8, targeting 52 distinct wallets that held the dollar-pegged stablecoin USDT 2. Out of these, two wallets containing about $12 million were seized outright under a warrant unsealed by the Department of Justice, while the remaining assets were frozen pending further legal proceedings 2. However, the enforcement faced immediate challenges, as a newly activated business address for Xinbi on September 8, 2026, was only partially restricted, allowing $1.8 million in USDT to escape while only 37,839 USDT was successfully frozen 2.
Inside the Xinbi Guarantee Marketplace
Xinbi Guarantee does not function as a traditional retail marketplace but rather as an escrow and trust-building platform for cybercriminals 2. Within this ecosystem, vendors deposit cryptocurrency as collateral to assure buyers that transactions—ranging from the sale of stolen personal data to money-laundering services—will be fulfilled 2. If a buyer is defrauded, they can seek reimbursement from these deposits 2.
Since 2022, Xinbi and its affiliated merchants have processed a minimum of $24 billion in transactions, positioning it as the second-largest illicit online marketplace ever monitored by blockchain analysts 2. It is surpassed only by Huione Guarantee, which processed $31 billion before being shut down by Telegram in May 2025 following a Treasury finding that its parent group was a primary money laundering concern 2. Xinbi subsequently absorbed a significant portion of the transaction volume left behind by Huione's closure 2. A substantial portion of the capital moving through these platforms originates from "pig butchering" schemes, where perpetrators build fraudulent online relationships over weeks or months to coerce victims into investing in deceptive applications 2.
Sanctions and the Shift to USDD
Following the asset freeze, the U.S. Department of the Treasury's Office of Foreign Assets Control designated Xinbi as a transnational criminal organization on September 9, 2026 2. This designation places the marketplace in the same category as international drug cartels 2. Alongside Xinbi, the Treasury sanctioned SafeW Technology, a firm based in Singapore, and Anwen Technology, located in Cambodia, for providing operational support 2. These actions follow prior international pressure, including sanctions imposed on Xinbi by the United Kingdom in March 2026 2.
In response to the asset freezes, Xinbi released a statement criticizing the actions as arbitrary and pledged to reimburse its users 2. To evade future freezes, the marketplace began transitioning its operations from USDT to USDD, a stablecoin launched by Tron founder Justin Sun that lacks a centralized freeze mechanism 2. Xinbi has already converted approximately $2.8 million of its remaining USDT into USDD via a decentralized exchange 2. However, analysts note that USDD is partially backed by USDT reserves, meaning it remains exposed to the very centralized freeze mechanisms Xinbi is attempting to avoid 2.
A Broader Landscape of Crypto Enforcement
The action against Xinbi coincided with a series of global enforcement efforts led by international authorities. On September 9, 2026, the Department of Justice's Scam Center Strike Force, which was established in November 2025, assisted local authorities in Madagascar to dismantle 13 Chinese-run scam compounds 2. This operation resulted in nearly 400 arrests and the seizure of over 3,200 devices 2. Since its inception, the Strike Force has seized approximately $938 million in cryptocurrency linked to scams 2.
Simultaneously, other major crypto-related criminal cases have advanced in U.S. courts. In September 2026, Malone Lam, a 22-year-old Singaporean national residing in Miami, pleaded guilty to leading an international conspiracy that stole 4,100 bitcoins, which were valued at over $230 million at the time of the theft 1. The conspiracy, which operated from October 2023 through at least May 2025, utilized database hacks, social engineering, and physical home break-ins to steal private keys and drain wallets, ultimately taking $245 million in cryptocurrency 1.
Meanwhile, European authorities are pursuing similar crackdowns. In September 2026, Polish Prosecutor General Waldemar Żurek announced that a court approved the pretrial detention of Roman Ż., the fifth suspect in an ongoing investigation into the Zondacrypto exchange 3. Roman Ż. is accused of participating in an organized criminal group that misappropriated at least 7.8 million złoty, or approximately $2 million, from exchange users between 2020 and 2026 3. This follows the detention of three other suspects on September 4, 2026, amid allegations of laundering millions of złoty through fictitious property deals 3.
What is not yet established
- The full extent of the remaining assets in Xinbi's frozen wallets that have not yet been seized outright
- The current whereabouts of Zondacrypto's former CEO, Przemysław Kral, who has been missing since April 16, 2026
- Whether Xinbi will succeed in fully transitioning its operations to USDD without facing further asset freezes due to USDD's USDT backing
Frequently asked questions
How much money has the Scam Center Strike Force seized since its launch?
The Strike Force has seized approximately $938 million in scam-linked cryptocurrency since it began operating in November 2025 2.
What is the estimated transaction volume processed by Xinbi Guarantee?
Since 2022, Xinbi and its merchants have processed at least $24 billion in transactions, making it the second-largest illicit online marketplace ever tracked 2.
What charges does the fifth suspect in the Zondacrypto investigation face?
Roman Ż. is charged with membership in an organized criminal group and misappropriating at least 7.8 million złoty, or about $2 million, from exchange clients 3.
Sources
- Bitcoin Magazine — Ringleader of $245M Crypto Theft Pleads Guilty (2026-09-10) https://bitcoinmagazine.com/news/ringleader-in-bitcoin-theft-guilty
- Decrypt — Secret Service Freezes $52.8 Million in Crypto Tied to Telegram Bazaar Behind Global Scams (2026-09-09) https://decrypt.co/377804/secret-service-freezes-crypto-telegram-bazaar-xinbi
- Decrypt — Polish Court Detains Fifth Suspect in Zondacrypto Exchange Probe (2026-09-08) https://decrypt.co/377650/polish-court-detains-fifth-suspect-in-zondacrypto-exchange-probe
This brief is for information and education. It is not financial advice or a recommendation to buy or sell.