US DOJ Sanctions Xinbi Scam Platform, Freezes $52M in Crypto

US authorities have moved to dismantle parts of Xinbi Guarantee’s ecosystem—seizing crypto assets linked to the alleged scam marketplace and coordinating criminal and sanctions action aimed at the communications and payment infrastructure behind large-scale fraud.

On Wednesday, the US Department of Justice (DOJ) said its Scam Center Strike Force seized two wallets used by Xinbi to collect vendor payments totaling about $12 million, with additional court-authorized restraints sought for 47 more wallets believed to be tied to money laundering across Xinbi’s network. Separately, the US Treasury’s Office of Foreign Assets Control (OFAC) designated Xinbi as a significant transnational criminal organization and sanctioned technology providers SafeW Technology (Singapore) and Anwen Technology (Cambodia) over alleged support to the network.

Key takeaways

• The DOJ action targeted both payment infrastructure (seized and restrained wallets) and the marketplace’s hosting channels, including Telegram infrastructure tied to vendors.
• OFAC sanctions block Xinbi’s US-linked property and generally prohibit US persons from transacting with the designated entities.
• Treasury says Xinbi shifted parts of its operations—particularly merchant and laundering workflows—toward SafeW’s encrypted messaging application after enforcement pressure increased.
• Law enforcement is framing the case as an attempt to disrupt the broader “service layer” enabling industrial-scale scam operations, not just individual scammers.
• TRM Labs policy head Ari Redbord argues Xinbi functioned as a large-scale “escrow and cash-out layer” in Southeast Asia’s scam markets following the fallout of earlier platforms.

Wallet seizures and expanded restraints in DOJ operation

The DOJ said that, based on a court order, its Scam Center Strike Force seized two wallets connected to Xinbi that were used to receive vendor payments. The agency also reported that it requested restraints against 47 additional wallets believed to be part of the platform’s money-laundering channels.

According to the unsealed warrant cited by the DOJ, the US District Court for the District of Columbia authorized the seizure of Telegram channels used to host and advertise the marketplace’s services on Sept. 7. The warrant describes vendors using those channels to promote money laundering services, custom scam-investment websites, and recruitment offerings tied to “scam compounds” in Southeast Asia.

This approach signals a shift in enforcement emphasis: rather than focusing solely on endpoint actors, prosecutors are targeting the operational plumbing—where scams recruit, where services are sold, and where funds move—helping make fraudulent networks more scalable.

Sanctions on Xinbi and technology providers

In a coordinated move, the US Treasury Department announced OFAC designations for Xinbi as a significant transnational criminal organization. Treasury also sanctioned SafeW Technology and Anwen Technology, alleging they provided technological and financial support to Xinbi.

Treasury’s statement ties specific roles to the alleged ecosystem. It said Xinbi began moving its merchant and money-laundering networks to SafeW’s encrypted messaging application around June 2025 as scrutiny intensified. Treasury also alleged that Anwen developed XinbiPay, also referred to as NewPay—a crypto wallet and payment application used by the marketplace.

The practical effect of OFAC sanctions is straightforward: they are intended to prevent Xinbi and the designated supporting entities from accessing US property and to restrict dealings by US persons. For compliance-focused businesses—exchanges, payment processors, service providers, and other crypto-facing firms—the designations increase the compliance burden by adding more counterparties and infrastructure to screening and risk controls.

Treasury further said Xinbi processed over $24 billion in crypto and fiat since around 2022, primarily through Southeast Asia, and that its platform has been used by North Korean hackers and entities associated with the sanctioned Prince Group. Treasury linked Xinbi’s activity to broader geopolitical threat dynamics, underscoring that the scam-marketplace model intersects with sanctioned actors rather than operating in isolation.

Why investigators are emphasizing escrow, communications, and “service layers”

US officials credited Tether with assisting in the investigation, suggesting that the inquiry involved tracing stablecoin-related flows or related compliance data as part of building the case.

The enforcement strategy also reflects a growing understanding of how industrial-scale scams operate. Large fraud networks often depend on a parallel “marketplace” that sells components: payment acceptance/escrow-like functions, tooling for converting funds into usable balances, hosting or distribution channels for recruitment and services, and templates for scam websites. By targeting wallets and Telegram hosting channels, authorities are aiming to choke both the money movement and the promotional layer that drives onboarding.

TRM Labs Global Head of Policy Ari Redbord, speaking to Cointelegraph, argued that Xinbi rose to fill a gap after Huione went down. He said Xinbi became the “go-to escrow and cash-out layer” for Southeast Asia’s scam compounds, describing it as operating “at industrial scale” and moving “more than USD 36 billion.”

That perspective matters for readers trying to interpret the enforcement: it suggests the problem is not simply a single marketplace operator, but a “layer” of services that can migrate and adapt when prior platforms are disrupted.

Sanctions momentum and what to watch next

The latest US designations come after earlier UK sanctions against Xinbi. Cointelegraph previously reported that the UK government imposed sanctions on March 26, freezing UK assets connected to Xinbi and barring the platform from the country’s financial, trade, and travel networks.

With both the DOJ and Treasury taking action now, market participants should expect more follow-on scrutiny across crypto rails commonly used by scam networks—especially wallet infrastructure and communication channels that facilitate vendor operations and fund routing. For compliance teams, the new designations on Xinbi and the technology providers named by OFAC will likely require immediate updates to screening processes and vendor risk assessments.

Readers should watch for additional court filings tied to the restrained wallets and for further public steps that connect Telegram channel seizures to downstream service providers. Equally important is whether new “escrow/cash-out” and encrypted messaging routes emerge to replace capabilities authorities targeted in this case.