Blab Tech
US Authorities Seize $52 Million in Crypto, Target Xinbi Guarantee Marketplace Infrastructure
When U.S. authorities announced their action on September 10, 2026, they didn’t merely freeze a handful of wallets; they pulled $52 million in cryptocurrency from a sprawling cyber‑crime network that has been moving fraud proceeds and stolen assets for years.
The Treasury Department’s Office of Foreign Assets Control (OFAC) declared Xinbi Guarantee a transnational criminal organization and slapped sanctions on two firms that the platform relies on for communication and payment: SafeW Technology and Anwen Technology. The move also froze ten Telegram channels tied to Xinbi and seized two wallets that held roughly $12 million. OFAC’s action follows earlier enforcement that targeted Xinbi’s USDT (Tether) network, including a $39.3 million freeze on ten Tron addresses.
Xinbi Guarantee began as a simple escrow service but has since morphed into a sophisticated financial engine that connects stolen cryptocurrency, fraud proceeds, and underground cash‑out networks. Chainalysis, a blockchain‑analytics firm, reported that North Korea‑linked threat actors moved tens of millions of dollars in stolen crypto through vendors on the platform. The marketplace’s vendor channels offer a range of services—from bank‑card fraud and personal‑data sales to surveillance equipment and malware development. Analysts estimate that Xinbi processed about $24 billion in digital assets and fiat after it emerged in 2022.
By sanctioning SafeW and Anwen, authorities targeted the messaging and payment applications—SafeW’s encrypted “SafeW” app and Anwen’s XinbiPay (also known as NewPay)—that vendors use to coordinate transactions. Xinbi’s shift to these services began in June 2025, as the platform sought alternatives to the heavily monitored USDT. The sanctions also aimed at the Telegram channels that facilitate escrow and dispute resolution between buyers and sellers.
The enforcement has already produced measurable on‑chain effects. Bitrace, a crypto‑analytics firm, reported abnormal outflows from a Xinbi sub‑guarantee platform that had previously operated with limited visibility. Daily USDT withdrawals ranged from $389,000 to $564,000 between September 1 and 7, then spiked to $1.28 million on September 8 and $1.81 million on September 9. By September 10, an additional $708,125 had left the platform. The firm attributed the rapid withdrawals to merchants moving funds to avoid potential freezes.
The ripple effect is visible on rival platforms. Fulilai Guarantee, another major transaction‑guarantee marketplace, began removing money‑laundering merchants from public groups after the Xinbi sanctions. Bitrace noted that Fulilai’s wallet recorded about $9.3 million in outflows since OFAC announced the Xinbi sanctions. The purge included operators offering “card‑to‑USDT” and “cash car” services, which are commonly used to move or convert illicit funds.
Xinbi’s attempts to shift activity away from USDT—after issuer‑level freezes demonstrated how centralized stablecoins can become enforcement choke points—appear limited by the broader sanctions on service providers and payment infrastructure. Moving to another token may reduce exposure to a direct issuer freeze, but it does not address the risk posed by sanctioned companies that facilitate the movement of stolen assets.
The U.S. action follows similar measures by the United Kingdom and other governments that increasingly target the service providers enabling the transfer of illicit crypto. The Treasury’s designation of Xinbi as a transnational criminal organization signals a broader strategy to dismantle the financial backbone of cyber‑crime networks.
At present, U.S. authorities have restrained over $52 million in crypto, seized multiple wallets and messaging channels, and sanctioned key infrastructure providers. The crackdown has triggered significant withdrawals from Xinbi and its rivals, and has prompted the removal of laundering merchants from competing platforms. Future enforcement actions may focus on additional payment providers and on‑chain monitoring tools, while regulators continue to evaluate the effectiveness of sanctions against the evolving infrastructure of illicit cryptocurrency markets.
The Treasury Department’s Office of Foreign Assets Control (OFAC) declared Xinbi Guarantee a transnational criminal organization and slapped sanctions on two firms that the platform relies on for communication and payment: SafeW Technology and Anwen Technology. The move also froze ten Telegram channels tied to Xinbi and seized two wallets that held roughly $12 million. OFAC’s action follows earlier enforcement that targeted Xinbi’s USDT (Tether) network, including a $39.3 million freeze on ten Tron addresses.
Xinbi Guarantee began as a simple escrow service but has since morphed into a sophisticated financial engine that connects stolen cryptocurrency, fraud proceeds, and underground cash‑out networks. Chainalysis, a blockchain‑analytics firm, reported that North Korea‑linked threat actors moved tens of millions of dollars in stolen crypto through vendors on the platform. The marketplace’s vendor channels offer a range of services—from bank‑card fraud and personal‑data sales to surveillance equipment and malware development. Analysts estimate that Xinbi processed about $24 billion in digital assets and fiat after it emerged in 2022.
By sanctioning SafeW and Anwen, authorities targeted the messaging and payment applications—SafeW’s encrypted “SafeW” app and Anwen’s XinbiPay (also known as NewPay)—that vendors use to coordinate transactions. Xinbi’s shift to these services began in June 2025, as the platform sought alternatives to the heavily monitored USDT. The sanctions also aimed at the Telegram channels that facilitate escrow and dispute resolution between buyers and sellers.
The enforcement has already produced measurable on‑chain effects. Bitrace, a crypto‑analytics firm, reported abnormal outflows from a Xinbi sub‑guarantee platform that had previously operated with limited visibility. Daily USDT withdrawals ranged from $389,000 to $564,000 between September 1 and 7, then spiked to $1.28 million on September 8 and $1.81 million on September 9. By September 10, an additional $708,125 had left the platform. The firm attributed the rapid withdrawals to merchants moving funds to avoid potential freezes.
The ripple effect is visible on rival platforms. Fulilai Guarantee, another major transaction‑guarantee marketplace, began removing money‑laundering merchants from public groups after the Xinbi sanctions. Bitrace noted that Fulilai’s wallet recorded about $9.3 million in outflows since OFAC announced the Xinbi sanctions. The purge included operators offering “card‑to‑USDT” and “cash car” services, which are commonly used to move or convert illicit funds.
Xinbi’s attempts to shift activity away from USDT—after issuer‑level freezes demonstrated how centralized stablecoins can become enforcement choke points—appear limited by the broader sanctions on service providers and payment infrastructure. Moving to another token may reduce exposure to a direct issuer freeze, but it does not address the risk posed by sanctioned companies that facilitate the movement of stolen assets.
The U.S. action follows similar measures by the United Kingdom and other governments that increasingly target the service providers enabling the transfer of illicit crypto. The Treasury’s designation of Xinbi as a transnational criminal organization signals a broader strategy to dismantle the financial backbone of cyber‑crime networks.
At present, U.S. authorities have restrained over $52 million in crypto, seized multiple wallets and messaging channels, and sanctioned key infrastructure providers. The crackdown has triggered significant withdrawals from Xinbi and its rivals, and has prompted the removal of laundering merchants from competing platforms. Future enforcement actions may focus on additional payment providers and on‑chain monitoring tools, while regulators continue to evaluate the effectiveness of sanctions against the evolving infrastructure of illicit cryptocurrency markets.
