U.S. Department of Justice Dismantles Xinbi Guarantee Marketplace in Global Crackdown on Organized Cyber-Scam Syndicates

In a major escalation against the growing epidemic of transnational digital fraud, the United States Department of Justice (DoJ) announced a coordinated, multi-agency operation targeting Xinbi Guarantee, a prominent Telegram-based marketplace serving as a central hub for criminal scam syndicates. The operation, which involved the seizure of digital infrastructure and the freezing of millions in cryptocurrency, marks a significant shift in the federal government’s approach to dismantling the "scam-as-a-service" economy that has flourished in Southeast Asia and beyond.

The enforcement action, spearheaded by the Scam Center Strike Force, saw the successful disruption of 13 illicit scam compounds located in Madagascar. These facilities, largely operated by Chinese organized crime syndicates, have been linked to the exploitation of thousands of victims through sophisticated "pig butchering" romance scams, investment fraud, and human trafficking. The raid resulted in the seizure of over 3,200 electronic devices and the arrest of nearly 400 individuals, including approximately 30 high-ranking syndicate leaders who have since been repatriated to China.

The Rise and Function of Xinbi Guarantee

Xinbi Guarantee emerged as a successor to earlier, similarly illicit platforms such as HuiOne Guarantee and Tudou Guarantee, both of which faced intense scrutiny and eventual closure in the previous year. Operating primarily through the encrypted messaging platform Telegram, Xinbi served as a "one-stop shop" for criminal operators. Its business model was built on providing an intermediary escrow service that facilitated trust between anonymous vendors and scam operators.

By holding funds in escrow until a service was completed, Xinbi ensured that scam center operators could purchase high-value criminal services—such as custom-built investment websites, money laundering logistics, and even the recruitment of forced labor for scam compounds—without the risk of being defrauded by the vendors themselves. Since its inception in 2022, the marketplace facilitated an estimated $30 billion in transactions, making it one of the largest illicit digital marketplaces currently in operation.

Chronology of Enforcement

The takedown of Xinbi is the culmination of months of intensive intelligence gathering by the U.S. Secret Service and blockchain analytics firm Elliptic. The timeline of this systemic disruption highlights the rapid evolution of these criminal marketplaces:

• 2022: Xinbi Guarantee begins operations on Telegram, filling the void left by smaller, less organized criminal forums.
• 2025 (May): Xinbi gains prominence as a major illicit marketplace following the collapse of HuiOne and Tudou Guarantee.
• 2026 (January): Despite pressure from authorities and Telegram’s limited intervention, Xinbi recovers, prompting a wider investigation into its infrastructure.
• 2026 (March): The United Kingdom becomes the first nation to impose formal sanctions on Xinbi for its role in selling stolen personal data and satellite internet equipment used to target victims.
• 2026 (June): The U.S. DoJ and the Treasury Department launch a final, coordinated strike. Authorities freeze 52 cryptocurrency wallets holding $52.8 million in Tether (USDT) and seize control of the platform’s Telegram channels.

The Role of Cryptocurrency and Financial Sanctions

A pivotal component of the operation was the focus on the financial lifelines of these syndicates. Historically, Xinbi operated almost exclusively using Tether’s USDT stablecoin, primarily on the TRON blockchain. Because USDT is issued by a centralized entity with the capability to freeze assets, the U.S. government was able to effectively "choke" the flow of funds by working directly with the issuer.

"Approximately $52 million of cryptocurrency involved in scam money laundering was restrained in one day," the DoJ stated in an official release. This move brought the total assets restrained by the Scam Center Strike Force to approximately $938 million, a figure that underscores the scale of wealth extracted from American victims annually.

In response to these freezes, Xinbi attempted to pivot toward USDD (Decentralized USD), a stablecoin that lacks a centralized issuer. However, industry experts remain skeptical of the platform’s survival. Dr. Tom Robinson, Founder and Chief Scientist at Elliptic, noted that while USDD claims to be decentralized, it remains partially collateralized by freezable assets like USDT, leaving the syndicate exposed to continued financial disruption.

Official Responses and the Strategy of Disruption

The Treasury Department’s Office of Foreign Assets Control (OFAC) has also leveled sanctions against Chinese-language media entities identified as facilitating this criminal activity. Treasury Secretary Scott Bessent emphasized the administration’s commitment to protecting the American financial system. "Scam centers in Southeast Asia steal billions of dollars from American victims each year," Bessent stated. "The Trump Administration is united in its efforts to dismantle these overseas criminal enterprises, and the Treasury will continue using its tools to disrupt the networks behind this egregious fraud."

Tara McLeese, Special Agent in Charge of the U.S. Secret Service Washington Field Office, highlighted the psychological impact of these seizures. "After scamming money from hardworking Americans, criminals operating overseas laundered it through the Xinbi Guarantee network, which operated under the false assumption that they were out of the reach of U.S. law enforcement," she noted.

Broader Implications for Global Cyber-Crime

The takedown of Xinbi is more than a simple law enforcement victory; it is a fundamental challenge to the "business model" of modern organized crime. By eroding the trust between vendors and scammers, the U.S. government has introduced a layer of uncertainty that threatens the stability of the entire ecosystem.

Industry analysts at Elliptic have characterized the action as a "severe setback" for the guarantee marketplace ecosystem. When users can no longer be certain that their illicit payments will remain secure or that their counterparts are legitimate, the efficiency of the criminal marketplace collapses. Furthermore, the expansion of the Scam Center Strike Force’s scope to target physical compounds globally—as evidenced by the Madagascar raids—signals that the U.S. is moving away from purely digital interventions toward direct international cooperation to secure physical infrastructure.

However, the challenge remains significant. As long as there is a demand for "scam-as-a-service" and a pool of vulnerable victims, criminal syndicates will likely attempt to migrate to more obscure platforms or further decentralize their operations. The success of future efforts will depend on sustained international pressure, the continued cooperation of private-sector blockchain analytics firms, and the ability of global law enforcement to keep pace with the rapid technological pivots of criminal enterprises.

Conclusion

The disruption of Xinbi Guarantee serves as a stark reminder of the global nature of modern fraud. By targeting the financial hubs that enable these crimes, the U.S. government has demonstrated that the perceived anonymity of the dark web and encrypted messaging platforms is not absolute. As the Scam Center Strike Force continues its operations, the global criminal community is on notice: the era of operating with impunity from behind a keyboard is rapidly coming to an end. For the victims of these scams, the recent seizures represent a critical step toward accountability and the long-term dismantling of the criminal networks that have exploited thousands of lives.