Xinbi Guarantee: The $24B Telegram Market That Kept the Scam Compounds Supplied

At 8am UTC on Tuesday 8 September 2026, 52 digital wallets stopped working. The $52.8 million inside could still be seen, but not moved. The wallets belonged to Xinbi Guarantee, a Chinese-language marketplace run inside the messaging app Telegram, and to the traders who sold goods there. They sold everything a scam compound needs: people to target, fake investment websites, fresh workers, and ways to turn stolen money into clean cash.

A little over a day later the marketplace was gone. By the afternoon of Wednesday 9 September the US Treasury had put Xinbi under sanctions, the Justice Department had seized two of its wallets holding about $12 million, and Telegram had deleted its channels. Since 2022 Xinbi had handled at least $24 billion, according to the blockchain analytics firm Elliptic, a figure the Treasury repeated. Elliptic ranks it the second-largest illegal online marketplace ever recorded. The largest was the one it replaced, Huione Guarantee.

The shop behind the scam

Xinbi's best customers ran "pig butchering", the romance and investment con named after the farmer's habit of fattening a pig before slaughter (sha zhu pan in Chinese). A stranger strikes up a friendship by text message or on a dating app, spends weeks building trust, then introduces the victim to a trading website that shows handsome profits. The profits are invented and so is the website. When the victim asks for the money back, it has already gone. Much of the chatting is done from walled compounds in Cambodia, Myanmar and Laos, often by trafficked workers lured with fake job adverts.

The losses are large. The FBI's Internet Crime Complaint Center received 181,565 complaints involving crypto in 2025, with reported losses of more than $11 billion, and investment fraud was the biggest single driver. Those are only the victims who reported it.

A scam compound is a business, and businesses have suppliers. According to a seizure warrant unsealed on 9 September, vendors on Xinbi advertised custom scam investment websites, "washing" of money taken from fraud victims, and recruitment of trafficking victims to work in Southeast Asian compounds. TRM Labs, another analytics firm, found listings for stolen personal data, fake identity documents, AI deepfake tools, satellite internet kits and cash exchange desks. One advert published by prosecutors offered live models or AI-generated videos for calls with victims, to "deepen their emotional connection".

How a guarantee market works

Criminals buying from other criminals have a problem: nobody can sue. Xinbi solved it the way a solicitor handles a house deposit. It acted as escrow, a trusted middleman that holds the buyer's payment until the seller delivers. Vendors also lodged a deposit with Xinbi that could repay a cheated buyer. That promise was the "guarantee" in the name.

Payment was in USDT, a stablecoin: a digital token issued by the company Tether and designed to be worth exactly one US dollar, like a digital banknote. Most of it moved on TRON, a blockchain that works as a cheap public payment network where every transfer is recorded. By September 2026 Xinbi's Telegram channels had 657,643 subscribers, TRM counted, and the security firm DarkTower told The Record that more than 4,600 vendors were trading there in early September.

Scammers were not the only customers. The Treasury said the platform had reportedly been used by North Korean hackers and by businesses already under US sanctions, including Jin Bei Group and parts of the Prince Group network. Chainalysis traced tens of millions of dollars from North Korea's thefts at the exchanges Bybit and WazirX through Xinbi vendors selling "Black U" services, which swap stolen, traceable tokens for cleaner ones drawn from scam takings. Oddly, Elliptic found Xinbi Co., Ltd registered as a company in Colorado in August 2022; by January 2025 the state listed it as delinquent.

Huione came first

Xinbi grew out of someone else's collapse. Huione Guarantee, part of the Cambodian conglomerate Huione Group, was exposed by Elliptic in July 2024 as a bazaar for scam suppliers. In May 2025 the Treasury's Financial Crimes Enforcement Network (FinCEN), the agency that polices money laundering through banks, proposed cutting Huione Group off from the US financial system, saying it had laundered at least $4 billion between August 2021 and January 2025. On 13 May 2025, after Elliptic passed on its findings, Telegram shut down both Huione Guarantee, by then renamed Haowang Guarantee, and Xinbi. Huione's market never returned. Elliptic puts its lifetime total at $31 billion, with a further $103 billion through its payments arm, Huione Pay.

Xinbi did return. Its daily inflows nearly doubled between May and December 2025, TRM found, as it absorbed Huione's merchants and the customers of another rival, Tudou Guarantee, which also shut. The Treasury put it plainly: after Huione was cut off, cybercriminals moved to Xinbi, which offered "substantially similar services to an overlapping customer base". Around June 2025 Xinbi began moving its merchants to SafeW, an encrypted messaging app, and launched its own wallet app, XinbiPay, also sold as NewPay. It even opened a physical shop in Yatai New City, a sanctioned scam compound complex in Myanmar, which Elliptic says the Myanmar military raided in late 2025.

FinCEN finalised its Huione ban in October 2025, the same week the US and UK sanctioned the Prince Group. On 1 December 2025 Huione Pay froze withdrawals after a rush of customers, then resurfaced as H-Pay, which FinCEN moved to cut off in June 2026. Huione's former chairman, Li Xiong, was extradited from Cambodia to China on 1 April 2026 to face fraud and money laundering charges.

©CMZ chart. Data: Elliptic, US Treasury

How the money was frozen

Stablecoins have a feature most crypto lacks: the issuer can freeze them. Tether can block the tokens at any address, much as a bank freezes an account, so the balance shows but cannot be spent. Elliptic, which had tracked Xinbi's wallets for years, gave the US Secret Service a map of the addresses belonging to the marketplace and its vendors, and the 52 wallets were frozen on 8 September. A day earlier, on 7 September, a federal court in Washington, DC had authorised the seizure of the Telegram channels that hosted the market.

On 9 September the pieces landed together. Jeanine Ferris Pirro, the US Attorney for the District of Columbia, said her Scam Center Strike Force, a Justice Department unit set up in November 2025, had seized two wallets holding about $12 million that Xinbi used to hold vendor payments, and had sought to restrain 47 more. In all, more than $52 million was restrained, and prosecutors thanked Tether. Pirro said Chinese organised crime could buy "a custom website and a money laundering service the way you order takeout".

The same day the Treasury's Office of Foreign Assets Control (OFAC) named Xinbi a significant transnational criminal organisation. Sanctions work like a blacklist for the US financial system: anything a listed party owns in the US, or held by a US person, is frozen, and Americans, including banks and companies, may not deal with it. OFAC also listed Anwen Technology, the Cambodian developer of XinbiPay, and SafeW Technology of Singapore, maker of the messaging app, and published 52 TRON addresses. Britain had moved first, sanctioning Xinbi on 26 March 2026 under its human rights rules. By 16:20 UTC on 9 September Telegram had deleted Xinbi's main channels and banned its usernames, Elliptic reported.

What happened next

Xinbi's administrators posted a statement condemning Tether's "arbitrary freezing" and promising to compensate customers. They announced a move to USDD, a rival dollar token on TRON launched in 2022 by TRON's founder, Justin Sun, which has no central issuer that can freeze it. Within hours Xinbi swapped about $2.8 million of its remaining USDT into USDD through a decentralised exchange, an automated currency booth run by software, Elliptic said. USDD is partly backed by USDT, Elliptic noted, so it is not fully beyond reach.

The freeze was a big number and a small fraction: about 0.2% of the $24 billion that passed through the market, and less against TRM's own estimate of more than $36 billion. The deeper damage is to trust, the only thing a guarantee market really sells. Every vendor now knows a wallet can be frozen overnight. Elliptic's co-founder, Tom Robinson, told The Record that Xinbi would likely "try to rebuild and relaunch, but it will be very challenging". As of 28 September 2026 no confirmed relaunch had been reported.