XinbiPay: A Sanctioned Scam Market's Visa Card and the Questions for UPay

On Thursday 1 October 2026 Owen Yang, co-founder and chief executive of the crypto card company UPay, posted two words on X: "Korean trip". UPay had spent the week at Korea Blockchain Week in Seoul, a trade show. The next day, at 12:59 UTC, a reply landed underneath it from ZachXBT, the blockchain investigator with more than a million followers. It came with a short video. A hand turns a black Visa card over and back, a large holographic X across the front, a contactless symbol in the corner.

"Since you've not replied to my DM can you please clarify why it looks like your company UPay potentially allowed Xinbi (sanctioned illicit marketplace) to whitelabel its Visa crypto card with Xinbi primarily supported pig butchering, fraud, money laundering, and human trafficking." ZachXBT wrote. "Xinbi primarily supported pig butchering, fraud, money laundering, and human trafficking."

The name matters. Twenty-three days earlier, on 9 September, the US Treasury's Office of Foreign Assets Control (OFAC), the agency that runs America's financial blacklist, had named Xinbi Guarantee a significant transnational criminal organisation. The Treasury said the Chinese-language marketplace had processed the equivalent of more than $24 billion since around 2022, connecting scam centres in Southeast Asia with sellers of money laundering, technology and other services. The analytics firm TRM Labs puts the total above $36 billion. Britain's Foreign, Commonwealth and Development Office had sanctioned Xinbi in March.

These are questions and allegations, not findings. ZachXBT framed his post as a question. No regulator, court or police force has accused UPay of anything, and UPay says it has never done business with Xinbi.

What a white-label card is

A white-label card is a shop selling a bank's card under its own name. A supermarket credit card works this way: the supermarket's logo is on the plastic, but a licensed bank issues the card and a payments company runs the accounts behind it. The customer deals with the brand. The brand never needs a banking licence.

A Visa card passes through several hands. Visa is the network, the road that carries a payment from the till to the bank, and it sets rules for everyone who uses the road. The issuer is a licensed bank or payments firm that is a Visa member and actually puts the card into circulation. The programme manager is the company that builds the app, onboards customers and runs the day-to-day business. The white-label client is the brand on the front. In a properly run chain, the programme manager checks each client before it gets cards (known as KYB, or know your business) and each cardholder after (KYC, or know your customer), and the issuer checks the programme manager. Responsibility for knowing who is really behind a brand sits mainly with those two.

UPay sits in the programme manager seat. Its website advertises crypto card issuance for businesses and promises "end-to-end solutions that help businesses launch and manage their own branded card programs". It says it has issued more than 320,000 cards to over 300,000 users in more than 180 countries, and lists a money service operator licence in Hong Kong, money services business registrations in the US and Canada, and an in-principle approval as a crypto service provider in Lithuania. The site names the operating company as UPay Technology Ltd, with an address in Denver, Colorado. Neither UPay nor ZachXBT has said which bank issues the card in the video.

©CMZ graphic

How a crypto card turns digital dollars into spending money

Most of the money moving through Xinbi was USDT, a stablecoin: a digital token issued by the company Tether and designed to be worth exactly one US dollar, like a digital banknote. It moves cheaply on TRON, a blockchain that works as a public payment network.

A crypto card connects those tokens to ordinary shops. The holder deposits USDT into an app. At the till, the card works like any Visa debit card. The card provider sells enough tokens to cover the bill and pays in ordinary money through the Visa system. The shop never sees crypto.

For a criminal marketplace this is the valuable part. Tether can freeze USDT sitting at a known address, much as a bank freezes an account. Around the time of the sanctions Tether froze more than $52 million linked to Xinbi, using wallet maps the analytics firm Elliptic had given US investigators, and the Justice Department's Scam Center Strike Force seized about $12 million of it. Money that has already become groceries, flights or ATM cash cannot be frozen. A card branded for Xinbi's own users would have been a way to turn scam proceeds into spending at any shop that takes Visa. That is the risk ZachXBT's question points at. It is not proof that anyone used a card that way.

Why sanctions make it serious

The Treasury's 9 September action did not only name Xinbi. It also sanctioned Anwen Technology, a Cambodian company the Treasury described as the developer of XinbiPay, "a cryptocurrency payment and digital wallet application" that Xinbi launched around June 2025 and that is also sold as NewPay. SafeW Technology of Singapore, maker of the SafeW messaging app Xinbi moved its traders to, was sanctioned too. XinbiPay is therefore itself a sanctioned product, made by a sanctioned company.

Under OFAC's rules, Americans and US companies may not deal with a blocked party or anything it owns 50 percent or more of. OFAC can fine breaches on a "strict liability basis", meaning a firm can be penalised even if it did not know. Non-US firms are barred from causing US persons to breach sanctions, "wittingly or unwittingly", and the Treasury, led by Secretary Scott Bessent, warned that "financial institutions and other persons may risk exposure to sanctions" for dealing with blocked parties. A front company with a clean name is the obvious way around such checks, which is ZachXBT's point. Whether any rule was broken here depends on facts that are not yet public: who the Hong Kong company really is, who owns it, and where its cards went.

What UPay said

UPay's answers came in stages. At 15:48 UTC on 2 October, Yang replied that he had not opened ZachXBT's private message earlier: "We already started internal investigation. Will update soon." At 18:03 UTC he posted a longer statement saying UPay was working with "external security partners" and that "we have not identified or seen any related entity onboarded with UPay". UPay's official account described the subject as "a card bearing UPay branding" and its alleged connection to Xinbi. At 18:51 UTC Yang added: "Till now no any XinBi related entity pass our KYB."

On 3 October, at 18:26 UTC, UPay published its preliminary findings. "The card design referenced in the public post belongs to another company," it said, and its review of that company's customer, director and ownership records "has not identified a connection to Xinbi to date". It added: "UPay has never provided a white-label solution to Xinbi." As a precaution, UPay said it had "temporarily frozen all cards issued under the company's programme", opened a formal request for information from the client, and promised a progress update within 48 hours.

Six minutes later Yang named the client's location. "The card interface in the video was applied by one HK company," he wrote, adding that standard checks on the company and its ultimate owners "didn't find any potential problems at that moment". He said UPay was asking the firm why its card design had elements similar to Xinbi's, but that it had not answered because it was the weekend. He thanked ZachXBT and asked how and where the card was being promoted.

ZachXBT was not persuaded. Replying that evening to Daniel Zou, an X user who called Yang "my good brother" and urged patience, he wrote: "Your mistake is thinking an illicit actor would register with its actual name and not a fake shell company." He said "XinbiPay support was contacted a bit ago and provided the video I attached as proof of its crypto card", that he had given UPay two weeks to reply before going public, and that "They did not reply until after I posted and stated it's a HK entity."

Visa had not commented publicly, The Crypto Times reported on 3 October. Nothing published suggests Visa knew of the card, and ZachXBT's question was put to UPay, not to Visa.