"Scam centers in Southeast Asia steal billions of dollars from American victims each year," said Secretary of the Treasury Scott Bessent, as the U.S. government moved to dismantle a key online marketplace that helped organize and launder the proceeds of those schemes.
Justice Department and Secret Service: seizures, Telegram takedowns, and wallet restraints
The U.S. Department of Justice announced coordinated actions against Xinbi Guarantee, a Telegram-oriented illicit marketplace that offered services to run and launder proceeds from "pig butchering" romance scams. The Justice Department said it seized the Telegram channels used to run Xinbi, banned the associated usernames, and confiscated cryptocurrency tied to the operation.
Working with blockchain analytics firm Elliptic, the U.S. Secret Service identified and froze $52.8 million in Tether's USDT stablecoin across 52 wallets associated with Xinbi and its merchant network. In addition, the Scam Center Strike Force seized two wallets Xinbi used to collect vendor payments; those wallets held approximately $12 million.
Tara McLeese, Special Agent in Charge of the U.S. Secret Service Washington Field Office, framed the operation: "After scamming money from hardworking Americans, criminals operating overseas laundered it through the Xinbi Guarantee network, which operated under the false assumption that they were out of the reach of U.S. law enforcement."
Treasury/OFAC sanctions: targeting facilitators and designated entities
In tandem with the Justice Department actions, the Treasury Department's Office of Foreign Assets Control sanctioned Chinese-language media that, Treasury said, were facilitating cyber scams, fraud, money laundering and other criminal activity targeting Americans. Treasury also stated Xinbi's platform had reportedly been used by North Korean hackers and by several OFAC-designated entities, including Jin Bei Group Co., Ltd. and entities that are part of the Prince Group TCO.
Secretary Bessent emphasized the cross-agency effort and intent: "The Trump Administration is united in its efforts to dismantle these overseas criminal enterprises, and [the] Treasury will continue using its tools to disrupt the networks behind this egregious fraud and protect Americans."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleXinbi Guarantee: a one-stop illicit marketplace
Xinbi rose to prominence after the closure of HuiOne Guarantee and its successor Tudou Guarantee last year. The marketplace acted as an intermediary between vendors and scam center operators: it sold services such as building custom scam investment websites, laundering funds obtained by wire fraud, and recruiting trafficking victims to work in scam compounds in Southeast Asia.
The DoJ described Xinbi's escrow-like operation: "Once a scammer 'purchases' a service from the vendor, Xinbi as an organization holds money to be paid to the vendor until the vendor's services are complete, to assure the scammers that the vendors will perform the services."
Elliptic characterized Xinbi as the second-largest illicit marketplace of its type, estimating about $30 billion in transactions to date since its inception around 2022. The firm called the U.S. actions a "severe setback" to the Guarantee marketplace ecosystem, saying merchants and criminal users now face the prospect that "their wallets may be identified and frozen at any time."
Cryptocurrency mechanics: USDT on TRON, the switch to USDD, and freezing risk
Historically, Xinbi accepted payments in Tether's USDT stablecoin, mainly on the TRON blockchain. After the asset freeze, Xinbi attempted to adapt by converting roughly $2.8 million of its remaining USDT into USDD ("Decentralized USD") via a decentralized exchange. Elliptic and the Secret Service froze $52.8 million in USDT prior to that switch.
Elliptic's Founder and Chief Scientist, Dr. Tom Robinson, explained the tradeoff: "Unlike USDT, which is issued by Tether and has a built-in feature that allows the company to freeze wallets, USDD has no central issuer or freezing capability. However, its claims of decentralization are contested, and it is still exposed to freezing risk, since USDD is partly collateralized with freezable USDT."
Scam Center Strike Force in Madagascar and global expansion
The Justice Department reported that the Scam Center Strike Force was deployed to Madagascar as part of this effort, resulting in the takedown of 13 scam compounds. Authorities collected more than 3,200 electronic devices and opened investigations based on interviews with nearly 400 arrestees.
Of those detained, roughly 30 individuals described by the DoJ are said to be Chinese leaders of the scam compounds; those individuals have been repatriated to China by the Chinese government. The Justice Department said the Strike Force will expand its scope to target scam center compounds globally going forward, and noted that the day's actions restrained approximately $52 million — bringing the Strike Force's total restrained assets to about $938 million.
What this means for law enforcement, blockchain analysts, and victims
- Law enforcement and prosecutors: the coordinated seizures, Telegram takedowns, and cross-border Strike Force operations signal a policy of combining sanctions, traditional investigative work, and blockchain tracing to disrupt marketplaces that provide services to scam centers.
- Blockchain analysts and technologists: the episode underscores how token design (USDT's issuer-side freezing capability versus USDD's contested decentralization) affects law enforcement options and how marketplaces may try to pivot between assets after enforcement actions.
- Victims and the public: authorities say Xinbi and similar marketplaces enable the recruitment, technical infrastructure, and money-laundering that underpin large-scale romance and investment scams, and the U.S. actions aim to recover and restrain funds tied to those schemes.
The immediate outcome is tangible: Telegram channels disabled, $52.8 million frozen from 52 wallets, two Xinbi collection wallets seized, and 13 scam compounds dismantled in Madagascar. The Justice Department's stated plan to expand the Scam Center Strike Force globally is the next explicit step named by officials — and a central question remains whether marketplaces can evade enforcement by rapidly migrating funds into alternatives like USDD, or whether such moves expose them to similar tracing and freezing risks because of their partial ties to freezable assets.
