US disrupts Xinbi Guarantee marketplace fueling the cyber scam economy

The U.S. government took action on Wednesday against a Telegram-based illicit marketplace facilitating billions of dollars in transactions connected to cyber scams, money laundering, human trafficking and other crime. 

The Treasury Department announced sanctions on the Chinese-language platform, Xinbi Guarantee, and two businesses it accused of supporting the marketplace’s operations. The government also carried out a seizure of $52.8 million from 52 wallets connected to the platform. The sanctions follow a similar designation by the U.K. in March. 

Xinbi’s main Telegram channel was no longer available on Wednesday and many associated usernames appeared to have been deactivated. According to a DOJ release, a district court on Monday authorized the seizure of Telegram channels hosting the marketplace. 

“Yesterday, my office issued a signed warrant to seize the Telegram channels where these vendors conduct their business and hawk their service to scammers,” Jeanine Pirro, U.S. attorney for the District of Columbia, said at a press conference on Wednesday. 

Created in 2022, Xinbi has processed at least $24 billion in transactions, making it the second-largest illicit online marketplace in history, according to the blockchain intelligence firm Elliptic, which helped the Secret Service to carry out the wallet seizures. It is a cornerstone of the cybercrime landscape in Southeast Asia, offering an array of services to carry out pig butchering and other scams. 

Vendors use its channels to offer everything from money laundering services to stolen personal data to deepfake technology, with all payments made through the platform in Tether’s USDT stablecoin. The marketplace acts as an escrow service, guaranteeing that providers are paid for their services.

Xinbi grew out of the takedown by Telegram of Huione Guarantee following international pressure, which saw $31 billion in activity before it closed down. Despite pleas by researchers for Telegram to take action against Xinbi as well, it did not, and criminals gravitated to it.

According to the cyber intelligence company DarkTower, as of last week there were more than 4,600 crime-as-a-service vendors on the platform.

The actions against Xinbi were performed by the DOJ’s Scam Center Task Force — an interagency effort created last November to crack down on cyber scams carried out largely by Chinese organized crime groups based in Southeast Asia. With Tether’s cooperation, it seized two cryptocurrency wallets holding $12 million used to collect vendor payments, as well as dozens of others allegedly associated with money laundering and other scamming activity. 

According to Elliptic, Xinbi administrators responded to Tether’s freezing of the funds by announcing that it would be moving to USDD, a stablecoin operating on the TRON blockchain that is harder to seize. 

“Xinbi strongly condemns Tether's arbitrary freezing of addresses,” they told users in a Telegram post. “The process of unlocking large amounts of USDT and ensuring compliance is far more difficult and lengthy than anticipated, and we are deeply saddened and frustrated.”

Elliptic cofounder Tom Robinson told The Record he expects the platform to try to adapt. 

“It's likely that Xinbi will try to rebuild and relaunch, but it will be very challenging in the face of these sanctions,” he said.

The Treasury Department also went after two entities it accuses of assisting Xinbi’s operations — Anwen Technology, the Cambodia-based developer of a cryptocurrency payment app called XinbiPay, and SafeW Technology Co., maker of an encrypted messaging application allegedly used by Xinbi’s money-laundering and merchant networks. 

While announcing the actions against Xinbi Guarantee, the DOJ said its strike force would “expand its scope to attack scam compounds globally” and had recently deployed a team to Madagascar to work with local law enforcement. The operation resulted in the takedown of 13 scam centers operated by Chinese organized crime syndicates and arrests of dozens of alleged leaders, who according to Pirro were “interestingly quickly repatriated to China.”

Jonathan Greig contributed to this story.