U.S. Department of Justice Dismantles Xinbi Guarantee Marketplace in Global Crackdown on Organized Cyber-Scam Syndicates

In a major escalation of the international effort to curb transnational financial crime, the United States Department of Justice (DoJ) announced on Wednesday a coordinated, multi-agency operation targeting Xinbi Guarantee, a sprawling, illicit online marketplace that served as a central hub for cyber-scam operations. The operation, which involved the seizure of critical digital infrastructure and the deployment of the specialized Scam Center Strike Force, marks a significant blow to the ecosystem of "pig butchering" romance scams and large-scale investment fraud that has plagued American victims for years.

The crackdown resulted in the seizure of Telegram channels instrumental to Xinbi’s operations, the confiscation of multiple cryptocurrency wallets, and a high-stakes tactical deployment to Madagascar. This mission led to the successful disruption of 13 separate scam compounds, which were operated by organized crime syndicates with deep ties to regional illicit networks. According to official reports, approximately $52 million in illicitly obtained cryptocurrency was restrained in a single day, pushing the total value of assets seized by the Scam Center Strike Force to nearly $938 million.

The Anatomy of the Xinbi Guarantee Ecosystem

Xinbi Guarantee functioned as an underground, one-stop shop for criminal enterprises. Operating primarily via the Telegram messaging platform, the marketplace acted as an intermediary, bridging the gap between specialized vendors and the operators of scam compounds. These compounds, often located in Southeast Asia, rely on a vast array of technical and logistical services to sustain their operations.

The marketplace facilitated the sale of bespoke scam investment websites, money laundering services for the movement of stolen funds, and the human trafficking networks required to staff scam centers with forced labor. By providing a "guarantee" mechanism—whereby the marketplace held funds in escrow until the vendor’s services were successfully rendered—Xinbi fostered a sense of professionalized reliability within the criminal underworld.

This business model was not an anomaly but rather the successor to previous, similarly structured marketplaces. Following the dismantling of HuiOne Guarantee and its successor, Tudou Guarantee, in the previous year, Xinbi rose to prominence, scaling its operations to facilitate an estimated $30 billion in transactions since its inception in 2022. Blockchain analytics firm Elliptic, which collaborated closely with the U.S. Secret Service to identify and freeze the $52.8 million in Tether (USDT) assets, has identified Xinbi as the second-largest illicit marketplace of its kind globally.

Chronology of the Escalation

The trajectory of the Xinbi investigation highlights the rapid evolution of digital crime and the subsequent regulatory response:

• 2022: Xinbi Guarantee is established, filling a void in the underground market for cyber-fraud services.
• 2024 (Early): Following the closure of predecessors HuiOne and Tudou, Xinbi solidifies its position as the primary facilitator for romance scams and money laundering.
• 2026 (January): Dr. Tom Robinson of Elliptic reports that despite pressure, Xinbi remains resilient, having effectively resisted attempts by Telegram to intervene in its operations.
• 2026 (March): The United Kingdom becomes the first nation to officially sanction Xinbi, citing the sale of stolen personal data and satellite internet equipment used to target victims.
• 2026 (June): The U.S. Department of Justice, working alongside the Treasury’s Office of Foreign Assets Control (OFAC), executes a comprehensive takedown. This includes the seizure of Telegram channels, the freezing of over 50 cryptocurrency wallets, and the tactical disruption of scam compounds in Madagascar.

Official Responses and the Strategic Shift

The U.S. government’s stance on these operations reflects a hardening of policy toward the nexus of organized crime and digital asset abuse. Treasury Secretary Scott Bessent emphasized the severity of the threat, noting that Southeast Asian scam centers siphon billions of dollars from American citizens annually.

"The Trump Administration is united in its efforts to dismantle these overseas criminal enterprises," Secretary Bessent stated. "The Treasury will continue using its tools to disrupt the networks behind this egregious fraud and protect Americans."

This sentiment was echoed by Tara McLeese, Special Agent in Charge of the U.S. Secret Service Washington Field Office. She highlighted the psychological component of the enforcement action, specifically targeting the false sense of security enjoyed by criminals who believed their digital footprints rendered them untouchable by international law enforcement.

Beyond the asset freezes, the Treasury’s OFAC has issued sanctions against Chinese-language media outlets suspected of acting as facilitators for these criminal syndicates. The inclusion of entities such as the Jin Bei Group and parts of the Prince Group TCO in these sanctions suggests a broader intent to sever the financial lifelines of organizations that provide structural support to cyber-scammers.

Implications of the Shift to Decentralized Assets

A critical aspect of the post-seizure landscape is the reaction of the criminals themselves. Historically, Xinbi and its counterparts relied on the TRON blockchain and Tether’s USDT stablecoin for transactions. Because Tether maintains a centralized capacity to freeze assets upon request by law enforcement, the marketplace was vulnerable to the actions taken by the Secret Service and Elliptic.

In an apparent attempt to circumvent these vulnerabilities, Xinbi operators have begun pivoting to USDD ("Decentralized USD"). This move represents a strategic effort to utilize assets without a centralized issuer that can be compelled to cooperate with regulatory bodies. However, industry experts remain skeptical of the efficacy of this pivot.

Dr. Tom Robinson noted that while USDD lacks a central "off-switch," it is not inherently immune to intervention. Because USDD is partially collateralized by traditional USDT, its value and liquidity remain tethered to the very system the criminals are attempting to flee. The shift may ultimately serve as a temporary workaround rather than a long-term solution for these criminal syndicates.

Global Impact and Future Outlook

The expansion of the Scam Center Strike Force’s mandate to target scam compounds globally is perhaps the most significant long-term development. The recent raid in Madagascar, which resulted in the collection of over 3,200 electronic devices and the opening of hundreds of individual investigations, signifies a shift from purely digital enforcement to physical, on-the-ground disruption.

The repatriation of approximately 30 Chinese nationals, identified as leaders within these compounds, indicates a level of international cooperation that was previously difficult to achieve. This level of cross-border coordination is essential, as the infrastructure of these scams is inherently migratory; as one center is shuttered, syndicates often relocate to jurisdictions with weaker law enforcement oversight.

The "severe setback" caused by the U.S. operation is expected to have a cascading effect on the trust-based economy of the dark web. By demonstrating that the "guarantee" mechanisms of these marketplaces are fragile, law enforcement has introduced a variable of uncertainty that may deter both vendors and users. For the criminal ecosystem, the realization that wallets can be frozen and physical compounds raided at any time undermines the core value proposition of using these platforms.

As the U.S. continues to refine its investigative techniques and leverage advanced blockchain forensics, the battle against organized cyber-fraud will likely move deeper into the infrastructure layer of the internet. The success of the Xinbi takedown provides a blueprint for future operations, emphasizing that while the digital landscape is vast, the reliance on stablecoins and centralized communication platforms provides law enforcement with critical points of leverage to dismantle even the most entrenched criminal networks. The path forward will necessitate continued international collaboration, as the fight against these syndicates remains a global challenge that requires both regulatory agility and persistent tactical enforcement.