Security1 publisher3 min readPublished
OFAC sanctions Xinbi Guarantee, the marketplace that absorbed Huione's scam-center trade
Treasury puts Xinbi's throughput above $24bn since 2022 and TRM Labs says $36bn, but the Secret Service and Elliptic have frozen $52.8m, and the last two guarantee markets designated this way were replaced rather than removed.
The Watch · Security desk
What happened
- OFAC sanctioned Xinbi Guarantee, a Chinese-language marketplace that Treasury says links Southeast Asian scam center operators and other crime syndicates to merchants selling financial and technical services.
- Treasury estimates the marketplace has processed more than $24bn in digital and fiat currency since it started in 2022.
- TRM Labs puts Xinbi's transaction total above $36bn and says daily inflows nearly doubled between May and December 2025 as sanctioned rivals Huione Guarantee and Tudou Guarantee declined.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- precedent Designating the market clears a seat rather than the demand: Huione and Tudou were sanctioned and their merchants reappeared on Xinbi, so the realistic forecast is a successor holding the same merchant base.
- exposure A messaging app publisher and a consumer wallet developer are now blocked parties, which puts app-layer vendors, not just exchanges and deposit addresses, into the screening obligation for anyone touching these rails.
- constraint The enforcement lever on offer is merchant distrust rather than asset recovery, because the frozen sum is a fraction of a percent of the claimed throughput and cannot be scaled up by adding more freezes.
- contradiction Treasury and TRM Labs are $12bn apart on how much moved through Xinbi, so any risk model calibrated to the official number is working from the low end of the range.
Two guarantee markets were sanctioned before this one, and their merchants did not stop trading. TRM Labs attributes Xinbi's rise directly to the decline of Huione Guarantee and Tudou Guarantee, and puts the growth at nearly doubled daily inflows between May and December 2025 [8]. One market absorbed the business of two. Nothing in this action addresses that pattern, and the pattern is what determines where the flow sits in six months [3].
The two companion designations show where OFAC now thinks the plumbing is. SafeW Technology, based in Singapore, publishes an end-to-end encrypted messaging app [9]. Anwen Technology, headquartered in Cambodia, builds the XinbiPay wallet, also sold as NewPay [10]. A messaging app and a wallet developer, not a marketplace or an exchange. A screening program built around marketplace names and deposit addresses does not catch a chat client or a consumer wallet app, and both are now inside the perimeter.
The US Secret Service and blockchain intelligence firm Elliptic said they identified and froze $52.8m in cryptoassets tied to Xinbi [11]. Against Treasury's $24bn of throughput since 2022 [3] that is 0.22 percent; against TRM's figure it is 0.15 percent [2]. Those are not recovery rates, since a frozen balance is a snapshot and throughput is cumulative, but they bound how much money this action touched. Elliptic's claim is a different one: merchants and users now operate knowing their wallets may be identified and frozen at any time, and that uncertainty undermines the mechanism these marketplaces depend on [12].
Treasury's $24bn is the government's number [3]. TRM's $36bn is one analytics firm's, about $12bn and roughly 50 percent higher [7][1]. For anyone tuning transaction monitoring against this network, the official figure is the floor, not the measurement.
TRM describes listings for stolen personal data, fake identity documents, AI deepfake tools, satellite internet equipment, and over-the-counter crypto exchanges [5]. That is the input side of the fraud rather than the proceeds side, which is why this reaches fraud teams that never touch sanctions work. The same firm says the scam operations these services support run on trafficked foreign nationals recruited with the promise of legitimate work [6].
Two things here are single-sourced and should be read that way. Xinbi appearing offline, and Telegram deleting the main associated channels and banning linked usernames, is Elliptic's account [13]. The designations, the named entities, and the $24bn are on the record [1][9][10]. The UK got there first, sanctioning Xinbi Guarantee in March [14]. Treasury secretary Scott Bessent framed the US action around scam centers in Southeast Asia stealing billions of dollars from American victims each year [4].
If the Huione sequence repeats, the successor market's inflow curve will be visible in chain data before the next designation names it.
What to watch
- Whether a successor marketplace's daily inflows climb the way Xinbi's did after Huione and Tudou were sanctioned.
- Whether Xinbi stays offline or its Telegram channels reappear under fresh usernames.
- Whether OFAC keeps designating app publishers, messaging and wallet, rather than only marketplaces and exchange addresses.