Security1 publisher2 min readPublished
Telegram deletes Xinbi Guarantee channels, likely in response to US sanctions after $52.8m wallet freeze
Elliptic and the US Secret Service froze 52 wallets holding $52.8 million in USDT on September 8. US sanctions followed a day later, Telegram deleted the channels the same day, and Xinbi says it is moving to a stablecoin nobody can freeze.
The Watch · Security desk
What happened
- Starting at 8am UTC on September 8, 2026, 52 wallets belonging to Xinbi Guarantee and its merchants were frozen, holding $52.8 million in USDT, in an action Elliptic ran with the U.S. Secret Service.
- The United States sanctioned Xinbi on September 9, and Telegram then deleted the marketplace's central channels and banned its usernames, which Elliptic said appears to have forced Xinbi offline.
- Xinbi has run on Telegram since 2022 and has processed at least $24 billion in transactions, second only to Huione Guarantee among illicit marketplaces, according to Elliptic.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability Wallet attribution by a private analytics firm is now the evidentiary front end for a Secret Service freeze and a US designation, a sequence that repeats against any marketplace settling in an issuer-controlled stablecoin.
- constraint The freeze only works where an issuer can freeze, so a merchant base that settles in USDD sits outside the reach of the instrument that took $52.8 million off the table.
- decision Telegram moved on a designation after declining to move on evidence, which gives investigators a reason to route a channel takedown request through a sanctions authority before going to the platform.
- exposure Merchants whose guarantee deposits sat in the 52 frozen wallets carry the loss, and Xinbi's promise to compensate customers is the only remedy on the table for them.
Tether can freeze wallets, and that is how this action reached the money: payments on Xinbi have historically been made in USDT, primarily on the TRON blockchain [8][17]. USDD, the stablecoin Xinbi named as its replacement, was launched in 2022 by TRON founder Justin Sun through his TRON DAO Reserve, and it has no central issuer and no freezing capability [16][17]. If the merchant base follows, the tool that took $52.8 million out of circulation stops working.
Against throughput, the seizure is small. Xinbi and its merchants have processed at least $24 billion since 2022 [9]; $52.8 million is about 0.22 percent of that [1]. Xinbi Pay, the linked payments service, has processed a further $6 billion, for roughly $30 billion across the two [11][2]. Huione Pay, the comparable arm of the older network, processed $103 billion [11].
Telegram shut Huione Guarantee and its successor Tudou Guarantee in 2025 after Elliptic exposed their activity, then declined to close Xinbi despite what Elliptic describes as clear evidence of illicit activity [12][13]. The UK designation in March 2026 did not change that [14]. The US designation did: Elliptic's update, timed 16:20 UTC on September 9, put the channel deletions and username bans about 32 hours after the freeze began [5][3].
Huione Guarantee closed in May 2025 following pressure from Elliptic, having processed $31 billion over four years [10]. Its merchants moved to Tudou, then to Xinbi, which came to sit at the center of the guarantee ecosystem [12][13]. Counting Huione and Tudou, Xinbi is the third of these marketplaces off Telegram in about sixteen months [5].
Trust on Xinbi ran on deposits. Merchants post a guarantee with the marketplace, and a buyer who gets defrauded can be paid out of it [7]. Xinbi condemned the "arbitrary freezing" and committed to compensating its customers [16].
Xinbi also had a street address. In June 2025 it opened a store inside the Yatai New City scam center complex in Myanmar, a site heavily sanctioned by the US and UK; Myanmar's military raided the complex late in 2025, and footage shows the store partially destroyed and covered in rubble [15]. The merchants themselves sold personal data to target victims, communications infrastructure to run scams at scale, and laundering services to cash out the proceeds [6].
What to watch
- Whether Xinbi's merchants actually settle in USDD or keep using USDT for liquidity.
- Whether a successor guarantee marketplace registers on Telegram, and how quickly it absorbs the merchant base.
- Whether the US action extends to Xinbi Pay, which has processed a further $6 billion.