Invest1 publisher2 min readPublished
Screening Xinbi's 52 blocked addresses catches about 35% of the $24bn Treasury counted
OFAC listed the Xinbi marketplace and two software developers on September 9, with 52 TRON addresses that Chainalysis says received more than $8.4bn in stablecoins against Treasury's $24bn count for the platform.
The Investor · Invest desk
What happened
- The Treasury's Office of Foreign Assets Control listed the Xinbi marketplace as a significant transnational criminal organization on September 9, 2026.
- Two software firms went on the list with it: Cambodia-based Anwen Technology, which built the XinbiPay wallet also marketed as NewPay, and Singapore-based SafeW Technology, behind the encrypted SafeW app.
- The Justice Department's Scam Center Strike Force seized related infrastructure and digital asset wallets the same day, and Telegram banned Xinbi.
- Treasury put processed value at more than $24bn in digital assets and fiat since about 2022, while TRM Labs estimates more than $36bn of throughput and about $17bn of inflows.
- Xinbi ran escrow, holding a buyer's payment until a seller delivered stolen personal data, forged identity documents, deepfake tools, satellite gear or unlicensed cash-out services.
Compiled by The InvestorSomething wrong?How this is made
Why it matters
- exposure Civil penalties here can apply on a strict-liability basis, and the 50 percent rule pulls in any company majority-owned by a blocked person. A platform that keeps processing linked flows is liable without intent.
- constraint The blocked addresses are all on TRON while XinbiPay supported USDT on three chains: a desk that screens only the listed TRON addresses is covering one of three settlement paths.
- contradiction Treasury's count is about two-thirds of TRM Labs' estimate, a $12bn gap, so a firm reconstructing its historical exposure to these rails has no single denominator to work from.
- precedent Each takedown so far has moved demand to the next guarantee market. The next OFAC package will be judged on whether it names wallets, apps and escrow together instead of one storefront.
The 52 blocked TRON addresses received more than $8.4bn of stablecoins, which is about 35 percent of the more than $24bn Treasury attributes to the marketplace since about 2022, and about 23 percent of TRM Labs' $36bn throughput estimate [8][6][7][1][2]. That averages roughly $161m an address [3].
Velocity is the part the totals hide. XinbiPay's withdrawal hot wallet took in $94.6m in December 2025, according to TRM Labs [10]. Twelve months at that rate is about $1.14bn [5]. Treasury's $24bn spread across roughly four and a half years averages about $5.3bn a year, so one hot wallet in one month was moving at about a fifth of the lifetime pace [6]. December was near a peak: TRM reported that daily inflows nearly doubled between May and December 2025 [14].
The growth came from enforcement elsewhere. After FinCEN targeted Huione Pay as a primary money laundering concern, and after Telegram restrictions and earlier crackdowns hit Huione, Haowang and Tudou Guarantee, a large share of remaining volume migrated to Xinbi [13]. Much of the demand sits in the Golden Triangle across Myanmar, Thailand and Laos, in compounds that have used trafficked workers lured by false job offers [22].
The flows are not only fraud proceeds. Treasury said North Korean-linked actors and previously designated groups, including entities associated with the Prince Group and Jin Bei Group, used Xinbi [17]. Chainalysis reported that DPRK-linked wallets moved tens of millions of dollars from major exchange thefts, including the Bybit and WazirX hacks, through Xinbi vendors that swapped tainted coins for cleaner stablecoins [18].
The two software listings look more consequential than the storefront designation. Around June 2025, facing rising scrutiny, Xinbi pushed merchants onto SafeW and launched the no-KYC XinbiPay wallet [15], and Treasury designated those developers to hit the fallback infrastructure, not only the public storefront [16]. The counter-case is timing. Britain designated Xinbi in March 2026, about six months before OFAC [19][7], and the platform was still running with infrastructure left to seize when the US action landed [8].
If a successor guarantee market posts the same near-doubling of daily inflows within six months of September 9 while settlement stays concentrated in USDT on TRON [9][14], then listing a wallet developer and a messaging developer did not raise the cost of rebuilding, and the address block was the whole of the action.
What to watch
- Whether OFAC extends the list beyond the initial 52 addresses or names further wallet and messaging developers in Cambodia and Singapore.
- Whether the Justice Department seizure produces named defendants, which would put evidence behind the throughput estimates.
- Whether TRM Labs and Chainalysis revise their Xinbi figures now that the designated addresses are public.