Security1 publisher2 min readPublished
Xinbi Guarantee switched stablecoins after the US froze $52.8 million of its USDT
The Justice Department seized the marketplace's Telegram channels and two payment wallets and sent a strike force into 13 Madagascar compounds. Elliptic puts Xinbi's lifetime throughput at about $30 billion.
The Watch · Security desk
What happened
- The Justice Department said Wednesday it seized the Telegram channels running the Xinbi Guarantee scam marketplace, banned the associated usernames, and confiscated two of the wallets it used to pay vendors.
- DOJ put the one-day figure at approximately $52 million of cryptocurrency restrained, and the Scam Center Strike Force's running total at approximately $938 million.
- In Madagascar the Strike Force disrupted 13 scam compounds run by Chinese organized crime syndicates, seized more than 3,200 electronic devices, and opened investigations from interviews with nearly 400 arrestees.
- Roughly 30 of those arrested are described as Chinese leaders of the compounds, and the Chinese government has repatriated them.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint The freeze reached USDT balances on TRON. With Xinbi now settling in USDD, repeating the seizure requires the same freeze capability to exist on a second token, and nothing about the first freeze ports automatically.
- exposure Forty-nine of the frozen wallets belong to merchants rather than the platform, so the vendors who built scam sites and moved victim funds are now individually attributed instead of sitting behind the escrow.
- precedent The escrow function has already survived two closures before this one, which makes the question after any takedown who inherits the vendor traffic rather than whether someone does.
- cost Victim restitution is not what this operation buys. A sum equal to a fraction of a percent of the marketplace's throughput means the return is disruption and identification, paid for by law enforcement rather than recovered for victims.
Payments on Xinbi settled in Tether's USDT, mostly on the TRON blockchain [18]. After the freeze, the marketplace moved to USDD, another dollar-pegged stablecoin, and is estimated to have exchanged about $2.8 million of the USDT it still held [19].
Against the marketplace's own numbers the seizure is small. Elliptic, which identified and froze the wallets with the U.S. Secret Service, puts Xinbi's transactions at roughly $30 billion since it started around 2022 and ranks it the second largest illicit marketplace [7][8]. The $52.8 million works out to about 0.18 percent of that [21], and about 5.6 percent of the $938 million the Scam Center Strike Force says it has restrained in total [20]. Around $12 million of the frozen funds sat in the two wallets Xinbi used to collect payments for vendors [13], leaving roughly $40.8 million spread across merchant wallets [22].
The function worth breaking is the escrow. Xinbi holds a scammer's payment until the vendor completes the work, which is what assures buyers that the vendor will perform [11]. What is on sale through that arrangement is custom scam investment websites, laundering of wire fraud proceeds, and workers solicited into compounds in Southeast Asia [10]. Treasury says the platform was reportedly used by North Korean hackers and by OFAC-designated entities including Jin Bei Group and parts of the Prince Group TCO [12]. OFAC also sanctioned Chinese-language media for facilitating cyber scams, fraud and money laundering aimed at Americans, though the announcement as reported does not name the outlet [4]. The Telegram channels are the shopfront; the escrow ledger is the business.
Telegram has been here before. Elliptic founder Tom Robinson told The Hacker News in January that Xinbi recovered after Telegram's intervention and that no further action followed, with other markets appearing on the platform afterward [9]. Xinbi's own rise came the same way, filling the space left when HuiOne Guarantee and its successor Tudou Guarantee closed last year [6].
DOJ says the Strike Force will now target scam compounds globally rather than in one region [15]. Two guarantee markets have already been replaced by a third [6]. Whether a fourth opens is the measurable test of this operation, and the move to USDD within the same window is the first reading on how fast the network re-plumbs [18][19].
What to watch
- Whether a fourth guarantee marketplace opens on Telegram, and how quickly Telegram acts on it compared with its earlier Xinbi intervention.
- Whether the balances Xinbi moved into USDD can be frozen the way the USDT holdings were.
- Which country the Scam Center Strike Force enters next now that DOJ says its remit is global.