OFAC Sanctions Xinbi Guarantee Over Multibillion-Dollar Criminal Marketplace

The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned Xinbi Guarantee, a Chinese-language online marketplace that US authorities say has been used extensively to support cyber scams, fraud, money laundering and other criminal activity targeting Americans.

The designation was announced on September 9, 2026, as part of coordinated action involving the Treasury Department, the Department of Justice and the Scam Center Strike Force. OFAC also designated two companies identified as supporting Xinbi’s operations: SafeW Technology Co., Ltd. and Anwen Technology Co., Ltd. The sanctions action included 52 cryptocurrency addresses associated with Xinbi.

According to the US Treasury, Xinbi Guarantee has operated since approximately 2022 and processed more than $24 billion in digital assets and fiat currency through its marketplace and associated platforms. Treasury described the platform as a central hub connecting transnational criminal organisations, including operators of cyber scams, with providers of financial services, technology and other resources.

Xinbi operated primarily through Chinese-language online channels and provided a marketplace where vendors could offer services and products to criminal networks. The platform was associated with activity in Burma, Thailand and Laos, according to OFAC's designation information.

The services available through the marketplace included financial services and other forms of support used by criminal organisations. Information released following the designation also identified services involving stolen personal information, fraudulent bank cards, scam infrastructure, cash delivery and other resources associated with cyber-enabled fraud.

The platform used an escrow model to facilitate transactions between vendors and customers. According to information from the investigation, Xinbi's marketplace allowed vendors and customers to transact through the platform without having to establish direct personal relationships with each other.

OFAC's designation identifies Xinbi Guarantee as a criminal organisation and lists multiple cryptocurrency addresses associated with the entity. The addresses identified by OFAC are primarily TRON addresses. The designation also lists Xinbi's operating locations as Burma, Thailand and Laos.

SafeW Technology Co., Ltd. and Anwen Technology Co., Ltd. were designated alongside Xinbi. OFAC identified SafeW as a Singapore-based computer programming company and Anwen as a Cambodia-based computer programming company. Both were identified as linked to Xinbi Guarantee.

SafeW has been associated with the SafeW messaging and cryptocurrency application, while Anwen has been identified as providing technology connected with Xinbi's operations. The companies were designated as part of the same sanctions action because of their links to Xinbi's infrastructure.

The US authorities' action was accompanied by measures against Xinbi's digital infrastructure. On September 7, 2026, a federal court authorised the seizure of Telegram channels used to operate the marketplace. The Department of Justice's Scam Center Strike Force also seized two cryptocurrency wallets allegedly used by Xinbi to collect payments on behalf of vendors. Those wallets contained approximately $12 million in cryptocurrency.

Authorities subsequently restrained an additional 47 cryptocurrency wallets associated with Xinbi. Together, the actions resulted in more than $52 million in cryptocurrency being seized or restrained in connection with Xinbi and its vendor network.

The investigation also involved analysis of cryptocurrency transactions associated with Xinbi. Blockchain analysis identified connections between the marketplace and cryptocurrency associated with cybercrime and fraud operations.

According to the analysis published following the sanctions action, North Korea-linked actors moved tens of millions of dollars in cryptocurrency through vendors operating on the Xinbi marketplace. The funds included cryptocurrency associated with major cyber thefts, including the approximately $1.5 billion theft from Bybit and the approximately $235 million theft from WazirX.

The investigation identified vendors described as “Black U” laundering services. According to the published analysis, these services accepted traceable cryptocurrency associated with thefts and exchanged it for stablecoins originating from other illicit revenue streams. Those other sources included proceeds associated with online scams and romance scams.

The cryptocurrency was subsequently capable of being converted into fiat currency through over-the-counter trading services. The transactions formed part of the broader network of financial services available through Xinbi's marketplace.

The Xinbi investigation also identified connections to scam compounds operating in Southeast Asia. Vendors operating through the marketplace offered services and resources used by operators of online fraud schemes.

The marketplace was used by several groups and individuals that had previously been designated by US authorities. Treasury identified links between Xinbi and designated organisations, including Jin Bei Group Co., Ltd. and entities associated with the Prince Group transnational criminal organisation.

The designation also follows earlier international measures against Xinbi. The United Kingdom designated Xinbi under its sanctions framework in March 2026. Following the US action, the UK updated its designation to include additional cryptocurrency addresses associated with the marketplace.

OFAC's September 9 action was taken under Executive Order 13581, as amended by Executive Order 13863, which provides for sanctions against transnational criminal organisations. Xinbi was identified by OFAC as a target type consisting of a criminal organisation.

As a result of the designation, property and interests in property of Xinbi Guarantee, SafeW Technology and Anwen Technology that are in the United States or within the possession or control of US persons are subject to blocking requirements. US persons are generally prohibited from engaging in transactions involving property or interests in property blocked under the sanctions regulations.

The cryptocurrency addresses specifically identified by OFAC are also subject to the applicable blocking restrictions. OFAC's designation records the addresses as digital currency identifiers associated with Xinbi Guarantee.

The Treasury action was part of a broader US government operation targeting scam centres and the criminal networks supporting them. The Department of Justice's Scam Center Strike Force participated in the seizure of Xinbi's online infrastructure and cryptocurrency.

The operation followed a series of US actions targeting organisations connected with Southeast Asian scam operations. US authorities have increasingly focused on the financial infrastructure supporting scam centres, including cryptocurrency wallets, online marketplaces, payment services and other technology providers.

Xinbi's marketplace was used to connect criminal organisations with vendors providing services required to conduct fraud and move the proceeds of criminal activity. The platform therefore operated across several parts of the criminal economy rather than being limited to a single type of illicit transaction.

The scale of the activity identified by US authorities is reflected in the more than $24 billion in digital assets and fiat currency that Treasury says passed through Xinbi since approximately 2022. This figure represents the value processed through the marketplace and associated platforms and does not mean that every transaction represented criminal proceeds.

The investigation also resulted in the identification of cryptocurrency addresses connected with Xinbi. OFAC listed 52 addresses as part of its September 9 designation, while the coordinated enforcement action separately targeted additional wallets associated with the marketplace and its vendors.

The enforcement action affected both the financial and technological infrastructure associated with Xinbi. In addition to the sanctions imposed on the organisation and two technology companies, US authorities seized Telegram channels and cryptocurrency wallets connected with the marketplace.

The measures followed an investigation that included blockchain analysis of transactions involving Xinbi and its vendors. The analysis was used to establish links between cryptocurrency associated with cyber thefts, scam proceeds and services offered through the marketplace.

Xinbi's designation is therefore part of a broader series of international enforcement measures directed at financial networks supporting cybercrime and Southeast Asian scam operations. The US action was coordinated with law enforcement activity targeting the platform's online infrastructure and cryptocurrency holdings, while the UK has separately maintained sanctions against the organisation.

Following the September 9 designation, Xinbi Guarantee, SafeW Technology and Anwen Technology remain subject to the US sanctions announced by OFAC. The cryptocurrency addresses specifically identified in the designation are also included in the sanctions action.

The enforcement operation resulted in the seizure or restraint of more than $52 million in cryptocurrency, the seizure of Xinbi-related Telegram infrastructure and the designation of the marketplace and two companies supporting its operations. US authorities said the measures were directed at a network that had processed more than $24 billion in digital assets and fiat currency since approximately 2022.

By fLEXI tEAM