U.S. Department of Justice and Treasury Department dismantle illicit Xinbi Guarantee marketplace to combat global cyber fraud

In a sweeping multinational operation, the United States Department of Justice (DoJ) and the Department of the Treasury have executed a coordinated strike against Xinbi Guarantee, one of the most prolific illicit online marketplaces facilitating organized cybercrime. The operation, led by the specialized Scam Center Strike Force, involved the seizure of critical digital infrastructure, the freezing of multi-million dollar cryptocurrency assets, and a ground-level intervention in Madagascar that disrupted thirteen active scam compounds. This action marks a significant escalation in the American government’s campaign to dismantle the infrastructure supporting the multi-billion dollar "pig butchering" industry and other forms of transnational financial fraud.

The crackdown, which saw the seizure of Telegram channels serving as the primary marketplace for criminal services, underscores the evolving nature of digital crime. Xinbi Guarantee has long functioned as a sophisticated "one-stop shop" for criminal syndicates, providing the tools necessary to execute romance scams, investment fraud, and human trafficking operations across Southeast Asia and beyond.

The Evolution of the Guarantee Marketplace Ecosystem

The rise of Xinbi Guarantee is not an isolated event but rather the latest iteration of a persistent criminal business model. Following the international pressure that led to the shuttering of predecessors like HuiOne Guarantee and Tudou Guarantee, Xinbi emerged as the primary hub for illicit services. Since its inception in 2022, the platform has facilitated an estimated $30 billion in transactions.

These "Guarantee" platforms operate as high-tech escrow services. When a scam syndicate seeks to purchase illicit assets—such as custom-coded fraudulent investment websites, databases of stolen personal information, or satellite internet hardware to maintain communication with victims—they route their payments through the marketplace. The marketplace holds the funds in escrow, releasing them to the vendor only upon the successful delivery of the illicit service. This mechanism, intended to build "trust" among bad actors, has now become a central point of failure that law enforcement is increasingly targeting.

Chronology of the Intervention

The disruption of Xinbi did not happen overnight; it was the culmination of months of intelligence gathering and cross-agency cooperation.

• 2022: Xinbi Guarantee launches on the Telegram messaging platform, positioning itself as a successor to earlier, smaller marketplaces.
• March 2026: The United Kingdom takes the lead in international regulatory action, becoming the first nation to officially sanction Xinbi for its role in distributing stolen data and enabling fraudulent infrastructure.
• January 2026: Dr. Tom Robinson of the blockchain analytics firm Elliptic reports that despite internal Telegram interventions, Xinbi has demonstrated significant resilience, leading to a proliferation of smaller, fragmented markets.
• June 2026: The U.S. Department of Justice, working in tandem with the U.S. Secret Service and the Treasury’s Office of Foreign Assets Control (OFAC), executes a coordinated seizure of 52 cryptocurrency wallets and multiple Telegram channels.
• July 2026: The Scam Center Strike Force expands its mandate, moving into Madagascar to dismantle 13 physical scam compounds, resulting in the arrest of nearly 400 individuals, including 30 high-ranking organizers who were subsequently repatriated to China.

Financial Impact and Data Analysis

The scale of the financial disruption is unprecedented. According to the DoJ, approximately $52.8 million in cryptocurrency was restrained during the most recent operation. This brings the cumulative total of funds frozen by the Scam Center Strike Force to roughly $938 million.

Blockchain analytics firm Elliptic, which played a pivotal role in identifying the flow of Tether’s USDT stablecoin, noted that the freezing of 52 specific wallets significantly crippled the marketplace’s ability to process transactions. The investigation revealed that these wallets were not merely holding personal funds but were acting as the financial clearinghouses for a global network of merchants servicing organized crime groups.

A critical point of analysis is the criminals’ pivot to alternative assets. Following the freeze of USDT assets, Xinbi leadership attempted to shift operations to USDD (Decentralized USD). However, experts warn that this move may offer little long-term protection. While USDD claims to be decentralized, it maintains a degree of collateralization with USDT, meaning that any move by Tether to blacklist specific addresses could still effectively paralyze the liquidity of the USDD network.

Official Responses and Strategic Objectives

The U.S. government has framed this operation as a vital component of national security. Secretary of the Treasury Scott Bessent emphasized that the administration is committed to using every tool at its disposal to dismantle the overseas criminal enterprises that siphon billions from American citizens annually.

"Scam centers in Southeast Asia steal billions of dollars from American victims each year," Secretary Bessent stated. "The Treasury will continue using its tools to disrupt the networks behind this egregious fraud and protect Americans."

Tara McLeese, Special Agent in Charge of the U.S. Secret Service Washington Field Office, echoed these sentiments, highlighting the psychological and economic toll of these crimes. She noted that many of these criminals operated under the delusion that the anonymity provided by encrypted messaging apps and decentralized finance would keep them beyond the reach of the law. The success of this operation aims to dispel that notion, signaling to the criminal underworld that the "Guarantee" model is no longer a safe haven.

Broader Implications and Future Outlook

The dismantling of Xinbi represents a "severe setback" for the illicit marketplace ecosystem, according to analysts at Elliptic. By targeting the financial mechanisms that underpin these markets, the U.S. government is attacking the "trust" that is essential for the criminal supply chain to function. If merchants and scammers can no longer be certain that their payments will be held securely or that their wallets will remain active, the incentive to participate in these marketplaces diminishes.

Furthermore, the expansion of the Scam Center Strike Force into regions like Madagascar indicates that the U.S. is prepared to pursue these networks wherever they relocate. The recent takedown of 13 compounds and the seizure of over 3,200 electronic devices provide a massive trove of intelligence that will likely fuel further investigations, potential indictments, and additional asset freezes in the coming months.

However, the challenge remains significant. The nature of these scams is highly adaptive. As one marketplace is shuttered, the underlying demand for these services persists, and decentralized platforms are quick to replace them. The future of this conflict will likely be defined by the ability of international law enforcement to keep pace with the rapid technological pivots of these criminal organizations.

The repatriation of 30 Chinese nationals involved in leading these compounds also highlights the role of international cooperation. Without the involvement of host governments and international partners like China, the ability of the U.S. to curb these operations would be severely limited. Moving forward, the effectiveness of the Scam Center Strike Force will depend on its ability to sustain this level of coordination, effectively turning the digital landscape from a place of refuge for criminals into a hostile environment that favors the rule of law.

As of this report, the digital footprints of the seized Telegram channels remain under the control of the U.S. government, and investigators are continuing to analyze the 3,200 devices recovered in Madagascar. This operation is expected to serve as a blueprint for future counter-fraud initiatives, emphasizing the necessity of combining blockchain forensics, traditional law enforcement, and aggressive financial sanctions.