Elliptic Helps Us Secret Service Freeze Xinbi Scam Marketplace Assets

Elliptic worked with the U.S. Secret Service to identify and freeze wallets holding $52.8 million in cryptoassets linked to Xinbi Guarantee.

Xinbi is the second-largest illicit online marketplace of all time, processing at least $24 billion in transactions. Xinbi Pay has received another $6 billion.

It is the leading marketplace for online scammers, including those running "pig butchering" romance scams and other fraud against victims worldwide.

It is a key enabler of the global cyberscam epidemic, providing scammers with the tools they need to conduct fraud on an industrial scale, including victim personal data, communications infrastructure and money laundering services.

Xinbi has also been sanctioned today by the United States.

*************************************************** Update: September 9, 2026, 16:20 UTC. Xinbi Guarantee now appears to have been forced offline. Telegram has deleted the central channels used by the marketplace and has banned the usernames associated with Xinbi. This is likely in response to the US sanctions announced today. ***************************************************

Elliptic has worked with the U.S. Secret Service to identify and freeze wallets holding $52.8 million in cryptoassets linked to Xinbi Guarantee, the second-largest illicit online marketplace of all time. Elliptic has been tracking Xinbi and its wallet infrastructure for several years, and our intelligence directly enabled the freezing action, as well as the sanctions imposed on Xinbi today by the United States .

What is Xinbi Guarantee? What is Xinbi Guarantee?

Xinbi Guarantee is an illicit marketplace that runs on Telegram. It serves online scammers, including those running "pig butchering" romance scams and other fraud, against victims worldwide.

It is a one-stop-shop for the goods and services these criminal operations rely upon. Merchants openly sell personal data to target victims, communications infrastructure to run scams at scale, and money laundering services to cash out the proceeds. Historically, all payments are have been made in Tether’s USDT stablecoin, primarily on the TRON blockchain. Merchants post “guarantee” deposits with Xinbi. If a buyer is defrauded, they can be compensated from the deposit, helping to maintain trust on the marketplace.

(Left) Providers of money laundering services on Xinbi Guarantee specify the types of funds they are willing to launder, including the proceeds of pig butchering (sometimes translated as “sha pig” or “shazhu”). “Chat”, “fine chat”, "jingchat" and “precise chat” refer to the proceeds of the broader category of scams where the scammer builds trust with the victim through online chats.

(Right) A merchant on Xinbi offers to launder scam proceeds from US victims. (All screenshots are machine-translated from the original Chinese)

Since beginning operations in 2022, Xinbi Guarantee and its merchants have processed at least $24 billion in transactions. Only one guarantee marketplace has handled more: Huione Guarantee, which closed in May 2025 following pressure from Elliptic, having processed $31 billion over four years.

A closely linked payments service, Xinbi Pay (also known as XPay), has processed a further $6 billion. Huione's payments business, Huione Pay, processed $103 billion. These services are distinct from the marketplaces, but heavily used by its customers.

Xinbi grew to fill the gap left by the closure of Huione Guarantee and its successor Tudou Guarantee in 2025. Telegram shut down those marketplaces after their illicit activity was exposed by Elliptic . However, Telegram has subsequently refused to close Xinbi Guarantee, despite clear evidence of its illicit activity. The result has been a migration of merchants and users to Xinbi, which now sits at the center of the "Guarantee" ecosystem.

Xinbi’s emergence as one of the largest illicit marketplaces, as well as its enablement of illegal scam centers across Southeast Asia, led to it being sanctioned by the UK in March 2026 .

Xinbi's facilitation of scam centers extends beyond its online marketplace. In June 2025, Xinbi announced the opening of its first physical store, within a large complex of scam centers in Yatai New City, Myanmar, that has been heavily sanctioned by the US and UK. The store’s operations were short-lived: Myanmar's military raided Yatai New City in late 2025, and subsequent footage shows the store itself partially destroyed and covered in rubble.

(Left) A photo of Xinbi signage on a store between the Hongtu towers (“鸿图双子楼”) in Yatai New City.

(Right) A zoomed-in still image from independent footage of the same location.

$52.8 million frozen $52.8 million frozen

Beginning at 8am UTC on September 8, 2026, 52 wallets belonging to the marketplace and its merchants were frozen. These contain $52.8 million in USDT.

Xinbi responded by condemning the “arbitrary freezing” and committing to compensating its customers. They also announced a shift away from using USDT, to another stablecoin: USDD.

USDD (“Decentralized USD”) is a dollar-pegged stablecoin, launched in 2022 by TRON founder Justin Sun through his TRON DAO Reserve. Unlike USDT, which is issued by Tether and has a built-in feature that allows the company to freeze wallets, USDD has no central issuer or freezing capability. However, its claims of decentralization are contested and it is still exposed to freezing risk, since USDD is partly collateralized with freezable USDT .

In the hours following the freezing of Xinbi’s wallets yesterday, Xinbi exchanged approximately $2.8 million of its remaining USDT assets into USDD, using a decentralized exchange.

A statement posted by Xinbi Guarantee following the wallet freezes.

Why this action matters Why this action matters

This asset freeze will be a severe setback for the Guarantee marketplace ecosystem that fuels online scams globally.

These marketplaces depend entirely on trust. The guarantee model exists precisely because participants are criminals who cannot rely on legal recourse: the marketplaces’ escrow and deposit systems substitute for it. That model only works if merchants and users believe their funds are safe.

Merchants and users of these services will now be operating with the knowledge that their wallets may be identified and frozen at any time. This uncertainty undermines the core mechanism these marketplaces rely on to function.

The role of blockchain data and intelligence The role of blockchain data and intelligence

This action demonstrates how blockchain intelligence enables law enforcement to strike at the financial infrastructure of transnational fraud. Elliptic's multi-year tracking of Xinbi's wallet infrastructure, mapping the flow of funds through the marketplace, its merchants and its money laundering networks, provided the foundation for the United States Secret Service to act, and for today’s designation by OFAC.

This action follows Elliptic’s March 2025 collaboration with the Secret Service to freeze wallets used by Garantex , the sanctioned Russian cryptoasset exchange.

Cryptoassets are often portrayed as a haven for criminals. The opposite is true: The transparency of blockchains means that illicit activity leaves a permanent, traceable record. Marketplaces like Xinbi can grow quickly, but their reliance on public blockchains is also their greatest vulnerability.

Elliptic will continue to track the Guarantee marketplace ecosystem and work with law enforcement agencies and regulators around the world to disrupt the infrastructure behind online scams.

Dive deeper Dive deeper

Xinbi: The $8 Billion Colorado-Incorporated Marketplace for Pig-Butchering Scammers and North Korean Hackers Xinbi: The $8 Billion Colorado-Incorporated Marketplace for Pig-Butchering Scammers and North Korean Hackers

UK sanctions Xinbi marketplace and entities connected to #8 Park in latest crackdown on illicit cryptoassets UK sanctions Xinbi marketplace and entities connected to #8 Park in latest crackdown on illicit cryptoassets

US Treasury takes 311 action against Huione Group: What this means for you US Treasury takes 311 action against Huione Group: What this means for you

Crypto regulatory affairs: US Operation Economic Outcast looks to squeeze Iran’s crypto activity Crypto regulatory affairs: US Operation Economic Outcast looks to squeeze Iran’s crypto activity