Summary
- U.S. authorities have sanctioned Xinbi Guarantee, a major Chinese-language illicit marketplace that connects criminal networks with money laundering, scam infrastructure, stolen data, and other illicit services.
- Chainalysis findings shows DPRK-linked actors moved tens of millions of dollars stolen from major crypto hacks, including Bybit and WazirX, through Xinbi’s vendor network, using specialized “Black U” laundering services to swap traceable stolen funds for less-tainted stablecoins.
- The crackdown has disrupted Xinbi’s financial and online infrastructure, with authorities seizing or restraining more than $52 million in cryptocurrency across Xinbi and its vendor network and targeting dozens of associated wallets.
On September 9, 2026, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned Xinbi Guarantee, a major Chinese-language marketplace for scam and money laundering services.
Today’s designation cuts off a critical piece of the financial infrastructure that threat actors relied on to launder billions of dollars in illicit cryptocurrency. Our analysis shows that DPRK-linked actors moved tens of millions in stolen funds from major hacks, including the $1.5 billion Bybit breach and the $235 million WazirX theft, through Xinbi’s sprawling vendor network of criminal-enabling services.
OFAC also identified dozens of associated cryptocurrency wallets and sanctioned SafeW Technology and Anwen Technology, developers of messaging and crypto payment apps supporting Xinbi’s operations. The 52 OFAC-designated addresses shown received over $8.4 billion in stablecoins. In a coordinated action, the Justice Department’s Scam Center Strike Force (SCSF) seized $12 million in Xinbi’s crypto and helped restrain millions more held by vendors.
These actions are the latest in a series of global efforts to disrupt major scam and cybercrime networks, including the UK’s Foreign, Commonwealth & Development Office’s (FCDO) sanctioning of Xinbi in March 2026. In conjunction with the new OFAC’s designation, FCDO updated its designation to include dozens of additional cryptocurrency addresses associated with Xinbi.
Inside Xinbi’s $24 Billion Illicit Marketplace
Since emerging around 2022, Xinbi has grown into a major marketplace for the infrastructure behind Southeast Asia’s scam economy, processing more than $24 billion in digital assets and fiat currency, according to the U.S. Treasury.
Its rise reflects a broader shift in illicit finance. Chinese-language money laundering services now dominate known crypto money laundering activity, processing an estimated 20% of illicit crypto funds over the past five years, including $16 billion in 2025. Guarantee platforms such as Xinbi are key to this ecosystem.
Xinbi operates as a marketplace for transnational organized crime. Through hundreds of Chinese-language Telegram channels, vendors advertise money laundering services, custom scam websites, stolen personal data, and recruitment for Southeast Asian scam compounds where trafficked workers are held under conditions of forced labor and torture. The UK designated Xinbi under its Global Human Rights sanctions regime because of this connection to grave human rights abuses.
Our analysis of Xinbi’s Telegram network reveals a vendor ecosystem spanning cash delivery, bank card fraud, personal data sales, KYC bypass services, scam platform development, surveillance equipment, and malware services. Together, these offerings support the full lifecycle of crypto-enabled fraud, from victim targeting and identity theft to operational infrastructure and money laundering services.
Xinbi’s escrow model binds this ecosystem together: the platform holds vendor deposits and manages payments, creating an enforced layer of trust that allows criminal vendors and their customers to transact at scale without relying on personal relationships.
How North Korea-linked actors laundered crypto through Xinbi
Our analysis of Xinbi’s on-chain footprint shows that DPRK-linked threat actors moved tens of millions in stolen cryptocurrency through the platform’s vendor network.
The laundering works through substitution, not obfuscation: specialized vendors known as “Black U” launderers accept the traceable, DPRK-linked stolen funds and replace them with stablecoins sourced from separate illicit revenue streams, including the proceeds of pig butchering and romance scams flowing through the same marketplace ecosystem. The stolen funds thereby blend into a larger pool of illicit activity, making them harder to trace,while DPRK-linked actors receive nominally “clean” stablecoins they can convert to fiat through unlicensed OTC desks.
Tracing Xinbi’s Network Led to $52 Million in Restrained Crypto
Investigators traced funds stolen from U.S. victims directly to vendors advertising money-laundering services on Xinbi. That trail ultimately helped authorities move against both the marketplace’s online infrastructure and the cryptocurrency underpinning its operations.
On September 7, a federal court authorized the seizure of Telegram channels hosting Xinbi’s marketplace. Under the same warrant, the SCSF seized two wallets Xinbi allegedly used to collect payments on behalf of vendors, containing approximately $12 million in cryptocurrency. Authorities also restrained an additional 47 cryptocurrency wallets believed to be associated with Xinbi.
Together, the coordinated actions restrained more than $52 million in cryptocurrency tied to Xinbi and its network — disrupting funds used by an ecosystem that authorities say supports scam centers around the world. Tether also provided assistance to law enforcement during the investigation.
FAQ
What is Xinbi Guarantee?
Xinbi Guarantee is a major Chinese-language illicit marketplace connecting criminal networks with money laundering, scam infrastructure, stolen data, and other illicit services. According to the U.S. Treasury, it has processed more than $24 billion in digital assets and fiat currency since around 2022.
Did North Korean hackers use Xinbi?
Yes. Our analysis shows DPRK-linked actors moved tens of millions of dollars stolen from major crypto hacks, including Bybit and WazirX, through Xinbi’s vendor network.
How did Xinbi help launder stolen crypto?
Specialized “Black U” launderers accepted traceable stolen cryptocurrency and swapped it for stablecoins sourced from other illicit activity, including scam proceeds. This allowed customers to exchange highly tainted funds for less-tainted assets that could then be converted into fiat.
What criminal services were available through Xinbi?
Xinbi vendors advertised money laundering, stolen personal data, fraudulent bank cards, KYC bypass services, scam platforms, malware, cash delivery, and other services supporting crypto-enabled fraud.
How much cryptocurrency was seized in the Xinbi crackdown?
U.S. authorities seized two Xinbi wallets holding approximately $12 million and restrained 47 additional wallets associated with its network. In total, more than $52 million in cryptocurrency tied to Xinbi and its vendors was restrained.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
