11 SEP 2026 — The United States moved against Xinbi Guarantee on 9 September, seizing the Telegram channels the marketplace ran on, restraining 52.8 million dollars across 52 cryptocurrency wallets, and sanctioning three entities behind it. Xinbi has processed at least 24 billion dollars since 2022. The seizure is about two tenths of one per cent of that.
The arithmetic does not suggest the action was pointless. It suggests the seizure is the least important part of it.
What Xinbi actually was
Xinbi Guarantee operated as an escrow service on Telegram. Vendors advertised, buyers paid, and the platform held the funds until both sides confirmed — the same mechanism any marketplace uses to make transactions possible between parties who have no reason to trust each other.
What was for sale was crime as a service. Money laundering. Stolen personal data. Deepfake tooling. Custom-built fake investment websites. Recruitment for the scam compounds themselves. As of last week the platform carried roughly 4,600 vendors, and every transaction settled in Tether's USDT.
That last detail is what makes the scale possible. A single stablecoin denominated in dollars, transferable across borders in minutes, gives an escrow platform a settlement layer that no bank would provide and no regulator supervises at the point of transfer.
The successor problem
Xinbi was the second-largest illicit marketplace ever measured. The largest was Huione Guarantee, which handled 31 billion dollars before shutting down in 2025.
The pattern is hard to miss. Huione closed, and Xinbi grew into the space it left. The demand Huione served did not evaporate when Huione did; the infrastructure to meet it was rebuilt somewhere else in the same market. That is displacement, not elimination.
Elliptic's co-founder expects Xinbi to try to rebuild, but notes that the sanctions make that difficult. The attempt is near-certain; the difficulty is the variable, and it is the variable this action was designed to move.
The sanctions are the durable lever
The Treasury designated three entities, and the second and third are more consequential than the first.
Xinbi Guarantee itself was sanctioned, which matters mainly as a signal to anyone considering handling its funds. Anwen Technology, based in Cambodia, built XinbiPay — the payments layer. SafeW Technology Co. makes the encrypted messaging application the ecosystem runs on.
A seizure goes after money that has already moved. A designation goes after the ability to move the next tranche, putting every exchange, payment processor and counterparty on notice that dealing with these entities carries sanctions exposure. The rails are harder to rebuild than the storefront, and the designations are aimed at the rails.
The Cambodian entity carries the most regional weight: a payments company incorporated in an ASEAN member state, servicing a marketplace that recruits into compounds across the region. That is not an offshore abstraction. It is a licensed-looking business in a neighbouring jurisdiction.
Britain got there first, in March
One fact complicates the argument above: the United Kingdom sanctioned Xinbi in March 2026, roughly six months before this week's action.
Xinbi did not stop. It was still carrying about 4,600 vendors last week, and the bulk of its 24 billion dollars in throughput was accumulated across a period that includes those six months. A designation by a G7 government, on its own, did not measurably impair the business.
There are two readings, and they are not equally comforting. Designations may work slowly, as the compliance systems of exchanges and processors absorb them, in which case the British action is part of what makes this week's bite. Or a designation in a jurisdiction the platform does not touch may be close to symbolic. In that reading, what changed the picture is the seizure of the actual channels and wallets, which happened this week and not in March.
The evidence does not yet separate them. The claim that sanctions are the durable lever is therefore a hypothesis about this action, not a lesson drawn from the last one.
Madagascar, and where the compounds are
The same operation saw the Scam Center Strike Force deployed to Madagascar to help disrupt 13 compounds run by Chinese organised crime syndicates. Cumulatively the strike force has now restrained roughly 938 million dollars.
Madagascar is worth pausing on, because the scam-compound industry is usually described as a Southeast Asian problem, and for good reason — we have written before about the compounds operating out of Myanmar and about where the money actually goes when the region hosts them. An operation in Madagascar says the compound model has been exported, and that the constraint on where a compound sits is weak governance rather than geography.
For the region that has been carrying this industry, that cuts both ways. Pressure that pushes operators out is welcome. An operating model that travels means the pressure has to keep moving.
What a defender should take from this
Very little of this changes what an individual or a business can do, and it would be padding to pretend otherwise. The exposure is to the output of the marketplace, not to the marketplace.
What does change is the reading of the environment. A vendor ecosystem of 4,600 sellers means the operational capability behind a romance-investment approach or a deepfake video call is bought rather than built, by operators who need no technical skill at all. The quality of what arrives in an inbox is no longer tied to the skill of the sender. It improves as the marketplace improves.
The second thing worth holding is the settlement layer. Every one of those 24 billion dollars moved in a single stablecoin. Any request to pay in USDT, from a party met online, sits downstream of exactly this infrastructure.
What to watch
Whether a third marketplace appears, and how quickly. Huione's closure was followed by Xinbi's growth; the interval between the two is the honest measure of how much friction a takedown creates.
And whether the designations reach the exchanges. Sanctioning a Cambodian payments company only bites if the counterparties that clear its transactions treat the designation as binding. That is a compliance question across several jurisdictions, and it is where this action will be shown to have worked or not.
View author profile → · Editorial policy
