Xinbi Crypto Laundering Network Disrupted

Coordinated Enforcement Action Targets Xinbi Guarantee Infrastructure

• OFAC designated Xinbi Guarantee, a Chinese-language platform facilitating connections between criminal organisations and providers of laundering, fraud infrastructure, compromised identity data and related illicit services.
• Match Systems analysis confirms North Korea-linked entities routed tens of millions in proceeds from the Bybit and WazirX breaches through Xinbi vendor channels, deploying "Black U" swap mechanisms to exchange flagged assets for stablecoins drawn from separate criminal revenue.
• Federal and Treasury actions froze or restrained over $52 million across Xinbi wallets and associated vendor addresses, while court orders shut down the platform's Telegram presence.

OFAC published its Xinbi Guarantee designation on September 9, 2026, identifying the marketplace as a nexus for scam operations and digital-asset laundering. The same enforcement wave saw the Justice Department's Scam Center Strike Force seize $12 million held in Xinbi payment wallets and secure restraint orders covering millions more in vendor custody.

The action removes a significant node in the infrastructure threat actors have used to move billions in tainted cryptocurrency. North Korea-linked wallets transferred tens of millions stolen in the $1.5 billion Bybit compromise and the $235 million WazirX incident through the vendor network Xinbi hosts, Match Systems tracing confirms.

OFAC's designation swept in SafeW Technology and Anwen Technology, entities behind messaging and payment applications that supported platform operations. The 52 addresses Treasury listed have collectively received more than $8.4 billion in stablecoin transfers. The Strike Force separately obtained seizure authority over $12 million in cryptocurrency Xinbi controlled and coordinated restraint of additional vendor holdings.

The UK Foreign, Commonwealth & Development Office had already sanctioned Xinbi in March 2026 under its Global Human Rights regime. Following the U.S. action, FCDO amended its designation to capture dozens more cryptocurrency addresses tied to the marketplace.

Marketplace Architecture and Transaction Volume

Xinbi emerged approximately four years ago and has since intermediated more than $24 billion in digital and fiat flows, Treasury estimates indicate. The platform's expansion mirrors the broader dominance of Chinese-language laundering networks, which now handle an estimated one-fifth of all identified illicit cryptocurrency over the past five years — $16 billion in 2025 alone. Guarantee models such as Xinbi anchor that ecosystem.

The marketplace functions as a multi-service hub for transnational crime. Hundreds of Chinese-language Telegram channels host vendor advertisements for laundering, turnkey fraud websites, breached identity records and labour recruitment tied to Southeast Asian fraud compounds where trafficking victims endure forced work and abuse. The human-rights nexus formed the basis for the UK's initial sanctions designation.

Match Systems mapping of Xinbi's Telegram infrastructure reveals vendor offerings spanning cash-out services, compromised payment cards, identity data, KYC circumvention tools, bespoke scam platforms, surveillance hardware and malware. These components collectively support the operational chain of crypto-enabled fraud from target acquisition and credential theft through to laundering and cash conversion.

Xinbi's escrow mechanism underpins the entire structure: the platform retains vendor security deposits and administers transaction settlement, establishing an enforced trust layer that permits criminal counterparties to transact at volume without pre-existing personal networks.

North Korea Routing Through Vendor Channels

On-chain reconstruction of Xinbi flows shows North Korea-linked wallets moved tens of millions in stolen cryptocurrency through the platform's vendor infrastructure.

The laundering mechanism operates through asset substitution rather than chain-hopping or mixing. "Black U" specialists accept the traceable, attribution-heavy stolen funds and deliver stablecoins sourced from unrelated criminal activity — chiefly pig-butchering and romance-scam proceeds circulating within the same marketplace ecosystem. The original stolen assets dissolve into a broader illicit pool, degrading attribution signals, while North Korea-linked controllers receive nominally cleaner stablecoins suitable for fiat conversion via unlicensed OTC desks.

Investigative Trail to $52 Million Restraint

Federal investigators traced U.S. victim funds directly to vendors operating money-laundering advertisements on Xinbi channels. That attribution enabled coordinated strikes against both the platform's online presence and its financial infrastructure.

A federal court authorised seizure of Xinbi's Telegram marketplace channels on September 7. Under the same warrant, the Strike Force took control of two wallets Xinbi allegedly operated for vendor payment collection, holding approximately $12 million in cryptocurrency. Authorities simultaneously secured restraint orders covering 47 additional wallets linked to the platform.

The combined enforcement actions locked more than $52 million in cryptocurrency tied to Xinbi and its vendor network, disrupting capital flows supporting what authorities describe as a global scam-centre ecosystem. Tether contributed investigative support during the inquiry.