Tether froze 39,273,713 USDT across 10 Tron addresses identified by MistTrack as linked to Xinbi Guarantee on September 8, just before the U.S. launched a coordinated operation targeting the Chinese-language marketplace accused of serving fraud and money laundering networks in Southeast Asia.
The incident places a stablecoin issuer’s ability to control USDT at the center of the campaign to cut off the payment infrastructure of guarantee marketplaces. U.S. authorities accuse platforms like Xinbi of providing escrow and money-movement services to scam centers, though Tether has not separately announced details regarding the 10 addresses identified by MistTrack.
Inside the $39.3 Million Freeze
Of the 39.3 million USDT frozen across the 10 Tron addresses, the largest wallet held over 10.7 million USDT, accounting for more than 27% of the total value.
According to MistTrack, this wallet received funds from several addresses labeled “Guarantee Merchant” and transferred 12 million USDT across two transactions to another wallet labeled Xinbi Guarantee. MistTrack has not disclosed the identities of the parties controlling these addresses.
Cash flows between Guarantee Merchant addresses and the Xinbi wallet. Source: MistTrack.
Tether’s blacklist maintains the USDT balances on the blockchain but prevents the tokens from being moved. Other assets at the same Tron addresses are unaffected. The freeze also does not transfer control of the funds to law enforcement; seizure requires a separate legal procedure.
BlockSec noted that Tether blacklisted 4,163 addresses on Tron and Ethereum in 2025, freezing a total of 1.26 billion USDT. Tron accounted for 3,506 addresses (84%), with restricted balances reaching 853.08 million USDT.
A Wider U.S. Crackdown
On September 9, OFAC added Xinbi Guarantee to its sanctions list as a significant transnational criminal organization. The agency simultaneously published multiple Tron addresses linked to Xinbi, including wallets belonging to the group previously identified by MistTrack.
SafeW Technology and Anwen Technology were also sanctioned for providing technology and services supporting Xinbi’s operations. SafeW Technology developed the encrypted messaging app SafeW, while Anwen Technology is behind XinbiPay, also known as NewPay. Under OFAC regulations, assets of the three entities in the U.S. or under the control of U.S. citizens and entities must be blocked and reported.
On the same day, the U.S. Department of Justice announced an operation seizing Telegram channels used by Xinbi to operate its marketplace. The seizure warrant was approved by the U.S. District Court in Washington, D.C., on September 7.
The Scam Center Strike Force also seized two cryptocurrency wallets used by Xinbi to receive vendor payments, with a combined balance of approximately $12 million. The strike force also requested the freezing of an additional 47 wallets suspected of involvement in money laundering within the Xinbi network and vendors serving scam centers.
The total value of cryptocurrency blocked in the campaign exceeded $52 million, bringing the assets restricted by the Scam Center Strike Force to approximately $938 million. The DOJ also thanked Tether for its proactive assistance in the investigation.
How Xinbi Guarantee Operated
Xinbi began operating on Telegram around 2022 as a Chinese-language guarantee marketplace, connecting scam centers with service vendors. TRM Labs suggests the network likely operates from the Golden Triangle region, spanning Myanmar, Thailand, and Laos.
According to TRM Labs, Xinbi has processed approximately $24.2 billion in digital assets and fiat since its inception. Of this, the platform recorded $12.1 billion in inflows since May 2025.
Vendors were required to deposit security funds, ranging from thousands of USDT for cybercrime services to tens of thousands of USDT for money laundering and cash-out operations. Xinbi held the buyer’s funds until the service was completed before paying the vendor.
According to DOJ filings, vendors on Xinbi advertised services for building fake investment websites, laundering scam proceeds, and recruiting workers for scam compounds. TRM Labs also documented the buying and selling of stolen personal data, forged documents, deepfake tools, and crypto exchange services facilitating online fraud.
Many transactions were conducted using wallets provided by Xinbi with minimal KYC procedures. This organizational model kept capital flows within an internal payment system, making the full movement of assets harder to trace.
Pressure on Crypto Guarantee Markets
The UK became the first country to sanction Xinbi on March 26, 2026. The British government accused the marketplace of providing crypto services to scam centers in Southeast Asia, including the laundering of stolen digital assets.
Telegram had previously taken down a series of channels linked to Xinbi, Huione, and Haowang in 2025. According to TRM Labs, transaction volumes for Huione and Haowang subsequently dropped by nearly 100%, while Tudou’s activity fell by around 74%. Inflows into Xinbi, however, nearly doubled between May 12 and December 22, 2025.
Xinbi began migrating users to SafeW and launched XinbiPay in June 2025. By late January 2026, its Telegram escrow service still had about 346,156 subscribers, while the corresponding service on SafeW surpassed 18,557. The hot wallet processing XinbiPay withdrawal transactions received over $94.6 million in its first month of operation.
What Remains Unclear
Tether has not disclosed the request that led to the freeze or the authority behind the action. U.S. officials have also not clarified whether the $39.3 million in USDT is included in the more than $52 million blocked from Xinbi and its vendor network.
The USDT at the blacklisted addresses cannot currently be moved, but there is no public decision regarding asset forfeiture or restitution to victims. Next steps will depend on judicial proceedings and Tether’s ability to transfer the assets as requested by law enforcement.
