September 9, 2026

The US Sanctions Xinbi, One of Southeast Asia's Largest Illicit Crypto Marketplaces

TRM Team

TRM User Conference

Which mission will you select?

November 2-3, 2026

Washington, D.C.

The US Sanctions Xinbi, One of Southeast Asia's Largest Illicit Crypto Marketplaces

Key takeaways

On September 9, 2026, OFAC designated Xinbi Guarantee — a Chinese-language marketplace at the center of Southeast Asia's cyber scam economy — as a significant transnational criminal organization, alongside two developers that build its core tooling: Anwen Technology (the XinbiPay/NewPay wallet) and SafeW Technology (the SafeW messaging app).
As of September 9, Telegram has officially banned Xinbi.
Xinbi runs an escrow-backed marketplace that connects scam syndicates with vendors selling stolen data, fake identity documents, deepfake tools, and cash-out services, settling primarily in USDT on TRON.
TRM analysis places the marketplace's throughput at more than USD 36 billion since around 2022, and it expanded as enforcement pushed rivals such as Huione and Haowang out of the market.
The US action follows the UK's March 2026 designation and a same-day DOJ Scam Center Strike Force seizure. All property of the designated persons is blocked for US persons, as is any entity owned 50% or more by them.

On September 9, 2026, the US Office of Foreign Assets Control (OFAC) designated Xinbi Guarantee, a Chinese-language online marketplace at the center of Southeast Asia's cyber scam economy, as a significant transnational criminal organization. OFAC also designated two Southeast Asia-based application developers that support Xinbi's core operations: Anwen Technology Co., Ltd., the Cambodia-based developer of the XinbiPay wallet, also marketed as NewPay, and SafeW Technology Co., Ltd., the Singapore-based developer of the SafeW messaging app. Xinbi's listing on the Specially Designated Nationals (SDN) List included 52 cryptocurrency addresses on TRON.

OFAC took the action under Executive Order 13581, as amended by Executive Order 13863, and in furtherance of Executive Order 14390 of March 6, 2026, "Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens." Treasury coordinated the designations with the Department of Justice's Scam Center Strike Force, which seized infrastructure and digital asset wallets used by Xinbi the same day.

"Scam centers in Southeast Asia steal billions of dollars from American victims each year," said Secretary of the Treasury Scott Bessent. "Treasury will continue using its tools to disrupt the networks behind this egregious fraud and protect Americans."

The designation makes the US the second country to sanction Xinbi. The UK Foreign, Commonwealth, and Development Office (FCDO) designated the marketplace on March 26, 2026, in the first state action against it. Today's designations also build on OFAC's October 2025 and June 2026 actions against the Prince Group transnational criminal organization and FinCEN's Section 311 actions against the Huione Group.

What Xinbi is

Xinbi Guarantee operates an illicit online marketplace that connects transnational criminal syndicates, including scam center operators, with merchants that provide financial services, technology, and other goods. Scam operators use the platform to buy goods and move money in support of cyber scams and fraud, and Xinbi provides them with escrow services. By offering transaction assurance with minimal due diligence, it lowers the barrier to entry for financial crime. According to TRM analysis, Xinbi likely operates from the Golden Triangle region spanning Myanmar, Thailand, and Laos.

Listings on the platform have included stolen personal data, fake identity documents, AI deepfake tools, satellite internet equipment, and over-the-counter crypto exchanges. Its services support scam operations that rely on trafficked foreign nationals, often lured with the promise of legitimate employment, to carry out online fraud at industrial scale.

The scale of the marketplace

Xinbi has processed more than USD 36 billion in digital assets and fiat currency since around 2022, and USD 17 billion in inflows. As of TRM's September 2026 analysis, Xinbi's Telegram presence had reached 657,643 subscribers. As of September 9, Telegram has officially banned Xinbi.

Xinbi settles primarily in the stablecoin USDT on TRON. Its XinbiPay wallet, also marketed as NewPay, took in USD 94.6 million through its withdrawal hot wallet in December 2025.

How Xinbi absorbed the market after earlier enforcement

Xinbi grew as its competitors collapsed. After FinCEN listed Huione Pay as a financial institution of primary money laundering concern, cybercriminals moved their activity to Xinbi, which continued offering substantially similar services to an overlapping customer base. Telegram banned Xinbi and rival marketplaces in spring 2025. Huione and Haowang volumes fell nearly 100%, and Tudou Guarantee declined about 74% before shutting down.

Xinbi recovered and expanded. Its daily inflows nearly doubled between May 12, 2025, and December 22, 2025, as it absorbed volume from the declining marketplaces.

The infrastructure OFAC targeted

Around June 2025, in response to growing law enforcement scrutiny, Xinbi began migrating its merchant and money laundering networks to SafeW, an end-to-end encrypted messaging app developed by SafeW Technology, and encouraged users to coordinate buyers and sellers there. At the same time, it launched XinbiPay, the no-know-your-customer wallet developed by Anwen that supports USDT across TRC20, ERC20, and BEP20.

Today's action reaches that infrastructure directly. OFAC designated Anwen and SafeW Technology for materially supporting Xinbi. By designating the wallet and messaging developers alongside the marketplace, OFAC reached the tooling Xinbi built to keep operating through enforcement.

The North Korea and Prince Group dimension

OFAC states that Xinbi's platform has been used by North Korean hackers and by several OFAC-designated entities, including Jin Bei Group Co., Ltd. and entities that are part of the Prince Group transnational criminal organization. That places Xinbi inside a national security picture reaching beyond Southeast Asian scam financing.

What the designation means for compliance teams

All property and interests in property of the designated persons that are in the US or in the possession or control of US persons are blocked and must be reported to OFAC. Any entity owned 50% or more by one or more blocked persons is also blocked. US persons are generally prohibited from transactions involving blocked persons, and OFAC may impose civil penalties for violations on a strict liability basis.

Any platform processing transactions linked to Xinbi wallets, XinbiPay infrastructure, or associated addresses now carries sanctions exposure. The 52 addresses named in the designation are live in TRM Labs products under the sanctions category, and TRM has attributed further addresses to the marketplace through on-chain analysis. TRM will continue to investigate Xinbi and its infrastructure, and will add additional addresses as they are identified.

Frequently asked questions (FAQs)

1. What is Xinbi Guarantee?

Xinbi Guarantee is a Chinese-language online marketplace that provided escrow ("guarantee") services connecting transnational scam syndicates with vendors offering money laundering, stolen data, fake identity documents, and other illicit goods. TRM analysis indicates it likely operates from the Golden Triangle region spanning Myanmar, Thailand, and Laos.

2. Who did OFAC designate, and under what authority?

OFAC designated Xinbi Guarantee as a significant transnational criminal organization, along with wallet developer Anwen Technology Co., Ltd. and messaging-app developer SafeW Technology Co., Ltd. The action was taken under Executive Order 13581, as amended by Executive Order 13863, and in furtherance of Executive Order 14390.

3. Had any other country sanctioned Xinbi?

Yes. The United Kingdom's FCDO designated Xinbi on March 26, 2026, making the US the second jurisdiction to sanction the marketplace.

4. How large is the marketplace?

TRM analysis places Xinbi's throughput at more than USD 36 billion in digital assets and fiat currency since around 2022. Xinbi settles primarily in USDT on TRON, and its XinbiPay wallet took in USD 94.6 million through its withdrawal hot wallet in December 2025.

5. What does the designation mean for crypto businesses and compliance teams?

All property and interests in property of the designated persons within US jurisdiction are blocked and must be reported to OFAC, and any entity owned 50% or more by one or more blocked persons is also blocked. US persons are generally prohibited from dealing with blocked persons, and OFAC may impose civil penalties on a strict liability basis. Any platform processing transactions tied to Xinbi, XinbiPay, or associated addresses now carries sanctions exposure.