Quick overview
This is some text inside of a div block.
Thursday, September 10, 2026
OFAC designates Xinbi Guarantee: 52 TRON addresses added to SDN list
Global News.png){kind=logo}
On September 9, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) designated Xinbi Guarantee (新币担保), a Chinese-language online marketplace operating across Burma, Thailand, and Laos, as a significant transnational criminal organization. OFAC took the action pursuant to Executive Order 13581, "Blocking Property of Transnational Criminal Organizations," as amended by Executive Order 13863, and in furtherance of Executive Order 14390 of March 6, 2026, "Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens."
The Specially Designated Nationals and Blocked Persons (SDN) List entry for Xinbi Guarantee carries 52 Digital Currency Address (TRX) identifiers, all on the TRON blockchain.
According to Treasury, Xinbi Guarantee has processed more than 24 billion US dollars in digital assets and fiat currency since its emergence around 2022, primarily facilitating transactions across Southeast Asia. The platform functioned as an escrow-backed marketplace connecting scam center operators with vendors selling stolen data, fraudulent identity documents, money laundering services, and technology tools, settling mostly in USDT on TRON.
Treasury also states that the platform has reportedly been used by North Korean cyber actors and by other OFAC designated entities, including Jin Bei Group Co., Ltd. and entities that are part of the Prince Group transnational criminal organization.
The growth pattern is one compliance teams have seen before. After the Financial Crimes Enforcement Network (FinCEN) issued a Section 311 final rule against Huione Pay in October 2025, cybercriminals looking to preserve their operations shifted to Xinbi Guarantee, which kept offering substantially similar services to an overlapping customer base. Xinbi had already been removed from Telegram once, in May 2025, and came back under the same name with a reported 90% increase in daily crypto flow.
The September 9 designation was coordinated with the Department of Justice's Scam Center Strike Force. On September 7, 2026, the U.S. District Court for the District of Columbia authorized the seizure of Telegram channels hosting Xinbi's marketplace. Authorities restrained more than 52 million US dollars in cryptocurrency connected to the platform and its vendor network, including two wallets holding approximately 12 million US dollars seized outright.
This action also complements the UK's earlier designation. The FCDO sanctioned Xinbi on March 26, 2026 under its Global Human Rights sanctions regime, citing the platform's role in facilitating scam operations tied to trafficking and forced labor in Cambodian scam compounds. Treasury's September 9 action noted close coordination between the two governments in disrupting the network.
Scorechain's database was updated to reflect the designation, with all 52 addresses flagged under the unified entity Xinbi - Xinbi Guarantee - 新币担保, scored 1 on a critical risk basis under the Sanction List indicator. On Scorechain's risk scale, a lower score means higher risk, so score 1 sits at the most severe end.
Based on a sample of the 52 addresses, measured throughput exceeds 2.7 billion US dollars across roughly 231,000 transactions, almost entirely in USDT. That figure is a floor rather than a total: it reflects only part of the full address set, and it counts gross measured throughput rather than distinct laundered value, since funds pass between several of the listed addresses themselves.
The address set splits into two clear tiers. A collection tier of high-frequency wallets each processes tens of thousands of transactions. A settlement tier of lower-frequency wallets moves comparable total dollar amounts in only a few hundred transactions, averaging close to 3 million US dollars per transfer. That matters operationally. Screening logic tuned to catch retail-pattern activity will likely miss the settlement tier entirely, and that is exactly where institutional counterparties are more likely to show up.
Several addresses in the sample still hold live, recoverable USDT balances, concentrated on one wallet holding more than 2 million US dollars, making them immediate freeze targets. A number of the listed addresses also follow a distinctive vanity pattern, repeated digits or letters in the string, consistent with a branded payment product and worth flagging as a possible lead for finding related, unlisted infrastructure.
Address-level provenance ties this designation to prior sanctions activity. One of the 52 addresses was funded by an address Scorechain attributes to a separate, pre-existing Xinbi marketplace entity, which appears to have been seeded from the UK's March 2026 action. That funding link points to the US and UK designations describing the same underlying network, not two unrelated marketplaces.
For more information on the Xinbi Guarantee network, read full OFAC sanctions data update.
The highest-volume addresses in this designation were not long-dormant. Several were created in July and August 2026 and stayed active as recently as September 8, 2026, the day before designation. That makes the compliance lookback window recent and operationally relevant, not a historical exercise. Any institution with exposure to this cluster in the past two months has an immediate question to answer, not an archival one, and the Department of Justice's same-day wallet seizure means some of these balances may already sit under law enforcement control.
Direct attribution changes the compliance response. A wallet named directly in an SDN entry is a confirmed sanctions match, not an inferred risk signal that needs a probabilistic judgment call. For compliance teams, this designation carries several immediate implications:
For European Union based crypto asset service providers (CASPs) operating under the Markets in Crypto-Assets Regulation (MiCA), this designation intersects with sanctions screening obligations under the Sixth Anti-Money Laundering Directive (AMLD6), even without a direct US nexus, given the platform's documented use by multiple internationally sanctioned networks.
Xinbi Guarantee (新币担保) is a Chinese-language online marketplace that operated primarily through Telegram, connecting Southeast Asian scam center operators with vendors offering money laundering, payment processing, and technology services. Treasury states it has processed more than 24 billion US dollars in digital assets and fiat currency since around 2022.
OFAC designated 52 TRON (TRX) addresses as part of the September 9, 2026 Specially Designated Nationals List entry for Xinbi Guarantee. All 52 are on the TRON blockchain, and Scorechain's analysis found the network settles almost entirely in USDT-TRC20 across a two-tier collection and settlement wallet structure.
An address on OFAC's Specially Designated Nationals List is blocked property. US persons are generally prohibited from transacting with it, and any exposure to it is a direct sanctions match rather than an inferred risk. For a transnational criminal organization designation like this one, the same address also carries obligations under corresponding non-US sanctions screening frameworks.
No. The UK's Foreign, Commonwealth and Development Office designated Xinbi under its Global Human Rights sanctions regime on March 26, 2026, months before the September 2026 OFAC action, citing the platform's connection to trafficking and forced labor in Southeast Asian scam compounds. The two designations describe the same underlying network.
Yes. Tether has reportedly frozen USDT balances across multiple TRON addresses tied to Xinbi Guarantee following the designation, consistent with the residual balances Scorechain identified as live freeze targets in its own address-level analysis. USDT was also the dominant asset across the collection and settlement wallets in that sample.
The designation is published on OFAC's Recent Actions page at ofac.treasury.gov/recent-actions/20260909, which lists the full SDN entry text and all 52 TRON addresses. Treasury's press release, covering the broader enforcement context and the coordinated Department of Justice action, is available here.
This designation fits a recurring cycle in Southeast Asia's scam economy. When FinCEN acted against Huione Pay in October 2025, criminal activity did not stop, it migrated to Xinbi Guarantee, which absorbed the displaced customer base and kept offering substantially similar services. Xinbi itself had already been removed from Telegram once, in May 2025, and returned under the same name with increased activity. The pattern suggests displaced activity from this designation will resurface on a successor platform, and compliance teams should treat this as an ongoing monitoring requirement, not a closed case.
The two-tier wallet architecture in Scorechain's analysis is the clearest lesson here: the addresses that matter most operationally are not always the ones with the highest transaction counts. A screening program tuned only to retail-pattern activity will miss the settlement tier, exactly where institutional counterparties are most likely to appear. If your team needs to see how Scorechain surfaces that settlement-tier exposure across a full sanctioned network, book a demo.
.webp)
