U.S. OFAC and DOJ Join Forces to Crack Down on Xinbi Guarantee, Restricting More Than $52 Million in Crypto Assets
On September 9, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the U.S. Department of Justice (DOJ) announced coordinated enforcement actions against Xinbi Guarantee. OFAC designated Xinbi Guarantee and two companies that provided operational support to the platform, while the DOJ’s Scam Center Strike Force seized related platform infrastructure and cryptocurrency wallets. According to the DOJ announcement, the coordinated action restricted more than $52 million in crypto assets linked to Xinbi Guarantee and its merchant network.
The action targeted not a single scam group, but the service network that supports the operation of scam activities. U.S. law enforcement agencies stated that Xinbi Guarantee connected scam groups with merchants providing services such as money laundering and scam website development, and provided the conditions for these illicit transactions to operate continuously through fund custody and transaction guarantees.
Sanctions Imposed on Xinbi Guarantee and Its Supporters, Associated Assets Seized
OFAC designated Xinbi Guarantee as a significant transnational criminal organization pursuant to Executive Order 13581, as amended. Also sanctioned were Singapore-based SafeW Technology and Cambodia-based Anwen Technology. The U.S. Department of the Treasury stated that the former developed the SafeW communications application used by buyers and sellers to communicate on Xinbi Guarantee, while the latter developed XinbiPay (also known as NewPay wallet), a crypto payment and digital wallet application.
The DOJ’s actions focused directly on the platform’s channels and funds. On September 7, the U.S. District Court for the District of Columbia authorized the seizure of Telegram channels used to operate the marketplace. Law enforcement subsequently seized two wallets used by the platform to collect payments on behalf of merchants, which held approximately $12 million in total, and sought to restrict assets in another 47 wallets believed to be associated with Xinbi Guarantee’s money laundering network and related merchants. The DOJ stated that the coordinated action restricted more than $52 million in crypto assets and, in its announcement, thanked Tether (the issuer of USDT) for its assistance.
How Scam Funds Entered Xinbi Guarantee’s Transaction Network
Xinbi Guarantee began operating around 2022 and is a Chinese-language online guarantee marketplace. According to data disclosed by the U.S. Department of the Treasury, the marketplace and related platforms have processed more than $24 billion worth of digital asset and fiat currency transactions since their establishment. This figure reflects the transaction volume processed by the platforms and does not represent verified scam losses or the amount of assets seized.
In terms of how it operates, the Xinbi Guarantee platform combines merchant listings, fund custody, and transaction guarantees. Merchants publish service information through channels such as Telegram, where scam groups look for money laundering services, customized scam websites, and other resources for carrying out illicit activities. According to disclosures from the DOJ, after a buyer purchases a service, the platform may temporarily hold the payment that should be paid to the merchant and release it after the service is completed. According to announcements from Xinbi Guarantee, merchants are required to pay a security deposit, and if a buyer is deceived by a merchant, they may receive compensation through the relevant mechanism. Historically, merchants primarily used USDT on the TRON blockchain to pay the security deposit.
For scam groups, this mechanism reduces the risks of transacting with unfamiliar underground service providers and lowers the barrier to accessing services such as money laundering. After scam groups obtain victims’ funds, the funds may further flow to money laundering merchants soliciting customers on the platform, who provide services such as fund transfers, exchanges, or cash-outs. The DOJ stated that investigators have traced funds from U.S. victims to specific merchants in multiple cases. These merchants had posted money laundering advertisements in Xinbi Guarantee channels and publicly provided cryptocurrency wallet addresses for receiving payments.
Within the network formed by these merchants, the sources of funds may also vary. According to matching against SlowMist’s threat intelligence database, some money laundering merchants known as “black U” merchants received stolen crypto assets that could be traced back to hacking incidents, and then delivered stablecoins originating from other illicit revenue streams to their customers, including proceeds from pig-butchering scams and romance scams. This indicates that different types of illicit funds may converge within the same merchant network and be transferred and exchanged through different addresses and forms of assets.
Therefore, analyzing underground marketplaces of this kind requires more than simply focusing on the platform itself; it is also necessary to identify the merchant network behind the platform and its receiving addresses. The platform facilitates transactions through advertising, fund custody, and deposit mechanisms, while specific money laundering activities may be carried out by different merchants. If investigations or risk controls focus only on the platform name or monitor only a small number of publicly known wallets, they may miss the receiving addresses actually used by merchants, as well as the subsequent flow of funds from those addresses.
From Huione Guarantee to Xinbi Guarantee: MistTrack Continues to Track Illicit Fund Networks
The development of Xinbi Guarantee is also related to the migration of business activities following regulatory and law enforcement actions against similar marketplaces. The U.S. Department of the Treasury stated that after the Huione ecosystem was affected by regulatory measures, some cybercriminal activities shifted to Xinbi Guarantee, which continued to provide similar services to an overlapping customer base. The Treasury also disclosed that, starting around June 2025, Xinbi Guarantee began moving its merchants and money laundering networks to SafeW, while launching XinbiPay (also known as NewPay wallet) during the same period.
Platforms can change, but merchants, addresses, and fund relationships still need to be continuously identified. From Huione Guarantee to Xinbi Guarantee, SlowMist MistTrack has continued to label relevant risk addresses and trace and uncover the flow of illicit funds.
MistTrack has currently identified and labeled dozens of variants related to Huione Guarantee, including Tudou Guarantee, Qitian Guarantee, Fulilai Guarantee, Jinbei Guarantee, and Xinbi Guarantee. At the same time, MistTrack’s analytical capabilities cover 19 major blockchains, 100+ tokens, and 18 stablecoins, and have accumulated labels for 500M+ entity addresses, 10,000+ entities, 500K+ threat intelligence data points, and 25 risk types, providing foundational support for on-chain risk identification and fund analysis. Continuous monitoring also enables address labels to be cross-referenced with actual changes in fund movements, providing clues for institutions to assess their own risk exposure.
Building on these capabilities, SlowMist provides financial and payment institutions with AML (Anti-Money Laundering) and KYT (Know Your Transaction) capabilities through MistTrack’s address labeling, risk identification, and fund tracing capabilities, combined with SlowMist KYT’s continuous transaction monitoring and configurable risk control rules. Institutions can integrate these capabilities into business processes such as customer and counterparty screening, deposits and withdrawals, and payment settlement to identify fund risks directly or indirectly associated with scams, money laundering, and sanctioned entities, while retaining on-chain evidence for suspicious transaction reviews and subsequent investigations.
Illicit transaction networks may continue to migrate, but merchants, addresses, and fund relationships still leave traces on-chain. For financial and payment institutions, continuously identifying these relationships can help detect potential risks in a timely manner and assess risk exposure. SlowMist will continue to update relevant risk labels and related intelligence to support institutions in conducting on-chain risk monitoring and illicit fund analysis.
If you are interested in how to apply on-chain risk identification capabilities to your business scenarios, please feel free to contact us for further information.
Website: https://misttrack.io/
Email: support@misttrack.io
Form: https://kyt.slowmist.com/cn/get-started.html
References
[1] https://home.treasury.gov/news/press-releases/sb0624/
[2] https://www.justice.gov/usao-dc/pr/scam-center-strike-force-conducts-seizures-chinese-run-illicit-scammer-marketplace-and
About SlowMist
SlowMist is a threat intelligence firm focused on blockchain security, established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.
SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.
By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.
