Secret Service Freezes $52.8 Million in Crypto From Chinese-Language Scam Marketplace Xinbi

The U.S. Secret Service froze $52.8 million in cryptocurrency on September 8 tied to Xinbi Guarantee, a Chinese-language marketplace that runs on Telegram and sells the tools scammers need to defraud people worldwide, according to Decrypt and confirmed by blockchain analytics firm Elliptic.

Agents froze 52 wallets holding USDT, Tether's dollar-pegged stablecoin, starting at 8am UTC. Two of those wallets, containing roughly $12 million, were seized outright under a warrant the Department of Justice unsealed the same day. The rest remain frozen pending further action, Decrypt reported.

Elliptic says it supplied the intelligence that made the action possible, extracting data from its Data Fabric platform into Secret Service systems to connect on-chain and off-chain activity. "For years, Xinbi Guarantee exploited the gap between on-chain and off-chain data to stay hidden," Elliptic CEO Simone Maini said in a statement carried by Morningstar. "Elliptic's intelligence closed that gap, giving investigators everything they needed to act."

Since 2022, Xinbi and its merchants have processed at least $24 billion in transactions, according to Elliptic, making it the second-largest illicit online marketplace ever tracked. Only Huione Guarantee moved more, processing $31 billion before Telegram shut it down in May 2025. Xinbi absorbed much of that traffic once its predecessor disappeared.

Xinbi functions as an escrow system: vendors post crypto deposits so buyers and sellers of stolen data, laundering services, and other criminal tools trust they'll get what they paid for. Much of the underlying money originates from "pig butchering" scams, where a stranger cultivates a fake online relationship for weeks or months before steering the victim into a fraudulent investment app, Decrypt reported.

Treasury's Office of Foreign Assets Control designated Xinbi a transnational criminal organization on September 9, the same legal category used against drug cartels. Two supporting firms, Singapore-based SafeW Technology and Cambodia-based Anwen Technology, were sanctioned alongside it. The UK had already sanctioned Xinbi earlier this year, though Decrypt and Elliptic's own statement give different months for that action.

None of this amounts to a criminal conviction. The sanctions and freezes are enforcement actions against the marketplace and its infrastructure; no individual has been charged in connection with this specific action based on available reporting. Xinbi itself has pushed back, posting a statement condemning what it called the "arbitrary freezing" of its funds and promising to compensate customers, according to Decrypt. The platform appears to be shifting from USDT toward USDD, a stablecoin from Tron founder Justin Sun that has no central issuer able to freeze wallets.

A Bigger Enforcement Push

The Xinbi action isn't isolated. The FBI just wrapped up Operation Riptide, a 60-day campaign launched in June targeting cybercriminals who defrauded Americans out of more than $20 billion last year, FBI Director Kash Patel told Fox News Digital. "We went after this criminal enterprise more aggressively than we ever have," Patel said.

The operation produced an arrest tied to the pro-Russia hacktivist group Cyber Army of Russia Reborn and the seizure of a cloud computing account used by subsidiaries of the Huione Group, the same Cambodia-based conglomerate whose predecessor marketplace Xinbi replaced. Working with Google and Black Lotus Labs, investigators also took down Outsider, a Chinese phishing-as-a-service platform that provided hosting and phishing kits used against victims in at least 54 countries, per Fox News.

Separately, the Financial Action Task Force released a year-long study covering more than 80 jurisdictions concluding that unlicensed online gambling platforms have become go-to infrastructure for laundering criminal proceeds, terrorist financing, and even proliferation financing, according to Crypto Briefing. The watchdog flagged smurfing, unusually coordinated betting patterns and complex ownership structures as red flags, and warned that e-wallets, mobile money and virtual assets are the fastest-growing vulnerabilities. A related FATF estimate put illegal online gambling proceeds laundered through underground networks at more than half a billion euros.

A Separate Warning on Chinese Bots

A different but related flag came from X, which said its Safety team identified a bot farm of roughly 200,000 suspected Chinese inauthentic accounts, 200 of which were posting content designed to shape the U.S. debate over AI data centers and energy policy, according to Breitbart. The posts claimed data centers are driving up electricity prices and included AI-generated cartoons depicting operators "enriching themselves at the public's expense," per X's Global Government Affairs account.

Michael Lucci, founder of State Armor, told Breitbart this fits a pattern in which "PRC-linked actors" have used American AI tools, including OpenAI's models, to generate content opposing U.S. data center and AI infrastructure buildout. That characterization is Lucci's own, drawn from his organization's advocacy work and OpenAI's disclosed findings; X's statement itself only confirms the accounts were suspected inauthentic and Chinese-linked, not that Beijing directed the campaign. No government investigation into the bot farm has been announced.

Whether these threads represent a coordinated Chinese strategy or simply parallel exploitation of open platforms by different bad actors remains an open question. What's confirmed: $52.8 million in crypto is frozen, Xinbi has been sanctioned as a transnational criminal organization, and Treasury says it will pursue further action against the remaining wallets.