U.S. freezes $52.8M in Tether, blacklists Telegram escrow fueling global scam networks

Federal law enforcement and treasury officials have intensified a global campaign against the financial networks powering international cyber-scam syndicates. The coordinated offensive targets Xinbi Guarantee, a prominent Chinese-language “guarantee” marketplace operating on the Telegram messaging platform. The platform serves as a vital financial intermediary for transnational criminal organizations, particularly those orchestrating “pig-butchering” investment schemes.

As part of the crackdown, the U.S. Secret Service, collaborating with blockchain intelligence firm Elliptic, froze $52.8 million in Tether (USDT) stablecoins held across 52 digital wallets linked to the marketplace. According to federal court documents unsealed by the Department of Justice, agents seized approximately $12 million outright from two of those wallets under a federal warrant, while the remaining 50 wallets were frozen pending further legal proceedings.

Xinbi Guarantee does not operate as a traditional storefront. Instead, it functions as an illicit escrow and dispute-resolution service designed to facilitate trust among cybercriminals who would otherwise have no reason to trust one another. On the platform, vendors of illicit goods—ranging from money-laundering services and fraudulent bank accounts to stolen personal identification data—must post cryptocurrency deposits.

The enforcement actions highlight the growing reliance of federal investigators on public blockchain ledgers to disrupt the financial architecture of cybercrime. By blacklisting wallets holding USDT, authorities leveraged the centralized governance model of Tether Limited, the stablecoin’s issuer, which maintains smart-contract capabilities allowing it to freeze assets on various blockchains at the request of law enforcement.

According to data compiled by Elliptic, Xinbi and its affiliated merchants have processed at least $24 billion in transactions since 2022, cementing its status as the second-largest illicit online marketplace ever tracked by blockchain analysts. The platform’s transaction volume surged after the collapse of its chief competitor, Huione Guarantee. Huione had processed an estimated $31 billion before its parent group was designated as a primary money laundering concern by the U.S. Department of the Treasury.

A vast portion of the capital flowing through these escrow platforms is generated by “pig butchering” (*sha zhu pan*), a highly structured form of financial fraud that originated in China and has since spread globally, often operating out of heavily fortified compounds in Southeast Asia. In these schemes, scammers spend weeks or months building romantic or platonic relationships with victims online before coaxing them into depositing their life savings into fraudulent investment platforms that display fabricated returns.

If a buyer is defrauded or does not receive the promised services, they can be reimbursed from the vendor’s escrowed deposit. Telegram shut down the Huione marketplace in May 2025, and Xinbi quickly absorbed the displaced criminal traffic and merchants left behind by Huione’s closure. On September 9, the day following the Secret Service wallet freezes, the Treasury Department’s Office of Foreign Assets Control (OFAC) designated Xinbi Guarantee as a “significant transnational criminal organization.”

This designation places the group in the same regulatory category as international drug cartels and organized crime syndicates, effectively blocking any U.S.-based assets and prohibiting U.S. citizens or entities from transacting with them. OFAC also extended sanctions to two third-party firms accused of providing critical operational and technological support to Xinbi: Singapore-based SafeW Technology and Cambodia-based Anwen Technology. The United Kingdom had previously blacklisted Xinbi in March as part of its own domestic efforts to curb transnational fraud. In a public statement, Xinbi condemned the asset freezes, characterizing the U.S. actions as “arbitrary” and pledging to reimburse affected clients.

Blockchain tracking data indicates that Xinbi has begun migrating its transaction infrastructure away from USDT toward USDD, a decentralized stablecoin launched by TRON blockchain founder Justin Sun. Through decentralized exchanges, the group has already swapped approximately $2.8 million of its remaining USDT reserves into USDD. Unlike USDT, which is managed by a centralized issuer capable of blacklisting addresses, USDD is designed to operate via smart contracts without a central authority holding a unilateral “freeze switch.”

The enforcement actions have triggered a tactical shift by Xinbi as it attempts to bypass the centralized freezing mechanisms built into major stablecoins like Tether. However, blockchain analysts point out a structural vulnerability in this evasion strategy: USDD’s collateral reserves are partially backed by USDT itself. Consequently, while the USDD tokens themselves cannot be directly frozen by a centralized entity, the underlying assets backing the stablecoin’s peg remain exposed to potential regulatory interventions.

The action against Xinbi coincided with a broader international operation led by the Department of Justice’s Scam Center Strike Force. Established in November 2025 to target the physical and digital infrastructure of transnational fraud rings, the task force recently deployed federal agents to Madagascar. Working alongside local law enforcement, U.S. agents assisted in raiding 13 Chinese-run scam compounds in the island nation.

The joint operation resulted in the arrest of nearly 400 individuals and the seizure of more than 3,200 electronic devices, which are currently being analyzed for evidence of global wire fraud and money laundering. Since its inception, the Scam Center Strike Force has seized approximately $938 million in cryptocurrency tied to illicit schemes. Federal prosecutors indicated that efforts to recover the remaining outstanding balances linked to Xinbi’s network are ongoing.