In a significant escalation of international efforts to combat transnational cybercrime, the United States Department of Justice (DoJ) announced a sweeping series of coordinated actions aimed at dismantling "Xinbi Guarantee," a notorious Telegram-based illicit marketplace that served as a central hub for global scam operations. The operation, which involved the seizure of critical digital infrastructure and the deployment of the Scam Center Strike Force to Madagascar, marks a turning point in the ongoing battle against organized criminal syndicates that have systematically drained billions of dollars from American citizens.
The crackdown resulted in the immediate freezing of approximately $52.8 million in cryptocurrency assets tied to 52 digital wallets, a move that brings the total value of illicit funds restrained by the Scam Center Strike Force to nearly $1 billion. Beyond the financial seizures, the operation successfully disrupted 13 high-intensity scam compounds in Madagascar, resulting in the processing of nearly 400 individuals, including 30 identified leaders of these operations who have since been repatriated to China.
The Anatomy of an Illicit Marketplace
Xinbi Guarantee functioned as a "one-stop shop" for cybercriminals, providing the necessary tools and infrastructure for "pig butchering" scams—a sophisticated form of long-term financial fraud often involving fake romance and investment opportunities. By operating primarily through the encrypted messaging platform Telegram, Xinbi acted as an intermediary between specialized vendors and the operators of scam compounds.
The services offered through this marketplace were comprehensive, covering the entire lifecycle of a fraud campaign. This included the development of custom-coded investment websites designed to mirror legitimate financial institutions, the laundering of proceeds through complex cryptocurrency networks, and the facilitation of human trafficking to source labor for scam compounds across Southeast Asia and, more recently, Africa.
A critical component of Xinbi’s success was its escrow mechanism. By holding funds in transit until a service—such as the creation of a phishing site—was verified as complete, the marketplace established a veneer of professional trust within the criminal underworld. This structure allowed vendors to scale their operations, effectively professionalizing a sector of the dark economy that had previously operated in fragmented silos.
A Chronology of Escalation
The emergence of Xinbi Guarantee is the latest chapter in a broader saga of digital enforcement. Following the collapse of previous major marketplaces like "HuiOne Guarantee" and "Tudou Guarantee" last year, Xinbi rose to fill the power vacuum, quickly establishing itself as the second-largest illicit marketplace of its kind. Since its inception in 2022, blockchain analytics firm Elliptic estimates that the platform facilitated upwards of $30 billion in illicit transactions.
The timeline of this operation reflects a deepening collaboration between private-sector cybersecurity firms and government agencies:
- 2022: Xinbi Guarantee begins operations on Telegram, quickly gaining traction among criminal syndicates seeking reliable vendor services.
- Early 2025: Following the closure of competitor marketplaces, Xinbi solidifies its dominance, attracting high-profile criminal entities, including North Korean state-sponsored hackers and OFAC-sanctioned groups.
- March 2026: The United Kingdom becomes the first nation to officially sanction Xinbi, citing the sale of stolen personal data and satellite internet equipment used to target victims.
- January 2026: Dr. Tom Robinson of Elliptic notes that despite minor interventions by Telegram, the marketplace remained resilient, leading to a proliferation of smaller, fragmented markets.
- June 2026: The U.S. Department of Justice launches a coordinated strike, seizing digital assets and initiating a global physical raid on infrastructure in Madagascar.
Official Responses and the Treasury’s Stance
The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has concurrently intensified its pressure, sanctioning media outlets and entities that facilitate these criminal enterprises. Secretary of the Treasury Scott Bessent underscored the administration’s commitment to protecting the American financial system.
"Scam centers in Southeast Asia steal billions of dollars from American victims each year," Secretary Bessent said. "The Trump Administration is united in its efforts to dismantle these overseas criminal enterprises, and the Treasury will continue using its tools to disrupt the networks behind this egregious fraud and protect Americans."
The Secret Service, which played a pivotal role in identifying the flow of funds, highlighted the misconception of anonymity that often emboldens these criminals. "After scamming money from hardworking Americans, criminals operating overseas laundered it through the Xinbi Guarantee network, which operated under the false assumption that they were out of the reach of U.S. law enforcement," stated Tara McLeese, Special Agent in Charge of the U.S. Secret Service Washington Field Office.
Technical Implications and Market Evolution
A defining feature of this crackdown was the targeted disruption of the criminals’ financial agility. Historically, Xinbi operated almost exclusively using Tether’s USDT stablecoin on the TRON blockchain. However, in response to the U.S. government’s ability to freeze USDT wallets, the marketplace attempted a tactical pivot to "Decentralized USD" (USDD).
Dr. Tom Robinson of Elliptic pointed out that while USDD claims to be decentralized and immune to central freezing, this is a contested reality. "It is still exposed to freezing risk, since USDD is partly collateralized with freezable USDT," Robinson explained. This transition highlights a desperate attempt by criminal networks to maintain liquidity in an increasingly hostile regulatory environment.
The shift toward USDD is viewed by experts as a "severe setback" for the criminal ecosystem. By demonstrating that even "decentralized" assets can be effectively traced and rendered inaccessible, law enforcement has introduced a new layer of risk for both the vendors and the criminal operators. This uncertainty is expected to fracture the trust required for these marketplaces to function, potentially leading to increased competition and lower operational security among remaining syndicates.
Global Impact and Future Outlook
The expansion of the Scam Center Strike Force’s mandate to target compounds globally—as evidenced by the Madagascar takedown—signals a shift in the global posture against cyber-organized crime. The seizure of over 3,200 electronic devices in Madagascar alone provides law enforcement with a treasure trove of intelligence, likely leading to further arrests and the identification of additional, previously unknown criminal nodes.
The involvement of foreign governments, specifically China’s cooperation in the repatriation of 30 compound leaders, suggests that the scale of the "pig butchering" epidemic has finally reached a threshold where international diplomatic cooperation is no longer optional. These syndicates, which often prey on vulnerable populations, have increasingly moved their operations out of traditional strongholds in Cambodia and Myanmar into regions with weaker oversight, such as Madagascar, to evade regional crackdowns.
Analysis of the Strategic Shift
The dismantling of Xinbi Guarantee is not merely a tactical victory; it is a strategic blow to the operational efficiency of global scam networks. By attacking the "guarantee" mechanism—the very foundation of trust within the illicit marketplace—the Department of Justice has forced these organizations to revert to less efficient, more dangerous methods of interaction.
Furthermore, the integration of blockchain analytics into standard law enforcement procedures has effectively weaponized the transparency of public ledgers against the criminals themselves. As these syndicates attempt to move toward less transparent assets, they inevitably encounter higher costs, lower liquidity, and greater operational friction.
The broader implication is that the "Wild West" era of Telegram-based scam markets is drawing to a close. The success of the Scam Center Strike Force suggests that future efforts will likely focus on the infrastructure providers—such as the messaging platforms and decentralized finance (DeFi) protocols—that inadvertently host these activities. As the net tightens, the cost of doing business for cyber-syndicates will continue to climb, potentially rendering their massive, labor-intensive operations unsustainable in the long term.
In conclusion, the coordinated action against Xinbi Guarantee serves as a stark warning to criminal syndicates operating across borders. Through the fusion of financial intelligence, international diplomatic pressure, and decisive enforcement actions, the U.S. government has demonstrated that the digital sanctuary once enjoyed by these criminal networks is rapidly eroding. For the victims of these crimes, the recovery of nearly $1 billion in assets and the disruption of active compounds represent a significant step toward justice in an increasingly complex and interconnected digital landscape.
