U.S. SCAM CENTER STRIKE FORCE SEIZES XINBI MARKETPLACE INFRASTRUCTURE AND RESTRAINS MORE THAN $52 MILLION IN CRYPTOCURRENCY

WASHINGTON — The Justice Department’s Scam Center Strike Force has carried out a coordinated disruption of Xinbi Guarantee, a Chinese-language illicit marketplace that federal authorities say supplied money laundering, fraudulent investment infrastructure, trafficking recruitment and other services to organized scam operations, while restraining more than $52 million in cryptocurrency in a single day.

The September 9, 2026 operation combined Justice Department seizure authorities with sanctions imposed by the U.S. Department of the Treasury against Xinbi and supporting entities. The Justice Department said the latest action raised the total value of assets restrained by the Scam Center Strike Force to approximately $938 million since the initiative began.

According to allegations in a seizure warrant unsealed by federal authorities, Xinbi operated primarily through Telegram and functioned as a service marketplace for operators of cyber-enabled scam centers.

TRJ previously reported on the broader U.S. disruption of Xinbi Guarantee and its role in the cyber scam economy. US Disrupts Xinbi Guarantee Marketplace Fueling the Cyber Scam Economy.

According to the seizure-warrant allegations, vendors advertised directly to criminal customers in Chinese-language channels, offering services that included custom fraudulent investment websites, laundering or “washing” proceeds stolen from wire-fraud victims, and recruitment connected to trafficking victims working inside scam compounds in Southeast Asia.

The warrant also alleged that the marketplace operated an escrow system. When a scam operator purchased a service, Xinbi held payment until the vendor completed the transaction, providing criminal buyers with a mechanism intended to reduce the risk that another criminal service provider would take payment without delivering the promised work.

The seizure warrant alleged numerous instances in which funds belonging to U.S. victims were traced to specific vendors advertising laundering services through Xinbi. Those vendors allegedly posted cryptocurrency wallet addresses within Telegram as payment destinations.

One advertisement released by the Justice Department promoted an exchange operation involving USDT and Chinese renminbi, telling prospective customers that the operation accepted USDT and claiming the money would be “clean.” Another advertisement sought experienced personnel for fraudulent-order schemes and offered resources ranging from customer-acquisition scripts and remote-network infrastructure to instruction related to gold-exchange scams and AI-generated video communications.

Those advertisements provide a direct view into the service economy operating around modern scam compounds: specialized vendors offering financial laundering, digital infrastructure, account-management techniques, fraudulent sales methods and technological tools to operators who can purchase those capabilities rather than build them internally.

On September 7, the U.S. District Court for the District of Columbia authorized the seizure of Telegram channels hosting the Xinbi marketplace.

Under the same warrant, the Scam Center Strike Force seized two cryptocurrency wallets used by Xinbi to collect vendor payments. Those wallets contained approximately $12 million.

Investigators also sought restraint of 47 additional cryptocurrency wallets believed to be associated with money laundering across Xinbi’s network and vendors servicing scam operations. Combined with other coordinated measures, federal authorities said more than $52 million in cryptocurrency was restrained from Xinbi and its associated network in one day.

The Justice Department credited Tether with providing proactive assistance during the investigation.

The action extended beyond the cryptocurrency wallets.

Treasury’s Office of Foreign Assets Control designated Xinbi Guarantee as a significant transnational criminal organization and identified cryptocurrency addresses connected to its operations.

OFAC also sanctioned two entities accused of materially assisting or providing financial, technological or other support to Xinbi.

As a result of the sanctions, property and interests in property belonging to the designated entities that are within the United States or possessed or controlled by U.S. persons are blocked and must be reported to OFAC.

U.S. Attorney Jeanine Ferris Pirro announced the operation alongside U.S. Attorney for the District of Alaska Michael J. Heyman, FBI Criminal Division Deputy Assistant Director Matthew Floyd, U.S. Secret Service Washington Field Office Special Agent in Charge Tara McLeese and Treasury OFAC Deputy Director Lisa Palluconi.

Pirro said the Strike Force intends to attack not only the scam operators themselves but also the commercial networks supplying their infrastructure and laundering services.

McLeese said investigators traced money stolen from Americans through Xinbi’s financial network and emphasized that operating overseas does not place cyber-fraud organizations beyond U.S. investigative reach.

FBI Chicago Acting Special Agent in Charge Ryan Whalen said the operation was intended to identify, disrupt and dismantle scam centers regardless of where they operate, while FBI Honolulu Special Agent in Charge David Porter pointed to the financial and emotional damage inflicted on elderly and other vulnerable victims.

The Strike Force simultaneously announced a significant expansion of its geographic operations.

Federal personnel deployed to Madagascar for two weeks to assist local authorities in dismantling 13 scam centers operated by Chinese organized crime syndicates, according to the Justice Department.

The U.S. team assisted Madagascar authorities in processing more than 3,200 electronic devices seized during the operation.

Images released with the announcement show boxes containing large numbers of mobile phones and a separate facility containing rows of computer monitors seized or examined during the Madagascar operation. The scale of the equipment provides a physical indication of the volume of communications and digital accounts potentially associated with industrialized scam operations.

Authorities interviewed nearly 400 people who had been arrested during the operation. Federal officials said approximately 30 were identified as Chinese leaders of the scam compounds and were subsequently repatriated to China by the Chinese government.

The Strike Force also opened U.S. investigations based on information developed during those interviews.

The Madagascar operation illustrates an important element of the scam-center economy that extends beyond financial fraud.

Federal authorities have tied organized scam compounds to human trafficking and transnational money-laundering networks. Workers may operate large numbers of phones, computers, messaging accounts and fraudulent financial profiles from centralized facilities capable of contacting victims across multiple countries.

The Justice Department’s photographs of seized equipment show hundreds of computer monitors arranged across a large room, along with boxes of mobile devices collected during the enforcement action.

Those tools are essential infrastructure for operations that depend on volume: maintaining multiple identities, managing victim communications, operating fraudulent investment platforms, transferring cryptocurrency and conducting long-term social-engineering campaigns.

The Scam Center Strike Force was formally launched in November 2025 to confront Chinese organized crime syndicates operating scam compounds primarily in Southeast Asia.

Its mission covers cryptocurrency investment fraud, other forms of cyber-enabled fraud, money laundering and human trafficking connected to the scam-center ecosystem.

The Justice Department cited FBI Internet Crime Complaint Center data showing that cyber-enabled fraud accounted for almost 85 percent of all losses reported to IC3 in 2025.

Within that category, reported cryptocurrency investment fraud losses rose from approximately $4.57 billion in 2023 to $8.65 billion in 2025, an increase of 89 percent.

Federal authorities cautioned that those figures are based largely on victim reports and may substantially understate actual losses because many fraud victims never file reports with IC3.

The Strike Force’s work also falls within the federal government’s broader cybercrime and fraud enforcement strategy established under a March 6, 2026 executive order directing federal agencies to prioritize foreign-backed cybercrime, fraud and predatory financial schemes targeting Americans. The Justice Department describes the Strike Force as one component implementing that directive.

The operation involves an extensive federal network.

Participating organizations include the FBI, U.S. Secret Service, Justice Department Criminal Division, U.S. Postal Inspection Service, IRS Criminal Investigation, Homeland Security Investigations, and U.S. Attorney’s Offices in the District of Columbia, Alaska, Hawaii, Rhode Island and Western Washington.

The Strike Force also coordinates with the Departments of Treasury and State and works with private-sector companies involved in communications, financial services and cryptocurrency infrastructure.

Assistant U.S. Attorney Karen P. Seifert for the District of Columbia directs the Strike Force.

The Xinbi seizures were handled by Seifert and Assistant U.S. Attorney Rick Blaylock Jr. of the District of Columbia, along with Assistant U.S. Attorney Mac Caille Peturrson of the District of Alaska. The FBI’s Chicago Field Office and U.S. Secret Service Washington Field Office participated, with assistance from paralegals Peter Bleicken and Jessica In.

The Madagascar investigations are being handled by Peturrson, Seifert and Blaylock together with the FBI’s Honolulu Field Office. Federal officials also credited authorities in Madagascar for their cooperation.

The Xinbi operation targets a layer of the cybercrime economy that often remains behind the visible scam presented to the victim.

A fraudulent investment message may appear to originate from a single scammer, but the infrastructure behind it can include separate vendors supplying laundering services, fraudulent websites, cryptocurrency wallets, recruitment networks, communications systems and technical support.

Xinbi allegedly created a marketplace where those components could be purchased and coordinated inside one ecosystem.

The seizure of its Telegram channels, restraint of cryptocurrency, sanctions against supporting entities and expansion of enforcement into physical scam compounds represent an effort to attack that infrastructure from multiple directions at once.

The case also demonstrates that cryptocurrency tracing has become a central component of federal scam investigations. Transactions designed to move stolen money through multiple wallets can still create financial records that investigators can analyze, associate with specific services and, when legal and technical conditions allow, restrain or seize.

With more than $52 million restrained in the Xinbi action and approximately $938 million restrained by the Strike Force overall, federal authorities are attempting to make the financial architecture supporting transnational scam compounds as much of a target as the individual fraud schemes those compounds generate.

---

---

---

---

---

U.S. DISRUPTS XINBI GUARANTEE CYBER SCAM MARKETPLACE AND RESTRAINS MORE THAN $52 MILLION IN CRYPTOCURRENCY

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---