OFAC Sanctions Xinbi Guarantee: What the $36B Scam Marketplace Means for Crypto Accounting
On 9 September 2026, the US Office of Foreign Assets Control designated Xinbi Guarantee as a significant transnational criminal organization, placing it on the Specially Designated Nationals list alongside two companies that built its core infrastructure. The action freezes all US-jurisdictional property tied to the designated entities, names 52 TRON-based cryptocurrency addresses, and runs concurrently with a Department of Justice Scam Center Strike Force seizure. For accounting firms, auditors, and CFOs managing digital asset exposure, the designation creates immediate sanctions screening obligations and raises fresh questions about transaction-history due diligence across USDT/TRON portfolios.
What OFAC Actually Designated and Why It Matters
Xinbi Guarantee operated as a Chinese-language escrow marketplace, connecting transnational scam syndicates with merchants selling stolen personal data, forged identity documents, AI deepfake tools, satellite internet equipment, and over-the-counter crypto exchanges. TRM Labs analysis puts the platform's cumulative throughput at more than USD 36 billion in digital assets and fiat currency since approximately 2022, with USD 17 billion in inflows recorded. As of early September 2026, its Telegram channel had grown to 657,643 subscribers before Telegram imposed an official ban on the day of designation.
OFAC acted under Executive Order 13581 (blocking transnational criminal organizations), as amended by Executive Order 13863, and in furtherance of Executive Order 14390 of 6 March 2026, which specifically targets cybercrime, fraud, and predatory schemes against US citizens. Treasury Secretary Scott Bessent stated that scam centers in Southeast Asia steal billions of dollars from American victims each year and that Treasury will keep using its tools to disrupt those networks.
The Three Designated Entities
The action reaches three distinct legal persons. First, Xinbi Guarantee itself, the marketplace believed to operate from the Golden Triangle region spanning Myanmar, Thailand, and Laos. Second, Anwen Technology Co., Ltd., a Cambodia-based company that developed the XinbiPay wallet, also marketed as NewPay, a no-KYC wallet supporting USDT across TRC20, ERC20, and BEP20 networks. Third, SafeW Technology Co., Ltd., a Singapore-registered company that built the SafeW end-to-end encrypted messaging application, to which Xinbi began migrating its merchant and money-laundering networks around June 2025 in response to rising law enforcement pressure.
By designating the wallet developer and the messaging-app developer alongside the marketplace itself, OFAC reached the technical infrastructure Xinbi constructed specifically to continue operating after enforcement pressure began to bite. The 52 TRON addresses named in the SDN listing are live under the sanctions category in blockchain analytics tools, and TRM Labs has indicated it continues attributing additional addresses through on-chain analysis.
The XinbiPay Wallet: Scale and Risk Signal
XinbiPay's withdrawal hot wallet alone received USD 94.6 million in December 2025, the single month for which TRM Labs published figures. That figure illustrates the practical liquidity flowing through infrastructure now designated under US sanctions law. Any exchange, custodian, payment processor, or corporate treasury that received funds traceable to XinbiPay addresses during that period faces potential exposure, because OFAC can impose civil penalties on a strict-liability basis, meaning good-faith intent does not automatically provide a defence.
How Xinbi Grew: The Enforcement Displacement Effect
The Xinbi case is a textbook example of how enforcement against one illicit marketplace can accelerate volume at a successor. After FinCEN designated Huione Pay as a financial institution of primary money laundering concern, cybercriminals migrated activity to Xinbi, which offered substantially similar escrow and cash-out services to an overlapping customer base. A related marketplace, Haowang Guarantee, was sanctioned by OFAC in spring 2025 and declined sharply. Tudou Guarantee also fell roughly 74% before shutting down.
Xinbi absorbed that displaced volume. Its daily inflows nearly doubled between 12 May 2025 and 22 December 2025, a trajectory that continued until the September 2026 designation. The pattern has direct relevance for AML risk models: when a dominant illicit platform is taken down, a compliance team should immediately screen whether counterparty wallets have begun transacting with newly prominent successor venues.
The UK Connection and the Cross-Border Sanctions Landscape
The United States is the second jurisdiction to sanction Xinbi. The UK's Foreign, Commonwealth and Development Office designated the marketplace in March 2026, making it simultaneously subject to UK financial sanctions. For firms operating under both UK and US regulatory frameworks, including UK-authorised crypto asset businesses and US-registered entities with cross-border transaction books, the dual designation means screening obligations arise under two separate legal regimes. Failure to screen against either list can constitute a standalone breach under the applicable national sanctions framework.
Accounting firms advising clients with any TRON-based USDT activity should now treat both the OFAC SDN list and the UK consolidated sanctions list as live reference points, not periodic checks. The pattern of coordinated UK-US actions, visible also in prior enforcement cycles against Huione, signals that major illicit-marketplace designations are increasingly being timed and structured as joint operations.
For further context on how sanctions screening is being embedded into crypto transfer workflows, see our coverage of Banca d'Italia's sanctions screening requirements for crypto transfers.
North Korea, the Prince Group, and National Security Dimensions
OFAC's designation statement notes that Xinbi's platform was used by North Korean state-linked hackers and by several OFAC-designated entities, including Jin Bei Group Co., Ltd. and entities forming part of the Prince Group transnational criminal organization. That language lifts Xinbi beyond the category of a typical cybercrime marketplace and places it inside a national security context. Transactions touching Xinbi infrastructure therefore carry the same heightened scrutiny that applies to dealings with North Korean-linked entities under the existing DPRK sanctions programme, regardless of whether the underlying counterparty was aware of the connection.
For firms that hold or process USDT on TRON at any scale, the North Korea nexus is particularly significant because it activates a separate layer of reporting obligations under US law and can affect the risk calculus for correspondent banking relationships with US financial institutions.
Accounting and Compliance Implications
Sanctions Exposure and the 50% Rule
Under OFAC's rules, any entity owned 50% or more by one or more blocked persons is itself blocked, even if that entity is not individually named on the SDN list. For crypto-native businesses structured through holding companies or with significant beneficial ownership by persons now designated, legal counsel should audit the ownership structure immediately. All property and interests in property of the designated persons that are within the United States or in the possession or control of US persons must be blocked and reported to OFAC.
Transaction Screening: The 52 TRON Addresses
The 52 TRON addresses published in the Xinbi SDN entry should be loaded into transaction monitoring systems as a priority. Because Xinbi settled primarily in USDT on TRON, firms running TRON-based stablecoin operations face the highest direct exposure. OFAC's strict-liability civil penalty regime means that a transaction executed without adequate screening is a potential violation regardless of knowledge, so the absence of a TRON-specific screening workflow is itself an audit finding.
Balance Sheet and Disclosure Considerations
Auditors reviewing digital asset holdings as at any balance sheet date after 9 September 2026 should ask whether any wallet addresses in the entity's custody have transacted with SDN-listed Xinbi addresses. Under FASB ASC 350-60 and the equivalent IFRS treatment of crypto assets at fair value, an asset that is blocked by sanctions may not be realisable and could require impairment disclosure or reclassification. Where a client cannot demonstrate clean chain-of-custody, the auditor should consider whether a qualification or emphasis-of-matter paragraph is warranted.
AML Programme Updates for Firms
Virtual asset service providers and money service businesses registered in the US or UK should treat the Xinbi designation as a trigger event requiring a formal AML programme review. Specifically: update the sanctions screening list to include all 52 named addresses and the three designated legal entities; review transaction history for the past 12 months against known Xinbi, XinbiPay, and SafeW wallet clusters; and document the review in writing as evidence of a proactive response. Firms that previously transacted with Xinbi-linked infrastructure and self-disclose to OFAC benefit from a more favourable penalty framework than those where violations are discovered through examination.
For background on the earlier phase of this enforcement action, see our article on the US Secret Service's earlier freeze of $52.8 million in Xinbi-linked wallets.
Frequently Asked Questions
What is Xinbi Guarantee and why was it sanctioned?
Xinbi Guarantee is a Chinese-language online marketplace that provided escrow services connecting transnational scam syndicates with vendors of stolen data, forged documents, deepfake tools, and crypto cash-out services. OFAC designated it as a significant transnational criminal organization on 9 September 2026 because it facilitated large-scale fraud and money laundering, processed over USD 36 billion in digital assets since around 2022, and was used by North Korean-linked actors and other OFAC-designated entities.
Which legal entities were designated alongside Xinbi?
Two technology companies were designated on the same date: Anwen Technology Co., Ltd. (Cambodia), developer of the XinbiPay/NewPay no-KYC USDT wallet, and SafeW Technology Co., Ltd. (Singapore), developer of the SafeW encrypted messaging application that Xinbi adopted around June 2025 to evade enforcement.
What are the immediate obligations for US persons and firms?
All property and interests in property of the three designated entities that are within US jurisdiction, or in the possession or control of a US person, must be blocked and reported to OFAC. Transactions with any of the 52 named TRON addresses or with any entity 50% or more owned by a blocked person are prohibited. OFAC can impose civil penalties on a strict-liability basis, so adequate screening is essential.
Are there UK obligations in addition to the US sanctions?
Yes. The UK's FCDO designated Xinbi in March 2026, meaning UK-authorised firms and UK persons are subject to separate UK financial sanctions obligations. Compliance teams operating across both jurisdictions need to screen against both the OFAC SDN list and the UK consolidated sanctions list, and breaches of either regime can be prosecuted independently.
How should auditors treat digital assets with potential Xinbi exposure on a client's balance sheet?
Auditors should first establish whether any client wallet addresses have transacted with the 52 SDN-listed TRON addresses or with XinbiPay infrastructure. If exposure is identified, the asset may be unrecoverable under sanctions, requiring disclosure under FASB ASC 350-60 or the applicable IFRS standard. Where chain-of-custody cannot be demonstrated, an emphasis-of-matter paragraph or qualification may be appropriate, depending on materiality.
Source: TRM Labs