U.S. Secret Service Freezes $52.8M in Xinbi Scam Marketplace Wallets

On September 8, 2026, 52 wallets tied to Xinbi Guarantee and its merchants were frozen, locking up $52.8 million in USDT. The action, coordinated between blockchain intelligence firm Elliptic and the U.S. Secret Service, marks the largest single asset freeze targeting what investigators describe as the second-largest illicit online marketplace ever recorded. For accounting firms, compliance officers, and CFOs with any stablecoin exposure, this action changes the risk calculus around USDT holdings and counterparty screening, immediately.

What Xinbi Guarantee Actually Is

Xinbi Guarantee is a Telegram-based marketplace that serves criminal operations running at industrial scale. Since launching in 2022, the platform and its merchants have processed at least $24 billion in transactions, denominated almost entirely in Tether's USDT stablecoin on the TRON blockchain. A linked payments service, Xinbi Pay (also called XPay), has handled a further $6 billion.

To put those figures in context: only one comparable platform, Huione Guarantee, has processed more, at $31 billion over four years. Xinbi has effectively filled the gap left when Huione Guarantee and its successor Tudou Guarantee were taken offline in 2025 following earlier Elliptic disclosures and resulting regulatory pressure.

What the Marketplace Sells

Merchants on Xinbi operate openly. Listings include victim personal data, communications infrastructure for running scams at volume, and money laundering services priced by the type of proceeds being cleaned. Screenshots published by Elliptic (machine-translated from Chinese) show vendors specifying whether they will accept proceeds from "pig butchering" romance scams, broader chat-based fraud, or other categories. One listing specifically targets funds originating from U.S. victims.

The marketplace uses a "guarantee deposit" model: merchants post collateral with Xinbi, and buyers who are defrauded can claim compensation from that deposit. The mechanism is designed to substitute for legal recourse that criminals obviously cannot access. It is also exactly why the asset freeze is so strategically damaging.

Physical Presence and Prior Sanctions

Xinbi's reach is not purely digital. In June 2025, the platform opened a physical store inside Yatai New City in Myanmar, a complex of scam centers that has already attracted U.S. and UK sanctions. Myanmar's military raided Yatai New City in late 2025, and subsequent footage showed the Xinbi store partially destroyed. The UK sanctioned Xinbi and connected entities before the September 2026 freeze, citing its role in enabling scam centers across Southeast Asia. OFAC issued its own designation on September 9, 2026, the same day the freeze became public.

How the Freeze Was Executed

Elliptic reports that it tracked Xinbi's wallet infrastructure for several years before the action. That intelligence, mapping fund flows through the marketplace, its merchant network, and connected money laundering services, provided the foundation for the U.S. Secret Service to act. Beginning at 8 a.m. UTC on September 8, 2026, 52 wallets were frozen, with USDT as the affected asset in each case.

Why USDT Was the Vulnerability

Tether has a built-in contract-level function that allows it to freeze wallets directly. That capability is what made the coordinated freeze operationally possible at speed and scale. Law enforcement agencies do not need to seize private keys or take physical custody of hardware. A confirmed freeze instruction to Tether is sufficient to immobilize the funds while legal processes continue.

Xinbi's response was telling. Within hours of the freeze, the marketplace announced it would move away from USDT and shift to USDD, a dollar-pegged stablecoin launched in 2022 by TRON founder Justin Sun through the TRON DAO Reserve. Xinbi also exchanged approximately $2.8 million of its remaining USDT into USDD using a decentralized exchange, before its own wallets were fully locked down.

The USDD Complication

USDD markets itself as decentralized, without a central issuer and therefore without the wallet-freeze capability that USDT carries. Elliptic notes, however, that USDD's decentralization claims are contested, and the asset retains indirect freeze exposure through its underlying collateral and infrastructure dependencies. Compliance teams should not treat USDD as categorically unfreezable: the situation is fluid and continues to evolve.

Accounting and Reporting Implications for Firms

The freeze has direct implications for how accounting practices and CFOs think about stablecoin risk in client portfolios and their own treasury operations.

Counterparty and Wallet Screening

The OFAC designation issued on September 9 means that any U.S. person or entity that transacts with a designated Xinbi wallet, or with merchants or entities connected to it, faces sanctions exposure. That is not hypothetical: USDT's traceability on the TRON blockchain means that tainted funds can travel through intermediary wallets before reaching a compliant exchange or custodian. Firms using crypto accounting software need to confirm that their transaction monitoring pipeline ingests OFAC SDN list updates in real time and flags incoming TRON-based USDT for enhanced due diligence.

Asset Impairment and Balance Sheet Treatment

For any entity holding USDT that was swept into a freeze (even as an innocent counterparty), the accounting question is immediate: is the asset still recognisable at fair value, or has the freeze created a contingent impairment? Under IFRS, IAS 36 applies to non-financial assets, while IFRS 9 governs financial instruments; stablecoins sit in a classification grey zone depending on jurisdiction and structure. Under U.S. GAAP, the FASB's ASU 2023-08 fair value model for certain crypto assets does not automatically account for enforced restrictions on transferability, and firms will need to assess whether a disclosed freeze constitutes a fair value adjustment trigger. Auditors reviewing Q3 2026 financial statements should be asking these questions now.

SAR Filing Obligations

For U.S.-registered money services businesses, broker-dealers, and banks with crypto exposure, any transaction involving a wallet that appears on the updated OFAC SDN list triggers mandatory Suspicious Activity Report filing under the Bank Secrecy Act. The 30-day filing clock starts from the date of detection, not the date of the freeze itself. UK-regulated firms face equivalent obligations under the Proceeds of Crime Act 2002 and must submit Suspicious Activity Reports to the National Crime Agency. Given that Xinbi operated across both jurisdictions and was sanctioned by both the UK and the U.S., dual reporting obligations are a real possibility for firms with transatlantic client books.

Systemic Significance: What This Action Signals

Blockchain analytics capabilities have now demonstrated, at scale, that stablecoin freezes can be executed swiftly enough to outpace a marketplace's ability to move funds. The $2.8 million that Xinbi managed to swap into USDD before the freeze completed represents a fraction of the $52.8 million locked. Multi-year wallet mapping enabled law enforcement to act faster than the target could react.

This matters for AML program design. The traditional assumption, that decentralised or pseudonymous transaction flows resist tracing, no longer holds in mature blockchain analytics environments. Compliance teams who relied on that assumption as a reason not to invest in real-time transaction monitoring are now operating with an outdated model. Regulators in the U.S. and UK have consistently signalled that "crypto is traceable" is not an industry talking point: it is an enforcement tool.

The action also follows Elliptic's collaboration with the Secret Service earlier in 2026 targeting a sanctioned Russian crypto exchange, suggesting a maturing operational relationship between blockchain intelligence providers and federal law enforcement that is producing consecutive enforcement results. For firms advising clients on AML programme adequacy, this is relevant evidence of the enforcement environment they are operating in.

The Trust-Model Disruption

Xinbi's guarantee deposit system only functions if merchants and buyers believe their funds are secure. A demonstrated freeze of 52 wallets, covering a specific monetary amount that is publicly reported, undermines that belief structurally. Elliptic's assessment is that this uncertainty strikes at the core mechanism the marketplace depends on. Whether it results in platform collapse or simply migration to less-traceable assets is an open question, but the latter scenario has its own compliance implications that firms should monitor.

Practical Steps for Compliance and Accounting Teams

The September 2026 Xinbi freeze is a concrete prompt to review several controls:

• Sanctions list refresh cadence: Confirm that your digital asset accounting software and transaction monitoring tools pull OFAC SDN updates at least daily, and that TRON-based USDT addresses are within scope.
• TRON chain coverage: Many compliance programmes historically prioritised Ethereum. Xinbi and the broader Guarantee ecosystem operated primarily on TRON. Verify your screening covers TRON addresses and TRC-20 tokens, not just ERC-20.
• Stablecoin classification review: If your balance sheet or a client's includes USDD, document the basis for fair value measurement and note the contested decentralisation claims. Auditors will ask.
• SAR readiness: Run a retrospective check for any TRON-based USDT transactions in the past 90 days against the newly designated wallet addresses. Engage legal counsel on filing obligations promptly.
• Client disclosure: If you manage books for entities that received USDT from TRON-based sources, assess whether the updated SDN list creates a prior-period disclosure obligation.

For a broader view of how stablecoin-linked scam networks have grown and what AML controls are expected to catch, see our earlier analysis: Xinbi Guarantee: The $8.4B USDT Marketplace Your AML Controls Must Flag. And for context on how U.S. legislative gaps continue to affect enforcement capability, the piece on FinCEN's $13B crypto scam analysis is directly relevant.

Frequently Asked Questions

Can a wallet freeze affect a firm that had no knowledge of the connection to Xinbi?

Yes. OFAC's strict liability standard means that U.S. persons can face penalties for transactions involving designated entities even without actual knowledge. The defence of no knowledge affects penalty mitigation, not liability itself. This is why real-time SDN screening, rather than periodic manual checks, is considered a baseline control.

Does the freeze apply only to U.S.-based firms?

OFAC's reach extends to any transaction that touches U.S. persons, U.S. dollar instruments, or U.S. correspondent banking infrastructure. Because USDT is denominated in USD, firms outside the U.S. that hold or transact in USDT may still have exposure. UK-sanctioned entities additionally trigger POCA 2002 obligations for UK-regulated firms.

How should USDT held in frozen wallets be treated on a balance sheet?

This depends on whether the holding entity is the target of the freeze or an innocent counterparty. For targeted entities, the asset may need to be derecognised or written down depending on the probability of recovery. For counterparties with indirect exposure, disclosure of contingent liabilities and enhanced fair value disclosures are the immediate priority. Auditors should apply professional judgment and document the basis for their assessment.

What is USDD, and why did Xinbi switch to it?

USDD is a dollar-pegged stablecoin launched in 2022 by TRON founder Justin Sun via the TRON DAO Reserve. Unlike USDT, it does not have a documented central freeze function, which is why Xinbi converted approximately $2.8 million of USDT into USDD following the freeze. However, its decentralisation claims are disputed, and it retains indirect freeze exposure through its collateral and infrastructure dependencies.

What does this mean for firms using TRON-based USDT in legitimate treasury operations?

The freeze does not impair legitimate TRON USDT holdings. The practical implication is enhanced screening requirements: firms should confirm their compliance stack monitors TRON addresses and that any incoming USDT is screened against current OFAC designations before being recognised as a clean asset.

Source: Elliptic