Xinbi Guarantee: $52.8M was frozen — and $146M had left the same wallets in the week before

Xinbi Guarantee is a Chinese-language marketplace run on Telegram. Merchants on it sell what scam compounds need — money laundering, stolen personal data, fake documents, satellite internet — and the platform holds the buyer’s USDT in escrow until the deal is done. The analytics firm Elliptic, which has tracked it since 2025, puts its lifetime volume at no less than $24 billion and calls it the second-largest illicit online market ever, after Huione Guarantee.

On 8 September 2026, from 08:00 UTC, Tether froze the marketplace’s wallets in an operation with the US Secret Service; Elliptic reported $52.8 million frozen across 52 wallets. On 9 September the US Treasury designated Xinbi as a transnational criminal organisation and published 52 Tron addresses. Everything below is our own reading of those addresses on chain, made on 4 October 2026.

Xinbi did not steal from its own users. The harm is to the people on the other end of what its merchants sell. People talked into fake investments and fake romances — pig butchering — whose money was laundered through the marketplace’s merchants. People whose personal data was sold there to be used against them. And the people held in scam compounds and forced to run those schemes, for whom the marketplace supplied the tools.

All 52 listed addresses are on Tether’s blacklist. Together they hold 48,843,415 USDT. The largest, TWPma8xH48AEN93x2krdukV9e1j6sPsBeS, holds 10.78 million; three more hold 8 million each.

That is four million short of the announced figure, and the difference sits on a 53rd wallet. TThEzBN6SQ8ojyhofX6wahj13QkEdGGWXB was frozen at 08:04:57 UTC on 8 September with 4,000,011 USDT on it, and it is not on the sanctions list. It is a relay: between 4 and 7 September the reserve wallet TBNjCi1d5Ns6ec5aMp28LpfKcX7xTpykAN sent it 6 million USDT a day, and it passed the money on in 2-million pieces to the marketplace’s hot wallet, TXHX2NUvcgft4zs6MkkUtdNVERPTavHDWN — both of which are listed. Add it and the total is 52,843,426 USDT, the $52.8 million that was announced.

For anyone screening against the sanctions list alone, that wallet does not exist. Tether’s blacklist catches it; the list does not.

From 1 to 7 September the 52 wallets received $181.5 million in USDT from 6,113 outside addresses and paid $146.0 million out to 8,256 outside addresses — between $16 million and $25 million out every single day. On top of that they moved about $620 million between themselves, the ordinary shuffling of an escrow business between reserve and hot wallets.

Set against that, $52.8 million is roughly two days of money passing through. The freeze stopped the wallets; it did not catch what they had already paid.

There was no rush for the exit. In the last eight hours before the freeze the wallets paid out $7.1 million, the same pace as every other morning that week ($4.8–8.4 million). The last payout — 2,500 USDT from the hot wallet — went out at 08:00:36 UTC, thirty-six seconds after the freezing began. Whoever ran the wallets did not see it coming.

We looked at the 300 largest destinations, which received $92.3 million — 63% of the outflow. None of them is frozen today. No destination is itself sanctioned.

About $13.9 million of that went straight into deposit addresses of 22 exchange-style services: addresses that forward everything they receive to a service’s central wallet. Those are accounts with a known customer behind them. The services carry no public label and we do not name them.

Twelve of those 22 services are ones we have met before. In our study of 9,993 pig-butchering reports on Tron, money sent by victims ended up in deposit addresses of the same twelve hubs. Scam proceeds reported by victims on one side, and payouts from a sanctioned laundering marketplace on the other, arrive at the same places.

The remaining $78 million among the top 300 went to addresses with no label at all — merchants and their customers, as far as anyone can tell from outside.

An ordinary person does not get paid out by an escrow service for money laundering, and does not pay into one. So on 4 October 2026 we marked every address that dealt directly with the 52 sanctioned wallets in that week and moved at least 1,000 USDT with them: 7,834 addresses. In PublicAML they now carry the label “illegal services” with the note “direct counterparty of Xinbi Guarantee” and the amounts, and they score as critical risk. Anyone who checks one of them — an exchange, a payment service, a person about to accept a transfer — will see it.

1,923 of them are deposit addresses at exchanges and similar services. We marked those too, on purpose: a deposit address belongs to one customer, and that customer was paid by Xinbi. What we did not mark are the services’ own shared wallets — hot wallets, collection wallets, custodians (27 addresses) — because thousands of unrelated customers’ money passes through those.

They are not marked as sanctioned, because they are not on any sanctions list. The mark says what the chain shows: this address traded with a sanctioned laundering marketplace. Addresses that moved less than 1,000 USDT are left out, to keep dust and stray transfers from marking anyone. This covers one week; Xinbi’s history is far longer, and so is the list of those who used it.

We then asked the opposite question: who paid the people who dealt with Xinbi? We read the 900 largest of the marked addresses — three quarters of all the money that moved between Xinbi and its counterparties that week — against everything already labelled in our database.

Mostly, from nowhere that has a name. For 646 of the 900, no identifiable source accounts for even a tenth of what they received: their money comes from other unlabelled wallets. That is what a laundering market looks like from outside — the point of it is that the source is not visible.

From exchanges. 28 addresses got a tenth or more of their money straight from exchange withdrawals — OKX (13), Binance (9), Gate (4), HitBTC and XT. Somebody with an account at those exchanges withdrew to an address that then traded with Xinbi.

From addresses victims reported. 16 of the marked addresses received USDT directly from addresses that scam victims had reported on Chainabuse — the set from our pig-butchering study — about 2.8 million USDT in all. One of them took in 2.29 million USDT from a single reported address and paid 59,100 USDT into Xinbi.

From frozen wallets. 10 received money directly from addresses Tether has frozen for other reasons. Seven have, further up the chain, the proceeds of a private-key theft on Tron on 13 September 2026 that we traced separately — in two cases only three transfers away. One sits four transfers downstream of the Amir Capital scheme.

What we did not find is as telling. Tron has no mixers, and none appear. And links that take five or more transfers to reach a sanctioned name — we see those for about a hundred addresses — are too long to mean anything by themselves; on Tron almost every busy wallet is that close to something. We do not count them.

According to Elliptic, Xinbi’s administrators responded by telling users they would move to USDD, a stablecoin on Tron that has no issuer able to freeze it in the same way. The 52 listed wallets hold no USDD; a move like that would use new addresses, which are not on any list yet.

That is the pattern of the whole story. Lists name addresses; businesses like this one replace addresses in a day. What stays the same is where the money has to come out — the deposit accounts at services that know their customers.

Xinbi was designated a criminal organisation by the US Treasury; we did not test that decision and do not dispute it — we read its wallets. The description of the marketplace is Elliptic’s. This page names no person. The mark on a counterparty address says that it traded with Xinbi, not what its owner did or who the owner is: a merchant, a buyer of the merchant’s services and an address that only passed money on all look the same on chain. Flows are USDT transfers of the 52 listed addresses between 1 and 9 September 2026; balances and freeze status are as of 4 October 2026. The destination breakdown covers the 300 largest recipients only; the marking covers every direct counterparty above 1,000 USDT.