US Prosecutors Freeze $52M on a Telegram Scam Market

Washington has moved against Xinbi Guarantee, a Chinese-language marketplace hosted on Telegram. US prosecutors placed $52M of crypto under court restraint, including $12M seized outright from two wallets and 47 further addresses frozen. The Treasury separately sanctioned the platform and two companies accused of keeping it running. The service had processed $24B in crypto and traditional currency.

Key Takeaways

• $52M of crypto restrained, including $12M seized from two wallets.
• Xinbi Guarantee moved $24B and served more than 650,000 users.
• SafeW Technology in Singapore and Anwen Technology in Cambodia were designated alongside it.

A Court Order and a Sanctions Listing, Fired Together

The operation ran on two separate levers. The Justice Department, through its Scam Center Strike Force, obtained an order from the federal court for the District of Columbia restraining $52M in digital assets. Two wallets worth roughly $12M were seized outright, with 47 additional addresses blocked.

The second lever is financial. OFAC, the Treasury’s sanctions arm, designated Xinbi Guarantee along with SafeW Technology, based in Singapore, and Anwen Technology, based in Cambodia. The listing blocks their US-held property and bars US persons from dealing with them.

Blockchain intelligence firm TRM Labs, which has tracked this network for years, walked through the mechanics in its published analysis of Southeast Asia’s illicit marketplaces. The model runs on guaranteed escrow between strangers, with the operator holding funds through the trade and clipping a fee.

The Telegram channels hosting the service were seized on September 7. That is the most visible part of the operation from a user’s point of view, since it cuts the meeting point between buyers and sellers. The messaging layer is where the business actually lives, with the chain acting only as the settlement rail.

The UK had already sanctioned Xinbi on March 26, freezing assets and cutting it out of financial networks. US prosecutors are therefore landing on a target an ally designated months earlier, which closes off the western financial centres as an escape route.

Timing matters in this kind of case. US prosecutors obtain restraining orders only once addresses have been mapped and attributed, which takes months of chain analysis before anything becomes public. What looks like a single strike is the visible end of a long surveillance operation.

The split between seizure and restraint is worth reading carefully. Seizing two wallets means the government took control of the keys or of the venue holding them. Restraining 47 more means the assets are frozen where they sit, pending proceedings, with no transfer of control.

That distinction sets the ceiling on what actually gets recovered. Restrained funds still depend on a court reaching a forfeiture decision, and on the wallets remaining reachable through a regulated intermediary. Freezing is not the same as recovering, and the gap between the two can run for years.

Designating two operating companies alongside the marketplace follows the same reasoning. A Telegram channel can be replaced in an afternoon. Corporate entities in Singapore and Cambodia have bank accounts, directors and contracts, all of which are far harder to reconstitute once they carry a sanctions listing.

What $24B of Throughput Says About the Real Scale

The Treasury puts the platform’s volume at $24B in crypto and fiat, serving more than 650,000 users. A historical figure above $36B has also been cited. At that scale this stops being a scam forum and becomes a parallel payments infrastructure.

Washington had already gone after Tehran-linked rails when Iranian crypto became an explicit sanctions target, using the same logic of designating intermediaries rather than chasing end users. The playbook is now consistent across very different geographies.

The services on offer went well beyond laundering. Officials describe purpose-built fake investment websites and labour recruitment for the scam compounds of Southeast Asia. The platform supplied the full toolkit, not merely the exit channel for stolen funds.

Links were also established to North Korean hackers and to the already-sanctioned Prince Group. The line between fraud and state financing dissolves in cases like this one, which is exactly why the sanctions toolkit gets pulled out alongside criminal process.

Picking the messaging layer as the anchor point was a deliberate design choice. It keeps coordination outside any clear jurisdiction and leaves authorities with settlement addresses as their only handle. That dependency showed itself once before, when Telegram’s t.me links broke for users worldwide without the underlying activity going anywhere.

The gap between throughput and recovery is the number worth holding onto. Billions moved through, tens of millions were caught. Enforcement in this market reaches the residue sitting still, rarely the flow itself.

A user count above 650,000 also says something uncomfortable about demand. A guarantee service only works because both sides of a trade want a neutral party holding the funds. That need does not disappear when one operator is designated, it simply relocates to whoever picks up the role next.

The recruitment angle deserves more attention than it usually gets. Supplying labour to scam compounds puts this network upstream of the fraud rather than merely downstream of the proceeds. Sanctioning the supplier hits the production line, which is a meaningfully different target from chasing the laundered output.

Also on Cryptonomic:

• MetaMask Splits From Consensys and Revives Token Talk
• MicroStrategy’s Bitcoin Treasury Sells to Pay Dividends
• Binance France Aims to Return Through an AMF Licence

Counterparty Exposure Matters More Here Than Price Risk

There is no direct price effect to speak of. No major asset is caught up in the seizure, and $52M is a rounding error against daily market turnover. This is regulatory news, not a directional signal.

The real exposure runs through the traceability of funds received. Designated addresses effectively taint the counterparties that touch them, and regulated venues apply those lists automatically. Someone who sold over the counter to a counterparty tied to this network can find a deposit blocked without having taken part in anything.

That risk is harder to manage than it sounds. A retail seller has no practical way to screen an over-the-counter counterparty against a list published after the trade settled. The exposure is retrospective, which is what makes it uncomfortable rather than merely annoying.

Venue policy varies more than most holders assume. Some platforms block a deposit outright and open a review, others accept the funds and quietly flag the account for later. Both outcomes come from the same designation, and neither is disclosed in advance.

The practical guidance has not changed in years, which is presumably why it keeps being ignored. Over-the-counter trades with anonymous counterparties carry a tail risk that no discount on the rate compensates. This case simply puts a number on what that tail looks like.

Tightening of this kind mechanically pushes part of the flow off centralised venues. The effect was measured in Europe, where 70% of withdrawn funds under MiCA went straight to self-custody. Compliance relocates volume at least as much as it destroys it.

There is a second-order effect on the intermediaries themselves. Every designation of this size raises the compliance cost of serving over-the-counter flow out of the region, and some venues respond by narrowing which counterparties they will touch at all. Liquidity in those corridors thins out well before any rule requires it.

Institutional desks have already priced this in. Their screening runs continuously rather than at onboarding, and a newly designated address propagates through their systems within hours. Retail flow is where the lag lives, and where the unpleasant surprises land.

Over the coming months the open question is whether US prosecutors killed the service or whether it reassembles elsewhere under a different name. Precedent points to the second answer, which would make this a durable nuisance rather than a shutdown. The measure of success will be the volume that fails to come back, not the headline figure of the freeze.

Follow the story on Cryptonomic.