On 9 September, the US Treasury designated Xinbi Guarantee as a significant transnational criminal organisation. Xinbi was one of the largest Chinese-language marketplaces serving Southeast Asia's scam economy, and the US action follows the UK's designation in March.
OFAC also sanctioned the two companies that built Xinbi's infrastructure: Singapore-based SafeW Technology, maker of the SafeW encrypted messaging app, and Cambodia-based Anwen Technology, developer of the XinbiPay wallet, also marketed as NewPay.
Fifty-two TRON addresses were added to the SDN list, and the Justice Department's Scam Center Strike Force seized related infrastructure and wallets the same day. Telegram then deleted Xinbi's central channels and banned the associated usernames.
Xinbi Will Adapt to the Sanctions
Nominis of course welcomes these designations. Earlier actions against such marketplaces have involved targeting the storefront itself, whereas these designations target the messaging and payment services built to keep the marketplace from running once Telegram became less reliable. This is the most complete action taken against this part of the scam economy so far.
However we anticipate that Xinbi will adapt to the designation, the same way it has done so in the past. When FinCEN designated Huione Group in 2025 and Telegram removed Huione Guarantee, the merchants did not stop trading. They moved to Tudou Guarantee and then to Xinbi. When Nominis wrote about the UK sanctions in March, we argued that sanctions alone are reactive and argued that the network around Xinbi would keep adapting.
The people who actually move the money, including OTC desks, "Black U" vendors buying tainted USDT at a discount, and the mule networks behind them, were never tied to a single platform. We assess that the likely outcome now is fragmentation, with merchants spreading across smaller guarantee platforms and private channels.
What Changes For Compliance Teams
The sanctions create immediate obligations. Property of the designated parties held in the US or controlled by US persons is blocked, companies owned 50 percent or more by blocked persons are blocked too, and penalties can apply on a strict-liability basis.
Platforms that keep processing flows linked to Xinbi, XinbiPay, SafeW or the listed wallets now face sanctions exposure, even though the Telegram shopfront has seemingly disappeared.
The risk also reaches beyond Xinbi itself. During the freezing operation, addresses belonging to third parties outside Xinbi's own group were restricted as well, including OTC providers that had simply done business on the platform. An exchange with a counterparty that traded on Xinbi can now find funds frozen without ever having dealt with Xinbi directly.
Next steps for compliance teams include:
- Screen against the new designations. Make sure the 52 listed TRON addresses, along with Xinbi, SafeW Technology, Anwen Technology and XinbiPay/NewPay, are in your screening and monitoring.
- Review historical activity for exposure to Xinbi-linked wallets, not only transactions from 9 September onwards.
- Look beyond direct hits. Most exposure sits one or two hops away from the listed addresses, in the OTC desks and vendors who traded on Xinbi. Screening against the SDN list alone will miss them.
- Pay attention to OTC and P2P counterparties. USDT on TRON remains the main settlement route for this ecosystem, and OTC counterparties are where tainted funds are most likely to reach regulated platforms. Notably we have recognised an adaptation by illicit actors to move financial infrastructure from TRON to Solana, for example, given the higher scrutiny on TRON wallets.
- Watch for what comes next. New guarantee platforms and rebranded merchants will appear. Intelligence needs to follow the merchants as they move, rather than waiting for the next designation.
How Nominis Tracks the Guarantee Ecosystem
Nominis has followed this ecosystem since the Huione era. In May 2025, our Intelligence Unit identified more than $3 billion moved by wallets directly linked to the Huione group. Our 2025 Annual Report included a detailed investigation into Huione Guarantee and the Telegram marketplace built around it. By August 2025, we were reporting that Huione's merchants were adapting to bans and resurfacing on Xinbi and Tudou.
That work depends on combining several sources at once. We monitor the channels where merchants advertise, attribute their wallets through human intelligence and behavioural patterns, and connect those wallets to wider on-chain clusters. A merchant who changes platform rarely changes everything. The wallets, counterparties, transaction timing and cash-out routes usually stay the same, and that is what allows us to flag the same actors when they reappear somewhere new, often well before they show up on a sanctions list.
Xinbi is offline, but its merchants are still active. The compliance teams best placed to manage what comes next will be the ones that can see who those merchants are and where they go.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
.png)
.png)