OFAC and DOJ Strike Xinbi, a Multibillion-Dollar Marketplace for Cybercriminals

What it is

Chainalysis's writeup of the September 9, 2026 OFAC designation of Xinbi Guarantee, adding detail the summary omits: OFAC also sanctioned SafeW Technology and Anwen Technology — developers of the messaging and crypto-payment apps underpinning Xinbi's operations — not just the marketplace itself. This is a coordinated OFAC/DOJ/UK action, not a single agency move.

Key specifics beyond the summary

• 52 OFAC-designated addresses collectively received over $8.4 billion in stablecoins — a compliance-relevant figure distinct from the $52M restrained. Any exposure to these addresses is now sanctions exposure.
• DOJ Scam Center Strike Force (SCSF) — named actor — seized two Xinbi payment-collection wallets holding ~$12M (Sept 7 court-authorized warrant, which also seized the Telegram channels) and restrained 47 additional associated wallets. That is the 2 + 47 = 49 wallets / $52M breakdown.
• UK FCDO first sanctioned Xinbi in March 2026 under its Global Human Rights regime (tied to trafficking/forced-labor scam compounds), and updated its designation alongside OFAC's to add dozens more addresses. Screening lists should reflect both jurisdictions.
• Tether actively assisted law enforcement — relevant because the tainted assets are stablecoins subject to issuer freeze capability.

Context worth carrying

The page frames Xinbi within a structural shift: Chinese-language laundering services now process an estimated 20% of all illicit crypto over five years, including $16B in 2025. Xinbi is one "guarantee platform" in that ecosystem — the designation dents but does not remove the category.

What to do

• Add the 52 OFAC addresses and the FCDO-added addresses to sanctions/transaction-screening blocklists; both lists were expanded in this coordinated action.
• Treat any historical counterparty exposure to those addresses as potential OFAC exposure given the $8.4B throughput.
• The "Black U" substitution laundering means DPRK-origin funds (Bybit/WazirX) were swapped into nominally clean stablecoins from scam proceeds — so downstream "clean" stablecoin flows from this network still carry sanctions and DPRK-nexus risk despite lacking a direct hack trace.

Caveats

The page states 47 of the 49 wallets are "restrained" and "believed to be associated" — restraint is not forfeiture, and association is asserted by authorities, not proven on-chain in the text. Chainalysis's own disclaimer declines to warrant accuracy or completeness.