1h ago
U.S. Sanctions Xinbi Guarantee, Two Related Firms, and 52 Crypto Addresses
The U.S. has expanded its crypto sanctions, targeting the guarantee (escrow) platform Xinbi Guarantee, two companies tied to its operations, and 52 cryptocurrency addresses.
On Sept. 9, the Treasury Department's Office of Foreign Assets Control (OFAC) designated Xinbi Guarantee, alleging the service was widely used by cybercriminals to enable online scams, fraud, money laundering, and other illicit activity affecting U.S. persons. OFAC also listed 52 associated crypto addresses and sanctioned two entities it said provided critical support to the platform. link: Sanction details
Treasury said Xinbi Guarantee operates an illicit online marketplace that functions as a hub linking transnational criminal groups—including fraud operators—with merchants offering financial services, technology, and other resources that facilitate criminal activity. According to the department, fraud networks use the platform to source services and settle transactions, while the platform provides escrow-style "guarantee" services for fraudsters, money-laundering networks, and cybercrime groups. link:
Treasury said Xinbi Guarantee emerged around 2022 and has processed more than $24 billion in trading volume, including digital assets and fiat-equivalent transactions. After U.S. actions against Taizi Group and FinCEN's designation of Huwang Group as a primary money laundering concern, Treasury said Huwang's guarantee services migrated to other platforms to keep operating.
Treasury determined Xinbi Guarantee had previously provided services to multiple OFAC-sanctioned entities, including Jinbei Group and related Taizi Group entities, and that the same illicit activity has shifted onto Xinbi Guarantee. OFAC designated Xinbi Guarantee as a significant transnational organized crime group operating overseas, making it subject to sanctions.
OFAC also sanctioned SafeW Technology, developer of the encrypted messaging app SafeW, and Anwen Technology, developer of the NewPay wallet (also known as NewCoin Wallet), citing substantial assistance, sponsorship, or financial, material, and technical support to Xinbi.
Address breakdown vs. Tether freezes
The action covers 52 cryptocurrency addresses, set against the addresses Tether froze on Sept. 8.
Among the 50 addresses where USDT was frozen, only TThEzBN6SQ8ojyhofX6wahj13QkEdGGWXB does not appear on OFAC's current sanctions list. Beyond the 49 addresses frozen on Sept. 8, OFAC added three more addresses:
TW5tokvhEfrb77z98Rc8HqbkzQJ6sxYtGX
TBKpozurdWLrbKkxtDqkveeq1dSB8Axj3V
TKRNCETxbiMmyyMraCkgdXKdLr1ZkmKxV5 (Tether froze on Sept. 9)
Beosin KYT and Beosin Trace analysis
Using the onchain AML platform Beosin KYT and tracing tool Beosin Trace, the addresses show the following patterns:
1) TThEzBN6SQ8ojyhofX6wahj13QkEdGGWXB
Beosin links this address directly to Xinbi's escrow activity. It was added to the UK Sanctions List (UKSL) on March 26, 2026. The wallet appears to have served only as a pass-through address, moving large flows to other Xinbi escrow addresses. From Sept. 4 to 7, it received roughly 24 million USDT in batches and sent out funds in 2 million USDT increments; on Sept. 8, Tether froze the remaining 4 million USDT held at the address. Beosin Trace fund flow chart
2) TW5tokvhEfrb77z98Rc8HqbkzQJ6sxYtGX
This is described as a Xinbi collateral deposit address. It was listed on UKSL on March 26, 2026, and was added to OFAC's sanctions list in this round. The address recorded 52,301 inbound transactions from 11,525 unique counterparties, a "high-frequency aggregation" pattern consistent with platform deposit collection, alongside concentrated outbound counterparties. Beosin KYT transaction data chart
Beosin data show activity from July 31, 2025 to Jan. 21, 2026, with major flows ending after January—ahead of the March 2026 UK sanctions and later freezes of USDT and USDC.
3) TBKpozurdWLrbKkxtDqkveeq1dSB8Axj3V
This is also identified as a Xinbi collateral address, listed on UKSL on March 26, 2026 and subsequently sanctioned by OFAC. Beosin indicates the wallet was most active from May 28, 2025 to Sept. 1, 2025, showing downlink-style behavior: receiving large lumpsum transfers from custodial platforms and then distributing to many recipients, including underground banks, fraudulent merchants, money laundering networks, or other high-risk custodial clusters. Beosin KYT transaction data chart
4) TKRNCETxbiMmyyMraCkgdXKdLr1ZkmKxV5
This address shows a similar pattern to TThEzBN6SQ8ojyhofX6wahj13QkEdGGWXB. It appears to function purely as a transit wallet, breaking funds into smaller amounts and sending them in batches to other transit wallets or downstream addresses. Beosin shows activity from Aug. 3, 2026 to Aug. 15, 2026, before Tether and Circle's freezing actions on Sept. 9–10.
Takeaway
The measures extend earlier U.S. actions against Taizi Group and related individuals in October 2025 and on June 23, 2026, including OFAC designations of multiple Xinbi-backed cryptocurrency addresses. For virtual asset service providers (VASPs), exposure to funds linked to Xinbi-backed assets may create sanctions risk. The brief argues that building blockchain AML capabilities to identify illicit or high-risk collateral platforms and related entities in Southeast Asia, assess wallet risk, and trace virtual asset flows is becoming essential for VASPs.