Actor Profile

Chinese organized crime syndicates operating the Xinbi Guarantee illicit marketplace, a Telegram-based platform facilitating pig butchering romance scams, wire fraud, and money laundering. The actor network provides intermediary services between vendors and scam center operators, functioning as an escrow platform for criminal services. Operations span Southeast Asia and Madagascar, with approximately 30 Chinese leaders identified and repatriated. The marketplace emerged around 2022 and became the second-largest illicit marketplace with $30 billion in transactions to date, rising to prominence after the closure of predecessor platforms HuiOne Guarantee and Tudou Guarantee. The network has been used by North Korean hackers and OFAC-designated entities including Jin Bei Group Co., Ltd. and Prince Group TCO.

TTPs (Tactics, Techniques, Procedures)

The criminal network operates a Telegram-based marketplace ecosystem providing turnkey scam services. Key capabilities include: creation of custom scam investment websites for pig butchering operations; cryptocurrency-based money laundering infrastructure primarily using Tether's USDT stablecoin on the TRON blockchain; escrow services holding payments until vendor service completion; trafficking victim solicitation for scam compound staffing; and sale of stolen personal data and satellite internet equipment. Following asset freezes, the network demonstrated operational agility by pivoting from USDT to USDD stablecoin via decentralized exchanges, converting approximately $2.8 million in assets. The operation targets Americans through romance scams and wire fraud schemes executed from physical scam compounds in Southeast Asia and Madagascar.

Targets & Patterns

Primary targets are American individuals and financial institutions, with victims losing billions of dollars annually to pig butchering romance scams and wire fraud schemes. The cryptocurrency and financial services sectors are targeted both as victims and as infrastructure for money laundering operations. The actor specifically targets Americans through social engineering campaigns, leveraging stolen personal data purchased through the marketplace to enhance targeting effectiveness. The choice of American victims appears motivated by financial gain, exploiting trust through romance scams and fraudulent investment schemes. The scale of operations—$30 billion in marketplace transactions and $938 million restrained by law enforcement to date—indicates systematic, industrial-scale targeting of U.S. citizens.

Historical Context

Xinbi Guarantee emerged around 2022 as part of an evolving Guarantee marketplace ecosystem. The platform rose to prominence following law enforcement actions against predecessor marketplaces HuiOne Guarantee and its successor Tudou Guarantee in 2025. In January 2026, researchers noted that Xinbi recovered following Telegram's initial intervention but the platform refused further cooperation, leading to proliferation of similar markets on the messaging platform. The U.K. became the first country to sanction Xinbi over five months prior to the September 2026 U.S. actions, targeting the marketplace for selling cryptocurrency services, stolen personal data, and satellite equipment to scam centers. The U.S. Scam Center Strike Force has now restrained approximately $938 million in total across multiple operations, with the Xinbi disruption representing $52.8 million frozen in a single day. The Madagascar deployment marks an expansion of Strike Force operations beyond Southeast Asia.

Defensive Recommendations

  • Monitor and flag cryptocurrency transactions involving USDT and USDD stablecoins on TRON blockchain, particularly large-volume transfers to known scam-associated wallet addresses
  • Implement enhanced due diligence for romance scam indicators: unsolicited investment advice from online contacts, requests to use specific cryptocurrency platforms, and pressure to transfer funds quickly
  • Deploy behavioral analytics to detect pig butchering patterns: gradual relationship building followed by cryptocurrency investment discussions, typically spanning weeks to months
  • Coordinate with Telegram to identify and report suspected Guarantee marketplace channels offering escrow services, custom website creation, or data brokerage targeting financial fraud
  • Establish cross-border information sharing with Treasury OFAC sanctions lists to identify transactions involving designated entities like Jin Bei Group Co., Ltd. and Prince Group TCO affiliates

---

# Geopolitical Context

Geopolitical Context

The coordinated U.S. action against the Xinbi Guarantee marketplace represents an escalation in transnational law enforcement efforts targeting Chinese organized crime networks operating across Southeast Asia and, notably, Madagascar. The operation demonstrates Washington's willingness to deploy specialized task forces extraterritorially and to leverage financial sanctions alongside technical disruption. The involvement of the Treasury's OFAC and the repatriation of approximately 30 Chinese nationals by Beijing suggests a degree of tactical cooperation between Washington and Beijing on transnational crime, even amid broader strategic competition. The marketplace's reported use by North Korean hackers and OFAC-designated entities such as the Jin Bei Group and Prince Group TCO underscores the convergence of state-linked and criminal cyber activity within shared illicit financial infrastructure. The expansion of scam center operations to Madagascar—outside the traditional Southeast Asian theater—indicates geographic diversification by Chinese organized crime syndicates, likely in response to intensified enforcement pressure in Cambodia, Myanmar, and Laos.

State Actor Alignment

Xinbi Guarantee has been linked to North Korean state-affiliated hackers and multiple entities previously sanctioned by OFAC, including Jin Bei Group Co., Ltd. and components of the Prince Group transnational criminal organization. The Treasury Department's designation of Chinese-language media outlets for facilitating cyber scams and money laundering reflects U.S. efforts to target enablers within China's information ecosystem. The repatriation of approximately 30 Chinese nationals identified as scam compound leaders by Chinese authorities suggests Beijing's willingness to cooperate selectively on organized crime enforcement, consistent with its broader campaign against cross-border gambling and telecom fraud. However, the operation does not indicate formal attribution of state sponsorship to the People's Republic of China; rather, it highlights the challenge posed by Chinese organized crime groups operating with varying degrees of autonomy in jurisdictions with weak governance.

Business Impacty pro region

For Europe, the disruption of Xinbi Guarantee may temporarily reduce the volume of pig butchering scams targeting European victims, though the marketplace's rapid pivot to USDD stablecoin suggests resilience and adaptability. European financial regulators and law enforcement agencies should anticipate displacement effects as vendors and scam operators migrate to alternative platforms or jurisdictions. The expansion of U.S. Scam Center Strike Force operations to Madagascar sets a precedent for extraterritorial enforcement that may encourage European partners to pursue similar joint operations in Africa, where governance gaps and Chinese economic presence create opportunities for organized crime. The case underscores the need for coordinated transatlantic action on stablecoin regulation, particularly for assets lacking centralized freeze capabilities. Globally, the operation signals that scam compounds are no longer confined to the Mekong subregion, complicating regional containment strategies and requiring broader international coordination, particularly within INTERPOL and multilateral frameworks addressing human trafficking and forced labor in scam operations.

Forecast

If Xinbi Guarantee's shift to USDD proves operationally viable, other illicit marketplaces are likely to adopt decentralized stablecoins to evade asset freezes, accelerating a regulatory and technical arms race between law enforcement and criminal networks. If Chinese authorities continue selective repatriation and prosecution of scam compound leaders, bilateral U.S.-China cooperation on transnational crime may expand incrementally, though it is unlikely to extend to cyber operations with strategic or intelligence dimensions. If the U.S. Scam Center Strike Force sustains its global mandate, additional operations in West Africa and Latin America are probable within the next 12 to 18 months, particularly in jurisdictions with significant Chinese diaspora populations and weak anti-money laundering enforcement. If the $938 million in total restrained assets leads to victim restitution programs, it may enhance public and congressional support for expanded Treasury and Justice Department authorities targeting cryptocurrency-enabled crime. However, if Xinbi's merchant network successfully reconstitutes on alternative platforms—such as encrypted messaging apps or decentralized marketplaces—the disruption may prove temporary, requiring sustained pressure and platform cooperation to achieve durable impact.