The freeze targeted USDT, the dollar-pegged stablecoin, and struck 52 separate wallets belonging to Xinbi Guarantee and its merchants, according to blockchain analytics firm Elliptic, which says its intelligence enabled the operation. For related coverage, see 10 Biggest Crypto Fraud Cases in 2026.
Elliptic reports the freezes began at 08:00 UTC on September 8, 2026. The frozen asset was Tether’s USDT, a stablecoin that trades at roughly $1 and whose issuer can freeze balances at named addresses. For related coverage, see Senate to Vote on Clarity Act for U.S. Crypto Regulation.
USDT frozen, according to Elliptic
$52.8 million
A freeze is not a seizure. The funds are locked, not forfeited, and none of it has been described as recovered or returned to victims. Any reader treating this as a closed case is getting ahead of the facts. For related coverage, see CFTC Crypto Rules: Chair Says Agency Acts if Bill Stalls.
The Reported Link to Telegram Marketplace Xinbi
Xinbi Guarantee is a Telegram-based “guarantee” marketplace, a model where merchants post deposits as collateral and buyers trust the platform to hold both sides accountable. Elliptic says Xinbi’s merchants offered personal data, communications infrastructure and money laundering services to scammers. For related coverage, see Coldcard Wallet Hack Tied to Firmware Flaw, $114M Lost.
The crypto was tied to Xinbi and its merchants, not owned outright by a single operator. That distinction matters: the 52 wallets span the marketplace and the vendors trading on it. For related coverage, see Bessent Says Crypto Clarity Act Is at the 1-Yard Line.
Wallets frozen, according to Elliptic
52
The scale is staggering. Elliptic estimates Xinbi Guarantee and its merchants processed at least $24 billion in transactions since launching in 2022. That figure is throughput, not proven victim losses, and the two should not be confused.
A closely linked payments service, Xinbi Pay, also known as XPay, handled a further $6 billion, which Elliptic counts separately from the marketplace. For scale, Xinbi ranks among the biggest crypto fraud cases surfacing in 2026.
The wallets sat on TRON, where USDT moves cheaply and fast. OFAC’s entity record lists TRX digital currency addresses for Xinbi.
Dr. Tom Robinson, writing for Elliptic, argued the freeze cuts at the marketplace’s foundation.
Merchants and users of these services will now be operating with the knowledge that their wallets may be identified and frozen at any time. This uncertainty undermines the core mechanism these marketplaces rely on to function.
Dr. Tom Robinson, Elliptic
Elliptic participated in the operation, so its read on the fallout is an interested one, not an independent audit.
The Sanctions Came One Day Later
The freeze and the sanctions are two different moves on two different days. On September 9, 2026, the Treasury’s Office of Foreign Assets Control added Xinbi Guarantee to its SDN List under the Transnational Criminal Organization program, one day after the wallet freezes began.
The same action named two corporate satellites: Singapore-based SafeW Technology Co., Ltd. and Cambodia-based Anwen Technology Co., Ltd., both explicitly linked to Xinbi. OFAC’s entity record identifies XINBI GUARANTEE, with XINBI as an alias, as a criminal organization.
Then Telegram moved. In a September 9 update at 16:20 UTC, Elliptic reported that Telegram deleted Xinbi’s central channels and banned its usernames, and that Xinbi appears to have been forced offline. Attributing Telegram’s motive to the U.S. sanctions is Elliptic’s inference, not a confirmed link.
This kind of enforcement is arriving as Washington debates how to police digital assets, from the Senate’s push on the Clarity Act to warnings that the CFTC will write its own crypto rules if legislation stalls.
What Remains Unclear About the Crypto Freeze
Decrypt reported that two wallets holding roughly $12 million were seized under an unsealed warrant while the rest stayed frozen pending action. That claim comes from a single outlet; the underlying DOJ page was unreadable and the warrant was not inspected.
Decrypt also reported that the Scam Center Strike Force has seized about $938 million since November 2025. That aggregate has not been independently verified.
Elliptic further reported that Xinbi swapped roughly $2.8 million of remaining USDT into USDD after the freezes, an unconfirmed on-chain claim with no transaction hash cited. No independent wallet-by-wallet balance audit or Tether freeze confirmation has surfaced; the headline figure rests on Elliptic’s first-party account.
What the evidence does not show is any charge, conviction or victim reimbursement flowing from this freeze. The wallets are locked. The marketplace looks dark. Whether the money ever reaches the people it was taken from is the question this operation has yet to answer.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
