U.S. Takes Down Xinbi Guarantee, a Telegram-Based Scam Bazaar
The Justice Department seized channels, froze $52.8 million in crypto, and sent a strike team to Madagascar to break up 13 scam compounds tied to Chinese organized crime.
Key points
- The U.S. Department of Justice announced on Wednesday that it had disrupted Xinbi Guarantee, an online marketplace that helped online scammers do business.
- Investigators seized the Telegram channels used to run the service and confiscated two cryptocurrency wallets holding roughly $52.8 million.
- A newly formed Scam Center Strike Force was deployed to Madagascar to help local authorities break up 13 scam compounds linked to Chinese organized crime.
- Xinbi Guarantee operated on Telegram, a messaging app popular with criminals because groups can hold hundreds of thousands of members.
- The action is part of a wider U.S. push against the industrial-scale fraud compounds now operating across parts of Africa and Southeast Asia.
The U.S. Department of Justice said on Wednesday it had disrupted a sprawling online marketplace called Xinbi Guarantee, a service that acted like a shopping mall for online scammers.
Prosecutors seized the Telegram channels that ran the marketplace, took control of two cryptocurrency wallets holding about $52.8 million, and sent a specialist team to Madagascar to help dismantle 13 scam compounds run by Chinese organized crime groups.
This is not a single hack or a single victim. It is the plumbing behind the scams that hit ordinary people every day.
What was Xinbi Guarantee, in plain English?
Think of it as a criminal eBay. Xinbi Guarantee ran on Telegram, a messaging app where groups can hold hundreds of thousands of members, and it offered services that fraud rings need to operate: fake bank accounts, laundered cryptocurrency, stolen personal data, and hosting for scam websites.
The "guarantee" part is the twist. The marketplace acted as a middleman that held the buyer's payment until the seller delivered, so criminals who did not trust each other could still do business. It is the same escrow idea a legitimate site uses, bent to a criminal purpose.
The Hacker News, which first covered the takedown in detail, noted the operators used Telegram both to host the storefront and to talk with customers.
Who ran it, and who used it?
Investigators tied the marketplace to Chinese organized crime networks that also run the physical scam compounds now spread across Southeast Asia and, increasingly, parts of Africa.
These compounds are fenced complexes where trafficked workers are forced to run "pig butchering" scams, long romance-and-investment cons that drain victims' savings over weeks or months. The people inside are often victims themselves, lured by fake job ads and then held against their will.
Xinbi Guarantee gave those operations the tools of the trade. Need a bank account to receive a victim's wire transfer? Buy one. Need to move stolen money into crypto that is harder to trace? A vendor on the marketplace would do it for a fee.
What did U.S. authorities actually do?
Three things happened at once.
The Justice Department worked with Telegram to seize the channels the marketplace used, cutting off its shopfront. Prosecutors froze two cryptocurrency wallets holding around $52.8 million, money believed to be scam proceeds moving through the service. And a new unit called the Scam Center Strike Force flew to Madagascar to help local police raid 13 compounds.
Seizing crypto wallets is possible when investigators can identify the private keys, the long secret codes that control the money, or when they can pressure an exchange that holds the funds to hand them over. Either way, the cash stops moving.
Should ordinary people be worried?
If you have never touched Telegram or crypto, this takedown does not change your day. But the scams the marketplace supported absolutely reach ordinary inboxes and phones.
The common pattern: a stranger strikes up a warm conversation on a dating app or a wrong-number text, moves the chat to WhatsApp or Telegram, and eventually recommends a crypto "investment" that shows fake profits until you try to withdraw. If that script sounds familiar, it is because it is being run at industrial scale.
A short rule of thumb: any online romance that pivots to investment advice is a scam. Full stop.
What happens next?
Takedowns like this rarely end a criminal ecosystem. They reset it. Vendors will regroup on new Telegram channels, or move to competing marketplaces, and the compounds that were not raided will keep operating.
Still, seizing $52.8 million and physically disrupting 13 compounds is a real cost imposed on the people running these operations. That is the point.
