U.S. Takes Down Xinbi Guarantee, a Telegram-Based Scam Bazaar
The Justice Department seized channels, froze $52.8 million in crypto, and sent a strike team to Madagascar to break up 13 scam compounds tied to Chinese organized crime.
Key points
- The U.S. Department of Justice announced on Wednesday that it had disrupted Xinbi Guarantee, an online marketplace that helped online scammers do business.
- Investigators seized the Telegram channels used to run the service and confiscated two cryptocurrency wallets holding roughly $52.8 million.
- A newly formed Scam Center Strike Force was deployed to Madagascar to help local authorities break up 13 scam compounds linked to Chinese organized crime.
- Xinbi Guarantee operated on Telegram, where groups can hold hundreds of thousands of members.
- The action is part of a wider U.S. Push against the industrial-scale fraud compounds now operating across parts of Africa and Southeast Asia.
The U.S. Department of Justice said on Wednesday it had disrupted a sprawling online marketplace called Xinbi Guarantee, a service that acted like a shopping mall for online scammers.
Prosecutors seized the Telegram channels that ran the marketplace, froze two cryptocurrency wallets holding about $52.8 million, and sent a specialist team to Madagascar to help dismantle 13 scam compounds run by Chinese organized crime groups.
This isn't a single hack or a single victim. It's the plumbing behind the scams that hit ordinary people every day.
What was Xinbi Guarantee, in plain English?
Think of it as a criminal eBay. Xinbi Guarantee ran on Telegram and offered services that fraud rings need to operate: fake bank accounts, laundered cryptocurrency and stolen personal data. Scam website hosting was available too.
The "guarantee" in the name is the twist: the marketplace held a buyer's payment until the seller delivered, so criminals who didn't trust each other could still do business. It's the same escrow idea a legitimate site uses, bent to a criminal purpose.
The Hacker News, which first covered the takedown in detail, noted the operators used Telegram both to host the storefront and to communicate with customers.
Who ran it, and who used it?
Investigators tied the marketplace to Chinese organized crime networks that also run the physical scam compounds now spread across Southeast Asia and, increasingly, parts of Africa. We've followed those compounds since 5 August, and our piece "Escaped the Scam Compound, Trapped by the Aftermath" from 23 August found that many freed workers have nowhere to go once they're out.
These compounds are fenced complexes where trafficked workers are forced to run "pig butchering" scams, long romance-and-investment cons that drain victims' savings over weeks or months. The people inside are often victims themselves, lured by fake job ads and then held against their will.
Xinbi Guarantee gave those operations their tools. A bank account to receive a victim's wire transfer? Buy one. Stolen money that needs moving into crypto that's harder to trace? A vendor would do it for a fee.
What did U.S. Authorities actually do?
Three things happened at once.
The Justice Department worked with Telegram to seize the marketplace's channels, cutting off its shopfront. Prosecutors froze two cryptocurrency wallets holding around $52.8 million, money believed to be scam proceeds moving through the service. A new unit called the Scam Center Strike Force then flew to Madagascar to help local police raid 13 compounds.
Seizing crypto wallets is possible when investigators can identify the private keys, the long secret codes that control the funds, or when they can pressure an exchange holding those funds to hand them over. Either way, the cash stops moving.
Should ordinary people be worried?
If you've never touched Telegram or crypto, this takedown doesn't change your day. But the scams the marketplace supported reach ordinary inboxes and phones without any effort from the recipient.
The common pattern: a stranger opens a warm conversation on a dating app or via a wrong-number text, moves the chat to WhatsApp or Telegram, and eventually recommends a crypto "investment" that shows fake profits until withdrawal is attempted. That script is being run at industrial scale, and it's the same playbook our 4 June reporting on the DOJ's pig-butchering sweep described months ago.
Any online romance that pivots to investment advice is a scam. Full stop.
What happens next?
Takedowns like this rarely end a criminal ecosystem. They reset it. Vendors will regroup on new Telegram channels or move to competing marketplaces, and compounds that weren't raided will keep operating.
Still, seizing $52.8 million and physically disrupting 13 compounds is a real cost imposed on the people running these operations. Disruption is the point, and right now it seems to be arriving faster than these networks can relocate.
