Federal agents have restrained more than $52 million in cryptocurrency tied to the alleged Xinbi Guarantee scam-services network. The action is significant, but it is not a final forfeiture judgment—and it does not mean $52 million has already been returned to victims.
The distinction matters. In a September 9, 2026 announcement, the U.S. Department of Justice said its Scam Center Strike Force seized two cryptocurrency wallets holding about $12 million and sought restraint of 47 additional wallets believed to be associated with money laundering across Xinbi’s network. The coordinated operation pushed the value restrained that day above $52 million.
That split—funds seized under a warrant, additional wallets restrained, and a larger total preserved from movement—offers a clearer picture of how U.S. crypto enforcement now works. Investigators are not only following transactions on public ledgers. They are also targeting the messaging channels, wallet infrastructure, software providers and centralized stablecoin controls that alleged scam networks still depend on.
What did the Justice Department actually seize?
The Justice Department described Xinbi Guarantee as a Chinese-language marketplace operating through Telegram where vendors allegedly sold services to scam-center operators. According to the unsealed warrant and DOJ release, those services included custom investment websites, money laundering and recruitment for scam compounds in Southeast Asia.
A federal court in Washington authorized the seizure of Telegram channels hosting the marketplace on September 7. Under the same warrant, the Strike Force seized two wallets that DOJ said Xinbi used to collect payments for vendors. Those wallets held approximately $12 million. Agents also sought to restrain 47 other wallets they believed were linked to laundering on Xinbi’s network or to vendors serving scam operators.
| Measure | Confirmed on September 9 | What it does not establish |
|---|---|---|
| Two wallets | Seized; approximately $12 million held | That the full $52 million sat in those wallets |
| 47 additional wallets | Restraint sought by law enforcement | A completed forfeiture of every asset |
| More than $52 million | Restrained across Xinbi and its vendor network in one day | That victims have already received the money |
| About $938 million | DOJ’s cumulative amount restrained by the Strike Force | A measure of convictions or final victim restitution |
The Justice Department’s language is deliberately procedural. “Restrained” generally means property has been frozen or preserved while the government pursues the legal steps required to forfeit it. The seizure-warrant application states that the targeted Telegram property would be locked pending completion of forfeiture proceedings. Allegations in a warrant are not findings of guilt.
Why Xinbi Guarantee drew U.S. sanctions
The law-enforcement action arrived alongside a Treasury Department sanctions package. The Office of Foreign Assets Control designated Xinbi as a significant transnational criminal organization and also sanctioned SafeW Technology and Anwen Technology, which Treasury said supplied communications and wallet applications supporting the network.
Treasury’s September 9 release said Xinbi had processed the equivalent of more than $24 billion in digital assets and fiat currency since emerging around 2022. That figure is reported marketplace volume—not a verified victim-loss total and not the amount restrained in this operation.
The agency portrayed Xinbi as an intermediary rather than a single boiler-room operation: a marketplace connecting criminal groups with escrow, laundering, technology and other services. Treasury also said activity shifted toward Xinbi after U.S. authorities intensified pressure on Huione Pay. That migration helps explain why the new action targets infrastructure and service providers as well as addresses on a blockchain.
The stablecoin chokepoint behind the headline
The public record shows one of the practical limits of the phrase “permissionless money.” The warrant describes investigators tracing victim funds through token swaps and bridges into USDT on the Tron network. It says one destination address was blocklisted by Tether at law enforcement’s request. DOJ separately thanked Tether for what it called proactive assistance.
That does not mean every cryptocurrency transaction can be reversed. Bitcoin has no issuer capable of freezing a native address. Even with an issuer-controlled stablecoin, a freeze depends on identifying the relevant addresses, establishing a legal basis and reaching infrastructure that can act. In this case, blockchain tracing, a court warrant, Telegram controls, OFAC sanctions and cooperation from a token issuer formed overlapping points of leverage.
For exchanges and other crypto businesses, the sanctions component is immediate. OFAC’s notice identifies Xinbi and dozens of Tron addresses. U.S. persons generally cannot transact with blocked parties absent authorization, and property within U.S. jurisdiction must be blocked and reported. Compliance teams therefore have to look beyond names to wallet exposure, counterparties and ownership rules.
A freeze is the start of recovery, not the finish
For victims, the $52 million figure is encouraging but incomplete. Restraining assets can stop further movement and preserve a pool that may later be forfeited. It does not resolve which transfers represent fraud proceeds, which claimants have valid interests, how competing victims will be handled or when a distribution could occur.
The Justice Department said the Strike Force’s cumulative restrained total has reached roughly $938 million. That is a measure of property put beyond the immediate control of suspected networks, not a count of convictions and not a restitution ledger. Those outcomes require additional court proceedings and claims work.
The broader development is still notable: federal agencies are moving upstream from individual wallets to the service layer that industrializes online fraud. A marketplace can help operators procure websites, labor, payment rails and laundering in one place. Disrupting that hub can impose costs beyond the value sitting in any single address, even if criminal activity later migrates elsewhere.
What happens next?
The seized and restrained property will move through federal forfeiture processes. Telegram-channel control, blocked addresses and sanctions compliance will remain important operational questions. Investigators may also use records and transaction histories to identify additional victims, vendors or downstream services.
Anyone who believes they were defrauded by a Southeast Asian scam-center scheme can report it through the FBI’s Internet Crime Complaint Center. A report does not guarantee recovery, but transaction records, wallet addresses and communications can help investigators connect otherwise fragmented cases.
Quick answers
Was $52 million returned to crypto scam victims?
No. DOJ said the cryptocurrency was restrained. Final forfeiture and any victim distributions require further legal steps.
What is Xinbi Guarantee?
U.S. authorities describe it as a Chinese-language marketplace that connected scam operators with vendors offering laundering, technology, escrow and recruitment services. Those descriptions are government allegations and sanctions findings, not a criminal conviction.
What role did Tether play?
DOJ thanked Tether for assistance, and the seizure-warrant application says a USDT address was blocklisted at law enforcement’s request. Neither source says Tether was accused of wrongdoing.
Sources checked September 12, 2026: U.S. Department of Justice, the federal seizure-warrant application, U.S. Treasury and OFAC. Featured illustration by Shubham Dhage/Unsplash. This report contains no affiliate links and is not investment advice.
Investment disclaimer: This article is provided for general information only and does not constitute investment, financial, legal or tax advice. Digital assets are volatile, and all investment decisions and their consequences are your own responsibility.