Fraud, Technology & National Security
Washington Hits a $24 Billion Scam Marketplace—and Freezes $52 Million in Crypto
Treasury sanctions and Justice Department seizures target the payment rails behind Southeast Asian scam compounds. The numbers are large, but their meaning needs precision.
Executive Takeaway
On September 9, Treasury sanctioned Xinbi Guarantee, a Chinese-language marketplace that the department says enabled cyber scams, money laundering, escrow, and technology services for criminal networks, primarily in Southeast Asia. Treasury says Xinbi processed the equivalent of more than $24 billion in digital and fiat assets since roughly 2022. Separately, the Justice Department said its Scam Center Strike Force restrained about $52 million in cryptocurrency in one day, seized two Xinbi-linked wallets holding roughly $12 million, and sought restraint of 47 additional wallets. Those figures are not interchangeable: marketplace transaction volume is not a proven loss total, while restraint preserves assets pending legal process. The action matters because it attacks infrastructure rather than one caller or website. Consumers should still assume recovery is uncertain and use prevention as their first defense.
What Treasury and DOJ Did
Treasury’s Office of Foreign Assets Control designated Xinbi Guarantee under an authority aimed at transnational criminal organizations. It also sanctioned Anwen Technology and SafeW Technology, which Treasury described as part of the marketplace’s supporting network. Property and interests in property of designated persons within the United States or the control of U.S. persons are blocked, and entities owned 50 percent or more by blocked persons are generally blocked as well.
The Justice Department’s coordinated action used seizure warrants and cryptocurrency tracing. Prosecutors said two Xinbi wallets containing about $12 million were seized, applications were filed to restrain 47 more wallets, and Telegram marketplace channels were taken over under a September 7 court warrant. The department said the Strike Force restrained about $52 million that day and about $938 million since its creation.
The agencies are using different legal tools. Sanctions isolate designated actors from U.S.-linked finance. Seizure and restraint bring specific assets under court supervision. Neither step by itself proves every transaction was criminal, and affected parties can contest government actions through established processes.
What the $24 Billion Figure Means
Treasury said Xinbi processed the equivalent of more than $24 billion in digital assets and fiat currency since around 2022. That is reported transaction volume associated with the marketplace—not a declaration that $24 billion was stolen from Americans. A platform can process deposits, withdrawals, transfers, escrow flows, repeated movement of the same funds, and transactions unrelated to a single victim-loss measure.
Precision matters because exaggerated numbers weaken good enforcement. The responsible formulation is that authorities targeted a marketplace of enormous scale that Treasury says supported illicit activity. Proven forfeiture, victim restitution, sanctions exposure, and criminal liability will depend on transaction-level evidence and court proceedings.
The $52 million and $12 million figures also describe assets restrained or seized, not money already returned to victims. Cryptocurrency can move quickly, but public ledgers can also preserve traces. Law enforcement gains leverage when exchanges, stablecoin issuers, analytics firms, and foreign authorities respond before assets are converted or dispersed.
The Scam-Compound Business Model
Southeast Asian scam compounds combine digital outreach, social engineering, payments, and often human trafficking or forced labor. Operators cultivate trust through romance, investment, employment, government-impersonation, or technical-support stories. The victim is then guided toward a transfer that appears legitimate or urgent. Infrastructure marketplaces lower the cost of operating at scale by supplying accounts, software, identity tools, laundering, escrow, and communications.
DOJ said its teams assisted Madagascar with the takedown of 13 Chinese-run compounds. The international element is central: a victim may be in Ohio, a messaging account registered elsewhere, operators located in Asia or Africa, and proceeds routed through multiple chains and exchanges. No single domestic agency can solve that structure alone.
The model also explains why taking down one phone number has limited effect. Criminal enterprises replace front-end accounts rapidly. Pressure on payment rails, hosting, device farms, domain registrars, communications platforms, recruiters, and laundering services can raise costs across the network.
The Scale of Reported Consumer Harm
The FBI’s 2025 Internet Crime Report recorded 1,008,597 complaints and $20.877 billion in reported losses. People age 60 and older accounted for 201,266 complaints and about $7.75 billion in reported losses. Those are complaints submitted to the Internet Crime Complaint Center, not a complete census of all fraud; underreporting and duplicate or incomplete information can affect totals.
The Federal Trade Commission separately said consumers reported roughly $16 billion in scam losses in 2025, up from $12.8 billion in 2024. Different databases, definitions, and reporting channels mean the FBI and FTC totals should not be added together. They still point in the same direction: online fraud is a mass-market financial and public-safety problem.
DOJ’s Operation Level Up provides a preventive example. By April 2026, officials said they had notified 8,935 potential victims, 77 percent of whom did not know they were being scammed, and estimated $562.7 million in losses avoided. Ninety-three people were referred for suicide intervention. The figures underscore that interruption can matter as much as prosecution.
What Households and Institutions Should Do
The FTC’s simplest rule remains powerful: government agencies will not order you to move money to protect it or demand payment by cryptocurrency, wire transfer, payment app, or gift card. A bank, police officer, investment professional, or tech-support caller who insists on secrecy or urgency is creating a reason to stop.
Before sending money, use a separate channel to contact the institution through a number or website you already trust. Do not use links, numbers, or apps supplied by the person making the demand. Discuss large or unusual transfers with a trusted family member. Financial institutions should make escalation easy for tellers and customers and train staff to recognize coercion, especially when an older customer suddenly liquidates savings.
Platforms and crypto firms need controls that identify clusters, mule accounts, impersonation campaigns, and rapid cross-chain movement. But automated blocking requires appeals and human review. False positives can lock innocent people out of essential funds; due process improves legitimacy without weakening urgency.
Facts, Analysis, and Scenario Map
Confirmed facts are the sanctions, warrants, stated restraint and seizure amounts, marketplace volume attributed by Treasury, and reported complaint data. RedWaveBrief’s analysis is that infrastructure-focused enforcement can be more durable than isolated takedowns when private firms and foreign governments act quickly.
Base case: networks lose assets and channels but rebuild parts of the operation. Better case: data from seized infrastructure identifies victims, recruiters, payment nodes, and additional funds, enabling restitution. Worse case: operators migrate to new platforms faster than compliance systems adapt. These are conditional scenarios, not predictions or claims of guilt beyond the official actions.
What to Watch
Watch court filings for forfeiture outcomes, victim-notification plans, and challenges to the warrants. Watch OFAC guidance for additional addresses or entities and whether exchanges publicly describe freezes. The decisive measure will not be the headline size of Xinbi’s throughput; it will be how much illicit activity is disrupted, how many victims are warned, and how much money is lawfully returned.
Action Checklist
Freeze the conversation when anyone demands secrecy, urgency, or irreversible payment. Verify through an independent number. Enable account alerts and strong multi-factor authentication. Families should agree on a no-judgment call before any large unexpected transfer. Businesses should rehearse invoice-change verification and employee escalation. If money was sent, contact the financial institution immediately, preserve messages and transaction identifiers, and report through official FBI and FTC channels. Do not pay a recovery service that promises guaranteed retrieval; recovery scammers often target people a second time.
Choose Our Next Deep Dive
Ask the Analyst
What practical question do you have about this issue? Send it to the RedWaveBrief analyst desk.
Sources & Methodology
Confirmed facts come from the sources below. RedWaveBrief analysis explains transmission channels and trade-offs. Scenario descriptions are conditional, not forecasts.
- U.S. Treasury — OFAC sanctions Xinbi network
- Department of Justice — Xinbi seizures and Scam Center Strike Force actions
- Department of Justice — April 2026 Scam Center Strike Force actions
- FBI — 2025 IC3 Annual Report
- FTC — Help fight imposter scams
Read Also
Treasury Flags $17.5 Billion in Suspected Health Care Fraud.