Blockchain analytics firm Elliptic says its intelligence supported a U.S. Secret Service action that restrained approximately $52.8 million in cryptocurrency linked to Xinbi Guarantee, an illicit marketplace accused of providing services to online scam operators. The September 9 enforcement action highlights how blockchain intelligence platforms are becoming a critical layer between on-chain transaction data and the off-chain identities, businesses and criminal networks that investigators need to connect.
The latest U.S. action against Xinbi Guarantee puts a spotlight on a less visible part of the digital-asset industry: the data infrastructure required to follow illicit money across blockchain networks.
Elliptic said its intelligence was used by the U.S. Secret Service in an action that froze wallets associated with Xinbi and its merchants, containing $52.8 million in cryptoassets. The U.S. Department of Justice separately confirmed that federal authorities restrained approximately $52 million in cryptocurrency linked to scam money laundering as part of a broader Scam Center Strike Force operation.
The DOJ described Xinbi as a Chinese-language illicit marketplace operating through Telegram, where vendors offered services to scam-center operators. Those services allegedly included money laundering, custom investment-scam websites, stolen data and recruitment of trafficking victims for scam compounds in Southeast Asia.
The case illustrates why blockchain investigations have increasingly moved beyond simply identifying suspicious wallet addresses.
According to Elliptic, its Data Fabric technology was integrated into U.S. Secret Service systems, giving investigators access to blockchain data and intelligence alongside off-chain information. The objective is to connect transactions, wallets, entities and real-world relationships rather than examine individual blockchain addresses in isolation.
That distinction is becoming increasingly important for Digital Asset Compliance.
Blockchains create a permanent transaction record, but the ledger does not inherently reveal who controls a wallet, why funds moved, which businesses are connected to an address or whether multiple transactions form part of a broader criminal operation.
Investigators therefore need systems capable of turning raw transaction data into an intelligence graph.
Elliptic says that its intelligence team had previously identified Xinbi and Huione before their activities became widely known. Its earlier research found that Xinbi Guarantee had received billions of dollars in USDT transactions and served fraudsters operating in Southeast Asia.
The marketplace was also part of a larger ecosystem of Telegram-based “guarantee” marketplaces. In May 2025, Telegram removed channels associated with both Xinbi Guarantee and Huione Guarantee after Elliptic research exposed their activities. Elliptic estimated that the two marketplaces had collectively facilitated more than $35 billion in USDT transactions.
The Huione case subsequently became a major financial-crime enforcement precedent.
In May 2025, the U.S. Treasury’s Financial Crimes Enforcement Network identified Cambodia-based Huione Group as a foreign financial institution of primary money laundering concern, saying the group was used to launder proceeds from cyber heists and cryptocurrency investment scams. FinCEN said its investigation identified at least $4 billion in illicit proceeds laundered through the group between August 2021 and January 2025.
FinCEN later finalized a rule severing Huione Group from the U.S. financial system.
Those actions show how blockchain intelligence can become part of a broader enforcement pipeline. Analytics may identify relationships and transaction flows; investigators then combine those findings with subpoenas, financial records, messaging data and other evidence before authorities take action.
The Xinbi operation also demonstrates the adaptability of illicit financial networks.
When major marketplaces are disrupted, merchants and customers can migrate to other platforms. Elliptic’s research into Tudou Guarantee, for example, found that the marketplace expanded after Huione Guarantee shut down, absorbing activity from displaced merchants.
That creates an ongoing challenge for law enforcement and financial institutions.
A one-time blacklist is unlikely to be sufficient when criminal organizations can create new wallets, change Telegram channels, establish successor marketplaces or route funds through different assets.
This is where behavioral analytics and network-level intelligence become more important than static address screening.
For banks, exchanges, payment providers and other financial institutions, the implication is that AML and crypto compliance infrastructure increasingly needs to operate across multiple data layers.
Transaction monitoring remains necessary, but sophisticated investigations may require entity resolution, wallet clustering, sanctions intelligence, transaction tracing and links to off-chain information.
The economics of illicit crypto activity make that investment more urgent.
Elliptic now describes Xinbi Guarantee as having processed at least $24 billion in transactions since 2022, with closely linked Xinbi Pay processing another $6 billion. Those figures are Elliptic’s estimates and should be distinguished from the DOJ’s independently stated enforcement figures.
The DOJ’s action itself was part of a much broader operation. Authorities said the Scam Center Strike Force restrained approximately $52 million in cryptocurrency in one day, bringing the Strike Force’s cumulative restrained crypto to approximately $938 million.
The case also reinforces a changing perception of blockchain technology within financial crime investigations.
Cryptoassets were once frequently characterized as difficult to trace because transactions could be pseudonymous and operate outside conventional banking systems. Today, the permanent nature of public blockchain records can provide investigators with a valuable trail—provided they have the analytical tools to interpret it.
That does not make blockchain transactions inherently transparent. Privacy-enhancing technologies, mixers, bridges, cross-chain transfers and increasingly sophisticated laundering techniques can complicate attribution.
But the Xinbi case demonstrates the other side of that equation: illicit actors may be able to obscure their identities, but their transactions still leave data that can potentially be analyzed retrospectively.
For the broader Financial Technology and Digital Payments industry, that creates a growing market for blockchain intelligence, risk scoring and compliance automation.
The same infrastructure that helps financial institutions monitor digital assets can increasingly support government investigations, sanctions enforcement and fraud prevention.
The challenge for vendors will be proving that their intelligence can translate into actionable outcomes rather than simply producing more alerts.
Elliptic’s role in the Xinbi investigation is therefore significant not merely because of the amount of cryptocurrency restrained, but because it demonstrates how on-chain intelligence is becoming part of the operational infrastructure of digital-asset enforcement.
As stablecoins, tokenized assets and blockchain-based payments move deeper into mainstream finance, that infrastructure will become increasingly important on the legitimate side of the market as well.
The future of digital finance will not be determined only by faster settlement and programmable money. It will also depend on whether institutions can see who is moving value, understand the networks behind those transactions and intervene when digital financial infrastructure is being used for crime.
Market Landscape
The Xinbi action comes as governments increasingly treat cryptocurrency analytics as an essential component of financial-crime enforcement. The DOJ’s Scam Center Strike Force says approximately $938 million in cryptocurrency has now been restrained through its operations, illustrating the scale at which digital assets are becoming part of investigations into organized fraud.
The enforcement environment is also becoming more international. The U.K. has separately sanctioned Xinbi Company Limited, imposing an asset freeze and director disqualification sanction. The U.K. listing states that Xinbi enabled and profited from the operation of scam centers in Southeast Asia.
For banks, exchanges, stablecoin issuers and payment companies, the competitive landscape increasingly includes blockchain intelligence providers that can connect transaction monitoring with sanctions, fraud and entity intelligence. As digital assets become embedded in mainstream financial infrastructure, compliance technology is becoming a core component of the market rather than a specialized crypto requirement.
Top Insights
- U.S. authorities restrained approximately $52 million in crypto linked to Xinbi as part of a broader crackdown on scam-center financial infrastructure.
- Elliptic says its Data Fabric intelligence supported investigators, connecting blockchain transactions with off-chain information to map the wider Xinbi network.
- Xinbi operated through Telegram, offering money laundering, scam infrastructure and other services to criminal operators, according to the U.S. Justice Department.
- Huione provides a broader precedent: FinCEN identified the Cambodia-based group as a primary money laundering concern after identifying billions in illicit proceeds.
- Blockchain analytics is becoming enforcement infrastructure, helping governments and financial institutions trace illicit funds across wallets, entities and transaction networks.
Get in touch with our fintech expert
