UK Sanctions Xinbi: Inside the $24 Billion Stablecoin-Powered Crime Empire
A Chinese-language marketplace incorporated in Colorado processed more money for pig-butchering scammers, North Korean hackers, and human traffickers than most regulated exchanges handle for legitimate customers. On March 26, 2026, the United Kingdom became the first country to formally sanction Xinbi — and what investigators found behind its Telegram storefronts reveals just how deeply stablecoins have become woven into global organized crime.
From a Colorado Filing to a $24 Billion Criminal Bazaar
Xinbi Co., Ltd was quietly incorporated in Aurora, Colorado in August 2022. On paper, it looked like any other small business filing. In practice, it became the operating entity behind Xinbi Guarantee — a sprawling, Chinese-language Telegram marketplace that would go on to process an estimated $24.2 billion in cryptocurrency transactions, almost entirely in Tether's USDT stablecoin.
By the time blockchain analytics firm Elliptic first exposed the network in May 2025, Xinbi had amassed over 233,000 users. Its merchants openly advertised services that read like a criminal starter kit: money laundering, stolen personal data, Starlink satellite internet equipment for contacting scam victims, and forged identification documents. Many vendors made no attempt to hide their willingness to launder proceeds from so-called "pig butchering" scams — the elaborate romance and investment frauds that have cost victims billions worldwide.
What made Xinbi remarkable was not just its scale, but its brazenness. The marketplace operated in plain sight on Telegram, with organized vendor categories and customer reviews, functioning as a criminal-service Amazon for Southeast Asia's booming fraud industry.
The USDT Engine: Why Stablecoins Are Crime's Preferred Rails
Nearly every transaction on Xinbi Guarantee was denominated in USDT, Tether's dollar-pegged stablecoin. The reasons are straightforward: USDT offers near-instant settlement, operates across multiple blockchains (Tron's TRC-20 being the most popular for illicit use), and requires no bank account or identity verification to receive.
Xinbi took this a step further by launching its own payment infrastructure. In December 2025, the marketplace debuted NewPay (also called XinbiPay) — a no-KYC cryptocurrency wallet supporting USDT transactions across TRC-20, ERC-20, BEP-20, and other networks. Within its first month, XinbiPay processed over $94.6 million. By March 2026, cumulative volume had reached nearly $500 million.
The no-KYC wallet represented an evolution in illicit finance infrastructure. Rather than relying on third-party exchanges or mixing services, Xinbi built its own closed-loop payment system — making it harder for compliance teams at legitimate exchanges to flag suspicious flows.
This pattern underscores a growing concern among regulators: stablecoins are not just being used by criminals as a medium of exchange, but are enabling the construction of entirely parallel financial systems purpose-built for illicit activity.
The #8 Park Connection: Cambodia's Largest Scam Compound
The UK sanctions did not target Xinbi in isolation. The March 26 designation also hit entities connected to #8 Park, believed to be Cambodia's largest scam compound with capacity to hold an estimated 20,000 trafficked workers.
Operated by Legend Innovation Co. and its director Eang Soklim, #8 Park was linked to the Prince Group — a Cambodia-based conglomerate led by chairman Chen Zhi that had built a vast network of scam compounds across Southeast Asia. Inside these compounds, workers — many of them trafficking victims lured by fake job advertisements — were forced to run pig-butchering scams, romance frauds, and other online schemes. Merchants within #8 Park accepted USDT payments through Xinbi and similar platforms, even running on-site supermarkets and bakeries that took stablecoin payments.
Elliptic's blockchain analysis of #8 Park provided some of the most granular evidence of how scam compounds operate financially. Researchers mapped merchant payment flows within the compound, traced funds across multiple blockchain networks, and even documented the compound's evacuation in February 2026 through the sudden cessation of on-chain transaction patterns — a form of "blockchain forensic archaeology" that is becoming increasingly important to law enforcement.
North Korea's Fingerprints: The Lazarus Group Connection
Perhaps the most alarming finding from Elliptic's investigation was the connection between Xinbi and the Democratic People's Republic of Korea. Blockchain analysis traced approximately $235 million in USDT from the WazirX exchange hack — attributed to North Korea's Lazarus Group — to merchant addresses on Xinbi Guarantee.
The Lazarus Group, North Korea's state-sponsored hacking operation, has been responsible for some of the largest cryptocurrency thefts in history, including the $1.5 billion Bybit hack in February 2025. The fact that a Telegram-based marketplace registered in Colorado was processing laundering services for a sanctioned nation-state's hacking proceeds illustrates the extraordinary complexity of modern crypto-enabled financial crime.
This nexus between Southeast Asian scam compounds, Chinese-language crime marketplaces, and North Korean state hackers represents what threat researchers call the "convergence of cybercrime" — where previously separate criminal ecosystems increasingly share infrastructure, services, and financial rails.
The Sanctions Hammer: What the UK Designation Means
On March 26, 2026, the UK's Foreign, Commonwealth and Development Office (FCDO) designated six individuals and four entities under the Global Human Rights sanctions regime. The key targets included:
- Xinbi itself, as a marketplace enabling human trafficking and fraud
- Legend Innovation Co. and director Eang Soklim, operators of #8 Park
- Thet Li, described as a key lieutenant of Prince Group chairman Chen Zhi who managed the group's international financial network
- Hu Xiaowei, a long-term associate of Chen Zhi operating under three aliases within the Prince Group's financial network
The financial consequences were significant. Multiple London properties were frozen, including a £100 million office block in the City of London, two multi-million-pound mansions, and a helicopter. These freezes built on previous actions: the coordinated US-UK operation in October–November 2025 targeting 146 Prince Group-linked entities had already resulted in asset freezes and seizures exceeding £1 billion.
The arrest and extradition of Prince Group chairman Chen Zhi to China in January 2026 was another pivotal moment, sending shockwaves through Southeast Asia's scam compound ecosystem. Blockchain data confirmed that activity at #8 Park nearly ceased by mid-February 2026 after compound residents were ordered to evacuate.
The Whack-a-Mole Problem: Why Xinbi Keeps Coming Back
Despite the sanctions and Telegram's May 2025 ban that disrupted both Xinbi and its larger rival Huione Guarantee (which processed over $27 billion), the enforcement story is far from a clean victory.
According to TRM Labs, Xinbi's daily inflows nearly doubled by December 2025 compared to pre-ban levels, even as competitors like Huione, Haowang, and Tudou experienced near-total volume collapse. Xinbi had effectively captured the market share of its disrupted rivals.
The platform also diversified its infrastructure. It launched SafeW, a proprietary messaging platform, in June 2025 — accumulating over 20,900 subscribers by March 2026 as a backup channel outside Telegram's reach. Combined with the XinbiPay wallet, Xinbi was building a vertically integrated criminal technology stack: its own marketplace, messaging platform, and payment system.
This resilience highlights a fundamental challenge in combating crypto-enabled crime. Sanctions and platform bans can disrupt operations temporarily, but determined operators migrate to new infrastructure, absorb displaced competitors' user bases, and often emerge stronger. The $12.1 billion in inflows TRM Labs observed flowing to Xinbi between May 2025 and March 2026 — post-Telegram ban — is a sobering data point for regulators worldwide.
What This Means for the Stablecoin Industry
The Xinbi case arrives at a pivotal moment for stablecoin regulation. The US GENIUS Act is moving through Congress with a July 2026 OCC rulemaking deadline. The EU's MiCA framework is entering final implementation. Seven major jurisdictions are simultaneously developing stablecoin compliance frameworks.
Yet the Xinbi story exposes a gap that legislation alone cannot close. The platform's $24.2 billion in transaction volume was almost entirely USDT on public blockchains — theoretically visible to anyone with blockchain analytics tools. Tether has historically pointed to its cooperation with law enforcement, having frozen over $3.4 billion in assets linked to illicit activity. But the sheer scale of Xinbi's operations, running for years in plain sight, raises uncomfortable questions about the speed and proactiveness of private-sector responses.
For stablecoin issuers, the policy implications are clear: passive cooperation with law enforcement after-the-fact may not satisfy regulators or legislators. The trend is toward expectations of proactive monitoring — automated freeze mechanisms triggered by hack detection, real-time suspicious activity reporting, and closer integration with blockchain analytics providers.
For the broader crypto industry, the lesson is that stablecoins' role as critical financial infrastructure cuts both ways. The same properties that make USDT attractive for remittances and DeFi — speed, low cost, borderless transfer — make it equally attractive for the $24 billion Xinbi Guarantees of the world.
Looking Ahead: The Enforcement Escalation
The UK's sanctions on Xinbi represent an escalation in the global approach to crypto-enabled organized crime. Rather than targeting individual wallets or exchanges, regulators are now designating entire marketplace ecosystems and their support networks — from the Telegram channels to the Cambodian compounds to the London real estate portfolios.
Several developments to watch in Q2 2026:
- US follow-up sanctions: The UK acted first, but FinCEN's 2025 designation of Huione as a primary money laundering concern suggests US action against Xinbi entities could follow
- Tether's response: Whether USDT's issuer implements more aggressive proactive freezing in response to mounting political pressure
- Telegram's evolving role: The platform's cooperation with Elliptic led to the initial May 2025 takedown, but Xinbi's rapid re-emergence tests Telegram's commitment to sustained enforcement
- Southeast Asian law enforcement: Following Chen Zhi's arrest, whether Cambodia, Myanmar, and Laos can dismantle the physical scam compound infrastructure that generates demand for platforms like Xinbi
The Xinbi saga is ultimately a story about the speed mismatch between criminal innovation and regulatory response. A marketplace that processes $24 billion in illicit stablecoin transactions while incorporated in Colorado and operating via a messaging app highlights how traditional jurisdictional enforcement models are struggling to keep pace with borderless, crypto-native crime networks.
The stablecoin industry's credibility as legitimate financial infrastructure depends on narrowing that gap — before the next Xinbi fills the vacuum.
BlockEden.xyz provides enterprise-grade blockchain API services with built-in compliance and security monitoring capabilities. As the crypto industry grapples with the challenge of illicit activity on public blockchains, robust infrastructure with proper safeguards becomes essential. Explore our API marketplace to build on foundations designed for both performance and accountability.