The US sanctions campaign against Xinbi Guarantee, the Chinese-language marketplace the Treasury Department estimates processed about $24 billion in digital assets and fiat, is producing measurable on-chain contagion — and not only on its target.
Blockchain analytics firm Bitrace tracked daily USDT withdrawals from a low-visibility Xinbi sub-guarantee platform running between roughly $389,000 and $564,000 from September 1 to 7. As enforcement pressure intensified, outflows jumped to about $1.28 million on September 8 and $1.81 million on September 9, with another $708,125 leaving by September 10. The firm attributed the surge to guarantee merchants moving funds rapidly to avoid being caught in subsequent freezes.
The Rival Reaction
The more striking signal comes from Xinbi's competition. Bitrace reported that Fulilai Guarantee, another major transaction-guarantee marketplace, began removing money-laundering merchants from its public groups after the Xinbi action — including operators advertising "card-to-USDT" and "cash car" conversion services. Fulilai's associated wallet has recorded about $9.3 million in outflows since the Treasury designation.
The behavior is rational: hosting laundering-linked merchants preserves transaction revenue but raises the risk that wallets, channels and affiliated companies become the next enforcement targets. The Treasury's designation of SafeW Technology and Anwen Technology — companies tied to the messaging and payment infrastructure Xinbi used — signaled that service providers, not just wallet addresses, are now in scope.
What Chainalysis Says Moved Through Xinbi
Chainalysis assessed that North Korea-linked threat actors moved tens of millions of dollars in stolen cryptocurrency through vendors operating on the platform. The firm's analysis describes specialist operators known as "Black U" launderers, who accept cryptocurrency traceable to hacks and return stablecoins sourced from separate illicit revenue streams such as pig-butchering proceeds — severing the direct on-chain link between the theft and the cash-out.
The marketplace's vendor channels also offered cash delivery, bank-card fraud, personal data sales, know-your-customer bypasses, scam-platform development, surveillance equipment and malware services, according to the firm. Chainalysis's attribution of specific flows to North Korea-linked actors is the firm's analytical assessment.
The Enforcement Baseline
The on-chain flight follows the coordinated action of September 9-10: the Treasury Department designated Xinbi a significant transnational criminal organization, a federal court authorized the seizure of the marketplace's Telegram channels, investigators seized two wallets holding about $12 million, and restraint was sought on 47 additional addresses tied to the laundering network. Approximately $52 million in cryptocurrency linked to the marketplace's laundering network was restrained in a single day, according to the DOJ.
Xinbi had already been adapting before the sanctions — shifting merchant coordination to the encrypted SafeW application around June 2025 and introducing its own payment rail as issuer-level USDT freezes demonstrated how centralized stablecoins could become an enforcement choke point.
The early on-chain evidence suggests the strategy's limit: moving to another token reduces exposure to a single issuer's freeze, but it does little against sanctions aimed at the counterparties and infrastructure that make the laundering market function.
TrustGrade covers the security and trust ecosystem around digital assets. For verified trust data on the platforms and firms shaping it, see trustgrade.ai.