US Seizes Telegram Marketplace With Over $24 Billion in Transactions
The Telegram marketplace Xinbi Guarantee has been seized by US authorities, which according to Treasury handled more than $24 billion in crypto and fiat transactions. But the seizure is just one event in a rapidly growing scam economy: money laundering, stolen data, KYC bypasses, malware, custom-built scam websites, and AI and deepfake software are all sold as goods and services — from bulk messaging for a dollar to exploitation tools at $500 a month — and operations are spreading from Southeast Asia to Nairobi, while victims, according to the Global Anti-Scam Alliance, lost $442 billion in a single year — more than some estimates of the world's cocaine trade.
The news: two moves in two days
The actions against Xinbi came in rapid succession in early September. A federal court in Washington authorized the seizure of the marketplace's Telegram channels on September 7, and prosecutors made the ruling public when the warrant was unsealed the following Wednesday, according to Crypto Potato. Two days later, on September 9, the Office of Foreign Assets Control (OFAC) sanctioned Xinbi along with the technology vendors SafeW Technology and Anwen Technology, according to Yahoo News/CCN.
US Attorney Jeanine Pirro announced that the Justice Department's Scam Center Strike Force, in cooperation with Treasury, seized the marketplace and restrained roughly $52 million in cryptocurrency in a single day. The same operation brought the total restrained by the Strike Force since its creation to around $938 million. Investigators seized two wallets worth approximately $12 million and sought to restrain 47 more tied to the network, according to the unsealed warrant as reproduced by Crypto Potato.
Both sets of actions — the September 7 seizure and the September 9 sanctions — are known through secondary reporting, not directly from primary documents. The transaction-volume figures also diverge: according to the US Treasury, the platform processed more than $24 billion in crypto and fiat transactions, while Chainalysis, as reported by Crypto Potato, estimates nearly $20 billion for the period 2021–2025. The discrepancy cannot be reconciled with the available source material — both figures are reported here with attribution.
How the marketplace worked
Xinbi Guarantee was a Chinese-language marketplace where sellers ran hundreds of Telegram channels with an offering that resembles ordinary e-commerce: money laundering, stolen data, KYC bypasses, malware, and custom-built scam websites, according to the Treasury account carried by Yahoo/CCN.
Before the takedown, the analytics firm Chainalysis had mapped parts of the supply chain on the blockchain. One prospective buyer paid $834 to a data vendor, another sent $9,150 to a seller of AI and deepfake software, and a separate AI vendor was linked to a payment of $200, according to Bloomberg. The sums are small — and that is the point: the entry price for professional scam infrastructure sits at a level where virtually anyone can take part.
The buyers were not only small-scale fraudsters. Chainalysis linked the activity to funds stolen in major hacking attacks, including the $1.5 billion Bybit breach and the $235 million WazirX hack. According to Chainalysis, North Korean actors used launderers known as "Black U" vendors to clean stolen crypto through asset substitution: traceable stolen crypto was swapped for stablecoins originating from other criminal flows, breaking the trail.
Scams as a subscription service
Xinbi is only one player in a market where the tools are cheaper and more accessible than ever. Security researchers Bloomberg spoke with have found subscription-based exploitation tools for as little as $500 a month, while bulk-messaging services can send material to 10,000 email addresses for one dollar. Basic phishing services are available, according to Bloomberg, for under $100.
AI is lowering the bar further. Stacey Higginbotham, a cybersecurity fellow at the consumer organization Consumer Reports, told CBS News that roughly one in five scam operations now includes some form of tailoring to the recipient — a share she expects to grow rapidly. It is worth being precise here: the sources document AI and deepfake software sold as goods on marketplaces and a growing share of customized scam attempts, not AI autonomously running the fraud.
The geography is shifting: the Nairobi raid
In early July, Kenyan police carried out a raid that shows how operations are moving. Not in the fortified compounds of Southeast Asia, but thousands of kilometers away: on the 18th floor of a modern apartment building in Nairobi. The suspects are alleged to have run a fake investment scheme targeting accounts in China, Hong Kong and Malaysia, and laundered millions of shillings through Kenyan banks, according to police investigators who spoke to Bloomberg on condition of anonymity to discuss an ongoing case. Nearly 20 Chinese nationals were arrested.
These are allegations from anonymous investigators in an active case that has not been tested in court — but they are consistent with Bloomberg's central thesis: operations are spreading beyond Asia's fortified compounds, becoming cheaper and easier to run, and harder to shut down.
The victims' side: numbers that are likely too low
The picture on the victims' side points in the same direction. The Global Anti-Scam Alliance estimates that victims lost $442 billion across 42 countries last year — above some estimates of the global cocaine trade. That is a third-party estimate based on reported victims, and the comparison should be read as an indication of scale, not as an established fact.
In the US, federal data cited in Wednesday's announcement put reported losses from crypto investment fraud at $8.65 billion in 2025, up 89 percent from $4.57 billion in 2023. The FBI notes at the same time that the figures are "significantly under-reported," since most victims never come forward.
A survey by Consumer Reports, Aspen Digital and Global Cyber Alliance, conducted among nearly 5,000 US adults in March and April, found that 90 percent had encountered a digital scam or cyberattack, and that 17 percent said they had lost money as a result of a digital security breach.
What the actions solve — and what they don't
"If Chinese organized crime can buy a tailored website and a laundering service the way you order takeout, then every American with a retirement account is within blast radius," US Attorney Jeanine Pirro said shortly after the actions against Xinbi, according to Bloomberg.
The statement captures the challenge well: the tools are cheap, replicable and distributed. A seizure can take down one marketplace, but not the model. The Strike Force is betting on following operations where they move — a dedicated team assisted Malagasy authorities in a two-week deployment, helping process more than 3,200 devices and interview around 400 arrested people after the takedown of 13 Chinese-run scam compounds, according to US Attorney Michael Heyman of Alaska, as reported by Crypto Potato.
The open question is whether this kind of investigation can keep pace with tools that cost hundreds — not millions — of dollars, and with marketplaces that can reappear under new names on new channels. The figures from Treasury, Chainalysis, GASA and the FBI all point in the same direction: losses are growing faster than seizures.