The U.S. Department of the Treasury recently marked a turning point in the fight against cybercrime by targeting Xinbi Guarantee, a black-market platform operating primarily via the Telegram messaging app. The entity is suspected of facilitating illicit activities totaling more than $36 billion since 2022. Labeled a transnational criminal organization by the OFAC, the outfit functioned as a veritable logistics hub for organized crime, offering services ranging from money laundering and the sale of stolen data to sophisticated deepfake tools.
The operation, conducted in collaboration with the Secret Service, resulted in the freezing of approximately $52.8 million in digital assets. While this figure illustrates the operational effectiveness of law enforcement, it represents only a tiny fraction of the colossal volumes that have flowed through the platform. On this occasion, the Department of Justice publicly commended the cooperation of Tether, highlighting the critical role stablecoin issuers play in monitoring financial flows. This unprecedented alliance between state authorities and private crypto actors is now becoming the standard for international investigations.
However, the Xinbi case reveals a major structural flaw: the ability of criminal networks to pivot instantly to less regulated infrastructure. In response to the sanctions, some funds were transferred to USDD, a stablecoin operating on the Tron blockchain that lacks the same automatic blocking mechanisms as USDT. This transfer underscores the avoidance strategy of illicit actors, who systematically favor protocols without "circuit breakers" to protect their assets from regulatory pressure.
Beyond the dismantling of Xinbi, the stakes extend far beyond this single case. Despite the $938 million seized by the Scam Center Strike Force since late 2025, the threat remains endemic. With every platform shutdown, new subcontractors and intermediaries emerge rapidly, making the fight against these black markets extremely complex. The challenge for global regulators no longer lies solely in one-off sanctions, but in the need to neutralize the technical building blocks—uncooperative stablecoins, hosting providers, and payment networks—that allow criminal ecosystems to continuously regenerate.