crypto crime

Tether’s coordinated freezing of over $45 million in USDT linked to a sanctioned Southeast Asian scam marketplace has prompted a strategic shift toward decentralized stablecoins that resist token-level controls. The enforcement action demonstrates both the power and limits of centralized stablecoin infrastructure in combating illicit activity.

• Tether froze more than $45 million in USDT across at least 22 addresses linked to Xinbi Guarantee, a UK-sanctioned marketplace serving scam compounds.
• Xinbi activated replacement wallets within hours of the initial freeze, but those new addresses were frozen again within 12 hours on Sept. 8.
• Xinbi responded by shifting operations to USDD, a decentralized stablecoin that cannot be frozen at the token level, fundamentally changing the enforcement landscape.

• $45M USDT frozen across Xinbi-linked addresses compared to $29.6 million in prior Huione Group action
• 22 Operational addresses targeted, including deposit, routing, and withdrawal wallets
• $1.5B USDD circulation across Tron and Ethereum versus USDT market dominance
• $4B Total USDT blacklisted by Tether since enforcement program inception

Background on Xinbi Guarantee and Scam Operations

Xinbi Guarantee emerged as a significant financial hub for cybercriminal operations in Southeast Asia, particularly servicing fraud and extortion schemes that target victims across East and Southeast Asia. The marketplace functioned as both a money-laundering platform and operational support center for scam compounds, where organized criminal groups operate call centers and digital infrastructure to defraud victims through romance scams, investment fraud, and technical support scams.

The UK government sanctioned Xinbi in March 2024, recognizing its role in facilitating transnational organized crime and money laundering on a significant scale. Chinese authorities had previously targeted similar marketplaces, but Xinbi’s cryptocurrency-native operations allowed it to maintain functionality despite regulatory crackdowns in traditional banking sectors.

Coordinated Freezes Across Xinbi’s Payment Network

Tether intensified enforcement operations against Xinbi Guarantee on Sept. 9, executing a freeze that extended across the marketplace’s entire payment infrastructure rather than isolating specific asset caches. Blockchain analytics firm Bitrace documented that the action targeted deposit addresses, intermediary wallets, hot wallets operated by Xinbi’s payment service Xpay, and third-party accounts with close financial ties to the platform.

The breadth of Tether’s action distinguished it from previous enforcement campaigns. When Tether froze approximately $29.6 million linked to Huione Group in 2024, the operation concentrated on a single address while leaving other operational wallets intact. Xinbi’s freeze spread across the entire ecosystem used to receive deposits, route capital, and process withdrawals, designed to disrupt money movement rather than simply immobilize stored assets.

This systemic approach reflects evolving enforcement sophistication. Rather than targeting isolated criminal wallets, Tether and its compliance partners mapped Xinbi’s entire financial network, including connections to payment processors, money exchangers, and operational partners. This ecosystem-wide view allowed regulators to understand how illicit capital flows through cryptocurrency markets and where intervention points could achieve maximum disruption.

Xinbi responded by establishing new operational addresses, but the reprieve proved temporary. Newly activated wallets faced additional freezes on the evening of Sept. 8, less than 12 hours after the initial action. The rapid second freeze demonstrated coordination between Tether’s compliance team and blockchain monitoring services, creating near-real-time enforcement response capability.

The enforcement perimeter also caught third-party operators with financial connections to Xinbi. Bitrace identified an over-the-counter operation that had processed more than $72 million over the preceding year among those affected, alongside smaller counterparties whose Xinbi-routed deposits totaled less than $850,000. One replacement business address moved approximately 1.8 million USDT before facing restriction, leaving roughly 37,839 USDT stranded.

Xinbi’s Pivot to USDD as Tether-Proof Alternative

Facing rapid successive freezes, Xinbi abandoned efforts to rebuild USDT-based payment infrastructure and announced a switch to USDD transactions. The marketplace directed users to deposit only USDD and discontinued acceptance of Tether’s stablecoin, according to Bitrace reporting. USDD, a US dollar-denominated stablecoin with approximately $1.5 billion in circulation across Tron and Ethereum, explicitly markets itself as an overcollateralized decentralized token that cannot be frozen.

USDD’s architecture removes the central point of control that enabled Tether’s enforcement campaign. The token operates without a central issuer capable of blacklisting individual addresses, positioning itself as resistant to token-level restrictions. For Xinbi, this design principle transformed into a practical operational advantage as address-level restrictions proved effective against USDT wallets.

On-chain analysis by Bitrace detected Xinbi-related capital already moving through Tron’s JustLend protocol and jUSDT, alongside flows through decentralized exchanges and cross-chain infrastructure, suggesting preparation for the eventual USDD transition. This multi-stage migration strategy indicates Xinbi anticipated regulatory pressure and pre-positioned operations to minimize operational downtime during the transition.

Enforcement Strategy Shifts as Token-Level Control Becomes Unavailable

The migration to USDD fundamentally alters the enforcement contest. Tether blacklisted USDT addresses each time Xinbi activated new wallets, but cannot impose equivalent restrictions at the token level on USDD, which resists such controls by design. The crackdown must now target the operational infrastructure surrounding USDD rather than the stablecoin itself.

This shift reflects a broader tension in cryptocurrency regulation between centralized and decentralized systems. Centralized stablecoins like USDT offer enforcement agencies direct technological capabilities to freeze and track illicit activity, but criminals can migrate to decentralized alternatives that eliminate these points of control. This cat-and-mouse dynamic suggests that future enforcement will focus increasingly on service providers and operational infrastructure rather than token-level interventions.

That shift does not render Xinbi inaccessible to law enforcement. Converting, exchanging, and cashing out USDD still requires interaction with centralized exchanges, bridges, over-the-counter desks, and other services vulnerable to regulatory pressure. Tether’s enforcement operation has already demonstrated capacity across this ecosystem, having worked with more than 340 agencies in 65 countries and frozen more than $450 million in illicit assets by May through its T3 Financial Crime Unit partnership with Tron and TRM Labs.

The next phase of enforcement will test whether Xinbi can establish a functioning USDD payment network faster than investigators can pressure the centralized services and counterparties that make such a network economically viable. The contest now hinges on infrastructure vulnerability rather than token-level controls, with the outcome determining whether decentralized stablecoin properties provide genuine operational protection for illicit activity or merely shift enforcement tactics toward service providers.