Shadow marketplace inside Telegram: channels seized, $52.8m frozen

On 9 September the US Treasury put Xinbi Guarantee on its sanctions list, the Justice Department moved against 52 million dollars in stablecoin, and a district court authorised something less familiar: the seizure of the Telegram channels the marketplace ran on. The money is the headline. The channels are the precedent.

What Xinbi actually was

Calling it a marketplace undersells the mechanics. Xinbi worked as an escrow: vendors posted a crypto deposit so that buyers could trust the deal, and the platform took its cut. What passed through it was the raw material of online fraud. Personal data for picking targets, communications infrastructure for running scams at scale, and laundering services for turning stolen money back into clean funds. Blockchain analytics firm Elliptic, whose intelligence enabled the freeze, counts more than 4,600 vendors on the platform and calls it the second-largest illicit online marketplace ever tracked.

The clientele went well beyond romance scammers. Chainalysis traced North Korean actors moving tens of millions through Xinbi's vendor network, including money stolen in the $1.5 billion Bybit breach and the $235 million WazirX theft. The service they used has a name of its own: Black U launderers take visibly stolen coins and swap them for stablecoins of a different dirty origin, so the customer ends up with assets clean enough to cash out.

Only one operation has ever moved more: Huione Guarantee, which processed $31 billion over four years before Telegram closed it in May 2025. That closure came after years of public exposure, and it was Telegram's decision. This time the decision was made by a court.

The part that matters: a channel is now seizable property

Blocking a channel is routine. A platform does it every day, on its own terms, under its own rules, and it can change its mind tomorrow. A judicial seizure is a different instrument. It treats the channel as an asset with an owner, subject to forfeiture like a bank account or a warehouse, and it puts the platform under an order rather than a request. What that looked like in practice is a channel going dark and its usernames going cold, not a US seal posted over the page the way it happens with a seized domain. The instrument is what changed, not the visible result.

That is the line that moved this week. Telegram has spent years arguing about what it will and will not remove, from a lawsuit in Australia over content it left up to automated scanners hunting pirate channels. Those are arguments about moderation. Seizure is not a moderation question. It says the state can reach an address inside a messenger the same way it reaches a domain name, and the messenger's opinion is not the deciding factor.

The second lever: a stablecoin you do not fully own

The freeze worked because Tether can freeze. USDT is issued by a company, that company keeps a blacklist, and an address on it stops being able to move tokens. It is not a court forcing a bank to hold funds. It is a private issuer flipping a flag, and it works within minutes.

Xinbi's administrators understood exactly what happened and announced a migration to USDD, complaining publicly that Tether had frozen addresses arbitrarily. Elliptic tracked roughly $2.8 million converted out of USDT after the freeze. The complaint is worth noticing even coming from this source, because the mechanism it describes is real and applies to everyone holding the same token. If your money lives in a stablecoin, someone can switch it off, and no amount of self-custody changes that.

The third lever: a messenger on the sanctions list

Alongside the marketplace, OFAC designated two application developers. Anwen Technology of Cambodia built XinbiPay, also marketed as NewPay, the wallet the vendor network used. SafeW Technology of Singapore builds SafeW, which Treasury describes as a highly private, end-to-end encryption messaging application. Around June 2025 Xinbi had begun moving its merchants and its laundering network onto it.

The reason given is narrow. Both firms were listed for supplying services and technology to Xinbi Guarantee, not for the fact that one of them encrypts messages.

That distinction is worth defending, because the short version of this story will be that an encrypted messenger got sanctioned. What happened is that a particular company was found to be servicing a particular criminal operation. The consequences are heavy all the same: anything the company owns in the United States is frozen, and Americans cannot do business with it without a licence from Treasury.

Why the pattern is worth following

The DOJ's Scam Center Strike Force says it has taken $938 million since it launched in November 2025. The industry it targets is the pig butchering economy, in which victims are groomed over months and drained through fake investment platforms, and it depends on exactly the services Xinbi sold. The strategy on display is to attack the supply chain rather than individual scammers: the escrow, the wallet, the data broker, the channel.

For anyone watching how states operate inside messengers, that strategy is the story. Russia has gone after Telegram through its founder, putting Durov on a terrorist list and freezing his accounts. Telegram itself has been trying to move further out of anyone's reach, including an application to ICANN for its own domain zone. Britain's Foreign Office had already sanctioned Xinbi back in March 2026, so this was a coordinated squeeze rather than a lone American move. Washington has now demonstrated the quieter and more effective route. It does not need the company, the founder or the servers. It needs a court order and an issuer's blacklist.