Americans have learned to recognize the fake investment pitch, the stranger promising easy cryptocurrency profits, and the frantic message demanding money before some invented disaster strikes.
What most people never see is the machinery behind those scams. Federal investigators just pulled back the curtain on an operation that moved more than $24 billion.
From the Treasury Department:
Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Transnational Criminal Organization (TCO) Xinbi Guarantee, a Chinese-language platform used extensively by Chinese cybercriminals that operates a large illicit online marketplace used to support cyber scams, fraud, money laundering, and other criminal activity targeting Americans. OFAC also designated two entities that support Xinbi Guarantee’s core operations via the provision of digital currency and other financial services. This action is being taken in coordination with the Department of Justice’s Scam Center Strike Force (SCSF), which today seized infrastructure and digital asset wallets used by Xinbi Guarantee.
“Scam centers in Southeast Asia steal billions of dollars from American victims each year,” said Secretary of the Treasury Scott Bessent. “The Trump Administration is united in its efforts to dismantle these overseas criminal enterprises, and Treasury will continue using its tools to disrupt the networks behind this egregious fraud and protect Americans.”
These actions are being taken in furtherance of President Trump’s Executive Order (E.O.) 14390 of March 6, 2026, “Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens,” which orders the U.S. Government to unleash every available tool to stop foreign-backed criminal networks that exploit vulnerable Americans through cybercrime, cyber-enabled fraud, and extortion. Today’s action further reflects OFAC’s coordination with the Homeland Security Task Force and National Coordination Center.
Today’s designations build on OFAC’s designations of the Prince Group Transnational Criminal Organization (Prince Group TCO) and persons related to the Prince Group TCO in October 2025 and June 23, 2026, and Treasury’s Financial Crimes Enforcement Network (FinCEN)’s October 2025 Huione Group section 311 final rule and subsequent June 2026 proposed amendment. Specifically, this action aims to build on efforts by Treasury to identify illicit marketplaces and highlight the risks they pose through their money laundering activities.
Additionally, this action highlights close cooperation between the United States and the United Kingdom to counter scam operations. OFAC’s actions today complement the United Kingdom’s Foreign, Commonwealth, and Development Office’s (FCDO) March 26, 2026 sanctions action against Xinbi.
Treasury sanctioned Xinbi Guarantee Wednesday, describing it as a Chinese-language illicit marketplace used extensively by Chinese cybercriminals. Since roughly 2022, Xinbi has promised more than $24 billion in digital assets and conventional currency while connecting scam operators with money launderers, technology providers, and other criminal services.
The Justice Department went further. A federal seizure warrant alleges Xinbi operated through Telegram, where vendors offered custom fake investment websites, laundering services, and even help recruiting trafficking victims to work inside Southeast Asia scam compounds.
From the DOJ:
As alleged in a seizure warrant unsealed today, Xinbi is a Chinese-language illicit marketplace, run on Telegram, where vendors market their services to scam center operators. The Telegram channel operated primarily in Chinese, and the vendors post their available services on the Telegram channel, to include creating custom scam investment websites, laundering or “washing” money that scammers obtain from victims of wire fraud, and soliciting trafficking victims to work in scam compounds in Southeast Asia.
Once a scammer “purchases” a service from the vendor, Xinbi as an organization holds money to be paid to the vendor until the vendors services are complete, to assure the scammers that the vendors will perform the services. The seizure warrant alleged numerous instances where U.S. victims funds were traced to specific vendors who advertised their money laundering services on the Telegram channel, and posted cryptocurrency wallets for payment on Telegram.
On September 7, 2026, the U.S. District Court for the District of Columbia authorized seizure of the Telegram channels hosting this marketplace.
Xinbi allegedly provided escrow services so criminals buying criminal services could be confident the other criminals would deliver. Organized crime apparently worries about customer satisfaction too.
A federal court authorized seizure of Xinbi's Telegram channels on Sept. 7. Treasury simultaneously sanctioned Xinbi and two companies supporting its operations. Federal authorities restrained about $52 million in cryptocurrency in one day, bringing the Scam Center Strike Force's total restrained funds to roughly $938 million. Restrained money isn't automatically money returned to victims, but stopping criminals from moving it is a pretty useful first step.
The scale becomes darker once human trafficking enters the picture. A Strike Force team spent two weeks in Madagascar assisting local authorities with the takedown of 13 scam centers operated by Chinese organized crime syndicates.
Authorities arrested nearly 400 people, while investigators helped process more than 3,200 electronic devices. About 30 alleged Chinese leaders of the compounds were later repatriated to China.
These operations aren't just stealing pocket change from careless people. The FBI recorded nearly $21 billion in reported cyber-enabled fraud losses during 2025.
From the FBI:
The FBI’s 2025 Internet Crime Report shows cyber-enabled crimes defrauded Americans of nearly $21 billion, with cryptocurrency and artificial intelligence-related complaints among the costliest.
The Internet Crime Complaint Center (IC3) received 1,008,597 total complaints, an increase from 859,532 in 2024. Phishing/spoofing, extortion, and investment schemes were the most frequently reported complaints. Americans over 60 reported approximately $7.7 billion in losses, up 37% from 2024.
The IC3 received approximately 453,000 cyber-enabled fraud complaints, with reported losses exceeding $17.7 billion. Investment fraud remains the primary driver, accounting for nearly 49% of all scam-related losses.
Americans who submitted complaints involving cryptocurrency reported the highest losses, with 181,565 complaints totaling more than $11 billion. In 2024, the FBI launched Operation Level Up, a proactive initiative to identify and notify people who are currently falling victim to cryptocurrency investment fraud. Since its inception, the initiative has surpassed 8,000 total victims notified and reduced losses by more than $500 million. In 2026, the FBI launched Operation Winter SHIELD, highlighting concrete steps organizations can take to bolster their digital security.
Costly tactics used by scammers also include compromised corporate e-mails, tech support fraud, and personal data breaches. For the first time in its nearly 25-year history, the IC3 report features a section on artificial intelligence, which accounts for 22,364 complaints, costing Americans nearly $893 million. Scammers rely on pressure techniques to defraud Americans while deploying fake social profiles, voice clones, identification documents, and believable videos depicting public figures or loved ones.
The FBI urges everyone to “Take a Beat” to identify the red flags of a potential scam. Resist pressure to act quickly and assess the situation before turning over money or personal information.
IC3 receives nearly 3,000 complaints per day. If you believe you or someone you know may have been a victim of a fraud or scam, contact your local FBI office or submit a complaint at ic3.gov as soon as possible. You should document the name of the scammer/company, methods of contact, dates of contact, methods of payment, where funds have been sent, and a thorough description of the interactions.
Americans over 60 reported about $7.7 billion in losses, while cryptocurrency investment fraud alone produced more than $7.2 billion in reported losses.
President Donald Trump ordered the federal government in March to treat foreign cybercrime, scam centers, fraud, extortion, forced labor, and human trafficking as a coordinated transnational threat. His order called for prosecutions, sanctions, international pressure, stronger cooperation among agencies, and a plan for returning recovered money to victims.
Wednesday's operation shows what such a policy looks like when it leaves Washington paperwork behind. Sanction the marketplace, seize its infrastructure, freeze the money, follow the network overseas, and help foreign authorities tear apart the compounds producing the fraud.
There's no evidence in these announcements tying Xinbi's operation directly to the Chinese government, and there's no need to pretend otherwise. Chinese organized crime on this scale is bad enough.
For years, Americans have been told to protect themselves by spotting suspicious texts and avoiding strange links.
Good advice, but the people stealing billions aren't merely sitting behind laptops hoping Grandma clicks the wrong button. They've built an international industry.
Now the United States is finally treating it like one.
The scams hitting American families aren't small-time crimes anymore. They're international businesses built to strip away savings accumulated over a lifetime. Join PJ Media VIP and help us keep digging into the networks behind the headlines. Save 60% with promo code FIGHT.
Join the conversation as a VIP Member