Notifications
Clear all
Topic starter
12/07/2026 12:19 pm
TL;DR: The UK’s FCDO has designated Xinbi, a Chinese-language illicit guarantee marketplace that Chainalysis says processed more than $19.9 billion between 2021 and 2025, because it underpins scam centres, money laundering, compromised data sales, and payment rails for industrial-scale fraud. The case shows infrastructure disruption is now as important as arresting individual scammers.
NHIMG editorial — based on content published by Chainalysis covering the Xinbi designation and scam infrastructure: Xinbi sanctions and the escrow backbone of global scam networks
By the numbers:
- Our analysis indicates Xinbi processed over $19.9 billion between 2021 and 2025.
Questions worth separating out
Q: How should investigators disrupt scam marketplaces that broker trust and escrow?
A: Treat the marketplace as infrastructure, not as a single account or chat channel.
Q: Why do scam ecosystems keep recovering after takedowns?
A: They recover because the business model is portable.
Q: What do security teams get wrong about marketplace fraud controls?
A: They often treat fraud prevention as a separate function from identity governance.
Practitioner guidance
- Map the trust layer, not just the scam event Identify the marketplaces, escrow services, messaging channels, and OTC brokers that sit between scam operators and their victims.
- Track cash-out continuity across platforms Monitor whether disrupted services reappear on new apps, new channels, or proprietary payment rails while keeping the same wallet clusters and vendor relationships.
- Prioritise transaction tracing for disruption decisions Use cluster attribution and fund-flow mapping to identify aggregation points that connect multiple scam vendors, laundering services, and databases.
What's in the full report
Chainalysis's full analysis covers the operational detail this post intentionally leaves for the source:
- On-chain cluster mapping that links Xinbi to other guarantee marketplaces and laundering services
- The transaction-flow evidence behind the reported $19.9 billion processed volume
- The role of SafeW migration and XinbiPay in preserving operational continuity
- How the FCDO designation fits into broader sanctions and disruption strategy
👉 Read Chainalysis's analysis of Xinbi sanctions and scam infrastructure disruption →
Xinbi’s designation: what it means for scam infrastructure disruption?
Explore further
12/07/2026 12:33 pm
Xinbi shows that scam ecosystems now depend on trust infrastructure, not just fraud tactics. The marketplace does not simply host illicit activity, it brokers the commercial relationships that make mass fraud operationally scalable. That makes it closer to a governance layer than a storefront, which is why enforcement has to target the trust fabric as well as the individual actors. For practitioners, the lesson is that resilience and fraud success often depend on the same hidden intermediary.
A question worth separating out:
Q: Who is accountable when illicit marketplaces support large-scale scam operations?
A: Accountability usually spans sanctions authorities, financial intelligence teams, law enforcement, and platform operators that allow the infrastructure to persist. The key question is whether the enabling marketplace had enough visibility and controls to prevent it from becoming a repeatable abuse layer.
👉 Read our full editorial: Xinbi sanctions show why scam infrastructure now matters more than actors
