Treasury Sanctions Scam Marketplace Amid Stablecoin Shift

The action pairs an enforcement designation against a marketplace Treasury accuses of laundering the proceeds of online scams with a reported attempt to swap out its primary settlement asset, a sequence that echoes Washington’s widening campaign against Xinbi Guarantee and other Southeast Asia-linked cybercrime hubs. The designation targets named entities; it is not a ban on Tether or on any rival stablecoin. For related coverage, see Lubin to Run MetaMask as Consensys Moves Protocol Work.

Who Treasury targeted and what the sanctions cover

Treasury’s Office of Foreign Assets Control designated Xinbi Guarantee as a significant transnational criminal organization, and named Singapore-based SafeW Technology Co., Ltd. and Cambodia-based Anwen Technology Co., Ltd. for supporting it, according to the Treasury announcement. The accompanying OFAC SDN update lists all three entities under the TCO program and identifies TRX digital-currency addresses tied to Xinbi.

The department says Xinbi processed the equivalent of over $24 billion in digital assets and fiat currency since its inception around 2022, a figure it frames as cumulative marketplace throughput rather than a measured victim-loss total or market valuation. For related coverage, see New Wall Street Crypto Fund Includes Staking.

The designation authority is Executive Order 13581, as amended by Executive Order 13863, with Treasury separately describing the action as furthering Executive Order 14390 of March 6, 2026. That distinction matters: E.O. 14390 is policy context, while E.O. 13581 is the operative designation authority, a legal nuance most coverage has glossed over.

The blocking measures reach designated persons’ property in the United States or in U.S. persons’ possession or control, plus any entity owned directly or indirectly, individually or in aggregate, 50 percent or more by blocked persons. A sanctions designation is distinct from criminal charges.

The designation did not arrive alone. Treasury says the Justice Department’s Scam Center Strike Force seized Xinbi infrastructure and digital-asset wallets in coordination with the September 9 action, though the announcement does not specify the seized wallet amounts. The U.S. move also complements United Kingdom sanctions against Xinbi dated March 26, 2026.

The marketplace’s reported shift from Tether to USDD

The most distinctive thread running through the story is a payment migration. Unchained, attributing the account to blockchain analytics firm Elliptic, reported that Xinbi administrators told users they were moving from Tether’s USDT to the Tron-based stablecoin USDD after condemning Tether’s freezing of addresses. That verifies the existence of the report, not a completed token migration.

What the evidence supports is an announced intent, not a measured on-chain replacement. No transaction-level data establishing the amount or completion of the switch was obtained, so the change is best read as a stated plan rather than a finished migration.

Elliptic, as attributed by Unchained, reported that Xinbi announced the move to USDD after objecting to Tether’s freeze actions. That reporting, citing The Record and Elliptic, described 52 wallets holding $52.8 million in Tether frozen on September 8 and two wallets holding about $12 million seized by DOJ, figures that remain single-sourced and were not confirmed against an original warrant or analytics report.

A claim that USDD lacks a comparable freeze switch, and is therefore harder to freeze than USDT, also traces to that same reporting and remains unverified. The relevant deployed USDD contract and its administrative controls were not independently inspected, and no token’s design confers immunity from sanctions or seizure.

Timing and motive should not be conflated. The reported migration and the September 9 designation sit close together, but the available evidence does not establish that the sanctions caused the payment change, nor that the swap alters the blocked status of the named entities.

What to watch in the sanctions response

The near-term questions concern reach rather than optics. An announced switch to a different stablecoin does not lift OFAC’s blocking of Xinbi, SafeW or Anwen, and the 50-percent ownership rule extends those restrictions to entities the designated parties control. Treasury also traced the network’s lineage, saying cybercriminals migrated activity from Huione Pay to Xinbi after FinCEN action, carrying over substantially similar services and an overlapping customer base.

Treasury further says Xinbi began moving merchant and money-laundering networks to SafeW around June 2025 and launched XinbiPay, also called the NewPay wallet, developed by Anwen, which suggests the payment reshuffle predates this month’s designation. That history frames the USDD reports as one more step in an ongoing effort to keep settlement rails running under pressure.

The backdrop remains a placid stablecoin market: USDT traded at $0.9997 with a market capitalization near $183 billion, showing no visible stress from the action. Tron’s regulated profile has been rising on other fronts too, from the debut of a U.S. staked Tron ETF to broader institutional stablecoin experiments like bank-led cross-border payment tests, a reminder that the same networks illicit actors probe are also where compliant finance is building.

The open items are concrete: whether Tether and the USDD issuer respond, whether DOJ discloses the seized wallet totals, and whether on-chain data eventually confirms a real migration rather than an announcement. Until then, the effectiveness of the sanctions is a question the payment change alone cannot answer.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.