On September 8, 2026, Tether, the issuer of the U.S. dollar-pegged stablecoin USDT, froze 50 blockchain addresses in a single action. The targets included 21 operational addresses belonging to Xinbi Guarantee, a major illicit cryptocurrency transaction guarantee platform in Southeast Asia. The total value reached $45 million, prompting significant concern across the industry. 

This article outlines the scale and scope of the freezes and, based on investigative experience, identifies potential secondary risks involving tainted funds.

What Is Xinbi Guarantee?

Xinbi Guarantee is an illicit cryptocurrency transaction guarantee platform serving Southeast Asia's gray and black markets. It is not a legitimate financial institution.

The platform primarily operates public groups on messaging services such as Telegram, bringing together merchants engaged in activities including money laundering, illegal foreign exchange, bank-card-to-USDT conversion, phishing, and technical support for scams. The platform uses its brand reputation and traffic to attract customers for merchants, while providing admission controls, security-deposit custody, transaction reporting, settlement, and dispute arbitration services in exchange for fees. After the collapse of the Huione/Tudou Guarantee ecosystem, Xinbi Guarantee absorbed substantial transaction demand and became the dominant platform in the local market.

Put simply, Xinbi Guarantee is an underground trading and credit intermediary that connects gray- and black-market service providers, criminal operators, crypto payment services, and money-laundering channels. It serves as an aggregation point for various merchants, but does not necessarily exercise direct control over all underlying criminal activity conducted within its public groups.

Because it receives large volumes of illicit funds, the entity has remained under scrutiny from law enforcement agencies worldwide. It was sanctioned by the U.K. Foreign, Commonwealth & Development Office in March 2026, setting the stage for the address freezes on September 8.

Details of the Xinbi Guarantee Freezes

According to Bitrace's investigation, the principal targets of this freezing action were Xinbi Guarantee's recently used operational addresses, including deposit, intermediary, and withdrawal addresses; the outgoing hot-wallet addresses of Xpay, an illicit payment service operated by Xinbi Guarantee; and addresses belonging to certain third-party illicit entities with close financial ties to Xinbi Guarantee.

The addresses definitively attributed to Xinbi Group are listed below:

At least 22 operational addresses belonging to Xinbi Group, holding more than $45 million, were targeted on-chain.

Increasingly Aggressive On-Chain Enforcement

Since 2025, both Tether and Circle have intensified their cooperation with law enforcement, driving sharp increases in both the number and value of on-chain stablecoin freezes.

In 2025, a record 4,059 addresses were frozen, exceeding the combined total of 3,199 over the previous four years. The figure included 653 Ethereum addresses and 3,406 Tron addresses, nearly all of the latter frozen by Tether.

The corresponding amounts frozen were $1.1 billion in USDT and $23 million in USDC, respectively.

The freezes targeting Xinbi Guarantee also differed from the earlier action against Huione Group. In July 2024, Huione Group had 29.62 million USDT frozen because its payment service, Huione Pay, received stolen funds linked to the North Korean hacking group Lazarus Group. Only one address was frozen, while other related operational addresses were unaffected.

By contrast, the on-chain enforcement action on September 8, 2026, clearly targeted Xinbi Guarantee itself. First, operational addresses recently holding business funds were frozen. Next, withdrawal hot wallets belonging to its payment service were frozen. Finally, some addresses belonging to partner merchants were frozen. This represents a fundamental difference.

Beware of Contamination From Funds Exposed to Freezing Risk

During this freezing action, the operational addresses of numerous third-party entities unaffiliated with Xinbi Group were also restricted. One OTC address is: TTmvr41Fa9LeWJQ8NKQ5t4wFUspgEA1mJF

According to Bitrace intelligence, the entity is an illicit cryptocurrency trading service provider known as Hengtong Group, commonly referred to as a money-laundering crew. In the year before the freeze, the entity had laundered more than $72 million worth of USDT, of which between $32 million and $68 million flowed through Xinbi Guarantee.

Another OTC service provider's operational address was also frozen because it had recently conducted business on the Xinbi Guarantee platform, even though its total deposits did not exceed $850,000.

This indicates that the unidentified law enforcement authority behind the incident adopted a notably aggressive strategy, freezing all of Xinbi Guarantee's operational addresses even at the risk of collateral impact.

On-Chain Enforcement Is Continuing

As of September 9, 2026, the unidentified law enforcement authority's on-chain enforcement activity was continuing. After Xinbi Guarantee's addresses were frozen on September 8, replacement operational addresses that it activated temporarily were also frozen that evening, less than 12 hours later.

This window would not ordinarily be sufficient for law enforcement authorities to successfully obtain an Account Freezing Order (AFO) or Restraint Order. This suggests that Tether likely bypassed standard law enforcement procedures and independently froze suspicious on-chain addresses.

Centralized cryptocurrency exchanges, payment services, and OTC service providers should immediately review customer addresses and segregate funds originating from addresses linked to Xinbi Guarantee, in order to prevent their own operational addresses from being frozen or their companies from becoming subject to judicial investigations.

Contact us:

Website: www.bitrace.io

Email: bd@bitrace.io

Twitter: @Bitrace_team

LinkedIn：@bitrace tech