Xinbi Guarantee Sanctioned: The Legal Status of $49 Million in USDT and U.S.-China Enforcement Pathways
On Sept. 8, 2026, Tether, the stablecoin issuer, blacklisted an on-chain business address belonging to Xinbi Guarantee, then Southeast Asia’s largest illicit crypto trading escrow platform, freezing more than $49 million in Tether (USDT). The next day, the U.S. Treasury Department and the Department of Justice jointly announced that they had designated Xinbi Guarantee a transnational criminal organization and imposed sanctions on it. Telegram and The Open Network (TON) blockchain network also moved to block it. Many of Xinbi Guarantee’s groups and TNS became inaccessible and have not been restored to date.
The developments have sent shock waves through organized criminal networks in East and Southeast Asia. Some illicit-market merchants have moved to other platforms, some have exited the market, and many others have sought to “defend their rights” through various channels in an effort to recover their frozen deposits. This has put a major question before all involved: What is the legal status of the tens of millions of dollars in crypto assets frozen from Xinbi Guarantee, and where will they go?
This article was co-authored by Bitrace, a blockchain regulatory technology company, and prominent crypto lawyer Jin Jianzhi. It introduces the escrow platform’s business model, distinguishes the nature of deposits made by merchants, and explains the legal risks Xinbi Guarantee faces under the legal frameworks of China and the United States.
I. The Nature of Crypto Escrow Platforms
Crypto escrow platforms are not legitimate financial institutions. They are underground credit and trading infrastructure serving illicit markets. They typically use cryptocurrencies such as USDT for settlement and set up trading groups on messaging platforms such as Telegram. They provide matching, deposit custody, trade registration, settlement and dispute arbitration for parties that lack mutual trust, and earn revenue from commissions, group rentals, deposits and other service fees. Such platforms have three core attributes:
1. Underground Credit Intermediary
Participants in illicit-market transactions conceal their identities, operate across borders and typically lack contracts that can be enforced through legal channels. Escrow platforms use their brands, deposit requirements and arbitration mechanisms to provide an alternative form of credit assurance to both sides.
2. Aggregator of Illicit-Market Merchants
Platforms establish numerous groups that bring together merchants supplying scam-tool development, online gambling, illegal currency exchange, money laundering, cash-out services, conversion of bank-card funds into USDT, phishing, servers and domain names. This enables buyers and sellers who would otherwise be scattered to find counterparties in one place.
3. Underground Market Infrastructure
Platforms combine messaging groups, merchant traffic, credit guarantees and crypto payments, connecting upstream technology and resource suppliers, midstream criminal operators, and downstream payment, money-laundering and cash-out channels. Notably, a platform is typically an aggregator of merchants and a credit intermediary; it does not necessarily control all underlying criminal activity in its public groups.
II. The Main Functions of Crypto Escrow Platforms
Escrow platforms generally perform the following functions:
- Identity and access management: Registering and screening merchants, or imposing deposit requirements on them;
- Supply-and-demand matching: Using groups to display different types of underground goods and services;
- Credit rental: Allowing merchants to use the platform’s reputation to reduce distrust between unfamiliar counterparties;
- Fund custody: Temporarily holding USDT deposited by one or both parties before a transaction is completed;
- Trade registration: Recording the parties, amount and terms to support subsequent settlement and dispute resolution;
- Settlement and disbursement: Releasing escrowed funds to the recipient after confirming completion of the transaction, less commission;
- Dispute arbitration: Resolving breaches or disputes under the platform’s internal rules;
- Traffic acquisition: Using the platform’s existing users, groups and brand to bring merchants customers;
- Connecting payment and money-laundering channels: Aggregating cash-out, over-the-counter exchange, crypto payment and fund-laundering services so that illicit proceeds can be received, transferred, exchanged and converted to cash.
III. Differences Between Private and Public Groups
Private Groups and Public Groups are the two main venues for escrow transactions. A Private Group is a small, closed group used to escrow a specific transaction. A Public Group is a larger, open group where merchants initiate transactions themselves.
In a Private Group transaction, the platform provides custody for a specific deal: One or both parties deposit USDT equivalent to the transaction amount with the platform in advance. Once the transaction is complete, the platform returns the deposit or releases the funds to the recipient, less commission.
Under the Public Group model, a service provider first pays a larger deposit, then rents a platform group by the month and serves multiple customers on an ongoing basis through advance trade registration. The platform not only provides escrow, but also rents its brand credibility, business space and user traffic to merchants. A Public Group is therefore more like a long-term “underground storefront” operating under the escrow platform, while a Private Group is closer to a temporary custody and arbitration venue set up for a single transaction.
IV. What Is the Legal Status of the USDT Deposits Collected by Xinbi?
Based on the illicit escrow business model described above, Xinbi Guarantee was not a platform through which scam proceeds flowed. The USDT Xinbi locked up in this process was a deposit from money-laundering transaction participants, separate from the scam proceeds. Understanding this is the starting point for analyzing all the legal issues that follow.
From a legal and functional standpoint, this USDT was a performance deposit, not transaction consideration—and certainly not proceeds of fraud.
It addressed the trust gap between the parties to a money-laundering transaction. Scam groups and the parties handling their funds do not trust one another: One side fears the other will fail to perform after receiving the victims’ funds, while the other needs assurance that the transaction will settle as agreed. The parties therefore lock up a specified amount of USDT with Xinbi in advance. The platform decides whether to return, deduct or continue holding the deposit based on whether the parties have fulfilled their agreed obligations.
This is similar to traditional third-party escrow, except that conventional escrow often holds the purchase price, while this arrangement holds a performance guarantee separate from the transaction price.
This applies to both Public Group and Private Group transactions.
In a Public Group, the money launderer posts a deposit first and then takes orders at random. In a Private Group, the money launderer has already agreed with a specific scam group to handle a particular sum and posts the deposit before the victim pays. The deposits do not differ in substance in terms of their source or civil-law function: Both are pre-existing USDT posted to guarantee performance. Neither is the dollars stolen from victims nor USDT directly converted from those dollars.
The real difference lies in the strength of the evidentiary link.
In a Private Group transaction, if a complete chain of evidence shows that “a victim is about to pay $1 million; the money launderer locks up a corresponding deposit in advance for that $1 million; the victim pays; the funds are converted; and the deposit is released,” authorities can more readily link that deposit to a specific crime. In random Public Group transactions, this one-to-one correspondence is generally weaker. The distinction is particularly important under U.S. law, because the U.S. civil forfeiture regime expressly requires authorities claiming that property was used to commit or facilitate a crime to prove a substantial connection between the property and the crime.
V. Under Chinese Law, Xinbi’s Risk Turns on Whether It Knew What It Was Helping
A 2025 judicial interpretation issued by China’s Supreme People’s Court and Supreme People’s Procuratorate on the crime of concealing or disguising criminal proceeds expressly provides that “other methods” under Article 312 of the Criminal Law are broad in scope. They include brokering the purchase or sale of property, providing accounts, converting property, transferring funds through payment and settlement methods, and transferring assets across borders. Whether a person had “knowledge” is not determined solely by whether the person admitted it verbally; authorities assess factors including the abnormality of transactions, how funds moved, the person’s occupation and background, and the person’s relationship with upstream offenders.
A typical case published by the Supreme People’s Court in 2025 involved a strikingly similar structure: The defendant first purchased virtual currency as a “deposit,” then provided a bank card to receive scam proceeds, withdrew the funds, purchased virtual currency and delivered it to an upstream contact. The defendant was ultimately convicted of concealing or disguising criminal proceeds.
That does not mean that providing deposit services automatically makes Xinbi guilty of a crime.
If Xinbi merely provided a set of general escrow rules, did not handle scam proceeds, did not know the nature of specific underlying transactions and could not distinguish between so-called Public Groups and Private Groups, the fact that criminals used its services would not, by itself, establish the platform’s criminal “knowledge.”
Conversely, if transactions repeatedly displayed highly abnormal characteristics—for example, amounts, frequency, counterparties and fund freezes consistently indicated typical telecom-fraud money laundering—and the platform continued to tailor its guarantee, settlement and dispute-resolution mechanisms for those transactions after receiving explicit risk information or even notice from law enforcement, the risk that it “knew or should have known” would rise significantly. The Supreme People’s Court’s 2025 gold-trading case illustrates this point: An operator may initially have been conducting ordinary business, but after the operator’s bank account was frozen because it contained fraud proceeds and police had given explicit notice, the operator continued to facilitate abnormal transactions and was ultimately convicted of concealing or disguising criminal proceeds.
Another, higher-risk scenario warrants attention. China’s latest judicial interpretation expressly provides that if a person conspires with an offender before a fraud takes place and later conceals or disguises the proceeds, the person may, if the elements of the offense are met, be treated directly as an accomplice to fraud or another upstream crime. If the platform itself participated in such advance arrangements, its potential criminal liability could escalate from “post-offense assistance in transferring criminal proceeds” to “complicity in an upstream crime.” But if Xinbi was unaware of the arrangement, the parties’ conspiracy cannot automatically be attributed to the platform.
China also has a regulatory issue separate from criminal liability for money laundering. The 2021 Notice on Further Preventing and Disposing of Risks in Virtual Currency Trading and Speculation expressly classifies exchanges between fiat currency and virtual currency, exchanges between virtual currencies, acting as a central counterparty in virtual-currency transactions, and providing information-intermediary and pricing services for virtual-currency trading as illegal financial activities. The notice also expressly brings services provided by offshore virtual-currency exchanges to residents of mainland China within the scope of regulation.
Xinbi’s criminal money-laundering risk and its regulatory risk arising from the virtual-currency business itself in China should therefore be assessed separately.
VI. Under U.S. Law, What Legal Liability Could Xinbi Face?
1. USDT Held by Xinbi May Be Forfeitable Even If It Is Not Criminal Proceeds
On the facts currently available, if the USDT frozen from Xinbi existed before victims paid and their dollars never flowed to Xinbi, there would be clear factual obstacles to directly characterizing the USDT as the victims’ “proceeds of fraud” or a traceable substitute for those proceeds. But U.S. authorities have another avenue. 18 U.S.C. § 981(a)(1)(A) authorizes the forfeiture of any property involved in a violation of U.S. money-laundering laws, not just the criminal proceeds themselves. U.S. courts have repeatedly held that funds that are entirely lawful in origin may still be forfeited if they were actually used to facilitate the completion of money laundering. For example, the Fifth Circuit endorsed the so-called facilitation theory in United States v. Tencer: Legitimate funds used to shield criminal funds and make it easier for money laundering to continue may qualify as property involved in money laundering. The classic test used by courts is whether the property made the unlawful activity “easier and less difficult to commit.”
The Tenth Circuit likewise held in United States v. Bornfield that property involved in money laundering may include not only the funds laundered, but also commissions and other property used to facilitate the laundering.
United States v. Puche, particularly similar to this case, involved a currency-exchange business. The court recognized that legitimate funds in a business account could be forfeitable if they actually protected illicit funds and thereby facilitated their transfer.
If U.S. authorities can prove that the deposits formed the credit infrastructure that enabled transactions between strangers to launder money reliably—particularly if they can match individual deposits to specific fraud proceeds—they may argue that the deposits are facilitation property.
Conversely, if the frozen assets were held in a longstanding general deposit pool and used at random for numerous transactions, with no clear link to a specific U.S. fraud, it would be more difficult for authorities to prove the substantial connection required under § 983.
2. Forfeitable USDT Does Not Automatically Mean Xinbi Committed Money Laundering
18 U.S.C. § 1956 sets out specific mental-state requirements for money laundering. In a typical case, authorities must prove that the defendant knew the property represented proceeds of some form of unlawful activity and acted with a statutory purpose, such as promoting unlawful activity or concealing the nature, source, ownership or control of criminal proceeds. For Xinbi, then, “the deposit mechanism objectively helped money laundering” and “the platform knew it was helping money laundering” are two entirely different propositions. If the platform merely applied a set of automated, general escrow rules to all users, lacked knowledge of the source of the underlying fiat currency and did not participate in an arrangement between buyers and sellers to commit fraud, authorities would still need to separately establish the platform’s knowledge or intent.
The risk would be very different if internal chats, customer-service records, dedicated channels, risk-control exceptions, fee arrangements or other evidence showed that platform managers knew the so-called “escrow business” primarily served to launder scam proceeds.
3. Forfeited Assets May Still Be Used to Compensate Victims Even If They Are Not the Victims’ Money
Another important but often overlooked distinction is that a freeze is not a forfeiture, and a forfeiture does not mean victims will receive the funds. When law enforcement freezes USDT, it means only that the assets are under temporary control. The U.S. must first obtain the assets through the appropriate forfeiture process. 18 U.S.C. § 981 itself authorizes forfeited assets to be used to compensate victims of crime, and current U.S. Department of Justice asset-forfeiture policy also provides a mechanism for remission to victims. Thus, even if a court ultimately finds that “the frozen 1 million USDT was not the same as the victims’ $1 million,” it is still possible that the 1 million USDT, despite having a legitimate source, is deemed property that facilitated money laundering, forfeited under U.S. law, and used to compensate victims of fraud.
But the United States cannot simply disregard third-party interests. The Justice Department’s current order of distribution expressly prioritizes owners and lienholders before addressing victim claims.
VII. From a Neutral Tool to Criminal Infrastructure
The most interesting aspect of this case is how it brings a longstanding question in traditional anti-money-laundering law into the on-chain world: At what point does a legitimate, neutral credit tool, after repeated use in illicit transactions, become “criminal infrastructure” in the eyes of the law? If one looks only at the source of the funds, Xinbi does have one strong fact in its favor: The victims’ money did not enter Xinbi.
But that does not resolve every issue. Chinese courts are paying increasing attention to whether a person had knowledge, actually participated in converting funds, or continued to provide assistance after receiving clear warning signs. In the United States, authorities look beyond tracing the criminal proceeds themselves and also ask whether particular property substantially facilitated the crime.
For platforms of this kind, the questions that ultimately determine legal risk may not be the abstract question of whether the platform is “centralized or decentralized,” or even whether it “ever handled criminal proceeds.” They may be three more straightforward questions:
What exactly did the platform see? What exactly did it control? And what did it do after learning this information? The answers to these three questions are closer to the ultimate legal answer.
Contact us:
Website: www.bitrace.io
Email: bd@bitrace.io
Twitter: @Bitrace_team
LinkedIn：@bitrace tech
