Crypto laundering for Asia's scam compounds moved within days of every US crackdown

The US Treasury sanctioned Xinbi Guarantee, a Telegram marketplace for Southeast Asia’s scam compounds, on 9 September 2026, and said it had processed more than $24 billion since 2022. Within hours Xinbi’s operators condemned the “arbitrary freezing” of their wallets and swapped about $2.8 million out of Tether’s USDT into a different stablecoin, USDD. Five days later, prosecutors in New York filed to seize about $61 million of Iranian oil money held in the same token, USDT.

Those stories are the latest turns in a pattern that has repeated since 2025. When Huione Guarantee closed its escrow business and lost its Telegram channels in May 2025, a rival’s daily volume rose almost 70-fold. The money in each case is real, documented in US sanctions notices, court filings and the published work of blockchain analysis firms, and each crackdown has sent it somewhere new. This piece follows it through Asia’s scam economy, the Mexican cartels and Iran, with every figure tied to the record that carries it.

How does crypto laundering work in 2026?

Most of the laundering in this piece runs on four pieces of plumbing, each documented in the sanctions notices and forensic reports cited below.

What is a guarantee market?

A guarantee market is an escrow service for fraud. It takes a deposit from each vendor, vouches for them, and settles disputes, so the people running scam compounds in Cambodia, Myanmar and Laos can buy stolen personal data, fake investment websites, laundering services and cash-out routes from strangers without being cheated. Almost all of it runs on Telegram and settles in USDT.

Huione Guarantee, later renamed Haowang Guarantee, was the largest. Elliptic counts at least $27 billion in USDT transactions through it, the largest illicit online marketplace it has recorded. The US Financial Crimes Enforcement Network (FinCEN) found that the wider Huione Group “has received at least USD 4 billion worth of illicit proceeds, between August 2021 and January 2025”, and cut it off from US correspondent banking in a final rule on 16 October 2025. That rule records that Telegram shut down Huione’s channel on 13 May 2025.

Chainalysis, the analysis firm FinCEN cites in the same rule, found that Haowang Guarantee had processed at least $49 billion in crypto since 2021. That figure counts everything through the service; FinCEN’s $4 billion counts only the proceeds it could tie to crime.

When Huione lost Telegram, Tudou took the trade

Tudou Guarantee’s daily incoming volume rose almost 70-fold from 11 May 2025, the day Huione Guarantee announced it would shut its escrow business, according to TRM Labs. Xinbi Guarantee’s daily inflows rose 90 per cent as it returned to Telegram. Chainalysis found Huione’s own activity still rising a month later: it resurfaced at huione.me, kept its logo and kept its Telegram accounts running.

Tudou wound down in January 2026 after about $12 billion in lifetime transactions, according to the threat intelligence firm Flare, and three rivals bought up its channels.

A single Telegram username, @xinqun, was valued at $400,000, Flare says. Tudou is also the service in which Huione reportedly held a 30 per cent stake, according to Chainalysis, so the buyers inherited a customer base that had already moved once.

The US sanctioned Xinbi on 9 September 2026

OFAC designated Xinbi Guarantee a significant transnational criminal organisation on 9 September 2026, with two technology suppliers: SafeW Technology of Singapore, which built the encrypted messaging app Xinbi moved its merchants onto from June 2025, and Anwen Technology of Cambodia, which built its XinbiPay wallet. The UK had sanctioned Xinbi on 26 March 2026.

The US Scam Center Strike Force restrained more than $52 million of crypto from Xinbi and its vendors the same day. Elliptic, which helped trace the wallets, puts the freeze at $52.8 million in USDT across 52 wallets, starting at 08:00 UTC on 8 September. That brought the Strike Force’s total restrained to about $938 million.

“If Chinese organized crime can buy a custom website and a money laundering service the way you order takeout, then every American with a retirement account is in the blast radius,” said Jeanine Ferris Pirro, the US Attorney for the District of Columbia.

Three published measures of Xinbi’s size each count something different.

Xinbi was registered as a company in Colorado

Xinbi Guarantee said it operated through Xinbi Co., Ltd, and Elliptic found that company was incorporated in Aurora, Colorado, in August 2022. The Colorado Secretary of State’s business register still lists Xinbi Co., Ltd, with the status “Delinquent” from 1 January 2025.

For more than two years, while it served scam compounds, the marketplace carried an active US state incorporation. Xinbi had about 233,000 users when Elliptic published in May 2025, up from 119,000 in August 2024, and its addresses had taken in about $220,000 in USDT stolen from the Indian exchange WazirX in a hack attributed to North Korea.

OFAC’s September 2026 designation names Xinbi Guarantee and its Singapore and Cambodia suppliers. The Colorado company appears in Elliptic’s research and in the state register.

Xinbi swapped into a different stablecoin within hours

Xinbi’s operators condemned the “arbitrary freezing” and announced that they were moving to USDD, exchanging about $2.8 million of USDT into it within hours of the 8 September freeze, according to Elliptic. USDD is a dollar stablecoin on the same Tron blockchain, issued by TRON DAO Reserve rather than Tether.

The move follows the logic of the whole piece. A freeze works through the company that issues a token, so the answer from the market was to hold a token issued by someone else. Elliptic says the marketplace was forced offline at 16:20 UTC on 9 September.

On 21 September the US State Department restricted visas for 32 people it says defrauded Americans, most of them tied to Cambodia’s Prince Group. “In 2025 alone, TCOs in Southeast Asia, like the Prince Group, defrauded Americans out of at least $18.2 billion through cyber-enabled scams,” the department said. The Treasury had already sanctioned 146 Prince Group members and affiliates in October 2025 and another 35 in June 2026.

How much cartel money moves through crypto?

Crypto shows up in roughly one in ten US bank reports about fentanyl money. FinCEN analysed 1,246 suspicious activity reports filed in 2024 that flagged suspected fentanyl-related activity, covering about $1.4 billion, and found a potential link to crypto “in nearly 10 percent of filings”, mostly involving bitcoin.

The Chinese chemical suppliers at the other end take crypto almost universally. About 97 per cent of Chinese suppliers of fentanyl precursors accept cryptocurrency, according to TRM Labs, and on-chain payments to them have grown each year: $30.9 million in 2023, $34.7 million in 2024 and $39.1 million in 2025. TRM estimates that cartel-linked laundering networks have moved more than $3 billion on-chain, most of it in the past two years.

The largest recent prosecutions show both routes running at once.

The Lu case is a cash case from end to end: shell-company accounts opened with real and fake identities at major US banks. The Ojeda Aviles network turns the same kind of cash into crypto.

US law now treats cartel money as terrorist financing

The US designated the Sinaloa Cartel, CJNG, the Gulf Cartel and five other groups as foreign terrorist organisations on 20 February 2025. Since then, moving their money can be prosecuted as material support for terrorism as well as money laundering.

OFAC used both sets of powers on 20 May 2026. It sanctioned Armando de Jesús Ojeda Aviles, whom it describes as the head of a network that collects Sinaloa Cartel drug cash in the US and “facilitates the conversion of this bulk cash into cryptocurrency for ultimate transfer to the Sinaloa Cartel in Mexico”, and Jesús Alonso Aispuro Félix, its “chief money broker”. Both were designated under Executive Order 14059 on drug trafficking and Executive Order 13224, the counter-terrorism order.

Prosecutors in Ohio have already charged crypto-paid suppliers with material support. On 25 March 2026 a grand jury charged two Chinese chemical companies and six people, three of them with attempting to provide material support to the Gulf Cartel, after US customers were told to pay for cutting agents in cryptocurrency. “This new indictment marks the first time in the Southern District of Ohio that we have brought charges for providing material support to a Mexican drug cartel designated as a foreign terrorist organization,” US Attorney Dominick Gerace said, pointing to the February 2025 designation. Material support carries up to 20 years.

The Ohio defendants are chemical sellers who were paid in crypto. The statute’s definition of material support includes financial services, and since February 2025 the groups it protects against include the cartels whose cash brokers move onto a blockchain.

A crypto mine was running beside a dam in Puebla

Mexico’s federal prosecutors, the navy and Puebla state police secured a property in Tlaola, in Puebla’s Sierra Norte, on 6 September 2026, which the state’s public security department said was allegedly used for crypto mining. The site held electrical infrastructure, satellite internet and specialised mining equipment.

Investigators found 300 graphics processing units, 80 medium-voltage terminals and eight satellite antennae, and are investigating whether the farm was taking electricity from a nearby hydroelectric dam, CNN reported on 14 September, carrying a Reuters report. It is the fourth crypto farm found in the area since early 2025. Mexico’s federal attorney’s office declined to comment, citing an active investigation.

Mining turns electricity into newly issued coins with a clean transaction history, which is why it appeals to a group holding dirty cash or stolen power. Police suspect the Puebla farm was mining to launder illicit funds, and David Saucedo, a Mexico-based security analyst, told Reuters that setting it up would have needed a well-financed backer such as one of the major cartels.

Iran sent bitcoin to the IRGC through BitBank

OFAC sanctioned the Iranian exchange BitBank on 17 September 2026, with its developer Pishtaz Simorgh Electronic Trade Company, Dot One Value Creation Group, and three executives, all linked to the Iranian financier Babak Zanjani. “Between June and July of this year, Zanjani utilized BitBank to facilitate the transfer of hundreds of millions of dollars’ worth of Bitcoin to the IRGC,” the Treasury said, referring to Iran’s Islamic Revolutionary Guard Corps.

The Treasury also said the Hormuz Safe Marine Services Authority, already under US sanctions, “has used BitBank to transfer payments it received to the Iranian regime” since June. BitBank follows two earlier Zanjani-linked exchanges, Zedcex and Zedxion, which TRM Labs says handled about $1 billion of IRGC-linked activity.

US prosecutors want $61 million from a $1.5 billion oil money trail

US prosecutors in New York filed on 14 September 2026 to forfeit about $61 million in crypto as proceeds of black-market sales of Iranian oil. A set of linked addresses they call “Entity A” received and distributed more than $1.5 billion of those proceeds, the complaint alleges, funnelling it to IRGC-linked money businesses, IRGC-linked addresses and an Iranian exchange.

Two Chinese companies, Blessed Trust and Hexa Whale, used trading accounts at the exchange Binance to do it, the complaint says. Blessed Trust presented itself as a wealth management and custody firm; Hexa Whale as a commodities broker. Both also sent or received tens of millions of dollars through the US financial system.

The forfeiture is about one twenty-fifth of what passed through the addresses. The case is filed as United States v. All USD Tether Held in the Cryptocurrency Address TBJT9BP7cM5yYne9kTdf2HNu9mX1WpRQpt, number 1:26-cv-08010, and the money is Tether’s USDT, which is why a freeze could hold it.

Two courts are testing how crypto gets frozen and seized

Two Thai businessmen, Nutthawat Rukthammachalern and Natthawat Kasamvilas, sued four Tether companies in Manhattan on 31 August 2026 over a freeze of 42,417,785.62 USDT, about $42.4 million at the dollar peg, held in ten Ethereum addresses. Their complaint says Tether froze the tokens on 30 October 2025 at the informal request of a Homeland Security Investigations agent, “without any warrant, order, or legal process of any kind directed to Defendants”. A seizure warrant from a magistrate judge in North Carolina followed on 19 February 2026, more than three months later.

The complaint also argues that Tether profits from freezing, because it keeps investing the reserves behind frozen tokens, mostly US Treasury securities, and keeps the income. The case is 1:26-cv-07400, before Judge Lewis Liman.

In Washington, Judge Rudolph Contreras ruled on 3 September 2026 on a US forfeiture case over funds laundered by North Korean IT workers. The Justice Department had announced in June 2025 that it had frozen and seized more than $7.74 million tied to the scheme and sought eight tranches. The judge granted forfeiture of one address, which had received about 158,122.85 USDC and 54,574 USDT, roughly $212,700. He denied the other seven without prejudice, because the government’s published notice did not describe them “with reasonable particularity”. The government can file again with a proper notice.

Every September action, in one table

The next stop is a token issued by someone other than Tether

Every crackdown in this piece worked on the thing it targeted. Huione lost Telegram and US correspondent banking, Tudou closed, Xinbi was forced offline with $52.8 million frozen, and $61 million of Iranian oil money sits in a US forfeiture case. Each one also showed the next network where to go: Tudou from the day Huione announced its closure, three rivals buying Tudou’s channels within weeks, and USDD within hours of the Xinbi freeze. A freeze works fastest where one company issues the token, and the scam markets are moving their money into tokens issued by someone else.