A redacted scam wallet, a manager’s advance in Tether and a deposit address Arkham labels Binance: how a compound’s money gets out

Part I ended on that one-word caption. It comes from the Shunda complaint, a different case and a different compound from the address I trace below, and it sat under a screenshot of a manager’s 1,000 USDT advance in December 2025.

The phone the FBI searched shows what else was priced in Tether. In another group chat, according to the complaint, a vendor quoted 21,000 USDT for the right to list a US-registered company as the developer of scam apps on the app stores. Another alleged conspirator asked “how much for a SEC license?” The vendor said, in the complaint’s summary, that “SEC licenses were now 13,000 USDT”. When the group set up again in Shwe Kokko, the property manager’s bill for rent, food and utilities came to about 57,085 USDT for two months. Advances, suppliers, rent: all quoted in a dollar token on a public blockchain.

In what I could trace, the money never vanishes into a mixer or onto the dark web. It moves on a ledger anyone can read, through a marketplace, through collection wallets and swap pools, and the part I could follow to the end lands at deposit addresses Arkham labels as exchange accounts, the kind somebody has to open with an identity document. Part I was about the people who answered the ad. This one asks where the money went.

The Marketplace

Xinbi Guarantee is, as the US Secret Service alleges, “a Chinese-language illicit marketplace, run on Telegram, where vendors market their services to scam center operators”. According to the release, vendors offered custom scam investment websites, laundering, and “soliciting trafficking victims to work in scam compounds in Southeast Asia”. Xinbi held the buyer’s money until the vendor delivered. That holding is the “guarantee” in the name.

Elliptic, a blockchain analytics firm, documented the marketplace in May 2025. Xinbi claimed to operate through Xinbi Co., Ltd, incorporated in Colorado in August 2022 with a principal office in Aurora. In January 2025 Colorado marked the company “Delinquent” for failing to file a periodic report.

Elliptic also found vendors that “appear to be engaged in sex trafficking, with victims as young as 14 years old.” These are listings. I found nothing on what happened to the people in them.

Telegram removed Xinbi’s channels on 13 May 2025. Xinbi came back on the same account, and its daily inflows rose by almost 90%, according to TRM Labs. The US Treasury says that around June 2025 Xinbi began moving its merchants to SafeW, a private messaging app, and that after FinCEN’s action against the Huione Group, cybercriminals moved to Xinbi, “which has continued offering substantially similar services to an overlapping customer base”. The investigative journalists’ network ICIJ calls Xinbi “a Huione affiliate”. I found no document showing common ownership.

Treasury also says Xinbi’s platform “has reportedly been used by North Korean hackers and by several OFAC designated entities, including Jin Bei Group Co., Ltd. and entities that are part of the Prince Group TCO.” Treasury is describing users there. No document I have read says who owns Xinbi.

Four Framings

Two governments acted against Xinbi in 2026, in four documents. They described the same marketplace in different words.

Quotations are from each document. The address counts are my counts of the Tron addresses printed in each notice and in OFAC’s list.

Britain called it a human rights case. The Justice Department and the Secret Service mentioned trafficking victims. Treasury’s release, which I searched word by word, never uses “trafficking”, “forced”, “slave” or “compound”. It doesn’t use “Telegram” either, for a marketplace that ran on Telegram. Its victims are American. Treasury does not say why it chose that framing, and I leave that question to Part III.

How Big

Every source on Xinbi gives a headline number, and the numbers disagree. Before quoting anyone else’s, I measured the one set of addresses I could fully reproduce: the 52 Tron addresses OFAC listed.

I pulled every USDT transfer to or from those 52 addresses: 796,415 transfers, from 30 September 2023 to 29 September 2026. They received $8.40 billion in total. Of that, $3.69 billion (44%) came from another of the 52, which is the marketplace moving money between its own wallets. What came in from outside was $4.71 billion, and $4.66 billion went back out.

Here is how my measured figure sits under the published ones:

The vendor figures cover different address sets, dates and measures. None of the vendors publishes its address list or says whether a marketplace paying itself counts as volume.

Chainalysis’s $8.4 billion for the 52 addresses matches my gross figure. That number includes the $3.69 billion the addresses paid each other. Chainalysis does not say whether it meant to count those transfers. Elliptic’s $8.4 billion from 2025 covers a different, larger set of addresses over a different period. The two happen to be the same size.

The headlines also move with the words. Elliptic wrote “inflows” in March and “transactions” in September. TRM’s figure went from $24.2 billion to $36 billion in under six months, while its wording changed from “total transaction volume” to “throughput”. Some of that is real growth, as the next section shows. Some of it is vocabulary. Elliptic, which says the larger Huione Guarantee closed in May 2025 “following pressure from Elliptic”, now ranks Xinbi “the second-largest illicit online marketplace of all time”.

After Britain

On 26 March 2026 Britain sanctioned Xinbi, fourteen months after Colorado had caught it out over paperwork. Between that day and the freeze on 8 September, the 52 addresses OFAC later listed took in $3.74 billion from outside wallets. That is 79% of all the external money they ever received, although the share is inflated by how the list was made: OFAC named addresses that were in use in 2026, so the set leans recent.

My count, from the full USDT history of the 52 addresses. Most of the August 2025 spike, 90%, went into TW5tok… in its first month of use, one of the two addresses Britain listed in March. The last six days of March 2026, after the sanction, brought in $5m.

Thirty of the 52 addresses were first funded after the British listing (my count, from each address’s activation date on TronScan). So I claim only this: the addresses OFAC named took in $3.7 billion after Britain sanctioned Xinbi. For those five and a half months, Britain’s list held two Xinbi addresses. Part III is about those two.

The Treasury and the Rotation

The transaction records split the 52 addresses into two groups.

The first is a treasury tier: wallets with few transactions and large balances, funded from other Xinbi addresses in monthly batches. On 1 September 2026, between 05:44 and 06:08 UTC, designated addresses funded each other in a chain that ran through seven wallets in 24 minutes and branched at the end. On 1 August one address fanned out to four new wallets and another funded a fifth. Seven of the 52 were activated on 1 August and six on 1 September. The six from September were frozen seven days later.

The second is the high-volume tier: long-lived wallets that took money from outside, thousands of payers at a time, and were never rotated.

The Wallet Tree

One group of wallets paid Xinbi’s addresses before the freeze and paid two new wallets after it. I don’t know who controls them, and neither TronScan nor Arkham, the labelling service I used, has a name for any of them. So here they are by role:

Roles are mine, read from the transaction pattern. Each hub pays out pieces of about $5,000 to between 1,700 and 2,000 receivers.

Before the freeze, the two payout hubs sent 90 transfers to Xinbi’s designated addresses between 16 June and 7 September 2026. After the freeze they paid two new wallets. One, TVEZ1…, was activated at 08:26 UTC on 8 September, 26 minutes after the freeze began. The other, TAbR12…, was activated on 16 September. My guess is that the wallet tree belongs to a regular customer or supplier of the marketplace. Identity unknown.

How I Traced It

The method, so anyone can repeat it:

1. Seeds. The 52 Xinbi addresses come from OFAC’s sanctions list as published on 2 October 2026. The scam address comes from the FBI affidavit described in Part I, which prints only its ending; Part I recovered the rest.
2. Transfers. USDT transfers on Tron came from the TronGrid API, which returns newest first. Addresses with long histories need deep paging. I checked completeness against each address’s activation date.
3. Activation and freezes. TronScan’s API (a free key is needed) gives each address’s first funding. Tether’s freezes are public events on its Tron contract. I found no events showing frozen funds destroyed or released on any of the 52 addresses, so as of 11 October the money is frozen, not burned.
4. Labels. Exchange and service labels come from Arkham Intelligence’s web interface. They are Arkham’s labels, not mine and not the exchanges’. I could not test their accuracy.
5. Ethereum. Transfers came from the Etherscan V2 API, about a hundred requests in total. An earlier run through a different explorer cached rate-limited replies as empty histories and was discarded.
6. Tracing. My own scripts. The first four runs of the Tron trace had bugs, from a truncated seed to loops that went uncounted. Only the fifth run’s numbers appear here.

Not every test worked out. I expected the whole network to move to new wallets every month. Checking who first funded each wallet showed that only the treasury tier does: wallets with few transactions and large balances, funded by other Xinbi addresses. The busy wallets were never replaced. The wallet tree turned up later, while I was following Xinbi’s regular payers past the freeze (Part III), and I confirmed each link on the transaction that activated the wallet. I also found four wallets that took money from Xinbi’s addresses in the 30 days before the freeze, were never frozen and were still moving money in October. Those payments are their only tie to Xinbi, Chainabuse has no reports on them, and they could as easily be trading desks, so I don’t name them.

The freeze count in The Freeze Hour comes from a second short script of mine. It takes the 52 addresses OFAC listed, finds the first time Tether froze each one, groups those freezes by the minute, and checks whether any address was never frozen.

$ python freeze_count.py# 1  Match the list to Tether's freezes# OFAC's 52 Xinbi addresses vs every USDT (Tron) freeze, Jan 2025 to 5 Oct 2026OFAC-listed Xinbi addresses: 52frozen by Tether: 52# 2  Group the freezes by minute# the first time each address was frozen, UTC  2026-03-27 21:08 UTC   2  Britain's two, after its listing  2026-09-08 08:00 UTC  25  49 in four minutes,  2026-09-08 08:04 UTC  24  a day before the sanctions  2026-09-08 19:21 UTC   1  the 50th, already empty# 3  Check for gaps# listed addresses Tether never frozenever frozen: 0

My script’s output, run 6 October 2026 on public data from TronGrid. The comments, boxes and labels are mine.

A wallet Arkham labels as OKPay’s hot wallet sent small transfers to Xinbi addresses; no document links OKPay to Xinbi’s operation and no wrongdoing is alleged.

The Exchanges

The obvious suspects for moving this money are the big exchanges. ICIJ’s reporting puts OKX customer accounts on Xinbi’s side of the ledger and Binance accounts on Huione’s, and my data says the direct route into Xinbi’s 52 addresses was a small one.

ICIJ’s “Coin Laundry” found that Binance accounts received at least $408 million in tether from the Huione Group between July 2024 and July 2025, and that OKX customer accounts received at least $226 million from Huione after OKX’s guilty plea in February 2025. On Xinbi, it reported a Crystal Intelligence analysis: “A Huione affiliate, Xinbi Guarantee, received $95 million in tether payments from OKX accounts between July 2022 and June 2025.” OKX “declined to comment specifically on its transactions with Xinbi Guarantee” and said it “may take action such as freezing and/or closing accounts that are suspected to be tied to illicit actors”. Binance, asked about Huione, said that “users who transact with this service are subject to investigation by our compliance department”.

My figure is narrower. Direct withdrawals from labelled exchange hot wallets into the 52 OFAC-listed addresses came to about $10 million over their lifetime, against $4.71 billion of external inflow. That is about 0.2%. ICIJ’s $95 million covers every address Crystal attributes to Xinbi, over three years, so the two figures measure different things. What mine shows is that almost none of the money arrived at these 52 addresses straight from an exchange hot wallet Arkham labels.

Between the British listing and the American one, OKX hot wallets sent $1.01 million to the 52 addresses, Binance $92,000 and Gate $62,000. After 9 September, none. That is not evidence that exchanges ignored British sanctions: for those months the British list named only two Xinbi addresses, and Part III is about what those two held.

Following the Money Out

Part I recovered the address the FBI calls scam address E2Fq34 in its Anlong Veng case, which the affidavit prints only by its ending: TWBtAxWscqhpRgjXDVfDVLaqWSGJE2Fq34. Between March 2023 and 5 April 2026, when Tether froze it, it sent $11.32 million to 379 receivers. I traced where that went. The FBI ties the address to the scam’s controllers through one victim’s payment in December 2025; treating its whole three-year history as one operation’s money, as I do below, is my assumption.

The method is haircut tracing. Money in a wallet is pooled, so no payment can be followed dollar for dollar. Haircut tracing assumes each outgoing payment carries the address’s money in proportion to its share of the wallet’s balance at that moment, which is the cautious way to split mixed funds. The trace runs four hops and explores at most 300 wallets, limits set by what the free APIs would let me pull. It stops at any labelled wallet, and at any wallet with 5,000 or more transfers, which I treat as a service: past that point one customer’s money is lost among everyone else’s. It drops any wallet that received less than $200 of the money. It placed $11.30 million of the $11.32 million.

A model’s split of mixed money, not proof of who received what (method). Labels are Arkham’s. The busy row includes TUebPj8…, which Arkham labels a Binance deposit address ($185,000).

So the trace reached a named end point for 16% of the money. The rest stopped at services nobody has named, ran into the limits or came back round, and I can’t say where it ended.

Tools like this make mistakes, and the error rate is rarely published. The best public test I know of is “Ghost Clusters”, a peer-reviewed study by Lubbertsen, van Eeten and van Wegberg at USENIX Security 2025. They checked Chainalysis’s attributions against three seized illicit services and found them “a reliable lower bound (24.54 to 94.85 percent accurate)”, with “very few false positives (less than 0.5 percent)”. That test covered Bitcoin only. The authors also analysed a second provider’s attributions, which they had through law enforcement, but could not publish them: the provider, they write, said that any disclosure, “even anonymous, would be treated as grounds for legal action”. Nobody has published a comparable test of the labels I used.

There are small links in both directions between this address and Xinbi. The FBI names a direct transfer with Xinbi by the end of its transaction ID; on the ledger it is 8,000 USDT coming in from a wallet the FBI labels Xinbi Guarantee (Part I). In the other direction, the model allocates $1,107 of the address’s money to TW5tok…, one of the two addresses Britain listed in March, through two intermediate wallets in August 2025. That figure is the model’s share of a larger, mixed transfer. Neither tells us what the money paid for.

The Two Deposit Addresses

I looked up in Arkham the eight largest busy wallets where the trace stopped. Seven had no name, only generic tags. One did: TUebPj8…. Arkham labels it a Binance deposit address. The model puts $185,000 of the address’s money there.

Two of the unlabelled wallets behave like collection points. TPuLvo… took money from 864 senders and TUWzYZ… from 673, with median deposits of $1,768 and $2,732. Both were active for about 220 days, busiest between 04:00 and 10:00 UTC, and both swept larger amounts on to a few receivers. Between them they received $1.4 million of the address’s money in the model.

The largest flows went to two addresses:

Lifetime flows on the Tron blockchain; the traced money is a small part of them. Of the $52.1 million the two collection wallets sent out, $25.3 million went to these two addresses. The $11.34 million matching Part I’s figure is a coincidence.

TCxPoL… has no label anywhere I looked. Thirteen wallets paid into it, with a median deposit of $9,302. Over 556 days it sent all of its outflow, $27.4 million, to two wallets Arkham labels as Binance hot wallets, 60% to one and 40% to the other. That is how an exchange deposit address behaves: the customer pays in and the exchange sweeps the money into its own wallets. It behaves like a Binance deposit address; no label I found says so.

So a large part of the collection network’s money went to two deposit addresses, one that Arkham labels Binance and one that behaves like Binance: about $25 million from these two collection wallets over their lifetimes. I don’t know who holds them. They could be a trading desk, a payment agent or a business that is unaware of where its customers’ money came from. I am not accusing anyone. If they are Binance deposit addresses, Binance’s records would show who holds them.

What such records hold is on the record, in the same FBI affidavit that names the scam address. The FBI traced one victim’s money from the Anlong Veng scam addresses to a different Binance deposit address and asked Binance about it:

A Binance deposit address leads to one account, and Binance keeps the identity behind it. The dashed line marks where I left out Figure 11, an identity document. Source: FBI affidavit, case 26-SZ-32, paragraphs 58 to 60, pages 36 and 37; a US government work, box mine.

If TUebPj8… and TCxPoL… are Binance deposit addresses, Binance’s records hold the same for them: an account number, an identity document, an email address, login locations, and any flags Binance’s own systems raised. The FBI had to ask for it. Binance only has to look.

The affidavit also prints the flags:

The FBI’s extract of Binance’s records for that account, cropped to the date and flag columns. One of eight withdrawal attempts carries an anti-scam flag; the other seven say “null”. Source: FBI affidavit, case 26-SZ-32, Figure 12, page 38; a US government work, box mine.

The Ethereum Side

Not everything runs on Tron. The FBI’s Tai Chang affidavit lists an Ethereum address, 0xc248c5Db7fa467B2d5660E0EE648e60C2c5e24dc, among those “being used by scammers inside Tai Chaing to accept victim payments”. It sent about $1.04 million in USDT between 16 November 2025 and 16 January 2026.

I ran the same haircut trace on Ethereum, four hops. Arkham’s labels and Etherscan’s contract names cover about 35% of where the money went, and every labelled destination is a swap, wallet or bridge service:

Model-based attribution, Etherscan V2 data. Curve and Bitget Wallet are Arkham’s labels; Uniswap v3 pool and Rango are Etherscan’s contract names (UniswapV3Pool, RangoDiamond). Roughly two-fifths went beyond the four-hop limit and about a fifth looped back. No custodial exchange appears in the labelled share.

The Anlong Veng affidavit describes “token-swapping”, “chain-hopping” and “bridging” as laundering techniques in general terms. My trace shows this address’s money going through swap and bridge services. It does not show that these services were chosen to escape freezes, and nobody I have read says so. They are public services, open to anyone.

The Freeze Hour

At 08:00 UTC on 8 September 2026, the money stopped. In Tether’s freeze events I count 49 of the 52 addresses frozen in the first four minutes, and a 50th, already empty, at 19:21 that evening. The other two had been frozen in March. The last outgoing transfer from any of them was at 08:00. One wallet not on OFAC’s list was frozen in the same minutes, at 08:04, and more followed that day. It had exchanged $32 million with two Xinbi addresses in eight transfers.

Elliptic, which says it worked with the Secret Service to identify and freeze them, dates the freeze from “8am UTC on September 8, 2026”. A court had authorised the seizure of Xinbi’s Telegram channels on 7 September. Treasury’s release went up on 9 September, at 14:15 UTC according to the page’s metadata. The Justice Department and Tether describe Tether’s role as “proactive assistance”. The money was frozen more than a day before the sanctions were announced.

Nobody agrees on how much was frozen:

Seven counts, two of them mine (method and script output above). None of these sources explains how its count relates to the others, and I have not reconciled them. Do not add any two of them together.

Xinbi answered within hours. According to Elliptic, it condemned the “arbitrary freezing”, promised to compensate its customers and announced a switch from USDT to USDD, a stablecoin with no central issuer that can freeze wallets. It swapped about $2.8 million of its remaining USDT into USDD on a decentralised exchange. Elliptic adds that USDD’s claims of decentralisation are contested and that it is partly backed by USDT, which can be frozen. Bitrace, in a post quoted by Decrypt, reported that a new address it attributes to Xinbi, activated on 8 September, was frozen too, after $1.8 million had already left it. A marketplace sanctioned for selling money laundering objected to arbitrary freezing.

The $48.8 million sits in the 52 addresses, still frozen on 11 October. The rest of the money went on. It left the scam address in transfers that each confirmed in seconds, the way the manager’s thousand USDT was confirmed in December. The last hop landed at an address Arkham labels a Binance deposit address. If the label is right, an identity document, an email address and a login history are attached to the account behind it. The ledger records only that it got there.

Arrived.

Sources and Further Reading

1. US Department of Justice. Criminal complaint and affidavit (the Shunda complaint), 1:26-mj-00018 (D.D.C.). Filed 30 Jan 2026, unsealed 23 Apr 2026. Source of the manager’s advance, the USDT price quotes, the Yatai bill and the caption “Arrived.”
2. Federal Bureau of Investigation, affidavit in support of a seizure warrant for t.me/pogojobhiring2023. In the Matter of the Seizure of One Telegram Channel, case 26-SZ-32 (D.D.C.). Sworn 22 Apr 2026. Paragraphs 53 to 60 and Figures 9 and 12.
3. Federal Bureau of Investigation, affidavit in support of a seizure warrant for tickmilleas.com (the Tai Chang compound). Case 25-sz-52 (D.D.C.). Nov 2025, released 2 Dec 2025. Paragraph 68.
4. US Secret Service. “Scam Center Strike Force Conducts Seizures of Chinese-Run Illicit Scammer Marketplace, and Restrains $52 Million in Laundered Crypto Scammer Funds In One Day.” 9 Sep 2026. The same release is on the US Attorney’s Office for DC site.
5. US Department of the Treasury. “Treasury Cracks Down on Transnational Criminal Organization Behind Cyber Scam Operations Targeting Americans,” sb0624. 9 Sep 2026.
6. Office of Foreign Assets Control. “Recent Actions,” 9 Sep 2026 (the Xinbi Guarantee entry and its 52 Tron addresses).
7. UK Foreign, Commonwealth and Development Office. “Sanctions Notice, Global Human Rights,” 26 Mar 2026. Entry GHR0190.
8. UK Foreign, Commonwealth and Development Office. “Sanctions Notice, Global Human Rights,” 9 Sep 2026.
9. UK Foreign, Commonwealth and Development Office. “UK crackdown on vile scam centres steps up with sanctions on illicit crypto network.” 26 Mar 2026.
10. Elliptic. “Xinbi: The $8 Billion Colorado-Incorporated Marketplace for Pig-Butchering Scammers and North Korean Hackers.” 12 May 2025.
11. Elliptic. “UK sanctions Xinbi marketplace and entities connected to #8 Park in latest crackdown on illicit cryptoassets.” 26 Mar 2026.
12. Tom Robinson, Elliptic. “Elliptic helps the U.S. Secret Service freeze $52.8 million Xinbi scam assets.” 9 Sep 2026, with an update at 16:20 UTC.
13. TRM Labs. “How Telegram’s Ban on Huione and Xinbi Has Reshaped the Guarantee Services Landscape.” 30 Jul 2025.
14. TRM Labs. “Xinbi Marketplace Remains Active with USD 17.9 Billion in Total Volume Despite Enforcement Actions.” 6 Feb 2026.
15. TRM Labs. “UK Becomes First Country to Sanction Xinbi, One of Southeast Asia’s Largest Illicit Crypto Marketplaces.” Mar 2026.
16. TRM Labs. “The US Sanctions Xinbi, One of Southeast Asia’s Largest Illicit Crypto Marketplaces.” 9 Sep 2026.
17. Chainalysis. “US Sanctions Xinbi, Asia’s Multibillion-Dollar Cybercriminal Marketplace.” 9 Sep 2026.
18. Spencer Woodman and others, ICIJ. “Crypto giants moved billions linked to money launderers, drug traffickers and North Korean hackers.” Coin Laundry, 17 Nov 2025.
19. Giuseppe Lubbertsen, Michel van Eeten and Rolf van Wegberg. “Ghost Clusters: Evaluating Attribution of Illicit Services through Cryptocurrency Tracing.” USENIX Security 2025.
20. Decrypt. “Secret Service Freezes $52.8 Million in Crypto Tied to Telegram Bazaar Behind Global Scams.” 9 Sep 2026.
21. The Record. “US disrupts Xinbi Guarantee marketplace fueling the cyber scam economy.” 9 Sep 2026.
22. Tether. “DOJ Credits Tether’s Assistance in $52 Million Enforcement Action Against Global Scam Network.” 11 Sep 2026.
23. crypto.news. “Tether freezes $39.3M USDT linked to Xinbi Guarantee.” 9 Sep 2026 (MistTrack figures).
24. Oluwapelumi Adejumo, CryptoSlate. “How Tether’s $45 million crackdown drove Southeast Asian scam compounds into an ‘unfreezable’ decentralized stablecoin.” 9 Sep 2026 (Bitrace figures).
25. Header image: my collage of a phone and desk from “Desk Top” by Matt (StockSnap, CC0), and red paper (Rijksmuseum, public domain) torn to the outline of a torn-paper photograph (rawpixel, public domain). “Arrived.” is the manager’s caption in the Shunda chat (source 1).
26. On-chain data: USDT (TRC-20) transfers, account activations and Tether freeze events on Tron, pulled through TronGrid and TronScan, and USDT transfers on Ethereum through the Etherscan V2 API, 5 to 6 Oct 2026. Labels from Arkham Intelligence, checked 6 Oct 2026. Figures marked “my count” or “MODEL” are mine and have not been checked by anyone else.