Two dead wallets, a freeze a day early and a new wallet live in 26 minutes: how the gate stays open

On 26 March 2026 Britain sanctioned Xinbi Company Limited, the business behind the Telegram marketplace that Part II followed. Under “Other information” the notice says Xinbi “is associated with the following Tron crypto addresses”, and prints two.

Both were dead. One had last sent money in January, the other the previous September. Both were empty.

For the next five and a half months those were the only addresses on Britain’s list. Over the same months the 52 addresses the US named in September took in $3.74 billion from outside. Then, starting at 08:00 UTC on 8 September, 49 of those 52 were frozen in four minutes, a day before any government said a word in public. Twenty-six minutes later a new wallet came to life, and by mid-morning Xinbi’s former payers were paying it. Tether has never frozen it.

Part I asked who answered the ad and Part II where the money went. This part asks who kept the gate open. I went looking for a bank or an exchange that had looked the other way, and kept finding clocks instead. Against the market’s speed, every control I found arrived late, including the one that worked.

Two Addresses

Here is the entry, as Britain’s Foreign Office published it:

The whole wallet list of Britain’s first Xinbi sanction. Source: UK Sanctions Notice, Global Human Rights, 26 March 2026, page 11; Crown copyright, Open Government Licence v3.0; boxes mine.

The ledger tells you what those two were by March. TW5tok… was used from 31 July 2025 to 21 January 2026 and took in about $398 million from outside wallets over its life. TBKpoz… ran from 28 May to 1 September 2025 and took in about $91 million (both my counts). By the day of the notice one had been idle for two months and the other for almost seven. Both held $0.

Tether froze both at 21:08 UTC on 27 March, the evening after the notice. The freeze is a public event on its Tron contract. I could not find who asked for it. It stopped nothing, because nothing was there.

The listing also froze Xinbi’s assets under British law: anyone who knows or has “reasonable cause to suspect” they are dealing with a designated person’s funds must freeze them and report it to Britain’s Office of Financial Sanctions Implementation. But a screening system matches addresses, and the addresses Britain printed were empty.

Meanwhile the marketplace kept rotating wallets. Thirty of the 52 addresses the US later designated were first funded after the British notice, as Part II showed. Of the money the 52 took in over those months, $3.63 billion went into those 30. Britain added 38 more addresses on 9 September, 167 days later. Hot wallets Arkham labels as OKX, Binance and Gate paid about $1.16 million into the 52 in those months (Part II has the breakdown). They had two empty addresses to screen against.

What Treasury Left Out

Britain sanctioned Xinbi under its human rights regime. The notice says Xinbi “has enabled and profited from the operation of scam centres in Southeast Asia”, and that the treatment of people in those centres abuses “the right to be free from slavery, not to be held in servitude or required to perform forced or compulsory labour”.

On 9 September the US sanctioned the same marketplace. Treasury’s release says its actions “complement” Britain’s of 26 March. It does not repeat Britain’s reason. Its title ends “Targeting Americans”. It designates Xinbi under the order for transnational criminal organisations, E.O. 13581, and the Treasury Secretary’s quoted line on harm is that “Scam centers in Southeast Asia steal billions of dollars from American victims each year.” As Part II counted, the release never uses “trafficking”, “forced”, “slave”, “compound” or “Telegram”. The State Department’s statement the same day follows it: “American” or “Americans” six times, trafficking never.

Another part of the US government said it. The Justice Department and Secret Service release on the same seizure says Xinbi’s vendors advertised “soliciting trafficking victims to work in scam compounds in Southeast Asia”. So the contrast is not Britain against America. It is Treasury against Britain and against the administration’s own Justice Department.

And Treasury knows the words. Its own releases on Southeast Asian scam networks use them again and again:

Quotations are from each release. The order column is the legal basis each designation rests on: “crime” is E.O. 13581 (transnational criminal organisations), “cyber” E.O. 13694, “Burma” E.O. 14014 and “human rights” the Global Magnitsky order, E.O. 13818, as each release states.

The DKBA release has “Americans” in its title too, and still describes soldiers “beating handcuffed scam workers”. The Kok An release says it was taken “in furtherance of” President Trump’s March policy order, “Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens”, the same order the Xinbi release cites, and it still says “trafficking victims”. Neither the crime order nor the cyber order needs a trafficking finding, and the cyber releases used the word anyway. So neither the audience, the March policy order nor the legal basis explains the omission.

What does differ is the target. In every release that uses the word, it is attached to people who own, guard or run the buildings where workers are held. The Kok An release also designates a bank, but its trafficking line is about K99’s properties. Xinbi has no buildings in the record. It is the payment rail. My reading, which I found in no document, is that Treasury attaches the trafficking to the compounds and describes the money that leaves them as fraud against Americans.

The reason on a designation is the part that travels, into news copy and compliance memos. Britain’s travelled as slavery. America’s, for the larger list, travelled as fraud against Americans. In April Treasury had written that trafficking victims were “forced to scam Americans and others”. In September the people forced to do the scamming had dropped out of the sentence.

The Freeze Before the Announcement

What stopped Xinbi’s money was a freeze, and it came before the list.

By my count of Tether’s freeze events, 49 of the 52 addresses were frozen between 08:00 and 08:04 UTC on 8 September, and a 50th, already empty, at 19:21 that evening. Part II has the timeline and the competing tallies. Elliptic, the London-based analytics firm, says it “worked with the U.S. Secret Service to identify and freeze wallets” and dates the freeze from “8am UTC on September 8, 2026”. Treasury’s release went up the next afternoon.

The Justice Department’s release does not give the date or say who pressed the switch. It says the Strike Force “thanks Tether for its proactive assistance”. Tether’s own release repeats the thanks and adds its record: more than 340 law enforcement agencies in 67 countries, more than $5 billion frozen. Those are its own figures, unaudited.

I first read this as a private company moving faster than governments. Elliptic’s account changes that. If it is right, a US agency used the one control point that sits on every USDT address, and the sanctions followed a day later. Tether, in Elliptic’s words, “has a built-in feature that allows the company to freeze wallets”. That feature did in one morning what Britain’s address list had not done in five and a half months.

Six of the seven were still open on 11 October. Times UTC, from Tether’s freeze events and TronScan. Bitrace attributes TMJfqu to Xinbi; I don’t know who controls the rest. The seven: TVEZ1g, TMJfqu, TK76ez, TFZinF, TRwrvg, TGBbLN, TAbR12. My count and design.

Twenty-Six Minutes

Xinbi’s payers did not wait for the press release.

If Xinbi had simply moved house, its customers would follow it to one new wallet. To test that, I took Xinbi’s regular payers, those active on five or more days in the 60 days before the freeze, and followed the 400 largest. After the freeze, 310 of them sent USDT on, about $67 million in all (my count). Most of it went to destinations that fewer than four of them shared, and I have not followed it.

Twenty wallets outside the 52 took money from four or more of the 400, about $5.3 million in all. The biggest, with $3.5 million, was the collector of Part II’s wallet tree, in use since April. The seven in the figure are among the other 19, chosen because each was activated after the freeze. The first of them, TVEZ1g…, was activated at 08:26 UTC, 26 minutes after the freeze began. It took its first USDT at 08:31, money from the wallet tree at 09:39 and money from one of the 400 at 10:07. It has been idle since 22 September.

One of the seven in the figure was caught. TMJfqu…, activated at 08:41, took in about 1.84 million USDT, sent 1.8 million on and was frozen at 18:29 with 37,839 left. That is the wallet the analytics firm Bitrace described, via CryptoSlate: a replacement that “moved about 1.8 million USDT before another restriction was imposed, leaving roughly 37,839 USDT stranded”. Bitrace says the replacements “provided only a brief escape” and that new wallets were “frozen again on the evening of Sept. 8”. Tether’s events do show eight more addresses outside the 52 frozen that day, and I don’t know whose they all are. But the other six in my figure were never frozen. When I checked on 6 October, four of them had moved USDT that day.

The new wallets don’t pay each other or a common sink. Two of them, TVEZ1g… and TAbR12…, are paid by the wallet tree that had paid Xinbi’s addresses 90 times before the freeze. That tree is unfrozen too.

So there was no single successor. Many new wallets each took from a handful of former payers, which fits a marketplace whose vendors each opened a new wallet better than one operator moving house.

So is the Xinbi wallet from Part I, the one that paid the compound’s address 8,000 USDT. The FBI’s Anlong Veng affidavit gives the transaction; matching it to this wallet is my work. It is on neither the British list nor the American one, and Tether has not frozen it. It last moved USDT on 20 June 2026.

Some money still arrived at the old addresses. After the freeze, 143 senders made 172 transfers into the frozen addresses, $1.22 million in all, to wallets that could no longer send anything on (my count). I don’t know who they were. Customers who had not heard, or victims told by a scammer where to pay: both are possible, and I can’t tell them apart.

Xinbi itself, as Part II told, condemned “arbitrary freezing” and moved about $2.8 million into USDD, a stablecoin whose claims to be unfreezable Elliptic calls contested. The State Department’s statement on 9 September closed with a promise: “cybercrime, fraud, and predatory schemes end here.” By then the first new wallet had been taking money for about a day.

Telegram moved last. At 16:20 UTC on 9 September, about two hours after Treasury’s release went up, Elliptic reported that Telegram had deleted the central channels and banned the usernames, “likely in response to the US sanctions”. In the same post Elliptic says Telegram had “refused to close Xinbi Guarantee, despite clear evidence of its illicit activity”. Telegram had removed Xinbi’s channels once before, on 13 May 2025, and Xinbi came back on the same account (Part II).

Brand by Brand

Enforcement has bitten before. Huione Guarantee was the largest of these marketplaces. After Telegram’s takedowns in spring 2025, TRM reported that Huione’s and Haowang’s transaction volumes fell “by nearly 100 percent” and Tudou’s by about 74%. Tudou, which had taken in many of Huione’s vendors, wound down in January 2026 after $12 billion in transactions. Elliptic saw “a sudden drop in activity” in its central wallets in the days after Chen Zhi, chairman of the sanctioned Prince Group, was arrested in Cambodia and sent to China on 6 January. FinCEN has gone after the next move in advance: its pending rule would extend its measure against the Huione Group to “H-Pay Service PLC and any successor entity”.

Each of those hit a brand. The market moved to the next one. Between 12 May 2025, the day before Telegram’s first ban, and 22 December 2025, while its rivals collapsed, Xinbi’s daily inflows “nearly doubled”, TRM says. Treasury’s own release says cybercriminals moved to Xinbi after FinCEN’s action against Huione. Elliptic expected Tudou’s customers to disperse “across dozens of guarantee marketplaces”. After Xinbi’s freeze, some of the money I traced was going to new wallets within hours.

The Other Gate

The compounds have a second kind of protection: armed guards.

Treasury says the Democratic Karen Benevolent Army, the DKBA, “not only provides security for the Tai Chang compound and permits its continued operation, but also actively participates in violence against victims of human trafficking trapped inside the compound” (sb0312, November 2025). It says the Karen National Army “provides security at scam compounds in Karen State” (sb0129, May 2025). The EU listed DKBA commanders in July 2026: the DKBA “has allowed scam centre compounds to operate under its protection”, in the words of the EU’s regulation.

When Myanmar’s army raided KK Park in October 2025, Prachatai and TCIJ reported, citing local sources, that senior managers had “already been informed about the pending action”, and that the armed groups moved bosses out “before the backhoes arrived”. “Lower-level scam workers were left to find their own way out.” In Cambodia, as Part I noted, Amnesty International found evidence of state intervention at only 24 of 86 compounds.

I looked for a link between the two gates and did not find one. Xinbi’s designated addresses never transferred directly with any of the 304 other Tron addresses on OFAC’s list, across their full history. One step further out, checking the most recent 4,000 transfers of each of those 304, thirty-seven wallets dealt with both sides, and 23 of them are exchange hot wallets, which everyone uses. No document I have read connects the armed groups guarding the compounds with the people running the payment rail. They protect the same business at different ends, and that is all I can show.

Restrained, Not Returned

What happens to the money that does get caught is the slowest part.

The Strike Force says it has restrained “approximately $938 million”. IBTimes UK calls it “the enforcement reach of the Strike Force, rather than a published victim-return total”, and points to one case in March 2026 where the Justice Department said it would return about $470,735 to two victims in Maine. Xinbi’s $48.8 million was still frozen on 11 October, none of it destroyed or released.

The largest case of all is still in court, and the forfeiture is contested. The US is trying to forfeit 127,271 bitcoin it links to the Prince Group. On 25 September the judge struck the claims of two alleged victims and refused seven more permission to file late, finding, CryptoSlate reports, that all nine lacked standing. The docket shows other claimants still fighting the forfeiture this month. The bitcoin has not been forfeited or paid to anyone.

The new partnerships are slower still. On 3 September the Strike Force signed a memorandum with the UK’s Crown Prosecution Service and National Crime Agency, promising “an in-person disruption event with private industry partners” in London “in early October”. US Attorney Jeanine Pirro marked the signing: “Standing together, we are invincible.” As I write, on 11 October, I can find no report that the London event has happened.

Who Kept the Gate Open

Part I found the people: a 19-year-old from Melaka who wanted a waiter’s job, and others like him, held and made to work. Part II followed a compound’s money as far as deposit addresses Arkham labels Binance.

Nobody held this gate alone. A sanctions list named two empty wallets and was not updated for 167 days. A Treasury release left the trafficked out of its reasons, so the reason that travelled was fraud. And when the one switch that worked was finally pulled, the market opened a new wallet in 26 minutes.

That is the second sense of the title. The money settles in seconds. The arrangement settles too, because every control I found arrived after the money had moved.

On 9 September Britain’s list for Xinbi grew from two addresses to 40. Every one of them was already frozen.

Arrived.

Sources and Further Reading

1. UK Foreign, Commonwealth and Development Office. “Sanctions Notice, Global Human Rights,” 26 Mar 2026. Entry GHR0190, page 11.
2. UK Foreign, Commonwealth and Development Office. “Sanctions Notice, Global Human Rights,” 9 Sep 2026.
3. US Department of the Treasury. “Treasury Cracks Down on Transnational Criminal Organization Behind Cyber Scam Operations Targeting Americans,” sb0624. 9 Sep 2026.
4. Office of Foreign Assets Control. “Recent Actions,” 9 Sep 2026 (the Xinbi Guarantee entry and its 52 Tron addresses).
5. US Department of State, Thomas Pigott. “Dismantling Transnational Criminal Organization Xinbi Guarantee.” 9 Sep 2026.
6. US Attorney’s Office for the District of Columbia. “Scam Center Strike Force Conducts Seizures of Chinese-Run Illicit Scammer Marketplace, and Restrains $52 Million in Laundered Crypto Scammer Funds In One Day.” 9 Sep 2026. Also published by the US Secret Service.
7. US Department of the Treasury. “Treasury Sanctions Cambodian Tycoon and Businesses Linked to Human Trafficking and Forced Labor in Furtherance of Cyber and Virtual Currency Scams,” jy2576. 12 Sep 2024.
8. US Department of the Treasury. “Treasury Sanctions Burma Warlord and Militia Tied to Cyber Scam Operations,” sb0129. 5 May 2025.
9. US Department of the Treasury. “Treasury Sanctions Burma Armed Group and Companies Linked to Organized Crime Targeting Americans,” sb0312. 12 Nov 2025.
10. US Department of the Treasury. “Treasury Sanctions Cambodian Senator Kok An and Scam Center Network Defrauding Americans,” sb0469. 23 Apr 2026.
11. Tom Robinson, Elliptic. “Elliptic helps the U.S. Secret Service freeze $52.8 million Xinbi scam assets.” 9 Sep 2026, with an update at 16:20 UTC.
12. Tether. “DOJ Credits Tether’s Assistance in $52 Million Enforcement Action Against Global Scam Network.” 11 Sep 2026.
13. Oluwapelumi Adejumo, CryptoSlate. “How Tether’s $45 million crackdown drove Southeast Asian scam compounds into an ‘unfreezable’ decentralized stablecoin.” 9 Sep 2026 (Bitrace figures).
14. TRM Labs. “How Telegram’s Ban on Huione and Xinbi Has Reshaped the Guarantee Services Landscape.” 30 Jul 2025.
15. TRM Labs. “Xinbi Marketplace Remains Active with USD 17.9 Billion in Total Volume Despite Enforcement Actions.” 6 Feb 2026.
16. Tom Robinson, Elliptic. “Tudou Guarantee winds down operations after $12 billion in transactions.” 19 Jan 2026.
17. FinCEN. “FinCEN Extends Comment Period for Proposed Rule To Amend the Definition of Huione Group.” 22 Jul 2026.
18. Council of the European Union. Implementing Regulation (EU) 2026/1895, 30 Jul 2026 (the DKBA entries).
19. Prachatai English and TCIJ. “The Myawaddy scammer crackdown.” 28 Aug 2026.
20. Amnesty International. “Cambodia: Evidence suggests scamming compounds bypassed despite high-profile ‘crackdown’.” 8 Jun 2026.
21. Dani Oh, IBTimes UK. “The $938m Scam-Centre Crypto Trail: Can the US Turn Freezes Into Money Returned to Victims?” 22 Sep 2026.
22. United States v. Approximately 127,271 Bitcoin, No. 1:25-cv-05745 (E.D.N.Y.). Docket, via CourtListener. Memorandum and order of 25 Sep 2026 (entry 506); checked 6 Oct 2026.
23. Liam ‘Akiba’ Wright, CryptoSlate. “US court blocks victims from 127,000 seized Bitcoin, and petition rules are blamed.” 1 Oct 2026 (the 25 Sep order).
24. IRS Criminal Investigation. “U.S. and UK launch first-of-its-kind joint alliance to dismantle global scam centers.” 3 Sep 2026.
25. Federal Bureau of Investigation, affidavit in support of a seizure warrant for t.me/pogojobhiring2023. Case 26-SZ-32 (D.D.C.). Sworn 22 Apr 2026. Paragraph 57 (the transfer with Xinbi Guarantee).
26. Header image: my collage of a rice field in Central Luzon, the Philippines (rawpixel, public domain), a gate cut from “Rustic Wood” by Derek Fleming (Flickr, Public Domain Mark), “Chain Links” by Leeroy (StockSnap, CC0), and red paper (Rijksmuseum, public domain) torn to the outline of a torn-paper photograph (rawpixel, public domain).
27. On-chain data: USDT (TRC-20) transfers, account activations and Tether freeze events on Tron, pulled through TronGrid and TronScan, 5 to 6 Oct 2026. Figure 3 is mine, from the same data and a freeze-status check on 6 Oct 2026. Figures marked “my count” are mine and have not been checked by anyone else.