Xinbi Guarantee Scam Marketplace Disruption
First seen Sep 10, 2026 · Updated Sep 10, 2026
The U.S. Department of Justice disrupted Xinbi Guarantee, an online marketplace facilitating scam services for Chinese organized crime groups, seizing associated Telegram channels and freezing $52.8 million in cryptocurrency. The action also included physical disruption of 13 scam compounds in Madagascar linked to romance and investment scam operations (commonly known as 'pig butchering' schemes).
Technical Analysis
Xinbi Guarantee operated as an escrow-style marketplace connecting scam operators with money laundering services, fraudulent identity documents, and technical infrastructure used to run romance/investment scams, primarily coordinated via Telegram channels. The DoJ action involved seizure of two cryptocurrency wallets and takedown of platform communication channels, disrupting the financial and logistical backbone of the scam network rather than exploiting a specific software vulnerability. This is a law-enforcement disruption of a fraud-enablement ecosystem rather than a technical malware or exploit campaign, so no CVEs or malware samples are directly involved. There is no direct evidence of impact to AI agent systems, LLM tool use, or RAG pipelines from this action, though scam operators of this type increasingly leverage AI-generated content (deepfakes, chatbots) for social engineering, which organizations deploying customer-facing AI agents should monitor as an adjacent risk.
Affected Systems
Telegram-based communication channels used by Xinbi Guarantee; two cryptocurrency wallets (unspecified blockchain); physical scam compound infrastructure in Madagascar
Indicators of Compromise
- Telegram channels associated with Xinbi Guarantee (specific handles not disclosed in source)
- Two seized cryptocurrency wallet addresses (not disclosed in source)
Remediation Steps
- 1
Public awareness and reporting
Financial institutions and individuals should report suspected pig-butchering or romance/investment scam activity to FBI IC3 or local law enforcement.
- 2
Cryptocurrency exchange monitoring
Exchanges and wallet providers should monitor for transactions linked to known scam-marketplace wallet clusters and apply enhanced due diligence.
- 3
Telegram channel vigilance
Organizations providing messaging or social platforms should monitor for re-emergence of similar guarantee/escrow scam marketplaces under new branding.
- 4
Employee and customer awareness training
Conduct awareness training on romance and investment scam tactics, particularly those increasingly using AI-generated personas or chatbots for initial engagement.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.