US Cracks Down on $2.29 Billion Cybercrime Marketplace Linked to North Korean Hackers

Post Views: 11

US Designates Cybercrime Platform Linked to North Korean Actors as Transnational Criminal Organization The US government has taken action against Xinbi Guarantee, a digital marketplace accused of facilitating large-scale cybercrime and financial fraud.

US Government Action Against Xinbi Guarantee

The designation by the Treasury Department’s Office of Foreign Assets Control (OFAC) highlights the platform’s role in enabling illicit activities, including money laundering and cyber scams targeting US citizens.

Platform’s Role and Transactions

The platform, which operates in Chinese, has been linked to criminal networks across multiple regions, with allegations of processing over $24 billion in transactions since its inception around 2022. This figure includes both digital assets and fiat currency, with the majority of activity concentrated in Southeast Asia.

Authorities’ Claims and Connections

Authorities claim Xinbi provided critical infrastructure for scam operations, allowing cybercriminals to access goods, financial tools, and resources necessary for sustained fraudulent activities. The platform’s services reportedly extended to sanctioned entities, including the Jin Bei Group and members of the Prince Group, a transnational criminal organization.

North Korean Involvement

North Korean hackers have also been implicated in using the platform, according to US officials. Cybersecurity analysts have traced cryptocurrency stolen by North Korea-linked actors to Xinbi’s network, suggesting the marketplace served as a conduit for laundering illicit funds.

WazirX Breach and Evidence

A 2024 breach of the Indian cryptocurrency exchange WazirX, which resulted in a $235 million loss, further underscores Xinbi’s alleged involvement. Blockchain analysis by Elliptic revealed that approximately $220,000 in USDT from the theft was routed through Xinbi’s infrastructure via nine transactions in November 2024.

This evidence suggests that vendors on the platform may have assisted in laundering proceeds from the attack.

Shift to SafeW

In response to increased scrutiny, Xinbi reportedly shifted operations to SafeW, an encrypted messaging service, around June 2025. The platform encouraged users to coordinate transactions through SafeW as regulatory pressure on digital crime hubs intensified.

US Action and Sanctions

The US action against Xinbi included coordinated efforts with the Department of Justice’s Scam Center Strike Force, resulting in the seizure of digital assets and infrastructure linked to the organization. Elliptic reported that the US Secret Service froze wallets associated with Xinbi and its merchants, containing roughly $52.8 million in cryptocurrency.

Broader Initiative and Conclusion

The crackdown follows a broader initiative targeting scam centers in Southeast Asia, where authorities estimate billions in losses to US victims annually. These operations rely on complex networks of payment processors, digital currencies, and encrypted communications to execute investment fraud and other schemes. The sanctions imposed on Xinbi require US entities to block assets and interests tied to the organization, prohibiting transactions unless explicitly authorized. The move aims to disrupt the financial and technological infrastructure enabling cross-border cybercrime. This action reflects ongoing efforts to sever criminal networks from digital payment systems, messaging platforms, and financial intermediaries used to conceal illicit gains. The designation of Xinbi as a transnational criminal organization underscores the evolving strategies of cybercriminals and the global response to their activities. Authorities emphasize that such measures are part of a sustained effort to protect financial systems and mitigate the impact of cyber-enabled fraud on victims worldwide.