Your Crypto Scammer Had a $24 Billion Marketplace. The US Just Shut It Down.

The Person Who Texted You "By Accident" Was Running a Script

They found you on Instagram, LinkedIn, or WhatsApp. Maybe they said they messaged the wrong number. Maybe they complimented your profile photo. Within a few days they were sharing trading tips, talking about a platform where they'd made serious money, and suggesting you try it yourself.

That script was written by a scam operation. The person delivering it may have been a trafficking victim, locked in a compound in Myanmar or Cambodia, forced to run fraud or face violence.

This is pig-butchering. And until September 9, 2026, the people running those operations had a $24 billion wholesale marketplace to order everything they needed.

How Does Pig-Butchering Actually Work?

The name comes from a Chinese phrase for fattening a pig before slaughter. You are the pig. The "fattening" is the weeks or months a scammer spends building your trust before asking you to invest.

Here is the supply chain behind that conversation.

A criminal organization sets up a scam compound, usually in Southeast Asia, often in lawless border zones. They staff it by trafficking workers, sometimes luring them with fake job ads promising legitimate call-center work. Once there, workers are forced to run romance fraud on real people. Those who don't hit quotas get beaten.

But the workers are just the front end. Behind them sits an entire criminal marketplace providing the infrastructure.

Fake investment platforms. Someone has to build the website that looks like a real crypto exchange, shows you fake profits, and locks up your deposit when you try to withdraw. Xinbi Guarantee sold those, ready to deploy.

AI deepfake tooling. The person video-calling you may not look like their profile photo in real life. Deepfake software, sold through platforms like Xinbi, lets operators fake the face of the attractive professional they've been pretending to be.

Stolen personal data. Scammers research their targets. They buy your data, your interests, your financial profile. That is how they know exactly what to say.

Fake identity documents. Moving money requires identities. Xinbi sold those too.

Money laundering services. Once you deposit, your money gets cleaned through layered crypto transactions and shell structures before it reaches the people at the top.

Xinbi Guarantee was not a fringe dark-web curiosity. It operated on Telegram, in Chinese, and it processed over $24 billion in cryptocurrency transactions since roughly 2022. That is the scale of one marketplace in one ecosystem of many.

What the US Government Did About It

On September 9, 2026, the US Treasury's Office of Foreign Assets Control sanctioned Xinbi Guarantee as a transnational criminal organization. The Justice Department and the US Secret Service froze $52.8 million in cryptocurrency tied to Xinbi and its vendor network.

Two supporting companies were sanctioned alongside it. Anwen Technology Co., based in Cambodia, built XinbiPay, the crypto wallet powering transactions on the platform. SafeW Technology Co., based in Singapore, built a messaging app used inside scam operations to coordinate workers and victims.

Sanctions mean US persons and businesses cannot transact with these entities, and their assets within US jurisdiction get frozen. It dismantles specific infrastructure and sends a legal signal. But it does not end pig-butchering. Other marketplaces exist. The demand that fuels them, desperate workers who need cash, criminal operators who want scale, and billions in potential victim funds, does not disappear with one designation.

What Should You Do Right Now?

The romance and investment scam threat is real and industrial in scale. Here is how you reduce your exposure.

1. Treat unsolicited contact as a signal, not just noise. A stranger who contacts you across any platform, builds rapport quickly, and mentions crypto investing is running a script. Not maybe. Statistically, that pattern maps almost exactly onto pig-butchering. You can be polite. You do not need to engage.

2. Never move money to a platform someone else introduced you to. Legitimate exchanges exist. If someone suggests a specific platform you have never heard of independently, the platform is fake. The "profits" you see are fake numbers in a database designed to make you deposit more.

3. Freeze your credit. This costs nothing in the US. It blocks new accounts from being opened in your name using stolen data. Go directly to Equifax, Experian, and TransUnion to do it. No third-party service needed.

4. Enable strong two-factor authentication everywhere. Use an authenticator app, not SMS. Scammers buy stolen credentials. A second factor makes those credentials far less useful.

5. Look up your data broker exposure. Sites like DeleteMe or Kanary charge a fee, but your state may have free opt-out tools. Reducing the data available for purchase narrows how precisely scammers can target and profile you.

6. If you have sent money, report it immediately. Contact the FBI's Internet Crime Complaint Center at ic3.gov and your bank. Speed matters. Crypto transactions are not always irreversible in the window right after they happen, especially if US exchanges are involved.

The Bigger Picture

The people who texted you were not entrepreneurial con artists working alone. They were nodes in a coordinated criminal industry with its own vendors, its own software developers, its own logistics, and its own labor supply sourced through trafficking.

Twenty-four billion dollars did not flow through Xinbi because a few bad actors got lucky. It flowed because the architecture for industrial-scale fraud exists, is well-funded, and is deliberately hard to trace.

Knowing this does not protect you automatically. But it changes the question. The right question is not "would I fall for a scam?" The right question is "would I recognize one before I'd already invested two months of trust?"

Do this now:

• Freeze your credit at all three bureaus
• Set up authenticator-app 2FA on your email, bank, and crypto accounts
• Screenshot and report any account that matches the unsolicited-contact-plus-investment pattern to ic3.gov

Sources

• thehackernews.com
• coindesk.com