Tether blacklisted 10 TRON addresses holding a combined 39,273,713 USDT on 8 September, freezing roughly $39.3 million linked to the Telegram escrow marketplace Xinbi Guarantee.
MistTrack, the on-chain tracing platform built by SlowMist, flagged the freeze within hours of the blacklist going live and connected the addresses to the marketplace through inbound transfers from wallets already tagged as Xinbi-linked.
The restriction operates at the token-contract level, meaning the affected USDT cannot be transferred by anyone. TRON itself continued operating normally, and USDT’s peg was unaffected.
The wallets remained frozen as of Wednesday.
The balances were lopsided
The distribution across the 10 addresses is worth noting, because it tells you something about how the network was organised.
One wallet held about 10.78 million USDT. Three others carried roughly 8 million each. A fifth held 2.04 million, with two more at 1.28 million and 1.17 million.
The remaining three addresses held exactly 1 USDT apiece.
Those are almost certainly placeholders, addresses seeded with a token amount to keep them active or reserved. Blacklisting them alongside the funded wallets suggests Tether or its sources had reason to treat the whole cluster as a single operation rather than freezing only where the money sat.
What Xinbi actually is
Xinbi emerged around 2022 as a Chinese-language guarantee marketplace operating through Telegram.
The model is straightforward. A buyer and a merchant agree a deal, and a third-party guarantor holds the crypto until both sides are satisfied. That structure has legitimate uses. It also removes the need for either party to trust the other, which makes it useful for transactions where neither party wants to be identified.
Investigations have linked merchants on the platform to services used by online scammers, including laundering proceeds, producing fake identification documents and selling stolen personal information.
The UK imposed an asset freeze on Xinbi Company Limited in March 2026, citing suspected connections to fraudulent compounds and human rights violations, and identifying two TRON wallet addresses.
Elliptic separately found that approximately $220,000 in USDT connected to the $235 million WazirX hack had passed through Xinbi addresses.
The scale is the point
The $39.3 million frozen is a fraction of what has moved through the platform.
TRM Labs describes Xinbi as one of Southeast Asia’s largest illicit marketplaces and estimates roughly $24.2 billion in cumulative transaction volume since 2022.
The trajectory matters more than the total. When Xinbi first drew wider scrutiny in May 2025, investigators had traced about $8.4 billion. By February 2026, TRM estimated it had processed $17.9 billion since mid-2025 alone.
That growth happened during enforcement, not before it.
Telegram removed thousands of channels associated with Xinbi Guarantee and Huione Guarantee in May 2025 after researchers documented their activity. Xinbi resumed operations soon afterward. The UK sanctioned the company in March. Volume continued.
Tether has now frozen roughly $39 million of it.
Why USDT keeps being the chokepoint
The reason these freezes keep targeting the same asset is documented in enforcement data rather than speculation.
FinCEN analysed 33,904 suspicious activity reports filed by approximately 1,300 financial institutions between September 2023 and December 2025. It found that criminals accepted 22 different digital assets from victims, then systematically swapped the proceeds into USDT to process through offshore exchanges and DeFi protocols.
That consolidation is what makes Tether’s blacklist function such an effective lever. Illicit funds may enter the system in many forms, but they converge on one token, on one network, before moving out.
It also explains the scale of Tether’s enforcement activity. BlockSec found the issuer blacklisted 4,163 addresses during 2025, freezing $1.26 billion in USDT across Ethereum and TRON, including $514 million across 370 addresses in a single 30-day window.
What a freeze does and does not do
The action stops those specific tokens from moving. That is real and immediate.
It does not shut down Xinbi. The marketplace has already demonstrated that it survives channel removals and sanctions designations, and nothing about a wallet blacklist prevents it from generating new addresses tomorrow.
Nor does it recover anything for victims. Frozen USDT sits immobilised at the address where it was found. Tether can destroy and reissue those tokens to a government-controlled wallet, but only when a court order directs it, and no such order has been reported here.
What the freeze does achieve is disruption and cost. Working capital that was available on Monday was gone on Tuesday, and rebuilding it takes time.
The follow-on question, which this incident does not answer, is whether these interventions accumulate into anything. Xinbi’s volume grew through a mass channel removal and a UK sanctions designation. A $39 million freeze against $24.2 billion in throughput is a small percentage.
The uncomfortable read is that Tether’s blacklist is the most responsive enforcement tool in crypto and still operates one cluster at a time against an adversary that regenerates faster than the tooling can find it.
FAQ
How much was frozen and where?
Exactly 39,273,713 USDT, roughly $39.3 million, across 10 TRON addresses blacklisted on 8 September. Balances ranged from 1 USDT to about 10.78 million, with three addresses holding a single USDT each.
What is Xinbi Guarantee?
A Chinese-language escrow marketplace operating through Telegram since around 2022. TRM Labs describes it as one of Southeast Asia’s largest illicit marketplaces, estimating roughly $24.2 billion in cumulative volume. The UK sanctioned Xinbi Company Limited in March 2026.
Can the frozen funds be recovered?
Not automatically. A freeze immobilises the tokens where they sit. Tether can destroy and reissue them to a government wallet, but only when a court order directs it. No such order has been reported in this case.
Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making any investment decisions.
