Two firms watched the same freeze and reported two different numbers. Elliptic, which fed intelligence to the Secret Service, per Decrypt was tied to a freeze of $52.8 million across 52 wallets. Bitrace, tracking the operational fallout, counted at least $45 million across at least 22 addresses. Both are correct, and the gap between them is the whole story.
The 52-wallet figure is the sanctions perimeter: the addresses OFAC designated, the addresses that received over $8.4 billion in stablecoins. The 22-wallet figure is the live payment network—the deposit, routing, and withdrawal addresses Xinbi was actually using to move money the morning the hammer came down.
Freezing the first set immobilizes evidence. Freezing the second set breaks a business. On September 8, agents did both.
Freezing the first set immobilizes evidence. Freezing the second set breaks a business. On September 8, agents did both.
Start with the clock, because the speed is the point. At 8am UTC, the Secret Service began freezing 52 USDT wallets tied to Xinbi Guarantee, the second-largest illicit marketplace ever tracked at roughly $24 billion in lifetime volume. Two of those wallets, holding about $12 million, were seized outright under an unsealed warrant. The rest were frozen pending action.
Xinbi did what a sophisticated operator does: it spun up fresh addresses. Bitrace reported those replacement wallets were frozen again by the evening of the same day—less than 12 hours later.
One replacement business address had just been activated on September 8. It managed to move about 1.8 million USDT before the second restriction landed, leaving 37,839 USDT stranded on-chain. That number is the texture of the fight: a launderer racing the blacklist, clearing most of the balance, and getting caught mid-transfer.
This is enforcement legacy systems cannot match. Bitrace explicitly contrasted it with the 2024 action against Huione Group, where about $29.6 million was frozen in a single address while the rest of the operation kept running. Against Xinbi, the freeze spread across the entire infrastructure—deposits, intermediaries, withdrawals, the Xpay hot wallets, even third-party OTC operators with close financial ties.
One of those OTC operations had processed more than $72 million over the preceding year. Another had taken less than $850,000 through Xinbi. Both got caught in the net. The perimeter was drawn by money flow, not by name.
Tether's scale here is not incidental. The company says it works with more than 340 agencies across 65 countries; its T3 unit with Tron and TRM Labs had frozen more than $450 million by May, and Stable.rip data shows more than $4 billion in USDT blacklisted over time. The freeze switch is now a standing weapon, not an emergency measure.
So the tool works. The harder question is against whom.
Here the substitution logic matters, because Xinbi's DPRK clients were never trying to hide. Chainalysis's finding is precise: the laundering works through substitution, not obfuscation. Specialized "Black U" vendors accept traceable, DPRK-linked stolen funds and hand back stablecoins sourced from separate illicit streams—the proceeds of pig-butchering and romance scams flowing through the same marketplace.
The stolen crypto—tens of millions traced from the $1.5 billion Bybit breach and the $235 million WazirX theft—gets absorbed into a much larger pool of dirty money. The North Korean actors walk away with nominally clean stablecoins and route them to unlicensed OTC desks for conversion to fiat.
Read that mechanism against the freeze switch and the ceiling becomes visible. Blacklisting bites the traceable, tainted funds—the ones the launderer was already trying to shed. The output of the swap is clean-by-provenance USDT that no analytics firm has yet flagged, sitting in wallets no warrant has yet named.
The freeze is fastest and most complete precisely against the launderers who least need to escape it: Xinbi's own operational rails, its known deposit addresses, its identified hot wallets. Those are the targets whose infrastructure is legible. The hard target—the actor who has already substituted into an unmarked pool—has by design placed himself where the switch has nothing to grab.
And when the operational rails do get frozen fast enough, the response is not better obfuscation. It is a different token.
Xinbi condemned the "arbitrary freezing," promised to compensate customers, and then told users it would accept only USDD going forward. It swapped about $2.8 million of its remaining USDT into USDD through a decentralized exchange; separately, per CryptoSlate, Xinbi-related funds moved through Tron's JustLend and jUSDT before accumulating the new token.
USDD, launched by Justin Sun and carrying roughly $1.5 billion in circulation, describes itself in its own documentation as "tamper-proof and cannot be frozen." It has no central issuer capable of blacklisting a holder. For Xinbi, a design principle became an operational advantage: even if investigators find the next payment address, they cannot repeat the token-level freeze that disabled the earlier wallets.
This is the reframe. The effectiveness of the freeze is exactly what drove the migration. The more precisely Tether could strand replacement wallets within 12 hours, the stronger the case for abandoning the freezable token entirely.
Which means the enforcement perimeter is moving off the token and onto the infrastructure around it. Bitrace and CryptoSlate both land in the same place: Tether can chase USDT from wallet to wallet, but it cannot impose the same restriction on USDD. The contest shifts to the exchanges, bridges, and OTC desks needed to acquire, move, and cash out the new stablecoin.
That is where "unfreezable" reveals its seam. A token that resists address-level freezes still has to be bought, exchanged, and ultimately converted to fiat—and every one of those touchpoints runs through a centralized service vulnerable to law-enforcement pressure. Resistance to freezing is not resistance to enforcement; it is a relocation of the enforcement surface.
There is a sharper tell buried in the USDD claim itself. Part of USDD's own reserves are backed by USDT—the very asset with the freeze switch Xinbi is fleeing. The "cannot be frozen" marketing rests, in part, on the frozen-able collateral underneath it.
That is a compliance seam that has not yet been pulled. If pressure ever reaches the reserve layer, the token that markets itself as beyond the switch is partially built on the switch. Whether that seam ever gets tested is a policy and enforcement question, not a technical one.
The scoreboard, for now, favors the state. The DOJ's Scam Center Strike Force has seized roughly $938 million in scam-linked crypto since launching in November 2025, and on the same day it hit Xinbi it deployed agents to Madagascar to help take down 13 Chinese-run scam compounds. Xinbi's outstanding balance is still on the board.
But the next phase is a race, not a checkmate. It will test whether Xinbi can rebuild a functioning payment network around USDD faster than investigators can target the counterparties that make that network usable.
The lesson from the 12-hour freeze is not that the switch is broken. It is that the switch works so well it teaches its targets where not to stand. Enforcement wins the wallet and loses the perimeter—unless it follows the money to the desks and bridges where "unfreezable" still has to become dollars.