Terror Finance Weekly

“Sunlight is the best disinfectant.”

Welcome back,

Between Xinbi and Sukkot? This issue reaches you between Yom Kippur and Sukkot. Sukkot is the festival of the temporary structure, the booth is built with prior knowledge that it will be taken down. Xinbi, however, built their structure and conducted maneuvers in order not to be taken down. Our lead story describes in detail the sequence step by step, because it is a specific playbook that will most certainly be run again.

On our own work: the first piece in our Hezbollah Financial Reports series, which models the organization the way an equity analyst models a company, is with a small group of readers now. If you would like an early look or a briefing, reply to this email.

We will be at the International Institute for Counter-Terrorism’s (ICT’s) World Summit 2026 in Herzliya, 5 to 8 October. On 8 October CENTEF will run a two-hour workshop, “Terror Financing: An Ancient Craft in the Age of AI,” with Dr. Matthew Levitt, Dr. Tamar Landau, Dr. Emanuele Ottolenghi, Mr. Nir Klaron and Adv. Barry Jonas. If you cannot make it to Herzliya, we will broadcast it live and send details soon.

Chag Sameach to all who are celebrating. As always, please reply.

Sharon Gal

Chief Executive Officer, CENTEF

 

OFAC Targets “Xinbi Guarantee” Cyber Scam Network: A Follow-Up

CENTEF ANALYSIS  ·  14 to 20 September 2026

The moves Xinbi made before and after the crackdown are textbook, and law enforcement agencies worldwide should study them and prepare accordingly.

We continue to follow and dig deeper into the story we brought you last week in Newsletter #3. Taking down Xinbi is a welcome blow to terror financiers and money launderers in Southeast Asia, as well as to the criminal and terrorist syndicates they serve. We hope it will expedite further complementary action by authorities to free the thousands of innocent people held in compounds across the region.

Here is the sequence.

1 June 2025: Move to an encrypted messaging platform. To reduce dependency on Telegram amid rising law enforcement scrutiny, Xinbi began migrating its merchants, escrow chats and money-laundering coordination networks to SafeW, a custom encrypted messaging application developed by SafeW Technology Co., Ltd. [Mallory AI, 10 September 2026]

1 December 2025: Move to proprietary no-KYC wallet infrastructure. Xinbi launched XinbiPay, developed by Anwen Technology Co., Ltd., an internal non-custodial wallet infrastructure that enabled no-KYC asset routing across TRC20, ERC20, BEP20, ETH and TRX. The closed-loop payment system obscured transaction paths and shielded user balances from centralized exchange controls. [FinCrime Agent, 14 September 2026]

8 September 2026: Emergency transfers. A day before the enforcement action, sub-guarantee platforms linked to Xinbi triggered emergency outflow spikes, moving funds out of high-risk operational addresses at rates rising from $389,000 to $1.81 million per day, ahead of the expected on-chain blacklisting. [Mallory AI, 10 September 2026]

9 September 2026: DeFi staking and protocol abstraction. Hours before the address freezes took effect, a primary business address linked to Xinbi transferred 1.8 million USDT into JustLend, a TRON-based lending protocol, converting liquid stablecoins into jUSDT, a yield-bearing receipt token. This obscured direct ownership, added a layer of protocol abstraction, and positioned the funds to be redeemed as assets that could not be frozen. [Beosin, 18 September 2026]

9 September 2026: The USDD shift. Following Tether’s freeze of $52 million in USDT across 52 TRON addresses, Xinbi’s operators publicly condemned the compliance action in an official statement to users, calling it arbitrary and warning that recovering the frozen USDT would be a lengthy process. They instructed all vendors to shift settlement immediately to USDD, a TRON-based decentralized algorithmic stablecoin with no centralized smart contract blacklist function. [The Record, 9 September 2026]

9 to 10 September 2026: Fragmentation, chain hopping and DEX layering. Xinbi deposit addresses initiated batch transfers into USDD to secondary withdrawal wallets, breaking the funds into fragmented multi-layer transactions across decentralized exchanges including SunSwap, to obscure the source before converting back to clean liquidity. [Beosin, 18 September 2026; Altcoin Buzz, 10 September 2026]

11 September 2026: Vendor relocation to second-tier markets. Following the deletion of Xinbi’s primary Telegram channels and court-ordered account bans, displaced vendors and liquidity pools migrated to alternative second-tier guarantee platforms, most notably Panda Guarantee and Crown Guarantee. [Beosin, 18 September 2026]

16 September 2026: Full ecosystem pivot to SafeW and XinbiPay. With its Telegram channels permanently closed, Xinbi transitioned its chat coordination and escrow functions to the SafeW encrypted messaging app and routed all non-KYC token transfers through the XinbiPay architecture. [CryptaCount, 16 September 2026]

Read end-to-end, the list makes one point that should shape what comes next. The freeze worked because the funds sat in USDT, whose issuer can destroy and reissue tokens on request. Freezability was a property of one company’s product, not of crypto, and Xinbi understood that within hours. Institutions with exposure to TRON-based settlement should be asking whether their screening tells apart the stablecoins with an issuer who can be served with process from those built so that nobody can.

ALSO THIS WEEK

OFAC Designates the Exchange Layer of Iran’s Crypto Economy

U.S. TREASURY / OFAC  ·  Week of September 14, 2026

Treasury designated the exchange BitBank, the software developer Pishtaz Simorgh, the exchange Nobitex, and related entities, describing a channel that moved hundreds of millions of dollars in Bitcoin for the Islamic Revolutionary Guard Corps (IRGC). Treasury separately convened global financial institutions to press Operation Economic Outcast forward.

August’s sectoral determination created the authority. Now we’re seeing this authority in use, and it lands on the on-ramps and off-ramps, the places where rials become dollar-denominated crypto and back again. Now what you should be watching is whether exchanges in jurisdictions with no Iran program of their own actually delist the flagged infrastructure, because that behavior, not the designation, is what the no-nexus model is betting on.

Prosecutors Place $61 Million of Iranian Oil Money Inside Binance

FINANCIAL TIMES  ·  Week of September 14, 2026

U.S. prosecutors said Chinese groups laundered $61 million in proceeds from Iranian black-market oil sales through accounts at Binance.

Read this next to the item above and the week contains two different problems. A designated Iranian exchange can be cut off, because being cut off is the whole point of designating it. Binance sits inside the regulated perimeter, screens its customers, and the money moves anyway. That is a detection failure rather than an access failure, and it is the harder of the two to legislate against. An enforcement action punishes one institution. A published typology tells every other institution what the pattern looked like, which is worth considerably more.

The Arab League Lifts Syria Sanctions, and the AML Test Begins

AGBI / ENAB BALADI  ·  Week of September 14, 2026

The Arab League ended its sanctions on Syria, following the U.S. withdrawal of Syria’s state sponsor of terrorism designation in August. Capital and bidders for reconstruction contracts are returning to Damascus, which is now seeking reconnection to international banks and payment networks, and facing watchdog scrutiny of its anti-money-laundering and counter-terrorist-financing controls.

This is the stage we flagged four weeks ago when we asked whether sanctions relief behaves like a light switch or a dial. The switch flipped in August. What follows is not political, it is a sequence of individual correspondent banks each deciding, one relationship at a time, whether the risk has genuinely lifted or merely been relabelled. The question that decides it is the one we keep returning to: whether the Hezbollah-linked financial entities built under Assad are being dismantled or simply re-papered.

The IMF Returns to Beirut

DAILY BEIRUT  ·  Week of September 14, 2026

Lebanese Finance Minister Yassine Jaber launched technical discussions with an International Monetary Fund (IMF) mission in Beirut. These meetings are crucial for advancing necessary fiscal reforms, stabilizing Lebanon’s financial sector that has not functioned normally since 2019 (some claim well before that), and establishing international backing as security and peacekeeping structures shift. Apart from stabilizing Lebanon itself, these reassuring steps also further weaken Iranian influence in the Middle East through its terrorist proxy groups, thus also contributing to Operation Economic Outcast.

Kuwait Sentences Five in Hezbollah Financing Cases

DAILY BEIRUT  ·  Week of September 14, 2026

Kuwait’s State Security Court of Appeal imposed prison terms and fines on five defendants across two separate cases involving membership in, and financing of, Hezbollah.

Designations and prosecutions are not the same instrument. Gulf prosecutions in this area remain rare enough that each one carries signals beyond its own facts. What to watch is whether other GCC states bring comparable cases, which would matter a great deal more than these five sentences do.

About this brief. Terror Finance Weekly is compiled by CENTEF from open-source reporting and primary government releases for research and situational-awareness purposes. Items reflect developments published between September 14 and 20, 2026. On-chain movements described here are drawn from third-party blockchain analytics and are attributed to the firms that published them. Allegations described in designation notices and indictments are the issuing authority’s findings and carry a presumption of innocence unless proven in court. Reporting is attributed to the outlets named; the judgments drawn from it are CENTEF’s own. Headlines link to source material where available.