The Outlier Lab

Scam Center Strike Force seizes a scam services marketplace

US prosecutors seized a Telegram guarantee marketplace serving scam centers and restrained about $52 million in crypto in one day, while OFAC sanctioned the marketplace and two technology suppliers.

What happened

On September 9, 2026, the US Attorney's Office for the District of Columbia announced that the Strike Force had seized Telegram channels belonging to a guarantee marketplace, a venue where vendors sell services to scam center operators and the platform holds payment in escrow until delivery. A federal court in DC had authorized the seizure on September 7. Vendors there advertised building fake investment websites, laundering money taken from wire fraud victims, and recruiting trafficked workers for compounds in Southeast Asia.

The same day, the Strike Force restrained more than $52 million in cryptocurrency, seized two of the marketplace's wallets holding about $12 million, and sought restraint of 47 more wallets tied to laundering vendors. Investigators traced US victims' funds to vendors who posted wallet addresses for payment. The release credits a stablecoin issuer with proactive help and puts the Strike Force's cumulative restraints at about $938 million.

Treasury's OFAC designated the marketplace as a significant transnational criminal organization under E.O. 13581, along with two suppliers: a Cambodia-based company that built its crypto wallet app and a Singapore-based company that built the encrypted messaging app it moved its merchant networks to around June 2025. Treasury says the marketplace has processed the equivalent of more than $24 billion since about 2022, and that users shifted there after FinCEN's earlier action against another regional payment platform. North Korean hackers and entities in the previously sanctioned Prince Group network reportedly used it.

The DOJ release also announced that the Strike Force will expand to target compounds worldwide. A team spent two weeks in Madagascar supporting the takedown of 13 scam centers, processing more than 3,200 devices and interviewing nearly 400 arrestees.

Why it matters for transaction fraud teams

Guarantee marketplaces are where the Fraud-as-a-Service Ecosystem buys its inputs. The services on offer include account creation, which for a US fintech means farmed or purchased accounts used as receiving and laundering endpoints (Account Farming and Resale, Money Mules). Taking one venue down raises costs briefly. Treasury's own account of users moving from one platform to this one after an earlier action shows that displacement is the expected result, so plan for continued volume.

The designation creates compliance work. OFAC blocking is strict liability, covers entities 50 percent or more owned by blocked persons, and reaches dealings in property of the designated parties. Exchanges, crypto-enabled neobanks and payment apps need to confirm that screening covers the new SDN entries, including any listed digital currency addresses, on both inbound and outbound transfers.

The restraint shows where recovery happens. Seizures depend on wallet addresses reaching investigators quickly and on stablecoin issuers that will freeze. FinCEN's alert six days earlier flagged stablecoins whose issuers won't cooperate, which makes the payment asset a recovery-odds signal. Victim-side teams at banks and brokerages rarely capture the destination wallet in the case record, and that gap limits what law enforcement can do with a referral.

What to do now

  • Confirm sanctions screening has picked up the September 9 SDN entries, including any digital currency addresses, and run a lookback on prior transfers.
  • Make destination wallet addresses, exchange names and transaction hashes required fields in scam case notes and IC3 referrals.
  • Record which stablecoin and network each scam payment used, so you can see which issuers your victims' funds pass through.
  • Watch new-account cohorts for mule and farmed-account patterns after the takedown, such as shared devices, aged-but-dormant accounts that suddenly receive funds, and fast in-and-out transfers to exchanges.
  • Add guarantee-marketplace exposure to your Threat Intelligence and Horizon Scanning watchlist as a source of new account and laundering supply.

What to watch

  • Civil forfeiture complaints against the restrained funds and any remission process for victims. A restraint is only the first step toward returning money.
  • Where vendors relocate. The designated messaging app was already the marketplace's fallback channel.
  • The Strike Force's overseas work, which may produce more seizures of the infrastructure that serves compounds in Southeast Asia and beyond.

Sources

Updates

  • 2026-10-26: Published.