This is an automated archive.
The original was posted on /r/cryptocurrency by /u/jbtravel84 on 2024-01-18 04:20:15+00:00.
40 MILLION! I think it's a conservative number.
We could be talking about 100's of MILLIONS from this one organization.
Investment scams are some of the worst type of blockchain crime around. This particular scheme appeared to to be targeting UK users through Whatsapp.
The group is a mix of hired guns (scammers) and victims interacting in a chatroom. All of the numbers appear to be +44 to make it look like a legit investing operation. The hired guns talk about how much money they've made with the platform, and mention that you too can be like them!
To the left is inside what the Whatsapp Investment Group looks like. To the right is a post by a victim alerting about the scam. Thanks to CryptoExposed23 on twitter for building an account just to track this scam.
The scam is always the same. Users "invest" in the investment platform and receive big gains over time. The user continues to invest, but when it comes time to withdraw, there's always a problem. You can't!
A victim who lost mid-six figures reached out to me asking for help tracking where the funds went.
I expected this to be a clear cut, your funds are here!
Instead, a worm hole of endless intermediary and deposit addresses opened up.
Most of the scams I deal with happen on the Bitcoin or Ethereum blockchains. However, this one is all TRON USDT. (Low fees!)
Let's follow the money!
Hacker Wallets
- TNFXSER8SxP5EeUBAQZXp9onLmyK4mxLeb - Hacker 350K UK 1
- TPEedMh4nSgcwew4wBM6evJkK4UsK56DQt - Hacker 350K UK 2
- TMNUcWtaSsauWp6wxCjWiFNgBSWsXXazAR - Hacker 350K UK 3
- TEZxC6T1ct74XaYfW6Y2HiBgtrUAfcfcRq - Hacker 350K UK 4
- TS51Fu1APb1tfrp7RakEjko7xsLMMSNKb1 - Hacker 350K UK 5
- TPEedeRH6BNBi5Aa1d6WfddGbJUTK56DQt - Hacker 350K UK 6
- TC3xLtV46LaYZpYZ6ExRpnEgWeQPfBf4Vy - Hacker 350K UK 7 [Intermediary]
- THNmVJDoxZA8qE6vrR5tgxKH4QzkejmFYY - Hacker 350K UK 8 [Intermediary]
- TEaLvx1bkJEWQE6SCZHMF75GBsMZfM5G9o - Hacker 350K UK 9 [Intermediary]
- TMZsm5onFqDPqfzTAG3tb663PmnVcoPyM8 - Hacker 350K UK 10 [Intermediary]
- THw9axhbN68aHxFuQsh8Mswi9c4rkStkuA - Hacker 350K UK 11 [Intermediary]
Primary Wallets used to Steal Victims Funds
I tried to map out the primary wallets, but the graph would take up an entire movie screen!
Below are the wallets the scammer used to steal funds from victims. All of these wallets sent the stolen funds to intermediary wallets, which then were sent to various exchanges. The bullet points are where most of the outgoing transaction went.
TNFXSER8SxP5EeUBAQZXp9onLmyK4mxLeb - Hacker 350K UK 1
- TC3xLtV46LaYZpYZ6ExRpnEgWeQPfBf4Vy - Hacker 350K UK 7
- THNmVJDoxZA8qE6vrR5tgxKH4QzkejmFYY - Hacker 350K UK 8
Most of the funds here went to TC3xLtV46LaYZpYZ6ExRpnEgWeQPfBf4Vy - Hacker 350K UK 7. I’ll get to that wallet later. I’m assuming this is the wallet mostly used by the scammer to collect from victims. Hacker 350K UK 7 is an intermediary wallet and used to off ramp to exchanges.
- $128,950 transferred to Hacker 350K UK 7.
- $30,000 transferred to Hacker 350K UK 8.
TPEedMh4nSgcwew4wBM6evJkK4UsK56DQt - Hacker 350K UK 2
- TEaLvx1bkJEWQE6SCZHMF75GBsMZfM5G9o - Hacker 350K UK 9
Same as above. All of the funds here went to TEaLvx1bkJEWQE6SCZHMF75GBsMZfM5G9o - Hacker 350K UK 9. Hacker 350K UK 9 is an intermediary wallet and used to off ramp to exchanges.
- $325,740K transferred to Hacker 350K UK 9
TMNUcWtaSsauWp6wxCjWiFNgBSWsXXazAR - Hacker 350K UK 3
- TEaLvx1bkJEWQE6SCZHMF75GBsMZfM5G9o - Hacker 350K UK 9
An exact repeat as above. $165,200 transferred to Hacker 350K UK 9
TEZxC6T1ct74XaYfW6Y2HiBgtrUAfcfcRq - Hacker 350K UK 4
- TEaLvx1bkJEWQE6SCZHMF75GBsMZfM5G9o - Hacker 350K UK 9
An exact repeat as above. $128,950 transferred to Hacker 350K UK 9.
TS51Fu1APb1tfrp7RakEjko7xsLMMSNKb1- Hacker 350K UK 5
- TEaLvx1bkJEWQE6SCZHMF75GBsMZfM5G9o - Hacker 350K UK 9
- TMZsm5onFqDPqfzTAG3tb663PmnVcoPyM8 - Hacker 350K UK 10
Same as above.
- $85,950 transferred to Hacker 350K UK 9.
- $30,000 transferred to Hacker 350K UK 10.
TPEedeRH6BNBi5Aa1d6WfddGbJUTK56DQt - Hacker 350K UK 6
There isn’t much activity here. Maybe it was used to pay gas fees?
Wallets used to Launder Funds
TC3xLtV46LaYZpYZ6ExRpnEgWeQPfBf4Vy - Hacker 350K UK 7
- THNmVJDoxZA8qE6vrR5tgxKH4QzkejmFYY - Hacker 350K UK 8 [1.85M sent here]
These next few wallets appear to be where the scammers go to send funds to exchanges to launder the stolen USDT. Due to time constraints I’m unable to map out ALL the exchange deposit addresses. There’s hundreds. Below I’ll list a few based on most amount sent.
Above is a look inside TC3xLtV46LaYZpYZ6ExRpnEgWeQPfBf4Vy - Hacker 350K UK 7. 1.85M in USDT was sent from Hacker 350K UK 7 to Hacker 350K UK 8.
Deposit Addresses
- TSyMA8hGYKcuXxagDKnNEYTpd7J4L3L6c9 - Binance
- TLLSrAhuNwU2RCNv6zYokTtfkukZGSdjdu - Binance
- TQCNp4ojKsNYeuibPA1YQFDHG4Uk2xszjr - Binance
- TJ1zD7nrGE8CPzsy8bpzW8egT4rR8XobnZ - Binance
- TLthCzRxB1gydVBDRc9nqNasiZ5MqVpxKZ - OKX
THNmVJDoxZA8qE6vrR5tgxKH4QzkejmFYY - Hacker 350K UK 8
- TSHphz5NicfHAnT36rKwE6mV2nnaJDbTW6 - Hacker 350K UK 8 1 [2.45M]
- TKRKZvn2CpvGE1ZQPZXERyR3sDG8hxJ2XV - Hacker 350K UK 8 2 [3.73M]
- TC3P75N2tLJV4YFKHJhVawbVVHTHdHjdpo - Hacker 350K UK 8 3 [1.8M]
- TK3sEKvHyf7URbhtuPotBNDvHb5WDxMNZL - Hacker 350K UK 8 4 [11.4M]
- TDxQD14jCcTkHuddjyuYpH1Gafgj14yFL2 - Hacker 350K UK 8 5 [732K]
- TD157Adu4rWZqKUp3HjZbsbMCaHhDT7AYo - Hacker 350K UK 8 6 [716K]
- TKLTvDGvYHbSAoRMMSbnV4Ff2UfGy25Wmx - Hacker 350K UK 8 7 [1.15M]
- TSTmV9xKBMnp9qbsNv1DSrYqGqu2UEYBun - Hacker 350K UK 8 8 [1.09M]
Above is inside THNmVJDoxZA8qE6vrR5tgxKH4QzkejmFYY - Hacker 350K UK 8. This wallet is doing some huge transactions and needs a thorough inspection.
This wallet needs to be thoroughly expected. It appears THNmVJDoxZA8qE6vrR5tgxKH4QzkejmFYY - Hacker 350K UK 8 is a main wallet of this organization. There’s just endless deposit addresses. I marked off additional wallets based off of outgoing transactions.
Deposit Addresses
- TQtoNr9LbFJNX3Pm2USRKBKh6dpyVbGjGU - Binance [5.77M in deposits]
- TGqsyxFUdECn3hrRmQhhgTuQodkmBTk8a2 - Binance
- TAWAeFm7y361YADXaPeQLawACLHQqW6ZJF - Binance
- TSeayces5SshEf8ePsVuJnNJ4NdZ6oceK3 - Deepcoin
Deposit Addresses Associated with Hacker 350K UK 8 (1, 2, 3, 4, 5, 6, 7, 8)
- TQopadKfzCMWdst17NUR64D7quDpAXsye5 - Deepcoin [50M in deposits! Could be a hot wallet]
- TK9Qmus9aXLCN2ABW92LQJ3pfsUetxn4Mo - MaskEX - [1.74M in deposits]
- TUAMd9hqW1L5dtaHt5Y5mbWm4RMYpS3K8o - OKX [847K in deposits]
- TCJcrBLEpJZohMtZua3i5u19MNmPAwbGTm - Binance
- TQjRaSujxveG6VvTFn3JEcuQhnyZvxf4yg - Binance
- TYqtLoMnz3cksnjCyFkC9s1KMxwJQgcY49 - Binance [750k in deposits]
- TJbfKroFaKzMNaH51WLu2i9oYGXDkHwLRa - CoinTR [3.87M in deposits]
- TWm1vfcbTTq9gwMqQ215QR5hsSJS5nyMXq - Binance [2.36M in deposits]
- TKsNPamcnHJPBNTYtMaXhXW82d6oCjR2uv - Binance [1.34M in deposits]
- TGbpDmnTnuPPpsBefX7bxH2PM3NoN4hvwd - Binance
- TCMzNTwZiM6mu5N92y8KFcMNXrxV2zXa4S - OKX [4.86M in deposits]
- TU9nsuZzRZAA5Xh3tc34fRNf2vrv2LLAae - Binance [900K in deposits]
- TLcT6L7HnPM51wZxFet8nqvniPaQvZ2hds - OKX
- TQ1DAuxVr8kh6ygbH7pr9nYqjF2qWsVE1v - OKX
- TKbiSmzyoJB2U5XFF4bdC4fsyguoJdQ9me - OKX
- TNxNvydHJ5vgdm1BA4KU7k31CXsMGHNeSL - OKX
TEaLvx1bkJEWQE6SCZHMF75GBsMZfM5G9o - Hacker 350K UK 9
THw9axhbN68aHxFuQsh8Mswi9c4rkStkuA - Hacker 350K UK 11 [2.52M sent here]
Above is inside TEaLvx1bkJEWQE6SCZHMF75GBsMZfM5G9o - Hacker 350K UK 9 [Intermediary]. There’s a few wallets here that need to be inspected further. 2.52M went to one wallet while the rest was sent to a few wallets.
This wallet also needs to be thoroughly expected. Most of the outgoing funds went to THw9axhbN68aHxFuQsh8Mswi9c4rkStkuA - Hacker 350K UK 11, but I’m showing a number of outgoing txns to other wallets as well.
Deposit Addresses
- TVqA8bFfrfWb1kxFthWHhLZoR9vduZAxPm - Binance
- TB7f3Ee1vjRNuBofjdU22tAh9ewCXqppAT - OKX
- TLGMFMBk7hfxH4bnvAE2A6fLCGanTvP1Xv - Binance
- TGtCHNr1C94Vwgv22Lnn78XzVq3n5zUJPh - OKX
TMZsm5onFqDPqfzTAG3tb663PmnVcoPyM8 - Hacker 350K UK 10
- THw9axhbN68aHxFuQsh8Mswi9c4rkStkuA - Hacker 350K UK 11 [4.29M sent here]
This wallet also needs to be thoroughly expected. This wallet follows the exact same path as Hacker 350K UK 9. Most of the outgoing funds went to THw9axhbN68aHxFuQsh8Mswi9c4rkStkuA - Hacker 350K UK 11 but I’m showing a number of outgoing txns to other wallets as well.
Deposit Addresses
- TNTtyUCUt4EaJXsa3dRXoZ6sp84jBEt9YM - ByBit
- TGn4Q4VszjLkRb2Z7x5h9571RJssh5JwLD - Binance
- TQqnC5stKqWU9XP3QXkdYvr3rWYPtSn2Fv - Binance
- TCeZWroJwomaknFG2hkfbqB7yFWaUWoV3o - Binace
THw9axhbN68aHxFuQsh8Mswi9c4rkStkuA - Hacker 350K UK 11
- TTCXGPxjMswsvejaLotfCCWAK1EKiTveaz - [44.69M sent here]
- TDvRhqyGMW5NuZjhiAmEmYuXrSZ4bdZtmu - [9.3M sent here]
- TJyGgbhqfpioRdKPznyVku9ReyQMj2BsdK - [7.12M sent here]...
Content cut off. Read original on https://www.reddit.com/r/CryptoCurrency/comments/199hd4g/unraveling_a_40m_investment_scam/