Real cases. De-identified. Verifiable on-chain.

Case NTI-2026-001 is a forensic trace of an advance-fee investment fraud on the TRON blockchain. Of $36,150 in claimed losses, $7,080 in USDT was confirmed on-chain, moving through 14 wallets and 29 transactions. Victim deposits were swept out of the collection wallet the same day they arrived and reached a KYC-holding regulated exchange, with $483.88 still freezable at the report date.

According to the NTI-2026-001 forensic report, funds passed through three to four wallets within 30 minutes of deposit and reached an exchange-attributed address within two hours.

What happened

A fake trading platform, operating as an "investment" service, took five deposits from one victim between May 8 and August 25, 2025, totaling $7,080 USDT (verified on TronScan). The victim was cultivated by three personas over several weeks (a "long-time investor," a "platform support" representative, and a "senior analyst" who supplied fabricated statements), then steered to a slick dashboard showing fake profits. When a withdrawal was requested, "fees," "taxes," and "verification charges" appeared, each one another theft. Classification: advance-fee investment fraud, consistent with organized pig-butchering operations.

The forgery tell

Fund flow: three-layer cascade

Layer 1, crime wallets. The entry point and immediate layering chain.

Layer 2, relays and exchange. Seven further wallets sat between the crime wallets and cash-out, including a hot wallet attributed to a regulated centralized exchange and an exchange deposit address. That attribution is the recovery lever: the exchange holds the account-holder's identity under its own KYC rules.

Layer 3, infrastructure. A gas/energy delegation operator that pre-staged energy on the fraud wallet before victim deposits arrived, and an energy-market wallet behaving as an unlicensed money-services business. Both referred to FinCEN.

Contract method signatures observed

Timing analysis: automated sweeping

• Same-block sweeps: victim USDT left the collection wallet within the same or next block, roughly three seconds.
• Gas-before-sweep: energy was delegated from the operator wallet before each victim transfer landed.
• Multi-hop velocity: funds crossed three to four wallets within 30 minutes of deposit.
• Exchange alignment: $480 reached an exchange-attributed address within two hours of a same-day deposit.
• Weekend timing: peak activity Friday to Sunday, typical of cross-border fraud farms.

Recovery path

1. Tether can freeze specific USDT addresses on a verified fraud or law-enforcement request. Freezable at report date: $483.88 across the two sink wallets.
2. The exchange-attributed hot wallet is the identification path: a compliance letter, attorney subpoena, or law-enforcement request produces the account identity. On-chain tracing alone stops at pseudonymous addresses.
3. All 14 wallets flagged on ChainAbuse; filings prepared for IC3, the FTC, the SEC, FinCEN, and the state securities regulator.