$812M, One Ghost Wallet, Three Exchanges — Nobody Flagged It
A Flash USDT Telegram channel led investigators to a 2-of-3 multisig TRON wallet that processed $812M in 15 months with a 0.006% net retention rate. The funds aggregated from 69,591 victim wallets, relayed through purpose-built automated infrastructure, and exited to named KYC-linked deposit addresses at OKX, Kraken, and Binance. Every hop is on-chain. Every exchange had the data.
A Flash USDT Telegram channel (@ARCHY_USDT, 37,864 subscribers) posted a confirmed $100,000 USDT transaction as fraud proof. That transaction originated from TEkddeyN — a 2-of-3 multisig relay wallet that processed $812.3M inbound and $807.2M outbound in 15 months, retaining just $5.1M (0.006%). The wallet aggregates funds from 69,591 victim wallets through a mule aggregator, then splits outflow to a mass disburser (8,043 end recipients) and a relay ring that exits to OKX ($5.67B), Kraken ($5.36B), and Binance ($4.14B) deposit addresses — all KYC-linked, all active. The circuit has been operational since early 2025. 33 tamper wallets and a just-in-time energy delegation system keep it running without leaving a staking footprint.
The failure first
Three global exchanges received billions from a wallet whose behaviour should have stopped them cold.
That is the conclusion we reached, and we want to state it before we show our work. Across this investigation we kept arriving at the same place: OKX, Kraken, and Binance each hold KYC-linked deposit addresses that received billions of dollars from THCuQ27 — a relay wallet with a 3.4-year operating history of receiving large USDT batches and immediately forwarding them, retaining $573,000 net on $21.44 billion moved.
The clearest example is TBtHBd5ZGVW3MjdsEHszrKucaJ7NzkfUc6. Arkham Intelligence identifies it as an OKX deposit address. In the 90-day window we profiled, it received $5.67B across 2,309 transactions from THCuQ27. Its most recent inbound transfers — $1.5M, $3.2M, and $4.95M — arrived nine hours before we finalised this report. The account is live. OKX has the KYC file.
| Address | Exchange | Received | Txns | Last seen |
|---|---|---|---|---|
| TBtHBd5ZGVW3MjdsEHszrKucaJ7NzkfUc6 | OKX DepositA | $5.67B | 2,309 | Active 9h ago |
| TDL5Essu6rG9TzHF3BiqnEHcgkgNsc1hEZ | Kraken DepositA | $5.36B | 2,044 | Active 4 days ago |
| TPthiuuwnMTrqYkNSghbBMUkVJGe2ChZwS | Binance DepositA | $4.14B | 341 | Active 14h ago |
A Exchange labels from Arkham Intelligence and OKLink — third-party attribution, not exchange-confirmed.
Where it started
A Telegram scam channel. A pinned transaction. A public ledger.
We did not start with the exchanges. We started with a single Telegram channel.
FLASH USDT BTC CRYPTO — 37,864 subscribers, contact handle @ARCHY_USDT — had a pinned message: “Transaction success. 100,000 USDT. Confirmed onchain.” Alongside it, a Tronscan link. Standard Flash USDT social proof: post a real blockchain transaction, imply you sent it, collect upfront fees from victims who believe you can send spendable USDT.
Two transactions appeared in the channel’s history. The first — 6da039bd…567ec, 15,000 USDT, 6 June 2026 — involved wallets unconnected to our circuit. Scraped from a public explorer, consistent with standard Flash USDT practice. The second was different.
Transaction 402686127a… was posted in the channel approximately five days after it confirmed on-chain on 1 June 2026. The timing matters: a five-day gap is consistent with a scam operator recycling public blockchain data rather than having real-time control of TEkddeyN. We state that clearly. The Telegram-to-wallet link is circumstantial. What is not circumstantial is what TEkddeyN is, and what it connects to.
The target wallet
TEkddeyN — a 2-of-3 multisig relay processing $812M in 15 months with 0.006% net retention.
TEkddeyNsrKKzAX48MMzCrHHXLCbCHW619 has been active since March 2025. In 15 months it processed $812.3M inbound and $807.2M outbound, retaining $5.1M net — a retention rate of 0.006%. It is not holding funds. It is moving them.
First, it is a 2-of-3 multisig wallet. Every outbound transaction requires two of three keyholders to sign. The $100K Telegram transaction was co-signed by TEkddeyN itself and TQQhN3ECLLYdjHCUkS8d2UK5x3fZvdq3FR. A third keyholder — TLRr4rA6opQ2h9csW5dH3X6BxmGw2rkuH6 — has not been profiled. Multisig at this scale is institutional-grade key management, not retail behaviour.
Second, TEkddeyN does not pay for its own operations. Every USDT transfer is preceded by an energy delegation from dedicated infrastructure wallets and followed immediately by energy reclaim. TEkddeyN borrows 64,285 energy units per transfer, uses them, and returns them — a just-in-time rental model that leaves the wallet with no staking footprint and reduces its detectability.
Supporting TEkddeyN is a network of 33 confirmed TRX dust-sending wallets — pure operational bots with zero USDT activity, each sending sub-cent TRX pings to maintain bandwidth. Their funding traces to at least three master distribution wallets, the most notable being TGGJqVx6jV12119u6JLGmGzxf166666666 — a vanity address ending in nine sixes, with 221,413 outbound transactions and only 132 inbound refill transactions. Those 132 refills are the closest available trail to the network’s ultimate controller.
The machine
Five layers, seven nodes, a mule aggregator collecting from 69,591 wallets — and a relay ring exiting to three regulated exchanges.
TEkddeyN is not the top of this circuit. It is the third layer. The full structure runs five layers deep.
| Layer | Wallet | Role | Lifetime | Characteristics |
|---|---|---|---|---|
| L0 | TWUByRE… | Dedicated feeder | $59.4M | Sends exclusively to TWhC1Fv |
| L0 | TJbLini… | Dedicated feeder | $13.3M | Sends exclusively to TWhC1Fv |
| L1 | TWhC1Fv… | Mule aggregator | $799.8M | 71,542 txns from 69,591 wallets · avg $2,013 in · avg $897K out · 2 recipients |
| L2 | TEkddeyN… | Target relay | $812.3M | 2-of-3 multisig · 6 senders · 23 recipients · Mar 2025–present |
| L3 | TDDfqH… | Mass disburser | $442.4M | 40,782 txns to 8,043 recipients · avg $2,456 |
| L4 | THCuQ27… | Relay | $21.44B | Jan 2023–present · 33 exit wallets · top 3 are OKX, Kraken, Binance |
| L5 | OKX / Kraken / Binance | KYC-linked exits | $15.17B | Named account holders · active within 24h of this report |
The structure at L1 is the most operationally significant. TWhC1Fv collects from 69,591 distinct wallets at an average of $2,013 per transaction, then sweeps consolidated batches of approximately $897K to TEkddeyN. This is not one sender moving money — it is a mass aggregation of small inflows into large outflows, the on-chain signature of a mule network collecting fraud proceeds at scale.
txns in
How the relay ring works
THCuQ27 has processed $21.44B lifetime since January 2023, retaining $573,000 net. It has 33 lifetime outbound recipients, of which three are the exchange deposit addresses shown in Section 01. The remaining recipients include a $1.39B unexplored wallet (TSLyJNfq…) and a brand-new rotation address that appeared in May 2026 and received $23.4M in its first two weeks (TMcroaKFG…).
The operational infrastructure
33 tamper wallets, 3 energy delegators, and a vanity address — this is automated, not manual.
What is visible in TEkddeyN’s full transaction log is not a human manually sending USDT. It is a programmatic loop running continuously:
- 1An energy delegation transaction fires from one of three infrastructure wallets immediately before each USDT transfer.
- 2The USDT transfer executes using the borrowed 64,285 energy units.
- 3The energy is reclaimed within the same block cluster.
- 4A dust TRX ping arrives from one of 33 tamper wallets to maintain bandwidth.
- 5The cycle repeats.
The energy delegation wallets hold staked TRX. That staked TRX came from somewhere with a traceable funding path. All 33 tamper wallets have zero USDT activity — operationally sterile by design.
| Address | Role | Profile | Note |
|---|---|---|---|
| TGGJqVx6jV12119u6JLGmGzxf166666666 | Primary TRX funder | 221,413 out · 132 in · Nov 2024 | Vanity — “666666” suffix |
| TB4djHQ4aBJkxc3Ext3gneZno2fFMPdyuk | Legacy funder | 203,043 out · 12,549 in · May 2022 | 3+ yrs · funded TKqKDv at creation |
| TEzPZwTxL2dVqkdNQmsCyCV1t39imF73vn | Mid-tier distributor | Funded TPJKp5P at creation (Oct 2023) | Sits between funder and tamper wallets |
TGGJqVx6jV12119u6JLGmGzxf166666666 has 132 inbound transactions against 221,413 outbound. Those 132 refills are the narrowest point in the funding trail — and the highest probability of finding an exchange withdrawal linked to a KYC-verified identity.
The exit, confirmed on-chain
OKX, Kraken, Binance. Named accounts. Live deposits.
THCuQ27 has 33 lifetime outbound recipients. The top destinations:
| Recipient | LabelA | Received | Txns | Status |
|---|---|---|---|---|
| TBtHBd5Z…NzkfUc6 | OKX Deposit | $5.67B | 2,309 | Active 9h ago |
| TDL5Essu…Nsc1hEZ | Kraken Deposit | $5.36B | 2,044 | Active 4 days ago |
| TPthiuu…ChZwS | Binance Deposit | $4.14B | 341 | Active 14h ago |
| TSLyJNfq…jmked9v | Unexplored | $1.39B | 1,650 | Highest priority |
| TMcroaKFG…ibAmAKx | New wallet | $23.4M | 41 | Created May 2026 |
A Exchange labels via Arkham Intelligence — third-party attribution, not exchange-confirmed.
TMcroaKFGBHZXYMxRGMvGJdwvjvibAmAKx first appeared in May 2026 and received $23.4M in its first two weeks. A fresh wallet receiving high-volume flows from established infrastructure is the standard wallet rotation signal — suggesting the operators are cycling out older, more visible addresses in real time.
Read backward
The full circuit, end to end.
Fraud proceeds enter at the feeder layer, aggregate through a 69,591-wallet mule network, relay through a 2-of-3 multisig processing $812M in 15 months, and exit to named KYC-verified accounts at three of the world’s largest regulated exchanges. At no visible point in this chain did exchange monitoring interrupt the flow.
Context
Why TRON, and why this keeps happening.
TRON settled roughly $2 trillion in USDT in Q1 2026. Over 10.9 million transactions cross the network every day. Fees are near-zero, settlement runs under three seconds, and there is essentially no friction in moving value across borders pseudonymously. That is exactly why monitoring failures at the exchange layer are so costly: when a circuit can move $812M through a single relay wallet in 15 months, the institutions positioned to interrupt it are the on/off ramps. When those ramps fail to flag counterparties whose on-chain behaviour has been visible for months, the rest of the network has no chokepoint at all.
None of the addresses in this circuit carried a risk flag in Dune Analytics, Tronscan, or OKLink when we began. The signal was entirely in the behaviour: a 2-of-3 multisig with a 0.006% net retention rate; a mule aggregator collecting from 69,591 sources; a relay wallet with $21.44B lifetime volume and a $573K net balance; and three exchange deposit addresses each receiving billions from a single wallet. All of it readable, in real time, on a public ledger.
Every query ran through Bitquery’s TRON stablecoin dataset (623GB, full TRON history). Dual wallet profiling, directional flow mapping, outbound recipient ranking, inbound sender ranking, cross-cluster edge detection, and timezone analysis — all in a single interface. Cross-verified against Arkham Intelligence, MetaSleuth, OKLink, and Tronscan. Transaction hashes and block timestamps confirmed on Tronscan UI.
Still live
Open threads.
Every node in this circuit had a confirmed transaction on the date this investigation was finalised. The circuit is operational.
$1.39B received from THCuQ27 across 1,650 transactions since January 2023 — completely unexplored. Its downstream recipients have not been mapped. The highest-priority uninvestigated node in the circuit.
Co-signer on the $100K Telegram transaction. One of three TEkddeyN multisig keyholders. Full counterparty profile not yet pulled. Profiling this address could identify the second controller of the target wallet.
Third TEkddeyN multisig keyholder. Unexplored. May be a cold wallet, a coordinator address, or a separate operator.
Primary TRX funder with 132 inbound refill transactions. Pulling those 132 inbound senders is the highest-probability path to a KYC-linked identity behind this operation.
$23.4M received since May 2026. Possible active wallet rotation event. Real-time monitoring recommended.
Addresses
Click any address to copy. Complete list for verification.
Run the next investigation in minutes
Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain.
Explore AI Investigations →This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice.
The findings describe patterns observed in blockchain transaction data and third-party attribution sources including Bitquery, Arkham Intelligence, MetaSleuth, OKLink, and Tronscan. Wallet-to-entity attributions and exchange labels are based on these sources and on-chain behavioural analysis. They may be incomplete, may contain errors, or may change as additional data becomes available. Blockchain addresses are pseudonymous, and the presence of a transaction between two addresses does not by itself establish the identity, intent, or knowledge of any party.
References to specific exchanges describe transaction flows observed on-chain and inferences drawn from them. They are not assertions that any named entity knowingly facilitated, participated in, or is legally liable for unlawful conduct, and should not be read as accusations of criminal or regulatory wrongdoing against any specific company or individual.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material.