Hours after a Prince Group arrest, X Wallet stopped paying users, 42 minutes before it told them every deposit address would change

01 · The noticeX Wallet tells users every deposit address will change

Late on 5 November, a Telegram channel posted a short notice. Every user would get a new address for deposits. Until the work was done, users should stop paying in and stop taking money out.

X Wallet lives inside Telegram. People use it to hold and send USDT, a dollar stablecoin, on TRON. In July its channel promised "no risk control, no account bans, no freezes". That promise covers X Wallet's own accounts. Tether can still freeze USDT itself, as our audit of every USDT freeze shows.

The notice said the change would make payments safer and more stable. About 10 hours earlier, Singapore police had said they arrested Chen Xiuling, also known as Karen Chen. Police say she was a director of Singapore firms believed to be owned by Chen Zhi, the founder of Prince Holding Group, known as Prince Group. OFAC, the US Treasury's sanctions office, listed Prince Group and its network last October, and her name is on that list.

X Wallet's notices do not mention Prince Group. Jinbo, a large escrow service on Telegram, names X Wallet as one of its own accounts. A report by Odaily, a Chinese crypto news site, says Chen Zhi co-founded Jinbo under its old name, Jinbei. Bitquery reads all payments on TRON. So we followed X Wallet's wallets through the night and back to July 2025. The address that paid X Wallet's users stopped 42 minutes before the notice, and a new one was already collecting deposits. The old address that gathered deposits stopped 14 minutes after it. The money also led to the address where Jinbo holds sellers' deposits, and to Huione. It led to a much larger hub too, most likely run by Fully Light, another escrow group. The ledger shows the money moving. It does not show who gave the order, or why.

02 · Who runs itJinbo, once Jinbei, and Chen Zhi's Prince Group

Guarantee markets are escrow services on Telegram. In Chinese they are called danbao. A buyer and a seller who do not trust each other both trust the market, which holds the money until the deal is done. Sellers post a bond, a deposit the market keeps if they cheat. FinCEN, a US Treasury bureau, cut Huione Group, a Cambodian payments firm, off from US banks. Its rule took effect on 17 November 2025.

Jinbo Guarantee runs a Telegram channel with more than 65,000 members that lists gambling groups and the bond each one has posted. A notice it posted in May 2025 names one bond address, TYRiqc…, as its only one. The channel's profile lists X Wallet first among its official accounts. Bitrace, a blockchain data firm, called X Wallet the Telegram wallet of Jinbei Group in a post on X, without saying how it knew.

This July, Odaily reported, in a piece republished by 36Kr, that Chen Zhi helped found Jinbei's escrow business. It says the business was later renamed Jinbo. OFAC's list names Jin Bei Group, also called Jinbei Casino, as part of the Prince Group network. Odaily gives another company name, so the two may not be one firm. In September, OFAC put Xinbi Guarantee, another escrow market, on its list. It said Jin Bei Group had reportedly used Xinbi.

03 · How it worksHow a Telegram wallet moves your USDT

Every user gets a deposit address, a TRON address that X Wallet controls but ties to one account. When money lands there, the service moves it into a sweep wallet, its main inbox. That move is called a sweep. From there money goes to a hot wallet, an always-online account that pays out. X Wallet's hot wallet, TBTPnk…, paid large withdrawals itself and topped up a payout wallet, TYWfC…, that paid 24,779 addresses. From May 2026 a reserve wallet held the surplus. Each sweep is an ordinary payment between X Wallet's own wallets, so the whole system shows on TRON. In 15 months, thousands of wallets paid $520M into the sweep wallet. Most were users' deposit addresses. Some were outside wallets paying in directly.

Exchanges use the same layout. So did the collector wallets in the iPhone wallet drains we traced.

04 · The nightX Wallet moves before it posts

The payout wallet, TYWfC…, paid users every few minutes through the evening of 5 November. Its last payment to a user came at 21:41 UTC. Eleven minutes later it sent everything it held to a new address, TSdB…, which began taking sweeps from deposit addresses within two minutes. Of those addresses, two thirds had paid the old sweep wallet before. By the time the notice went up, TSdB… had taken 194 sweeps.

The old sweep wallet, TAxaAs…, kept taking deposits too. Its last came 14 minutes after the notice. Five minutes later, TSdB… took its last sweep and a third address, TVpBds…, took its first. By midnight TVpBds… had gathered $467K in USDT.

Just after midnight, TAxaAs… sent its last USDT to the hot wallet and went quiet. Two hours later, a fresh address took a small payment from the hot wallet and sent it back four minutes later, which looks like a test. Later that morning the hot wallet moved $102K into a new payout wallet, TMZ4L8…, which paid its first user at 07:02. No payout address had paid a user since the evening before. Five minutes later the channel said the update was complete.

The new setup ran for about two hours. By mid-morning TMZ4L8… had stopped paying. Up to our noon cut-off, TVpBds… took only two more payments: TMZ4L8…'s last USDT, and USDT from a swap of its own TRX. At 09:42 the channel posted the same notice again.

05 · The historyFifteen months of deposits, and payments to Huione

TAxaAs… opened in July 2025 and took little for six months. Then deposits climbed, from $1.5M in January to a peak of $122M in September. Most of the money arrived in its last year, as the chart shows.

On its first day, after a small test, it paid $605K into a Huione deposit address. That address passed the money on 24 seconds later to a wallet that our labels mark as a Huione hot wallet. Between July and September, Jinbo's bond address paid $6.62M into another Huione address. All of these payments came before FinCEN's rule took effect.

From March to September, X Wallet's sweep, hot and payout wallets paid $19.6M into Jinbo's bond address. That is 44% of everything the address has ever taken in. The bond address sent $8.35M back, so X Wallet paid in a net $11.2M. That fits a treasury the two share. It also fits a large bond that X Wallet keeps with Jinbo. The ledger cannot tell which.

06 · Old addressesMoney sent to old addresses still reached the new wallets

On the morning after the swap, the channel told users that the old addresses had stopped, and that sending money to them could mean losing it. Users kept sending, before that warning and after it. Between the old sweep wallet's last deposit and noon, 29 old deposit addresses received $21.1K in USDT, and $6.6K of it came after the warning.

Each of the 29 paid only two or three wallets in its life, the pattern of a deposit address. All the USDT they sent on after the swap went to X Wallet's two new sweep wallets, TVpBds… and TP1vDWBd…. TP1vDWBd… had taken almost nothing since July. From late that night it took 26 payments from 25 addresses and passed 4,500 USDT to the hot wallet. Another 165 addresses each sent it one millionth of a USDT. One more address on our list is a busy outside address, which took $4.5K and sent it elsewhere.

So the money reached the service, even the payments sent after its warning. Whether those users got credit is recorded only in X Wallet's own books. Anyone who paid an old address should keep the transaction hash and ask the service for the credit.

07 · The reserveWhere the reserve wallet sent its money

The reserve, opened in May, took in $276M. Nearly all of it came from TAxaAs…. The largest share went back to X Wallet's own hot wallet. Its last payment left just after midnight, in the middle of the maintenance pause.

The other 22 wallets it paid carry no label in our data, and several send money back to X Wallet. TSjdq…, the third largest, sent $12.45M to the hot wallet. TRcWD… pays only TAxaAs…, so that money came straight back. TDAYa… paid $25.2M into the hub.

08 · The hubA bigger hub, most likely Fully Light

Since March the hub, TBtKuo…, has taken in $1.24B in USDT from tens of thousands of wallets. It kept paying out every hour of the night, while X Wallet's payout addresses paid no users. So it is most likely not X Wallet's. Money flows both ways between the two through go-between addresses. Besides the route through TDAYa…, the hub paid $72.1M to THA7SB…, an address that sent $75.6M into TAxaAs….

Four of the hub's feeders have addresses that end in FLL. An address with a chosen ending is called a vanity address: its owner runs a program until a key comes out with the ending they want. The four sent 19% of all the hub took in, and one of them made the hub's first USDT deposit.

Fully Light, or Fulilai (福利来), brands its Telegram accounts with FLL. Its escrow is @FLLDB and its wallet bot is @FLLDBQB_bot. The same Odaily report says the Liu family founded the FullyLight Group in Kokang, Myanmar, and set up its escrow mainly to serve local scam compounds. It adds that the family's syndicate has since been broken up. In a July report, Bitrace named three payment tools whose business grew after Huione Guarantee shut down. They are Fullylight Wallet, OKPay and X Wallet itself.

Nothing on the chain names the hub. We call it most likely Fully Light's because of the FLL feeders and the hub's first deposit, and we found no Fully Light post that names it.

From April to early September, the hub paid $512K in USDT to addresses that OFAC listed as Xinbi Guarantee's on 9 September. The last payment came on 7 September. The next day Tether froze all 10, and OFAC listed them the day after. In March and April the hub also paid $16.8M into an OKX deposit address, which sent every dollar on to an address in OKX's public proof of reserves. OKX can see which account it was.

09 · What to watchThe money X Wallet still holds

At our noon cut-off, X Wallet was in its second pause of the day, and TVpBds… had taken in $490K in USDT and sent none of it on. After the cut-off the wallets moved again. In the early afternoon TSdB… paid $113K into TVpBds…, and TP1vDWBd… took more payments. Two things will show on the chain next: where that money goes, and when deposits reopen. Every address in this story can be followed with the Bitquery MCP.

The chain cannot show why X Wallet moved to new addresses, but it does rule out a hack. A hacked account pays the thief. These old wallets sent all their money to new wallets that X Wallet runs. The hot wallet kept working through the night, and old deposit addresses still swept into the new wallets. Tether has never frozen any of X Wallet's wallets, according to Bitquery's record of every USDT freeze on TRON. It froze all 10 Xinbi addresses the hub paid.

Our reading is that freezes and risk flags were the concern. Since July, X Wallet has let users swap a deposit address that risk tools flag. Fresh addresses carry no history, so they are harder to flag and harder to freeze. X Wallet's notices said only that the change would make it safer. Its payout address stopped paying users before X Wallet said a word. That was the day Singapore police arrested a Prince Group associate.

10 · The methodHow we traced X Wallet

We started from the bond address Jinbo publishes. X Wallet's wallets were among the wallets it dealt with, and their stop and start times fall within minutes of X Wallet's posts. Payments come from Bitquery's TRON data, read up to noon UTC on 6 November. We checked every headline figure against a second copy of that data. TronGrid's public node settled any gap. We also read the memo field on a sample of payments to and from the hub, the reserve wallet and TAxaAs…. A memo is a note a sender can attach to a payment. None carried one. Freezes come from Tether's freeze events in the same data, checked against the live freeze list. Names of exchanges and services come from Bitquery's own labels, backed by where each address sends its money. Some of the queries ran through the Bitquery MCP server, and we used the same approach in our $110M TRON circuit trace. The full TRON history is also sold as files, as the TRON dataset on the Bitquery Data Store. For cases like this, we also run crypto investigation services.

11 · The recordThe addresses behind the swap

FAQ

What is X Wallet (@xvip)?

X Wallet is a Telegram app, run through the bot @xvip, for holding and sending USDT. Its channel promises no risk control, no account bans and no freezes. Jinbo, a Telegram escrow service, lists it as one of its own accounts.

Is X Wallet linked to Cambodia's Prince Group and Chen Zhi?

Through Jinbo. Jinbo lists X Wallet as one of its accounts, and X Wallet's wallets traded $27.9M in USDT with the bond address Jinbo publishes. A report by Odaily, republished by 36Kr, says Chen Zhi, the founder of Prince Group, co-founded Jinbo under its old name, Jinbei. OFAC lists Jin Bei Group as part of the Prince Group network.

Why did X Wallet change its deposit addresses?

X Wallet said only that the change would improve security and stability. It posted the notice late on 5 November 2026, about 10 hours after Singapore police said they had arrested Chen Xiuling, whose name is on OFAC's Prince Group list. On TRON, its busiest payout address paid its last user 42 minutes before the notice.

What happens to USDT sent to an old X Wallet address?

On 6 November 2026, USDT sent to the old deposit addresses we checked was still swept into X Wallet's new sweep wallets, even after the service said the old addresses had stopped. Whether a user gets credit is recorded only in X Wallet's own books.

Is Huione Group involved?

X Wallet paid $605K into a Huione deposit address on its first day, and Jinbo's bond address paid $6.62M into another. Both payments came before the US rule against Huione Group took effect.

What is Xinbi Guarantee?

Xinbi Guarantee is a Telegram escrow market that OFAC put on its sanctions list on 9 September 2026. A large TRON hub, most likely run by Fully Light, paid $512K to Xinbi addresses in the months before. Its last payment came the day before Tether froze them.