For business
KYT office
Compliance solution to monitor risks, detect sanctions and ensure AML rules.
KYT office
Compliance solution to monitor risks, detect sanctions and ensure AML rules.
AML certification
How industry players can get up-to-date knowledge and professional certification.
AML certification
How industry players can get up-to-date knowledge and professional certification.
Comprehensive transaction analytics that helps to build graphs and trace funds.
Graph
Travel rule
(soon)
For personal use
Telegram bot
Bot for checking crypto for risks, providing AML reports.
Telegram bot
Bot for checking crypto for risks, providing AML reports.
Crypto recovery
Services are focused on tracking
and recovering crypto assets.
and recovering crypto assets.
Сrypto recovery
Services are focused on tracking
and recovery crypto assets.
and recovery crypto assets.
Docs and reports
All types of documents related
to cryptocurrency.
to cryptocurrency.
Docs and reports
All types of documents related
to cryptocurrency.
to cryptocurrency.
Portfolio tracker
Information about all assets and risk assessment in one place.
Portfolio tracker
Information about all assets and risk assessment in one place.
AML checks
Сhecking wallets and transactions
for illicit funds.
for illicit funds.
AML checks
Сhecking wallets and transactions
for illicit funds.
for illicit funds.
AML-сертификация
Актуальные знания в области AML/KYT от ведущих экспертов отрасли.
AML-сертификация
Актуальные знания в области AML/KYT от ведущих экспертов отрасли.
Graph
Визуализация перемещения активов
и связей между кошельками.
и связей между кошельками.
Graph
Визуализация перемещения активов
и связей между кошельками.
и связей между кошельками.
KYT Office
Мониторинг транзакций и кошельков для вашего отдела комплаенса.
KYT Office
Мониторинг транзакций и кошельков для вашего отдела комплаенса.
Для себя
Для Бизнеса
Travel rule
(Cкоро)
Телеграм-бот
Бот для проверки кошельков и транзакций с выдачей отчётов.
Телеграм-бот
Бот для проверки кошельков и транзакций с выдачей отчётов.
Возврат средств
Услуги по отслеживанию и возврату украденных криптоактивов.
Возврат средств
Услуги по отслеживанию и возврату украденных криптоактивов.
AML-проверки
Проверка кошельков и транзакций на наличие "грязной" криптовалюты.
AML-проверки
Проверка кошельков и транзакций на наличие "грязной" криптовалюты.
Портфолио трекер
Информация о всех активах и оценка рисков в одном месте.
Портфолио трекер
Информация о всех активах и оценка рисков в одном месте.
Отчёты
Все типы документов связанные
с криптовалютой.
с криптовалютой.
Отчёты
Все типы документов связанные
с криптовалютой.
с криптовалютой.
Iran has been under sanctions since 1979. With the advent of cryptocurrency, the country's authorities gained a convenient tool for circumventing financial restrictions. But before the 2026 war with the United States, few understood how deeply cryptocurrency had been integrated into Iran's ecosystem.
U.S. authorities, backed by Tether, the issuer of the world's largest stablecoin by market capitalization (USDT), began freezing wallets linked to Iran. But U.S. regulators' efforts proved insufficient. BitOK analysts identified an active network surrounding sanctioned Iranian wallets. This report explains how Iran's cryptocurrency ecosystem, hidden from regulators' view, operates.
U.S. authorities, backed by Tether, the issuer of the world's largest stablecoin by market capitalization (USDT), began freezing wallets linked to Iran. But U.S. regulators' efforts proved insufficient. BitOK analysts identified an active network surrounding sanctioned Iranian wallets. This report explains how Iran's cryptocurrency ecosystem, hidden from regulators' view, operates.
All data is current as of August 21, 2026. Supporting evidence, with links to blockchain explorer data, is provided in Appendix A at the end of this report.
Table of content:
- Why Iran Needs Cryptocurrency
- How Iran's Hidden Crypto Network Was Identified
- U.S. Address Freezes Did Not Stop the Network
- How the Infrastructure Works
- Five Episodes That Reveal How the System Operates
- Leaving TRON: Where Network Participants Send the Funds
- Conclusions
- Appendix A. Representative Supporting Transactions
Why Iran Needs Cryptocurrency
Why Iran Needs Cryptocurrency
For Iran, cryptocurrency has become a practical alternative to traditional financial instruments. Digital assets allow payments to be made quickly, cheaply, and anonymously. With the country cut off from conventional financial channels, cryptocurrency became its only viable alternative.
Domestic payments are not the only use case for digital assets. Iran also uses cryptocurrency for international transfers. Two examples:
Domestic payments are not the only use case for digital assets. Iran also uses cryptocurrency for international transfers. Two examples:
Of note: Other sanctioned countries are drawing on Iran's experience with cryptocurrency. Russia is a clear example. In 2026, Russian authorities passed a law formally permitting the use of cryptocurrency in foreign economic activity.
How Iran's Hidden Crypto Network Was Identified
How Iran's Hidden Crypto Network Was Identified
BitOK analysts noticed an unusual pattern in wallet behavior. Roughly 20 large TRON addresses linked to six identified wallets belonging to Iranian authorities followed the same sequence:
1. Funds arrived before the wallet was activated. All 20 addresses received USDT before their first TRX transfer. Such transactions are known as wallet activation: funds can be parked in advance at an address that is not yet formally active.
2. Funds could remain in a wallet for more than a year. For 12 addresses, the interval between receiving funds and the first large outflow ranged from 110 to 413 days. The longest pause was 413.19 days at THESNdLWWSuFV8sS6vrfc2C4euunXND7VP. Other similar pauses lasted 407.89, 406, 328.87, 259.23, and 245.63 days.
3. Wallets were brought online using the same method. The same address, TUSYcK5yf8Et4xNTiUcpfZwmhFsxfdoooo, activated 17 of the 20 addresses. It sent each of them exactly 0.8 TRX, the very first transfer that brought the wallet online. However, this address belongs to a service used by thousands of people, so the transfer alone proves nothing.
4. A test payment was sent to the same address before a large transfer. Seventeen of the 20 addresses sent a small amount to TDii6vao7xyWg2rKPbCPWVRpSmne8xcqYx, which is linked to the Netts service. Of the 12 addresses funded directly by a source linked to DTC Pay, 10 made an outbound transfer of at least 100,000 USDT within one hour.
The sanctioned address TAhwhFv3JpK39Nc2m8W5LPCcoTisutiRfp repeated the pattern twice:
1. Funds arrived before the wallet was activated. All 20 addresses received USDT before their first TRX transfer. Such transactions are known as wallet activation: funds can be parked in advance at an address that is not yet formally active.
2. Funds could remain in a wallet for more than a year. For 12 addresses, the interval between receiving funds and the first large outflow ranged from 110 to 413 days. The longest pause was 413.19 days at THESNdLWWSuFV8sS6vrfc2C4euunXND7VP. Other similar pauses lasted 407.89, 406, 328.87, 259.23, and 245.63 days.
3. Wallets were brought online using the same method. The same address, TUSYcK5yf8Et4xNTiUcpfZwmhFsxfdoooo, activated 17 of the 20 addresses. It sent each of them exactly 0.8 TRX, the very first transfer that brought the wallet online. However, this address belongs to a service used by thousands of people, so the transfer alone proves nothing.
4. A test payment was sent to the same address before a large transfer. Seventeen of the 20 addresses sent a small amount to TDii6vao7xyWg2rKPbCPWVRpSmne8xcqYx, which is linked to the Netts service. Of the 12 addresses funded directly by a source linked to DTC Pay, 10 made an outbound transfer of at least 100,000 USDT within one hour.
The sanctioned address TAhwhFv3JpK39Nc2m8W5LPCcoTisutiRfp repeated the pattern twice:
- a transfer of 30.101106 USDT to TDii6vao7xyWg2rKPbCPWVRpSmne8xcqYx, followed 9.9 minutes later by 1,308,000 USDT to TANBQbt1PEwXxYqwGPeDy8rTmSXRQJHbUd;
- a transfer of 64.860558 USDT to the same TDii6vao7xyWg2rKPbCPWVRpSmne8xcqYx, followed seven minutes later by 172,000 USDT to the same TANBQbt1PEwXxYqwGPeDy8rTmSXRQJHbUd.
5. Nearly all funds were swept out. After active use, 17 addresses had zero or near-zero balances. An ordinary customer wallet does not behave this way. This looks more like a temporary operational wallet.
6. Funds were split and later reconsolidated. After receipt, the funds were distributed across temporary addresses. Separate, independent chains then converged at the following addresses:
6. Funds were split and later reconsolidated. After receipt, the funds were distributed across temporary addresses. Separate, independent chains then converged at the following addresses:
- TSkjnvs32xnFwM4XrBF889PrLm6ZwdYJwf;
- TJGfqPFT2WHCsor1sUBSziJEADCiN2vSeC;
- TANBQbt1PEwXxYqwGPeDy8rTmSXRQJHbUd;
- TX1MP3sL9mbqmwCgRKMY6y9h6UVnVCmpB8;
- TZ1wAp1T2KCdPGFL7FjGYaKDELZh5arcNi.
A shared convergence point alone does not prove common ownership; what matters is that it appears alongside all the other indicators.
7. Funds retained their exact "shape" across short-lived intermediary addresses. Identical amounts moved through transit wallets within seconds or minutes. If residual balances or third-party funds were mixed in, analysts stopped tracing the specific USDT precisely to avoid attributing unrelated funds to the network.
8. Neighboring addresses remained active after the freeze. The six frozen addresses could no longer move funds, but linked, unfrozen addresses continued operating. They were used to distribute and store funds. BitOK analysts therefore concluded that the system extended beyond the six sanctioned wallets.
7. Funds retained their exact "shape" across short-lived intermediary addresses. Identical amounts moved through transit wallets within seconds or minutes. If residual balances or third-party funds were mixed in, analysts stopped tracing the specific USDT precisely to avoid attributing unrelated funds to the network.
8. Neighboring addresses remained active after the freeze. The six frozen addresses could no longer move funds, but linked, unfrozen addresses continued operating. They were used to distribute and store funds. BitOK analysts therefore concluded that the system extended beyond the six sanctioned wallets.
Only addresses matching several indicators of the scheme were included in the group of suspicious addresses.
Once the pattern had been reconstructed, the analysts compared it with six TRON addresses that the U.S. Treasury linked to the Central Bank of Iran:
- TNiq9AXBp9EjUqhDhrwrfvAA8U3GUQZH81;
- TTiDLWE6fZK8okMJv6ijg42yrH6W2pjSr9;
- TAhwhFv3JpK39Nc2m8W5LPCcoTisutiRfp;
- TJdgB1k6ot3f2nLuZug6D8eD3HavTmzmSK;
- TXGHxdYbGy574z5hBu4LNzq9NzjZQ9bhUf;
- TFQbqaNbmq2xsVor2NbufLkYZvxFC9wC7k.
One of these six addresses, TAhwhFv3JpK39Nc2m8W5LPCcoTisutiRfp, matched the entire behavioral sequence exactly from start to finish. The other five were connected directly to the identified network by transfers.
U.S. Address Freezes Did Not Stop the Network
U.S. Address Freezes Did Not Stop the Network
BitOK analysts concluded that Iran's crypto payment network had been operating for years. The U.S. authorities' freeze of six addresses did not stop the wider system; it continued operating around the restrictions. The timeline below shows what happened:
Operational TRON graph: confirmed transfer directions and amounts, and the reconvergence of branches between sources, the sanctioned core, and downstream settlement nodes. The screenshot provides a visual guide to the supporting evidence. Source: BitOK Graph.
How the Infrastructure Works
How the Infrastructure Works
At its simplest, the system consists of seven sequential operations:
1. The network operators establish a liquidity source.
2. Funds are sent to an unactivated reserve address.
3. The address is activated.
4. A test payment is sent from the address.
5. A large transfer follows.
6. The funds then move to transit addresses.
7. The funds reconverge at settlement nodes:
1. The network operators establish a liquidity source.
2. Funds are sent to an unactivated reserve address.
3. The address is activated.
4. A test payment is sent from the address.
5. A large transfer follows.
6. The funds then move to transit addresses.
7. The funds reconverge at settlement nodes:
- exchange addresses;
- shared Binance infrastructure;
- routes to bit.com / Gate.io / Bitget;
- from Bridgers into Bitcoin;
- a new reserve / reused node.
No single aggregate transaction volume can be assigned to this infrastructure. The same capital moves through multiple addresses. Adding these amounts together would count the same USDT repeatedly. The scale is therefore broken down by layer:
An additional review of the original dataset covered 717 unique recipients from January 1, 2025 onward. An exact match was found for 52 addresses: a 0.8 TRX transfer from TUSYcK5yf8Et4xNTiUcpfZwmhFsxfdoooo. Thirty-two addresses received USDT before activation.
A broader review of the history back to 2023 included 1,092 direct recipients; 95 of them received at least 1 million USDT.
A broader review of the history back to 2023 included 1,092 direct recipients; 95 of them received at least 1 million USDT.
Five Episodes That Reveal How the System Operates
Five Episodes That Reveal How the System Operates
BitOK analysts compiled five clear examples that show Iran's hidden crypto system continuing to operate after the U.S. freezes.
Episode 1. A Frozen Address Replicated the Identified Pattern
Episode 1. A Frozen Address Replicated the Identified Pattern
Between July 14 and 17, 2025, TAhwhFv3JpK39Nc2m8W5LPCcoTisutiRfp received 56,485,112.55 USDT in nine transfers from a source labeled DTC Pay. The funds arrived before the address became active. On August 5, it was activated with a transfer of 0.8 TRX. The first large outflow began 110.27 days after the final deposit.
The funds then moved in several directions:
The funds then moved in several directions:
- 32,978,366 USDT to the reserve address TJdgB1k6ot3f2nLuZug6D8eD3HavTmzmSK;
- 18,216,355 USDT, across 32 transfers, directly to TANBQbt1PEwXxYqwGPeDy8rTmSXRQJHbUd;
- 3,104,808 USDT to TYYZH7FMdqdsL3EAUPFNXEr6w2adtRXfm6;
- 900,340.9 USDT to TSuQtWsNJEBE6PAyRovnB1d7YUwFMGGLn2, including the test payment.
A total of 55,199,984.65 USDT was withdrawn. The address retained 1,285,180.48 USDT.
Episode 2. A Reserve "Woke Up" After 413 Days
Episode 2. A Reserve "Woke Up" After 413 Days
The address THESNdLWWSuFV8sS6vrfc2C4euunXND7VP received 34,666,513.12 USDT between June 4 and 11, 2025, then "slept" for a full year. On July 29, 2026, after 413.19 days, it split the funds into three parts within 32 minutes, each time sending a small test payment first:
- 100 USDT, followed by 15,000,000 USDT to TT6MqM6PWEwsBzLQmPkVi1MvocRMeMhN4D;
- 100 USDT, followed by 9,666,196.67 USDT to TUQxgq1BjuybY7hXrgVMxEuAfPpLDp6C4t;
- 97.8 USDT, followed by 10,000,000 USDT to TDW6dmzwG17Ns9Ayaqknx3iVpEBv7LZwmV.
All three new addresses received funds before their own activation. Later, the three sent a combined 33,138,878.56 USDT to the shared address TSkjnvs32xnFwM4XrBF889PrLm6ZwdYJwf. Numerous indicators converged here: a long pause, test payments, fund splitting, pre-funded downstream addresses, and a shared convergence point.
Episode 3. The Same Source Both Funded and Activated the Address
Episode 3. The Same Source Both Funded and Activated the Address
The address TQzkepMiPKUghk8AAPeiG8pNYEa64zBBBY sent the entire 20,000,005.66 USDT tranche to the not-yet-activated TCzNAg1PAfTpADhGUu8roeyZEjXYdk5YQW. Two minutes and 18 seconds later, the same sender activated it with a TRX transfer. After waiting 20 days, the address sent a 99 USDT test payment, followed by 19,999,890 USDT to the next transit address, THekVEFhdKXd7y9ZGVMezSDYsKjYGr2xrN.
This was not a coincidence. The same sender parked the funds, activated the wallet itself, and then passed the assets along a prearranged route.
This was not a coincidence. The same sender parked the funds, activated the wallet itself, and then passed the assets along a prearranged route.
Episode 4. A Distributor Address
Episode 4. A Distributor Address
On August 6, 2026, TTV9mvQmiRQbzr7igZDTmKTG6vDSbZrQo2 sent 4,000,000 USDT to TP2oy1DjePJGrppdi7XeMpUEQuq8pXy9G7, then activated the address itself 54 seconds later with a transfer of 30 TRX. The funds then split across three routes:
- 1,499,900 USDT to TWic9mBYBwqEarq169eYMBMR2vXX72FbSF;
- 1,284,561.98 USDT to TSkjnvs32xnFwM4XrBF889PrLm6ZwdYJwf, the same node seen in Episode 2;
- 1,215,140.53 USDT to TVZBsyQVrbPf3dWHxe3BMyeM9zndNV8WvR, from which the funds continued to TSjYrKSiQM8G4HtFoH8cKZ2YfqVBoKkVQu.
In addition, the address sent two test payments, of 100 and 300 USDT, and received two small inbound transfers. Its entire USDT history consists of eight transfers, and its final balance is zero.
Episode 5. Three Distinct Roles
Episode 5. Three Distinct Roles
A review of 26 addresses showed that large recipients of transfers from the Iranian network served different functions:
- TANBQbt1PEwXxYqwGPeDy8rTmSXRQJHbUd — mixed-use settlement node. A total of 134,428,196.59 USDT passed through it across 777 transactions with 266 counterparties. It received 18,216,355 USDT directly from the frozen address in Episode 1, and 28,459,992 USDT in total from known network branches. Because the node also processed unrelated flows, it cannot be considered exclusively "Iranian." It was, however, demonstrably used repeatedly by the network.
- TJGfqPFT2WHCsor1sUBSziJEADCiN2vSeC — distribution node. Its transaction volume was 23,749,216.72 USDT, of which 20,302,142.47 USDT, or 85.49%, came from six previously identified network branches. From there, the funds were distributed to numerous recipients.
- TESx6ywwcsKUZrPy9C6SiEMHXgFPVeQHUS — transit point en route to an exchange. Its transaction volume was 9,830,936.83 USDT, of which 2,000,000 USDT came from an identified network branch. Through the intermediary addresses TEgy6CHQiaARLxDN7yic5LZqN78TBzQtcg and TJpaC7q7bEVQdaD8uRAu8XV4Cjzy3Eu37i, the funds reached TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf, which is publicly labeled on Tronscan as Binance-Hot 7, an exchange hot wallet. An important caveat: this proves only that Binance infrastructure was used to withdraw the funds.
Leaving TRON: Where Network Participants Send the Funds
Leaving TRON: Where Network Participants Send the Funds
Funds do not remain on a single blockchain: the investigation identified several exit routes.
Via Gate.io. The address TSNuyDGZi5PWdJyVFnNTksAKCKKyhJZYtH received 2,247,981.82 USDT and almost immediately sent nearly the entire amount to an address labeled as Gate.io.
Via Bitget. Three matching amounts, 1,000, 47,000, and 100 USDT, passed through the intermediary address TLbssii7yGE2UspmLAGdpXqwd1mJafZkph and, two to four minutes later, were sent in the same amounts to an address labeled as Bitget.
Via bit.com and Binance. Large amounts converged at TX1MP3sL9mbqmwCgRKMY6y9h6UVnVCmpB8. One clear example: two amounts, 5,757,659.68 and 2,242,340.32 USDT, combined into exactly 8,000,000 USDT at TGMp7zwp1fT7jgjY1NZhLUZuL7ChL2Jznp. After another 9,000,000 USDT arrived from the bit.com branch, exactly 17,000,000 USDT was sent to TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf, Binance-Hot 7, an exchange hot wallet.
Into Bitcoin. The address TUy3hUTMZ5ANQBxCuzPyFKZJp2eUZMhahk was funded with 6,357,279 USDT. After a 110-day delay, on November 3-4, 2025, it made two test payments of 190 USDT each through the Bridgers exchange service, followed by 16 transfers totaling 5,123,735 USDT. On the Bitcoin side, 16 corresponding payouts totaling 48.577 BTC appeared in the same order, with delays ranging from 3.7 to 37.4 minutes and exchange rates of 104,690-108,070 USDT per BTC. On December 19, all 16 payouts were consolidated into a single Bitcoin wallet containing 48.577 BTC. As of the investigation, the funds remained untouched. The matching number and order of the transfers and the sequence of exchange rates show that this was one linked series of swaps.
Via Gate.io. The address TSNuyDGZi5PWdJyVFnNTksAKCKKyhJZYtH received 2,247,981.82 USDT and almost immediately sent nearly the entire amount to an address labeled as Gate.io.
Via Bitget. Three matching amounts, 1,000, 47,000, and 100 USDT, passed through the intermediary address TLbssii7yGE2UspmLAGdpXqwd1mJafZkph and, two to four minutes later, were sent in the same amounts to an address labeled as Bitget.
Via bit.com and Binance. Large amounts converged at TX1MP3sL9mbqmwCgRKMY6y9h6UVnVCmpB8. One clear example: two amounts, 5,757,659.68 and 2,242,340.32 USDT, combined into exactly 8,000,000 USDT at TGMp7zwp1fT7jgjY1NZhLUZuL7ChL2Jznp. After another 9,000,000 USDT arrived from the bit.com branch, exactly 17,000,000 USDT was sent to TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf, Binance-Hot 7, an exchange hot wallet.
Into Bitcoin. The address TUy3hUTMZ5ANQBxCuzPyFKZJp2eUZMhahk was funded with 6,357,279 USDT. After a 110-day delay, on November 3-4, 2025, it made two test payments of 190 USDT each through the Bridgers exchange service, followed by 16 transfers totaling 5,123,735 USDT. On the Bitcoin side, 16 corresponding payouts totaling 48.577 BTC appeared in the same order, with delays ranging from 3.7 to 37.4 minutes and exchange rates of 104,690-108,070 USDT per BTC. On December 19, all 16 payouts were consolidated into a single Bitcoin wallet containing 48.577 BTC. As of the investigation, the funds remained untouched. The matching number and order of the transfers and the sequence of exchange rates show that this was one linked series of swaps.
Bridgers Bitcoin branch: 16 sequential payouts following the USDT transfers were consolidated on December 19, 2025, into a single 48.577 BTC output at bc1q9kryxhfedjhmlapwvmmfqznyx5kqpguxrpz8h0. The pattern confirms UTXO lineage across the Bitcoin transfers. Source: BitOK Graph.
Conclusions
Conclusions
Iran's crypto infrastructure—its funding and transaction routes—had been put in place in advance. Consequently, the U.S. authorities' freeze of several specific wallets did not stop the system as a whole; it continued operating around the blocked points.
Freezing some of the wallets is not enough. The system can quickly reroute funds. When necessary, network participants can create new addresses to replace those that have been blocked.
Addresses play different roles within the network: some hold reserves, others bring prepared wallets online, and still others test routes with small payments, split and reconsolidate amounts, send funds to exchanges, including Binance, or convert them into Bitcoin through Bridgers.
The network could be disrupted only by blocking most of its addresses. The measures taken by U.S. authorities proved insufficient, and the system was quickly restored, as BitOK's investigation demonstrated.
Freezing some of the wallets is not enough. The system can quickly reroute funds. When necessary, network participants can create new addresses to replace those that have been blocked.
Addresses play different roles within the network: some hold reserves, others bring prepared wallets online, and still others test routes with small payments, split and reconsolidate amounts, send funds to exchanges, including Binance, or convert them into Bitcoin through Bridgers.
The network could be disrupted only by blocking most of its addresses. The measures taken by U.S. authorities proved insufficient, and the system was quickly restored, as BitOK's investigation demonstrated.
Appendix A. Representative Supporting Transactions
Appendix A. Representative Supporting Transactions
The table lists representative transactions; the links point to those transactions in public blockchain explorers.
Date, UTC | Event | Amount | TXID |
2026-03-03 | TAhwhFv3JpK39Nc2m8W5LPCcoTisutiRfp -> TDii6vao7xyWg2rKPbCPWVRpSmne8xcqYx | 30.101106 USDT | |
2026-03-03 | TAhwhFv3JpK39Nc2m8W5LPCcoTisutiRfp -> TANBQbt1PEwXxYqwGPeDy8rTmSXRQJHbUd (9.9 minutes later) | 1,308,000 USDT | |
2026-03-27 | TAhwhFv3JpK39Nc2m8W5LPCcoTisutiRfp -> TDii6vao7xyWg2rKPbCPWVRpSmne8xcqYx | 64.860558 USDT | |
2026-03-27 | TAhwhFv3JpK39Nc2m8W5LPCcoTisutiRfp -> TANBQbt1PEwXxYqwGPeDy8rTmSXRQJHbUd (7 minutes later) | 172,000 USDT | |
2026-07-29 | THESNdLWWSuFV8sS6vrfc2C4euunXND7VP -> TT6MqM6PWEwsBzLQmPkVi1MvocRMeMhN4D | 15,000,000 USDT | |
2026-07-29 | THESNdLWWSuFV8sS6vrfc2C4euunXND7VP -> TDW6dmzwG17Ns9Ayaqknx3iVpEBv7LZwmV | 10,000,000 USDT | |
2026-08-06 | TTV9mvQmiRQbzr7igZDTmKTG6vDSbZrQo2 -> TP2oy1DjePJGrppdi7XeMpUEQuq8pXy9G7 | 4,000,000 USDT | |
2026-08-06 | TTV9mvQmiRQbzr7igZDTmKTG6vDSbZrQo2 -> TP2oy1DjePJGrppdi7XeMpUEQuq8pXy9G7 (activation 54 seconds later) | 30 TRX | |
2026-04-27 | TSRkrPwSLLGoAtRPJFQAtsmMpDAUnBEK8n -> TLtVP8FDQ3e8u36pV3QF2ZXQxwB7VWVbAx | 5,000,000 USDT | |
2026-04-27 | TLtVP8FDQ3e8u36pV3QF2ZXQxwB7VWVbAx -> TYe5dLHKDUxuFGrtmfbfKh6w631CcAMYvZ (3.65 minutes later) | 5,000,000 USDT | |
2025-11-03 | First settlement transfer: TUy3hUTMZ5ANQBxCuzPyFKZJp2eUZMhahk -> Bridgers | 10,735 USDT | |
2025-11-03 | BTC payout 9.05 minutes later | 0.099333 BTC | |
2025-12-19 | Consolidation of 16 BTC payouts | 48.577 BTC input |
