One takeover, 287 victims

One gas-fee address unravelled the whole line

The seized wallets are not linked to each other: each takeover address is brand new, deliberately built to look unrelated. The real connection sits elsewhere — every one of these wallets needed someone to send it TRX for gas first. Following that funding address, 287 of the 289 wallets it paid have already had their permissions seized.

Permissions were seized in the very next block after the fee landed

For all 287 wallets we subtracted the moment the gas fee arrived from the moment the permissions changed. The result takes only three values: the same block, the next block, the previous block. TRON produces a block every three seconds — so not a single wallet falls outside one block either way. No human does that 287 times. This is a machine watching the chain and firing the instant the money lands.

Reaction delay across 287 wallets

Where the money went, and what is left

Of the 5.62M USDT involved, 5.14M has already left the victim wallets and is gone. But 489,450 USDT still sits untouched across 111 wallets — that part can, in principle, still be stopped. So the case we prepared argues for intercepting money that has not yet moved, rather than chasing money that already has: the first has a chance, the second is only consolation.

What is left across those 111 wallets

Four takeover addresses, very different scales

The 287 wallets belong to four takeover addresses. The one holding the most wallets is not the one taking the most money: the address with 27 wallets moved out 1.88M, while the address with 102 wallets moved only 874K and still sits on 307K. Scale and take are not proportional, which says these addresses play different roles — the most useful structural evidence when arguing that separate reports belong to one case.

No victim wallet address is published — they belong to real people who never consented. The attacker addresses are published so anyone can verify this independently, and so exchanges and peers can flag them.

Five months, still running

The earliest takeover was on 31 March 2026; the latest, at the time of this analysis, was on 25 August 2026 — the same day we ran it. This is not a one-off incident. It is a production line that was still running.

Why these numbers can be trusted

The takeover moment for all 287 wallets comes from the on-chain permission-change transaction itself, each with a transaction hash you can look up. Not one was estimated from the funding time because the real record could not be found — a number like that collapses under the first challenge, and should never be the basis of a client's decision. This is the one figure where we publish the denominator.

What we could not establish

80% of the funds entering the victim wallets came from a handful of exchange-grade hot wallets (each holding 39–53M USDT across nearly 4,700 counterparties). But we hold no commercial address-label database and cannot establish which exchange. So the filing says withdrawal from a suspected exchange, never a named one — get one institution's name wrong and the credibility of the entire file is gone.