On April 23, 2026, Tether froze 344.2 million USDT across two addresses on the TRON network. According to analysts at BitOK, these wallets weren't isolated entities but part of a massive infrastructure that funneled around 1.78 billion USDT from 2021 to 2023.
The total turnover of the entire related ecosystem is estimated at 3 billion USDT. Here's how the scammers operated.
Structure of the settlement hub
The investigation revealed that the cluster of 10 addresses was organized like a professional OTC exchange with a clear division of roles:
Level one. Four aggregators accepted funds from external clients. The total deposit volume amounted to 640 million USDT.
Level two. Four hot wallets ensured the rotation of assets. To reduce detection risks, each new wallet was activated on the closing day of the previous one.
Level three. Two cold storage wallets accumulated unused balances. It was on these addresses that Tether blocked 344.2 million USDT.
Counterparties and connections with fraudulent schemes
Transaction analysis allowed the identification of key participants who used the services of this node:
HuionePay and scam centers. A total of 392.7 million USDT passed through the Cambodian platform Huione Pay. In 2025, regulators recognized it as a critical link in money laundering for the Southeast Asian scam industry. More than 30 projects operating under the pig butchering scheme were also identified in the chains.
Garantex. Connections with a sanctioned exchange were recorded for a total of 59.2 million USDT. The average depth of the chains was 8–9 intermediaries, indicating an intentional effort to obscure traces.
MaskEX. The exchange from the UAE served as the main gateway for liquidity entry. Clients bought stablecoins on MaskEX and funneled them into the OTC desk, while the reverse flow was minimal.
The cluster exhibited high technical preparedness. The depth of transaction chains to suspicious services often reached 25–28 stages. Such a multi-layered filtering system and regular changes of hot wallets are characteristic of large players with their own compliance teams.
Chronology
The system began to wind down in February 2023. Notably, on March 14, 2023, the largest aggregator ceased operations, and the next day Europol and the Frankfurt prosecutor's office conducted an operation against the ChipMixer mixer. By May 2023, the cluster's operations were completely halted.
Funds in cold storage remained static for three years. The freeze in April 2026 was the result of a lengthy investigation involving regulators from several jurisdictions. This event confirms the trend of blocking not only the final addresses of scammers but also major infrastructure nodes supporting their activities.
There are plenty of news. News can vary quite a bit.
There are many changes in the economies of states and politics, in high technology, as well as in the financial and crypto markets. But our subscribers have the opportunity to stay updated on all major market changes!!!
The main thing now is that they no longer need to monitor dozens of information and news sites themselves. Everything is already gathered in a single feed here.
Enjoy your viewing!