How scam money is moved on
Scam proceeds usually run through three stages: victim payments, rapid on-chain laundering, then integration through mule networks and over-the-counter traders. These are the roles and regional patterns investigators look for.
Laundering roles
- Guarantee marketplace
- Chinese-language Telegram escrow networks selling laundering and other illicit services, settling mostly in TRON USDT. They reappear under new names after takedowns, so map merchants and settlement addresses rather than single addresses.
- U-merchant (U商)
- A USDT over-the-counter merchant converting cash and USDT.
- Black U (黑U)
- Tainted USDT sold at a discount for fast liquidation. A 10 to 20 percent discount, or a premium paid to launder, is an indicator.
- Courier and washing cell (车手, 水房)
- Cash-out couriers, and the cell that dispatches them. The cash leg and the crypto leg are deliberately kept apart, so CCTV, banknote serial numbers and timing matter.
- Mule account
- A bank, payment or exchange account used to move proceeds for others. Dormant accounts with sudden rapid in-and-out flows are the signal.
Where the trail ends decides the legal route
| Licensed exchange deposit address | Preservation, freeze and disclosure under domestic process |
| Offshore or unlicensed exchange | Direct request where lawful; otherwise mutual legal assistance |
| OTC desk or P2P merchant | The bank or UPI legs of the trade; the exchange's P2P order records |
| Stablecoin redeemed for fiat | The issuer's law-enforcement channel and redemption records |
| Crypto debit-card or payment programme | The card programme manager and the issuing bank's KYC |
| Unhosted wallet still holding value | Live watch, issuer freeze for tokens, key acquisition by lawful search |
Exchanges usually run a separate deposit address per customer, swept within minutes into pooled hot wallets, and keep reserves in warm and cold wallets that move rarely and in large amounts. A deposit address points to one customer, but only the exchange's ledger can name that customer. A hot or cold wallet identifies the exchange, not the customer: never describe a hot wallet as the suspect. You cannot freeze a pooled wallet; ask the exchange to freeze the customer account credited by the deposit, giving the transaction ID, amount and UTC time, and send preservation and freeze requests immediately.
Regional signatures: China, Hong Kong and South-East Asia
Patterns, not case data. Cross-check figures against current official releases before citing them.
| Signature | What it looks like | Investigative angle |
|---|---|---|
| Compound-based relationship-investment fraud | Long grooming, a fake trading app, small early withdrawals, then withdrawals blocked by 'tax', 'insurance' or 'processing fee' demands. Run from compounds with trafficked labour, mainly in Cambodia, Myanmar and Laos (UNODC, April 2025). | The fee demand is the near-universal terminal indicator. Trace the USDT (often TRON) collection wallet backward to find other victims. Treat workers as possible trafficking victims. |
| 'Professor' or 'trading mentor' groups | A social-media ad, then a WhatsApp or Telegram 'VIP group' with a mentor persona and fake profit screenshots. The platform shows huge fictitious balances. | Preserve member lists and admin handles. Map the payment rails (usually bank or e-wallet mule accounts, then USDT). |
| Crypto pyramid schemes | Wallet, mining or 'public chain' projects with an entry fee, downline recruitment and team commissions. Older investors are often targeted through seminars. | Collection and promoter wallets, referral trees and fiat channels. Promoters and outsourced providers may be liable as well as operators. |
| Unlicensed or fake trading platforms (Hong Kong) | Celebrity promotion; money-changer shops selling USDT over the counter as the on-ramp; sudden withdrawal fees or caps when the platform fails. | Check the Hong Kong SFC's lists of licensed and suspicious virtual-asset trading platforms. Applicant status is not a licence. |
| Fake job-interview calls with a 'script' | The victim is asked to download or run a file or 'meeting fix' during a call. It installs wallet-draining malware. | Image the device; identify the drainer or sweeper; report the domains and binaries. |
| Deepfake officials on video calls | Fake video conferences with synthetic senior officials or executives demanding urgent 'confidential' transfers. | Preserve meeting links and payment instructions; verify identities out of band; bank-layer holds for the fiat legs. |
| SIM-box and VoIP gateways | Overseas calls converted to local caller IDs through banks of SIM cards near borders. | Telecom legal process for gateway locations, SIM registrations and IP data records. |
| Regulator-perimeter abuse | Claims of foreign 'registration', fake regulator logos, or offices that do not exist on maps. | Check the regulator's own registers. |
| Underground-banking cash-out | USDT sold through OTC 'U-merchants', money-changers and guarantee marketplaces, with bank or card mules on the fiat side. | See the laundering roles below: the rate premium or discount is itself an indicator. |
What next?
More crypto guides
The first hour
What to do, in order, when you have just sent crypto to a scammer.
Red flags
Signs in the contact, the payment and the wallet, and how these scams unfold.
Can it be frozen?
The six ways money gets frozen, and which tokens can be blocklisted.
Questions and glossary
Common questions, answered plainly, and the terms explained.
This is information, not legal, financial or investment advice, and it does not recover money. Report crime to the police first.