Where Amir Capital's money went: a four-chain trace

The Amir Capital scheme collected investor funds across Bitcoin, Tron and Ethereum between 2019 and 2023. The Tron leg alone accounts for 66.4 million USDT once the cluster is counted as one entity, against the $53 million figure in the May 2026 report prepared for Cyprus authorities. On Bitcoin, the named addresses took in 4,262 BTC from outside and paid 4,185 BTC out, 3,254 of it through a single hot wallet across 30,572 transactions.

Almost all of it is gone. Every Bitcoin address in the cluster holds effectively zero today; the eighteen Tron wallets hold $2,234 between them. The money left through exchange deposits at Binance, OKX, Bitfinex, HTX and Kraken, and through tens of thousands of small outbound payments.

One exception matters more than everything else: an Aave position on Ethereum, roughly $24.6 million of collateral against a $6.78 million debt, which is live, liquid, and no longer at the address the case file names.

The Ethereum leg has the same shape as the other two, and until now it had no numbers. It runs through one hot wallet, 0xDb6Bc4DA…, which the case file lists without an amount: 156,085,840 USDT received and 156,085,834 sent across 62,740 movements between October 2019 and October 2024, a balance of six dollars at the end of it. Behind it sit 203 intake wallets and 273 deposit addresses; in front of it, 137 addresses whose only job was to move money out. Binance, Kraken and HTX paid that hot wallet directly, $7.7 million across fifteen transactions.

There is a fourth chain. An EVM address is its key, so the same address on BNB Chain is the same party. The wallet named in the case file, 0x0b32Aa5C…, received 16,623 BNB there and sent 19,700 BNB, almost all of it in 2021; the Ethereum hot wallet’s address and one cash-out conduit were active there too. No investor paid in on BNB Chain: there is no intake tier, only exchanges, DeFi venues and a sweep intermediary. It is the operator trading its own money, so it is not added to what investors lost.

The May report states that 0x0b32Aa5C… retains approximately $12.7 million in Aave. That is no longer true, and it was understated even then — the figure counted only the WBTC side and ignored the wstETH collateral.

Over roughly one hour on 11 August, the entire position was migrated to a wallet that appears nowhere in the report. The mechanism was a debt swap: the new wallet supplied the USDT needed to clear the old wallet’s Aave debt, the old wallet withdrew its collateral and handed it over, and the new wallet re-supplied that collateral under its own name. Ten direct transfers between the two addresses, each with its own transaction hash:

• 13:35:47 — 2.0000 wstETH · old → new
• 13:39:11 — 1,998.0000 wstETH · old → new
• 13:54:35 — 2,200,005 USDT · new → old, debt repayment
• 14:01:23 — 1,345.2564 wstETH · old → new
• 14:09:47 — 2,000,000 USDT · new → old, debt repayment
• 14:14:23 — 76.0395 WBTC · old → new
• 14:32:11 — 2,500,000 USDT · new → old, debt repayment
• 14:43:47 — 46,100 USDT · new → old, debt repayment
• 14:47:35 — 90.2471 WBTC · old → new
• 14:50:35 — 240,066.0475 ST-YCRV · old → new

Repaying another party’s multi-million-dollar debt in order to take their collateral is not an arm’s-length transaction.

The new wallet holds 166.2876 aEthWBTC (about $13.52M), 3,345.2564 aEthwstETH (about $11.00M) and 36.17 ETH, against 6,775,307 USDT of variable debt — roughly $17.8 million net. It is also still cashing out: 20,000 USDT went to a Binance deposit on 23 April, 20,000 on 25 May, 20,000 on 8 July, 30,000 on 14 July, and 561,000 USDT on 19 July 2026.

Aave has no per-address freeze. Governance can pause or freeze an entire market, but not a single participant. Neither collateral token helps: WBTC offers only a global pause controlled by its custodian, with no address blacklist, and wstETH has no control functions at all.

The only lever is Tether. The USDT contract on Ethereum exposes addBlackList and destroyBlackFunds, and a blacklist on the holder would block the USDT repayment required to release the collateral, locking the position in place. That window closes the moment the holder learns they have been identified: the August migration shows the whole position can move inside an hour.

Every transfer of all seventeen Tron addresses was walked and reconciled against each address's balance on chain, which is an exact test on an account-based chain: received minus sent must equal what the address holds now. Sixteen of the seventeen close to the cent. Netting out transfers between the addresses, the cluster took in 66,366,657 USDT from 14,382 addresses and paid out 66,399,236 to 19,256. The May 2026 report put the Tron leg at about $53 million; the difference is that this counts the cluster once rather than counting the same money again at each wallet it passed through.

As on Bitcoin, it is not one operation. Nine addresses were live before payouts stopped on 30 November 2021 and took in 56.68M USDT from 11,803 depositors. The other eight have no transaction before that date at all — the earliest opens on 9 December 2021, nine days after the stop — and took in 11.30M from 3,810. And the link between them is again the investor list: 1,225 addresses paid into both, and they account for 5,929,994 USDT, 52.5% of everything the second round collected. On Bitcoin the same measure was 49% and 44%. Three times is a method, not a coincidence.

One of those later addresses is still running. TTQUPBtmvdgM8VvFDCzAniKrgig6E6Xf6Z has taken 111,987 USDT and paid out 109,817 to 52 addresses between March 2022 and 2 September 2026, and holds 2,170 USDT today. It is funded in part by two addresses already attributed to the scheme, and its largest single source is the swap service ChangeNOW at 41,570 USDT. The amounts are small beside the first round; what matters is that money was still moving through it this month.

Between April and June 2023 two of the scheme's addresses sent 38,440 "USDT" that was not USDT. Four separate contracts, each naming itself Tether USD and using the symbol USDT, none of them Tether's real contract TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t. All 35 transfers went outward, to roughly fifteen recipients; none came in, so this is not the unsolicited token spam that reaches every busy wallet. The contract was changed four times over those weeks, which is what is done when wallets begin flagging the previous one. In a recipient's wallet the name, the symbol and the amount all read correctly; only the contract address differs, and almost nobody checks it.

Of the payouts, 22.6% reached identified exchanges — a single Binance address took 12,760,085 USDT, with Gate, Bybit and others behind it. Excluding exchanges, which sit on both sides by construction, 71 addresses both deposited and were paid, and they received 5.48% of everything paid out. The Bitcoin equivalent was 6.1%. On both chains, roughly 94% of what the scheme paid out went to addresses that had never paid in.

One residual is worth stating rather than hiding. On the largest pool address, 34,814 USDT of inflow cannot be reconciled — 0.066% of its 53M throughput. Three different collection methods returned three different sets of transfers for the same address and the same query, and that gap sits inside TronGrid's own inconsistency rather than in the arithmetic. It changes no figure above materially, and it is the reason every number here is checked against a balance instead of against the API's word.

One wallet in the Bitcoin cluster, 19HBjvQRq6sExcPf7YG4W5oPF52ifYru42, took part in 25 CoinJoin transactions between 10 and 25 December 2021 and put 23.93965190 BTC through them. The signature is unmistakable: every one of the 25 pays out a run of outputs of exactly 0.01000000 BTC — eleven of them in a 12-input transaction on 13 December, twenty-eight in a 37-input one earlier the same day. An ordinary payment never produces that; a JoinMarket CoinJoin always does.

The timing is the part that matters. Payouts to the first round of investors stopped on 30 November 2021. The second round of wallets opened on 9 December. The mixing runs from 10 December — in the gap between the two, and nowhere else in the cluster's history.

These are complete figures, not a sample. All six Bitcoin wallets were walked back past 1 November 2021, so the December window is covered on every one of them, and CoinJoin appears on exactly one. The busiest wallet of the cluster, 36XRdQsT…, had stopped entirely by 25 August 2021 and was not in use when the mixing happened.

The wallet holding the Aave position has a second kind of visitor. Five addresses have sent it 398 transactions carrying about a ten-millionth of an ETH each — and every one of those addresses was generated to look like the scheme's own previous wallet.

The real predecessor is 0x0b32Aa5C1e71715206fE29b7BADB21ad95F272C0. It begins 0x0b32 and ends 72c0. So does each of the five: 0x0b322a87…72c0 with 189 transactions, 0x0b327f3d…72c0 with 103, 0x0b324e49…72c0 with 100, 0x0b32ebad…72c0 with five, and 0x0b32aa77…72c0 — which copies six characters rather than four — with one.

That is the whole attack. Wallets and explorers abbreviate an address to its first and last characters, so on screen all six render as 0x0b32…72c0 and are indistinguishable. The dust exists only to place those look-alikes in the transaction history, where an operator copying "the address we used last time" will find them. It costs the attacker nothing and pays once.

It also says something about the position: somebody has decided this wallet is worth 398 transactions of patient work, which is not an effort anyone spends on a wallet they think is dormant.

The position itself is unchanged. Re-read from the chain on 21 September 2026 at block 26,024,397: 166.28766255 aEthWBTC and 3,345.25639741 aEthwstETH against 6,776,904.59 USDT of debt, with the debt accruing interest and the collateral untouched. Fourteen outgoing transactions in the wallet's life.

Three leads are ready for a formal request today.

• The Binance accounts behind $13.8 million of Tron withdrawals. The venue is identified, the amounts and dates are fixed, and the account stayed active until mid-2023 — recent enough that records are likely retained. Only the exchange can name the holder.
• The live Ethereum position. Roughly $17.8 million net sits in a wallet identified by ten transfers with their own hashes. This is the one part of the case where money can still be recovered rather than only traced — and the Tether blacklist is the lever that holds it in place.

Where the Ethereum money actually left, in dollars at the time of each transfer: Binance $37,490,371 across six accounts and 585 transactions; HTX $5,630,235 across nineteen; KuCoin $1,090,707; Bitfinex $953,299; Paribu $871,246; EXMO $419,708; Kuna Exchange $325,393; Bitzlato $180,001; Poloniex $118,363; Nexo $106,498; Bybit $100,142. About $47.6 million through named venues. Another $25.5 million went to addresses with no attribution, and one more hop explains about half of it. $8.53 million reached a single large address that paid $11.67 million back into the scheme’s Aave wallet, so that was circulation, not a cash-out. About $3.2 million went on to exchange deposit addresses (Binance, Kraken, Bybit, FTX and others) or across the Multichain bridge. $0.86 million went back into one of the scheme’s own hubs. Roughly $13 million is still unattributed, mostly sitting with personal wallets. Following every unattributed address one step further, weighted by what each received, about $4.6 million in total (the direct exits above included) ends at Binance, Kraken, WhiteBIT, Bybit, OKX, Coinbase and HitBTC, and about $6.3 million stays with personal wallets.

Three entries there are worth an investigator’s time more than the total is. Binance is not an occasional exit but a standing channel — 585 transactions across six accounts, every one of them identity-checked. Bitzlato is small at $180,001, but that exchange was seized by United States and French authorities in January 2023 for laundering, so its records already sit in a case file rather than behind a request. And Paribu, Kuna and EXMO put part of the exit in Turkey and Ukraine, wider than a case run in Cyprus and Kazakhstan assumes.

Two cautions about these figures. They are movement, not net loss: money that left through a venue and came back would be counted twice, and the receiving side of the hot wallet is served to us incomplete, so the inflow is a floor rather than a total. And repayments into MakerDAO and Aave are deliberately excluded — the case-file wallet borrowed 22,435,046 DAI against collateral across 62 transactions, and paying that back is not money leaving the scheme.

Every scheme-controlled address in this trace is flagged in the PublicAML database at 70 to 75 of 100, so any exchange or counterparty screening them now sees the history. Exchange deposit addresses are left unflagged by policy: funds belonging to thousands of unrelated customers pass through them, and labelling one as a scheme wallet would implicate the exchange rather than the scheme.