Where Amir Capital's money went: a three-chain trace

The full trace, with fund-flow charts and links to every address's risk page, is at https://publicaml.org/amir-capital/ (also in Russian and Kazakh). This is the summary.

The Amir Capital scheme collected investor funds across Bitcoin, Tron and Ethereum between 2019 and 2023. Almost all of it is gone: every Bitcoin address in the cluster holds effectively zero today; the eighteen Tron wallets hold $2,234 between them. One exception matters more than everything else: an Aave position on Ethereum, roughly $24.6 million of collateral against a $6.78 million debt, which is live, liquid, and no longer at the address the case file names.

## The position moved on 11 August 2026

Over roughly one hour on 11 August, the entire Aave position was migrated from 0x0b32Aa5C1e71715206fE29b7BADB21ad95F272C0 to 0x62e7b318FE59bD5584a99E7B6c5817698a2C235c by debt swap: the new wallet supplied the USDT to clear the old wallet's debt, the old wallet withdrew its collateral and handed it over, the new wallet re-supplied it under its own name. Ten direct transfers between the two addresses, each with its own transaction hash. Repaying another party's multi-million-dollar debt in order to take their collateral is not an arm's-length transaction.

The new wallet holds 166.2876 aEthWBTC and 3,345.2564 aEthwstETH against 6,775,307 USDT of debt — roughly $17.8 million net. It is still cashing out to a Binance deposit address: 20,000 USDT on 23 April, 20,000 on 25 May, 20,000 on 8 July, 30,000 on 14 July, and 561,000 USDT on 19 July 2026.

## What can be acted on

Aave has no per-address freeze, WBTC offers only a global custodian pause, and wstETH has no control functions at all. The one lever is Tether: the USDT contract on Ethereum exposes addBlackList and destroyBlackFunds, and a blacklist on the holder would block the USDT repayment required to release the collateral, locking the position in place. The August migration shows the whole position can move inside an hour.

## Bitcoin: 4,262 BTC in, 4,185 out — a deposit funnel and a payout engine

Every transaction of all nine addresses was walked — 127,196 of them, from March 2019 to May 2024 — and the totals reconcile with the public explorer to the satoshi. An earlier figure of 64,360 BTC "received" was the explorer's gross funded total: the hot wallet paid change back to itself in 30,570 of its 30,572 transactions, so the same coins were counted on every pass. Net of that, the cluster took in 4,262 BTC from outside and paid 4,185 BTC out, with 77 BTC in fees.

The cluster has a shape. Two addresses are the intake — the aggregator 36XRdQsT7iX8UgmFpXSCHvHU98D7RdaCvL received 2,418 BTC from 15,487 outside addresses and the feeder 13dVCsyLnwpofkPRjiy9FZghvCWmKTtxoL a further 765 BTC — and both forwarded almost everything to the hot wallet 1CUTyyxgbKvtCdoYmceQJCZLXCde5akiX2, the outlet: 3,254 BTC out to 61,377 addresses, 57% of it in amounts under 1 BTC, and only 12 recipients at 20 BTC or more.

Of 61,377 recipients, 401 had ever deposited. 94% of the BTC paid out went to addresses that never paid in. The 401 that did both had deposited 784 BTC — 18% of everything the scheme took in — and got back 248 BTC: for the median one of them, 0.83 BTC returned per BTC deposited, and only 43% received more than they put in. A depositor can pay from one address and be paid to another, so this understates round trips; it cannot overstate them.

Identified exchange destinations account for 694 BTC, 16.6% of the outflow: Binance deposit addresses and a Binance hot wallet (about 340 BTC together), Bitfinex 93.5, Kraken 90.0, HTX 41.6, OKX 31.0, Garantex 28.3 and Cryptonator 9.7. Garantex was designated by OFAC in April 2022. Deposits and payouts peak in the second quarter of 2021 — 1,022 BTC in, 875 BTC out — and collapse after the fourth quarter of 2021, matching the Tron leg's stop on 30 November 2021; 31.6 BTC still left in the first quarter of 2023.

## Tron: $13.8M to Binance, drip-fed until July 2023

Three flows out of the main collection pool account for $51.1 million: the payout engine TXxU8LJ9wwQxUdg1YNP7LPz4YSXB5guhc5 ($37,440,303 across 169 transfers), the cash-out channel TCtVdT6XSoWcQifTHbBzFcuaUDX9oo8Yr5 ($12,040,000 across 9) and distribution via TKEe8PWmkdrV8AGh8q2hzfaeNTisoixiMF ($1,621,093). The cash-out channel's full history is only 95 transactions: almost the entire $13.8 million lifetime total went to two Binance hot wallets. The scheme stopped paying investors on 30 November 2021; the cash-out channel kept running until July 2023, twenty months later, in tranches as small as $1,150.

The payout engine distributed $38.5 million through roughly 30,000 small transfers (mean $807, median $161). Of the 180 largest recipients tested, not one had ever deposited into the scheme.

Every scheme-controlled address identified in this trace carries an investment-scheme label in the PublicAML database at 70 to 75 of 100. Exchange deposit addresses are left unflagged: funds belonging to thousands of unrelated customers pass through them.