Pig butchering on Tron: we followed the money from 9,993 victim reports

Chainabuse is the largest open database of crypto-scam reports. Anyone can file one, usually with the address they paid. We took every report in three categories — pig butchering (1,999; the site’s listing stops near 2,000), romance (1,622) and fake-returns platforms (6,372) — and extracted the Tron addresses. Tron matters because this kind of fraud is overwhelmingly paid in USDT on Tron.

Before reading anything into an address we checked what it is. 38 of the 2,197 are exchange hot wallets that victims listed by mistake — the place they bought USDT, not the place it went. Those are left out. 132 are exchange deposit addresses: the victim was told to pay straight into an exchange account. That account belongs to whoever opened it, which makes it the most useful lead in the whole set — the exchange knows who that is.

For the remaining 2,154 we read the USDT history. 1,895 had activity; 855 received USDT from 10 or more different senders, and 110 from more than 100 — far more than one victim each. Most of those people never filed a report.

The useful question is not what one reported address did, but where several of them send money. Across all of them, 115 receiving wallets get USDT from four or more different reported addresses. Many are exchanges. Some are not.

`TRZxeXSWnqsJzSt712WYBaxmydxVFBTkP6` received money from 7 reported addresses. Read on its own, it took in 92.7 million USDT from 70 senders between 1 May and 2 July 2025, and passed nearly all of it to three wallets with no public label: 48.0M to TYzyB3X64PpkAXaQ46Mr2pnaiUAWtPXViE, 17.6M to TKLLW7yFdvUUCDeHDs3MTjbGrR1TArRy3f and 16.0M to TPBrDxaepqeUm3WzxCAdWKaggq9qg6kpBV. It has had no activity since.

`TVE1KMVZucBDjoYeBjxbtvcXgDV2k9PYwj` and `TRkHJNBxFpP9waNqGcRmP4R3sNk3VoNKot` were fed by 9 and 7 reported addresses. They were active in exactly the same three weeks, 10 September to 3 October 2023, and both sent their money to the same two wallets, TVVKHDrwid1VW9XrTewjpM2grFbRspv4NS and TVReU4Zz7h7jHwvYkzhT6gnCXwyWV8AccS — together about 6.3M out of 10.7M received. Two collectors working the same window into the same destinations is what one operation looks like on chain.

`TEion5ow2fkZVCw24PjB4cB7h8oHxbDXgB` — itself reported once — took in 57.8M USDT from 1,553 senders in its last 10,000 transfers alone (since August 2025) and is still active; its largest outflow goes to TUXcBqJSUqb62oqtowFZgrohUQCbRyxBgJ. `TJnJeormPeDNLSA5Qo4obXJH4e6H5yw2tW` received from 7 reported addresses, took 12.3M from 1,094 senders since December 2022, is still active, and pays out partly through deposit accounts at one exchange, such as TTHycaY6HJSwd6QnUMHqaKZ3HwfXRVjPuj.

The money from reported addresses exits through 184 exchange deposit accounts. Most belong to a handful of exchanges whose deposit networks we can see but do not name here; others are at Binance, Kraken, Bybit and HitBTC. A deposit account is not the exchange’s own money: it is a customer account, and the customer is identifiable to the exchange.

Four HuionePay addresses received about 1.63 million USDT from reported addresses — 1.17M of it into TMqDrZa5kEebg5wi3W3wusVZ6ZF2w6JczH alone. Huione has been named by US Treasury as a laundering channel for exactly this kind of fraud.

A report is a claim, not a finding. Reports on Chainabuse are anonymous, and some are filed in bulk: 105 reports about one fake trading platform were written to five templates. That is why we counted senders on chain rather than reports. It is also why a single report does not raise an address’s risk score in our system; addresses with many independent reports, or that money from several reports flows into, are where we are working to raise it.

This page names nobody and does not say who controls any wallet. The large nodes are described by what they received and from whom. Exchange hot wallets reported by mistake are not listed. The full address-level data is going to our risk team so the reported addresses can be checked against the incident database.