Tracing $4M of pig butchering wallets: a live investigation

This is the on-chain story of a single pig-butchering operation that took $40M from approximately 1,100 victims across 18 countries between Q2 2024 and Q1 2026. We are publishing it for two reasons: because the public should understand the *mechanics* of how stolen funds actually move, and because the same patterns appear in nearly every large operation we trace. Once you can see them, you can recognise them.

All wallet addresses cited are already on the GACS public blacklist. We have aged the data and omitted attribution-sensitive details to avoid compromising live law-enforcement work.

The 14 deposit funnels

The operation in question used a rotating set of 14 victim-facing deposit wallets on the Tron network (USDT-TRC20). Each wallet handled inbound deposits for an average of 47 days before being retired, and was replaced by a fresh address with no overlapping history. The pattern is consistent across every large pig-butchering operation we have traced: rotation is deliberate, designed to defeat naive blacklisting and to limit single-wallet exposure if law enforcement freezes one.

Across the 14 wallets, we observed: - ~1,140 distinct depositing addresses (one per victim on average, with some victims using multiple). - Median deposit per victim: $19,400. Mean: $35,200, pulled up by a long tail of life-savings losses. - Total inbound: ~$40.1M USDT over the 22-month window. - Time-to-onward-transfer: median 4 hours, almost never more than 24. Victim funds do not sit at the deposit wallet — they move immediately.

The four consolidation addresses

All 14 deposit funnels emptied into a small number of consolidation wallets — four primary addresses over the 22-month period, with each consolidation wallet active for 4–8 months before being retired. The pattern is mechanical:

1. Victim deposits to one of the 14 victim-facing wallets.
2. Within hours, the deposit wallet sweeps to the active consolidation wallet.
3. The consolidation wallet aggregates 2–7 days of deposits across all 14 funnels.
4. The consolidation wallet then makes one of two onward moves: either to an OTC desk hot wallet, or to a bridging/swap protocol.

This layered architecture is universal in serious operations. The reason is operational: it limits the blast radius of any single wallet being frozen, it makes blockchain-analytics attribution slower, and it concentrates the actual "cash-out" decision at a small number of controlled choke points.

The two OTC desks

The funds we traced ultimately reached two OTC desks during the period observed: - One operated out of a Hong Kong-registered entity with a banking relationship in mainland China. - One operated as a freelance broker network across Telegram, settling via Dubai-registered shells.

OTC desks are the under-regulated chokepoint in the global crypto-laundering economy. They accept large USDT inflows, settle in fiat or physical goods (gold, real estate), and operate under KYC standards that are nominally compliant but practically lax. The largest single recommendation in our State of Crypto Scams 2026 report is that OTC desks be brought under KYC parity with user-facing exchanges — because this is the layer at which stolen funds become unrecoverable.

For this specific operation: - ~62% of the $40M exited through the Hong Kong-linked OTC desk, settled into onshore RMB and routed via a mainland banking relationship. - ~21% exited through the Dubai-linked Telegram OTC network, settled into physical gold purchased at specific Deira gold-market dealers. - ~12% routed through Tron-native mixers (chiefly Tornado-equivalents that have emerged since the original Tornado Cash sanctions) before exiting at smaller offshore exchanges. - ~5% remains observably idle in cold wallets that we believe are controlled by upstream operators rather than the front-line scam compound.

The 48–72 hour window

The single most important practical finding from this tracing work is this: funds become unrecoverable within 48–72 hours of the victim deposit. This is not a regulatory failure or a forensics failure — it is a property of the architecture above. By hour 48, victim funds have typically left the original deposit wallet, passed through a consolidation address, and either been swept to an OTC hot wallet or bridged out of Tron entirely.

A wallet freeze at hour 72 or later is rarely freezing victim funds — it's freezing the OTC desk's working capital, which is recoverable in a much more limited sense (subject to international cooperation, civil-asset claims, and counterparty negotiation).

This is why the GACS country reporting guides all emphasise the 24-72 hour window for the first round of filings. The window is not arbitrary. It is set by the operational tempo of the laundering layer.

What the deposit wallets look like before they're flagged

This is the part most useful to ordinary readers, because it explains how to *avoid being victim 1,141*. A fresh victim-facing deposit wallet, in the first 7 days before community reports flag it, shows:

• Age: 0–14 days from first transaction.
• Inbound pattern: many small-to-medium deposits from many distinct addresses, each of which is itself a fresh-funded wallet (the victim's first crypto wallet, freshly funded from a fiat on-ramp).
• Outbound pattern: almost-immediate consolidating transfers to one or two addresses.
• Net direction: money in, money immediately out, near-zero idle balance.
• No interaction with legitimate dApps, NFT marketplaces, or DeFi protocols.

A wallet with this profile, prior to the platform itself being reported, is identifiable as a scam-deposit funnel with very high accuracy from on-chain features alone. This is why the GACS Wallet Checker can warn on freshly-rotated addresses that haven't yet been individually reported: the *pattern* is the signature.

The five things to take away

1. The deposit wallet rotates. Don't trust "I checked this wallet and it's clean" if the wallet is less than three weeks old.
2. The platform brand rotates faster. The same operation runs under 4–6 different "broker" brands simultaneously. Checking one brand doesn't clear the others.
3. The OTC chokepoint is where regulation can actually bite. Until that happens, recovery rates will remain catastrophically low.
4. The 48–72 hour victim window is real. File with your bank, your national fraud agency, the receiving exchange, and GACS inside it.
5. The data is shared. Every wallet, brand, and phone number reported to GACS makes the next victim's search return a warning instead of a welcome. This is the single highest-leverage action a victim can take.

How to cite this investigation

GACS (2026). *Inside the wallets: tracing $40M through 14 pig-butchering deposit funnels.* Global Anti-Crime & Safety. https://gacs.app/blog/tracing-pig-butchering-wallets-investigation

Press, researchers, and law-enforcement contacts can request the de-aged wallet list and the methodological appendix at hello@gacs.app. We do not publish the live, currently-active wallet set on this blog — that data is in the live blacklist queried by the GACS Wallet Checker, where it is most useful: in the four-second window before someone is about to send the next deposit.