New Domain, Old Wallet: Four Fake Trading Sites Whose Deposit Addresses Predate Their Websites, One by Three Years
BlockintAI · 2026-11-05T15:21:44.598Z
bridgevest[.]live was registered on October 30, 2026. On the morning of November 5, 2026, its deposit page showed a USDT (TRC-20) address that has been receiving money since June 14, 2023. Over its lifetime that address took in 885,967.65 USDT and sent out exactly the same amount, across 537 transfers.
BlockintAI checked the deposit addresses shown on four fake trading sites that use the same "CFD Trading" template. Six of the addresses have on-chain history. On every one of the four sites, the wallet is older than the website.
Times are US Central Time (CST, UTC-6) unless marked UTC.
Key facts
| Site | Domain registered (RDAP) | Deposit address shown | First on-chain activity | Lifetime in / out |
|---|---|---|---|---|
| bridgevest[.]live | Oct 30, 2026 | TNBRcqbVDwChmQLj8nj52TzY1ChJECZEQC (USDT, TRON) |
Jun 14, 2023 | 885,967.65 USDT / 885,967.65 USDT |
| bridgevest[.]live | Oct 30, 2026 | bc1qh83dexpv7v7wrhmz2cdf3j0ur96y0szjthjfee (Bitcoin) |
Dec 22, 2025 | 0.07252146 BTC / 0.07252146 BTC |
| summittradeprime[.]live | Dec 23, 2025 | TKWBqmbMQZyRJzvn6oV3EutxWxXzj7Csp3 (USDT, TRON) |
Oct 18, 2025 | 1,231.39 USDT / 1,231.39 USDT |
| vestprocapital[.]com | Nov 1, 2026 | 0x6AFc0c68effCD0C8992d639824cE51b61Ad225FD (Ethereum and BNB Chain) |
Jun 8, 2026 | 100.051126 USDT + 1,127.27 BSC-USD, all forwarded |
| vestprocapital[.]com | Nov 1, 2026 | bc1qcsvdrly7vthca7px4y3dr788fhmlvvd0yhjmgd (Bitcoin) |
Jun 13, 2026 | 0.01986090 BTC / 0.01986090 BTC |
| encoraxpro[.]com | Aug 30, 2026 | bc1q70jutlee45cgpuztzlqpg7nwag8kl4ceae7g9q (Bitcoin) |
Aug 22, 2026 | 0.00319194 BTC / 0.00319194 BTC |
These are on-chain totals at the deposit addresses. They are not a count of victim losses.
What the sites show
All four sites' page titles include "CFD Trading — Trading on Stocks, Gold, Oil, Indices". On November 5 at 7:07 AM CT, each homepage displayed fixed-return "plans" with "Principal return on maturity". bridgevest[.]live, summittradeprime[.]live and vestprocapital[.]com list a "150% / Trade" plan with a $500 minimum and a "16% / Trade" plan. On summittradeprime[.]live and vestprocapital[.]com the 150% plan is still named "Test". encoraxpro[.]com lists a "12% / Trade" plan with a $2,100 minimum and a "5% / Trade" plan with a $500 minimum.
Each site also says it is "Globally Regulated" and "Operating under strict financial regulations", without naming a regulator or licence. A real broker can't promise a fixed return per trade. Fake trading platforms like these are a standard tool of pig-butchering scams: the victim is groomed by a contact, steered to the site, shown fake gains on a dashboard, and then asked for more money before any withdrawal.
The wallets are older than the websites
- bridgevest[.]live. The domain is six days old. Its USDT address first received money on June 14, 2023, more than three years earlier. The largest single deposit, 65,944.98 USDT, came on June 15, 2023. The address had 200 incoming and 337 outgoing USDT transfers, from 51 sending addresses to 65 receiving addresses, with heavy use again from May to September 2025. Its last transfer before the site went up was on August 13, 2026. The site's Bitcoin address has been active since December 22, 2025, with 12 deposits, all spent onward.
- summittradeprime[.]live. The domain was registered on December 23, 2025. Its USDT address received its first transfer on October 18, 2025, two months earlier. It took in 1,231.39 USDT over eight deposits, and 1,203.39 USDT of that went to one address,
TPWShAk3…aAc9. - vestprocapital[.]com. The domain was registered on November 1, 2026. Its Ethereum address received 100.051126 USDT on June 8, 2026, and the same address on BNB Chain received 1,127.27 BSC-USD on October 15, 2026. Both amounts were forwarded in full to the same address,
0xc0f3892c…93ec. Its Bitcoin address was first used on June 13, 2026. - encoraxpro[.]com. The domain was registered on August 30, 2026. Its Bitcoin address received 0.00319194 BTC on August 22, 2026, eight days before the domain existed, and spent it the same day.
How the money moves
None of these addresses holds a balance. Money comes in and leaves.
- The bridgevest[.]live USDT address sent 403,231.87 USDT, almost half of everything it received, to one address,
TJupS7sG…kdtH. The next two largest destinations,TK5SG7XL…sfm9andTZ2QWfpm…TCPQ, got 136,752.91 and 91,163.17 USDT. - The bridgevest[.]live Bitcoin deposits were swept repeatedly to
1F2puF9U…84Bjand17LNZ2J2…m2aR, both busy addresses with hundreds of transactions. - The vestprocapital[.]com address attracted address-poisoning spam. After its real USDT and BSC-USD went to
0xc0f3892c…93ec, fake tokens appeared to move to lookalike addresses that also start with0xc0f3and end in93ec. Anyone copying a recent address from that wallet's history could send money to a scammer's copy.
The volume is lopsided. One address, the one bridgevest[.]live is now showing, accounts for almost all of the money. The other five have small totals, but the pattern is the same: the address was in use before the domain was bought.
What this shows
- The domain is the cheap part. A new domain is cheap and can be registered days before a victim is sent to it. The collection wallet is reused across storefronts. Here, one wallet has been in use since 2023, and the site showing it today is six days old.
- Domain age is not the whole check. "Registered last week" is a strong red flag. "Registered last year" doesn't make a site safe, because the operator may have simply kept the domain.
- A deposit address with a long history before the site existed is a strong sign of a reused operation. Exchanges typically assign each customer their own deposit address. They don't hand a new customer an address that has already moved hundreds of thousands of USDT for other people.
If someone you met online sent you to a trading platform, look the platform's deposit address up on a public block explorer before you pay. Check whether its history starts before the website existed. If it does, stop.
Addresses in this post
Deposit addresses shown on the sites' deposit pages, November 5, 2026:
TNBRcqbVDwChmQLj8nj52TzY1ChJECZEQC(bridgevest[.]live, USDT TRC-20)bc1qh83dexpv7v7wrhmz2cdf3j0ur96y0szjthjfee(bridgevest[.]live, Bitcoin)TKWBqmbMQZyRJzvn6oV3EutxWxXzj7Csp3(summittradeprime[.]live, USDT)0x6AFc0c68effCD0C8992d639824cE51b61Ad225FD(vestprocapital[.]com, USDT on Ethereum and BNB Chain)bc1qcsvdrly7vthca7px4y3dr788fhmlvvd0yhjmgd(vestprocapital[.]com, Bitcoin)bc1q70jutlee45cgpuztzlqpg7nwag8kl4ceae7g9q(encoraxpro[.]com, Bitcoin)
Shortened because they are downstream addresses, not in a BlockintAI report: TJupS7sG…kdtH, TK5SG7XL…sfm9, TZ2QWfpm…TCPQ, TPWShAk3…aAc9, 1F2puF9U…84Bj, 17LNZ2J2…m2aR, 0xc0f3892c…93ec.
Related report
Sources
- Domain registration dates: public RDAP records for bridgevest[.]live, summittradeprime[.]live (Identity Digital registry), vestprocapital[.]com and encoraxpro[.]com (Verisign registry), read November 5, 2026
- Site text: each site's public homepage, read November 5, 2026, 7:07 AM CT
- TRON: TronGrid USDT (TRC-20) transfer records for
TNBRcqbV…ZEQCandTKWBqmbM…Csp3. First bridgevest[.]live deposit: https://tronscan.org/#/transaction/ee4a856354f788fa44abfccc0b459ca4bb4b5631e8257d3dedba6d065c1f4713; largest deposit: https://tronscan.org/#/transaction/559bff84a9370e4dae41256ddbd0c656a521c7487683008c3d935edbefe5c4a9 - Bitcoin: https://blockstream.info/address/bc1qh83dexpv7v7wrhmz2cdf3j0ur96y0szjthjfee, https://blockstream.info/address/bc1qcsvdrly7vthca7px4y3dr788fhmlvvd0yhjmgd, https://blockstream.info/address/bc1q70jutlee45cgpuztzlqpg7nwag8kl4ceae7g9q
- Ethereum USDT in: https://etherscan.io/tx/0xca7a7ecb4d7bf4fd0f694dee89c6d30a367663d5ca197683bd45f30e177d8b16; BNB Chain BSC-USD in: https://bscscan.com/tx/0xfd9b6641e41830998519fcb6d23cbeb7bf3f67e2516b7290824591235597b3cc
Lost money? Report it to IC3 (FBI) at ic3.gov and the FTC at reportfraud.ftc.gov, and file at https://blockint.ai/c3?mode=file