Pig Butchering, Followed to the Exit: The Hidden Approval Behind a DOJ Forfeiture Case, and Three More Money Trails

BlockintAI · 2026-10-17T11:05:25.900Z

BlockintAI research. Court records were read on October 16, 2026. On-chain figures come from public Ethereum, TRON and BNB Chain data, re-checked on October 16, 2026 between about 7:35 PM and 7:50 PM CT unless another date is given. Times are Central Time (CT).

Pig butchering doesn't start with crypto. It starts with a friendly stranger. On March 30, 2025, a 69-year-old Charlotte resident the court calls "A.M." got a message on X from someone named "Thalia Williams." The two kept talking over X chat and WhatsApp. By April 7 he had a new wallet app and an "investment" that paid interest every day.

By June he had lost about $150,000. On October 2, 2026, federal prosecutors in North Carolina filed to forfeit the 119,306.27 USDC that Circle froze in the wallet that received his money.

The court filing tells A.M.'s side. The blockchain shows what happened on the other side. BlockintAI traced it, along with three other investment-scam money trails we published on X on October 16. Here is where the money went.

Key facts

Part 1: qsjt66[.]com, the mining pool that drained its own investors

What the court filing says

The forfeiture complaint, filed October 2, 2026 in the Western District of North Carolina and backed by an FBI agent's sworn verification, lays out a script that will sound familiar to anyone who has followed pig butchering.

• March 30, 2025. "Thalia Williams" contacts A.M. on X. The conversation moves to X chat and WhatsApp.
• The pitch. Williams tells him to install the Bifrost Wallet app and link it to qsjt66[.]com, which pays daily "interest" on whatever sits in the wallet. The site advertised 3.3% a day for balances over 500,000, which the complaint notes works out to about 1,204% a year.
• April 7 to May 27, 2025. A.M. puts about 50,000 USDC into the wallet. Small near-daily deposits, about 5,000 USDC in total, look like interest.
• May 27, 2025. The site tells him a "fund suspected of money laundering (5007.442069 USDC)" has reached his account and that his funds are "locked in the mining pool." The same day, all of the roughly 55,000 USDC leaves his wallet. He did not send it.
• May 29 to June 5, 2025. "Tim," writing from timereumtim@gmail.com and claiming to work for "Ethereum Network Investment," demands "verification payments." A.M. pays about 100,000 USDC more over a week. Each time, the money leaves his wallet the same day.
• June 5 and 10, 2025. Tim demands a 20% "tax," then says the funds will go to the IRS if it isn't paid by Friday. Earlier he had claimed the money was tied to a laundering fund "locked by the FBI."
• June 10, 2025. A.M. reports the scam to the FBI.
• About June 13, 2025. The FBI serves a seizure warrant on Circle, and Circle blocks the receiving address. The FBI had also received two similar complaints, on May 30 and June 5, 2025, from people contacted on X and told to link Bifrost Wallet to qsjt66[.]com.
• September 2026. Circle agrees to issue replacement USDC to the United States if the court orders forfeiture, because it can't move the frozen coins itself.

The complaint says A.M.'s money "moved" to the target address, 0xe6d328eb45bd03b2cbb801a0c4a93c993f735b76. It doesn't say how the money could leave a wallet when its owner never sent it.

What the blockchain says: one approval

A.M.'s Bifrost wallet, 0x7731…cf25, is the one the complaint calls "0x77313," and the amounts match it exactly. The wallet's own transaction history answers the question.

• April 7, 2025, 10:16 PM CT: the wallet's first outgoing transaction.
• April 7, 2025, 10:34 PM CT, 18 minutes later: the wallet signs an approve on the USDC contract. It grants 0x8e301b925a607e7bc91f2a18338bcafb69729698 the right to spend an unlimited amount of its USDC. The timing fits the moment a victim is walked through "linking" a wallet to a site. The approval looks like a routine setup step, and it is the whole scam.

After that, the scammers never needed A.M. to send them anything. Every drain is a transferFrom call sent by 0x8e301b92… itself:

The "verification payments" were never payments to anyone. A.M. moved money into his own wallet, and the puller swept it out the same day, on May 30 and June 5 within minutes of it arriving. The "frozen account" story bought time between pulls.

The last row is not in the complaint. Six weeks after Circle froze the target, the same puller took another 3,000 USDC from A.M.'s wallet, this time to a different collection wallet. The approval was never revoked. As of October 16, 2026 it is still live, though the wallet holds less than one cent of USDC.

Each pull also came with a shadow. Minutes after each of the four drains, a fake token named to look like "USDC" logged a matching "transfer" from A.M.'s wallet to 0xe6dcd69874498d1eb174f8e44487a9bccb735b76, a lookalike of the target that shares its first and last characters. That is address poisoning: it plants a near-copy of a real counterparty in the wallet's history, in the hope that someone copies the wrong one later.

One puller, 149 wallets

A.M. wasn't the puller's only target. Its full history on Etherscan shows:

• 291 successful transferFrom pulls, all in USDC, totaling 2,059,313.65 USDC from 149 different wallets, between March 20, 2025 and August 16, 2026. Another 41 attempts failed. The first, on March 20, 2025, took 2 USDC from 0xcac10afc83bfda8520d1dab336bba18e2057f7ef, a wallet in the network's own gas chain (below).
• The busiest month was August 2025, with about 817,000 USDC pulled.
• Where it went: 782,732.06 to 0xf8d838f3cda7491371f544dfbbbb6a761de1de2e, 774,122.90 to 0xfd015fe4f1b3fedc0bc2d64798034eb11aefe5c0, 369,303.26 to the forfeiture target, 68,888.83 to the hub 0xd9a777fb…, and smaller amounts to other wallets in the same network.
• The forfeiture target was filled almost entirely by the puller. The complaint counts 60 deposits totaling 369,306 USDC into 0xe6d328eb…. On-chain, 58 of them were pulls by 0x8e301b92…, from 24 different wallets, adding up to 369,303.26 USDC.
• Its last pull was on August 16, 2026: 15,020 USDC from one wallet, then 14 small sweeps of 5 USDC or less.
• 142 of the 149 wallets still carry an unlimited approval to it as of October 16, 2026. Together they hold only about 35 USDC today, but any USDC that lands in one of them can be taken.

The puller's own gas, the ETH it spends to send transactions, came from 0x0a27237c88cabbdf4bb3db73b162f25f76db5915 on March 20, 2025, about ten minutes before its first pull. Later top-ups came from the hub 0xd9a777fbcb537e58ed0c7bf0520a0a48c46dd80f in October 2025.

0xf8d838f3…de2e was another collection wallet. Its first gas came from the same 0x0a27237c… on April 8, 2025. Between February and December 2025, mostly from April on, it took in 793,509.83 USDT and USDC from 124 wallets, most of it by pull, and sent it on to HiFiSwap: Router (559,354), HiFiSwap 2 (66,356) and 50,000 to 0xfd015fe4…. Etherscan tags both HiFiSwap addresses as swap services.

The network behind the target

Only two wallets appear by name in the complaint: A.M.'s and the target. On-chain, several more wallets are tied together by who paid whose gas and who paid whom:

• The gas chain runs 0xcac10afc83bfda8520d1dab336bba18e2057f7ef → hub 0xd9a777fb… → 0x0a27237c… → the forfeiture target. 0xcac10afc… was itself first funded by a withdrawal from an address Etherscan tags "Binance 15" on March 22, 2024.
• The fake interest. The near-daily "interest" in A.M.'s wallet, 5,043.27 USDC in total, came from 0xfdec204d52b184d4415372737ebe1eb452d74a72. Between April and November 2025, that wallet took in USDT and USDC from the hub (38,200), 0xfd015fe4… (30,443), 0x3d71f13eaa1a44f13e3a791abf700852f7f79f1c (19,000), 0x0a27237c… (17,500) and 0xf8d838f3… (7,303). The same operation paid the bait and collected the haul.
• Four hours after the freeze. Circle's blacklist took effect on June 13, 2025 at 4:19 PM CT. At 8:31 PM the target moved the 32,274.59 USDT it also held, which Circle can't freeze, to 0xfd015fe4…. On November 21, 2025 the target's owner tried to move the frozen USDC; the transaction failed.

Five of these wallets (the target, 0x0a27237c…, the hub, 0xfd015fe4… and collection wallet 0x3d71f13eaa1a44f13e3a791abf700852f7f79f1c) together took in about $6.85 million in USDT and USDC from 521 sending addresses between April 2024 and October 2026. Most of it arrived between November 2024 and October 2025. That includes A.M.'s 161,044 USDC, and 83 of those sending addresses also got small payments back from the network, the same fake-interest pattern the complaint describes. The network was running a year before A.M. was contacted.

The hub alone took in 2,513,253.71 USDT from 199 sending addresses and 105,733.71 USDC from 13. Its last real outflow was on October 3, 2026 at 6:46 AM CT. The later entries in its history are fake lookalike tokens. As of October 16, 2026 it still holds 1,277.78 USDT and 3,680.99 USDC and is not frozen.

The exits:

• About 1.39 million to the address Etherscan tags "Bridgers" and about 2.8 million to addresses Etherscan tags as HiFiSwap ("HiFiSwap: Router", "HiFiSwap 1", "HiFiSwap 2", "HiFiSwap: Bridge 7" and "HiFiSwap: Bridge"). These are swap and bridge services, and the money's onward path from them can't be followed on-chain.
• Three addresses Etherscan tags "Binance Deposit": 0x9ae4ac74a4e823e4de29df0d5f7f863c1db61674, 0x227fe7a3609f1644deccdb4a6a196d0368789db5 and 0x6ec0fc1db2cd86d828cd56509334a3ca3d540900. Each sweeps into "Binance 14." The hub and 0x0a27237c… paid into the same deposit address, which points to one exchange account receiving from both.
• Smaller amounts went to deposit-style addresses that sweep into wallets Etherscan tags "OKX 7" and "HitBTC: Hot Wallet 4."

Deposit addresses are the points where an exchange can identify an account holder when law enforcement asks. Only one wallet in this network is frozen: the forfeiture target. qsjt66[.]com no longer resolves (checked Oct 16, 2026).

Part 2: AccGN[.]club, from "AI trading" to TRON

AccGN is a cousin of pig butchering: no romance in the reported story, just a fake trading platform. A California resident told the state's Department of Financial Protection and Innovation (DFPI) that AccGN[.]club claimed to trade crypto with artificial intelligence. Withdrawals worked for a while, then the latest one was blocked. The reported loss was $2,400, sent to 0x92275b6cc254b68a6bcc9c76be198264cdabdf94. DFPI's tracker files it as a "Fraudulent Trading Platform" and doesn't date its entries.

That deposit wallet received 5,154.20 USDT between September 29 and October 8, 2025 and passed all of it to 0xc3f5afb6f6d987600610a45430a9fce7b0c22fc6. That's where the scale shows:

• Between September 11 and October 13, 2025, 0xc3f5afb6… took in 406,774.03 USDT and 767,706.74 USDC (1,173,786 in total) from 2,138 sending addresses. Most deposits were between $100 and $1,000.
• It forwarded all of it to 0x454eb9a3af939f626ba2133f13732fd64b060b1b.
• 0x454eb9a3… bridged about 1.22 million to one TRON address, TNgvWRdnw4oQWsvSvyvTeG8ptdnZAjWy3q, in September and October 2025. It used three bridges: Butter Network (964,672, per Butter's public bridge API), Allbridge Core (160,853 USDC, from the transaction calldata) and Wanchain (97,000 USDT, per Wanchain's public status API). About 48,000 of that came from two other wallets.

The same pattern runs on BNB Chain. Two collectors, 0xd7093a21b4d25d1ed703677028bd35867fc89600 (thousands of sending addresses, September 11 to October 15, 2025) and 0xe0b2cf6c6fabf6c858a0d7542d5ce2be1f1e7d50 (September 2024 to September 2025), fed the same bridging wallets. Butter's API shows 150 bridge hops into four TRON receivers between July 2025 and July 2026, about 5.77 million USDT-equivalent in total, led by TNgvWRdn…. That figure is money moved through the bridge route, not a loss count.

On TRON, TNgvWRdn… passed its USDT to TG3a9dxj1XLxwuxJK68ehjwzxkdgYh4SBx. Its last transfer was on October 16, 2025, and it now holds 0.80 USDT. TG3a9dxj… (21.8 million USDT from 15 sending addresses, September 11 to October 30, 2025) and a second large wallet, TRiTSCYfnoSWkaQvv2hrbTSojmUZTTKZ5R (16.5 million USDT from 26 sending addresses, October 2024 to October 2025), also take in money from other sources. Both pay the same two wallets, TPtuYa4hv5rvf86WK7sxRgxs7J6LkV1kxg and TEJSqsQ53pd98DwMdaQUJK3w2hh25B4Uxd.

TEJSqs… is the one wallet on this route that still holds money. On October 16, 2026 it received eight USDT transfers between 10:28 and 10:35 AM CT, 59,800 USDT in total, from four wallets outside the traced route. At 7:45 PM CT it sent 5,000 USDT on, and at 7:49 PM CT it held 146,581.71 USDT. Tether has not blacklisted it. USDT on TRON is one of the few places in this story where the issuer could freeze funds.

Part 3: cwgmain[.]cc, the fake exchange with a membership fee

In late April 2025, two Reddit users described the same fake exchange, "cwgmain" (pc.cwgmain[.]cc). After their balances grew, withdrawals were blocked unless they bought an "exclusive membership" for 5,000 to 10,000 USDT, the familiar pig-butchering exit fee. Both named 0x1fae712e926978865eecfe63c6975c34aaa7f7fe as the platform's ETH deposit address. California's DFPI tracker also lists cwgmain[.]cc. In February 2025, CWG Markets warned that a related domain, m.cwgmain[.]com, was impersonating its brand.

On Etherscan:

• April 19 to August 10, 2025: the address took in 717.28 ETH from 35 sending addresses and 26,378.66 USDT from 4. Almost all of it was passed on.
• One sender alone put in 313.40 ETH. That wallet had been funded from an address Etherscan tags "Coinbase 10."
• The HTX route. 196.80 ETH and 12,689.58 USDT went to 0xface4ebd037df749f0fc515dffb4f2d9652c0600, which forwarded everything it held, 502.62 ETH and 44,398.62 USDT, to an address Etherscan tags "HTX 48", an HTX deposit address under a community-compiled tag. About 305 ETH of that came from a different wallet, so not all of it traces to cwgmain.
• The MEXC route. 0xea9da77b2e288a0da3c380d0883e390f05f1489a, gassed by the deposit address, received 177.38 ETH and sent 167.00 ETH and 5,891.88 USDT to the Etherscan-tagged "MEXC 16".
• The swap route. 0xc4e2cd4f3270fac93eeac0e63daea14af3097505 received 138.37 ETH and swapped through routers Etherscan tags "OKX Labs: Old DEX Router."

The deposit address has been dormant since August 10, 2025, and nothing is frozen. Exchange deposit addresses are where a request for records or a hold can land, which is why the destinations matter even a year later.

Part 4: Nexus Equity on BNB Chain, still moving in October

Nexus Equity (nexusequity[.]com) is an advance-fee investment scheme rather than a romance scam, but its money moves the same way. On October 6, 2026, a Reddit user described being unable to withdraw and being told to pay for an "Investor Operational Compliance Process" (IOCP). An October 1 email declared the platform insolvent. An October 3 email asked "Team Leaders" to push the remaining members to pay. We covered the address-poisoning decoy in that case in How Pig-Butchering Kits Are Built and Cashed Out. The BNB Chain side is a separate story:

• Collectors. 0x5ae2ae2e377e38557ea2ab0da9e3d2d3d6711967 took in 864,560 USDC from 70 sending addresses starting December 29, 2025. Its last outflow, 23,784.99 USDC, was on October 11, 2026 at 4:56 AM CT (re-checked on BscScan, Oct 16). 0xfadb1907d98bfd65383d0b9cdc381f3c81c534d1 took in 706,689 USDC from 73 (December 5, 2025 to September 4, 2026), and 0x73ea814e5b904a5094da2807eb2abc5a3d39ceea took in 294,288 from 34 (October 21 to November 13, 2025).
• Gas operator. 0xec1f2d611ad738622e6d3f376f888f523d8ce260 paid the first BNB for several collectors.
• Downstream. 0x9277882599e2d02f12754202006c812aa99b3bee received 1,492,290.43 USDC on BNB Chain from 15 sending addresses between September 2025 and January 2026. 97.3% of it came from the collectors themselves.
• Cash-out. 0xb57b620d1615dc85754e63d43966249ed197cbed forwarded 484,362 USDC, between October 5, 2025 and February 25, 2026, to 0x579810ef3005b7abc1d40ab9a09c808c4bd08ea6. That address got its gas from BscScan-tagged "Binance: Deposit Funder 1" and sweeps into "Binance 51," the profile of an exchange deposit address.

The stablecoins here are Binance-Peg USDC and USDT, which have no issuer freeze function. Any hold has to come from an exchange.

What these trails have in common

• The lure is personal; the plumbing is industrial. A.M. talked to one "Thalia." The wallet that emptied his account pulled from 147 other wallets as well.
• "Linking" a wallet can be the theft. An unlimited token approval lets the approved address move your coins whenever it likes, without another signature. Fake mining pools, "liquidity" apps and fake staking sites use this step.
• Money leaves fast, and across chains. Within one or two hops, funds hit swap services (Bridgers, HiFiSwap), bridges to TRON (Butter, Allbridge, Wanchain) or exchange deposit addresses.
• Freezes depend on the token. Circle froze USDC in the qsjt66 case, but USDT in the same wallet left four hours later. USDT on TRON can be frozen by Tether. Binance-Peg tokens on BNB Chain can't be frozen by an issuer.
• Frozen money can be recovered. The qsjt66 case shows the path: a fast complaint, a seizure warrant, a frozen balance, and a forfeiture case 16 months later.

Protect yourself

• Nobody legitimate pays 3.3% a day. Daily "interest" that you can see but can't withdraw is the bait.
• Never "link" or "authorize" a wallet for someone you met online. If you already did, review and revoke token approvals with Etherscan's free Token Approval Checker. An unlimited USDC or USDT approval to an address you don't recognize is an emergency.
• "Verification," "tax," "membership" and "compliance" fees are the second stage of the same scam. Paying them never unlocks anything.
• Anyone claiming your funds were "locked by the FBI" is not the FBI.
• Copy addresses from the source, never from your transaction history. Lookalike addresses are planted there on purpose.
• Report it. In the U.S., report fraud to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. Elsewhere, report to your national police cybercrime unit. You can also file a report at blockint.ai with the addresses and details; it is free, and anonymous reports are accepted.

Addresses in this post

qsjt66[.]com (Ethereum)

• Forfeiture target (frozen by Circle): 0xe6d328eb45bd03b2cbb801a0c4a93c993f735b76
• Puller (unlimited-approval spender): 0x8e301b925a607e7bc91f2a18338bcafb69729698
• Collection and network wallets: 0xd9a777fbcb537e58ed0c7bf0520a0a48c46dd80f (hub), 0x0a27237c88cabbdf4bb3db73b162f25f76db5915, 0xfd015fe4f1b3fedc0bc2d64798034eb11aefe5c0, 0x3d71f13eaa1a44f13e3a791abf700852f7f79f1c, 0xf8d838f3cda7491371f544dfbbbb6a761de1de2e, 0xcac10afc83bfda8520d1dab336bba18e2057f7ef
• Fake-interest payer: 0xfdec204d52b184d4415372737ebe1eb452d74a72
• Address-poisoning lookalike: 0xe6dcd69874498d1eb174f8e44487a9bccb735b76

AccGN[.]club

• Ethereum: 0x92275b6cc254b68a6bcc9c76be198264cdabdf94 (reported deposit), 0xc3f5afb6f6d987600610a45430a9fce7b0c22fc6, 0x454eb9a3af939f626ba2133f13732fd64b060b1b
• BNB Chain: 0xd7093a21b4d25d1ed703677028bd35867fc89600, 0xe0b2cf6c6fabf6c858a0d7542d5ce2be1f1e7d50
• TRON: TNgvWRdnw4oQWsvSvyvTeG8ptdnZAjWy3q, TG3a9dxj1XLxwuxJK68ehjwzxkdgYh4SBx, TRiTSCYfnoSWkaQvv2hrbTSojmUZTTKZ5R, TEJSqsQ53pd98DwMdaQUJK3w2hh25B4Uxd, TPtuYa4hv5rvf86WK7sxRgxs7J6LkV1kxg

cwgmain[.]cc (Ethereum)

• Deposit address: 0x1fae712e926978865eecfe63c6975c34aaa7f7fe
• Forwarding wallets: 0xface4ebd037df749f0fc515dffb4f2d9652c0600, 0xea9da77b2e288a0da3c380d0883e390f05f1489a, 0xc4e2cd4f3270fac93eeac0e63daea14af3097505

Nexus Equity (BNB Chain)

• 0x5ae2ae2e377e38557ea2ab0da9e3d2d3d6711967, 0xfadb1907d98bfd65383d0b9cdc381f3c81c534d1, 0x73ea814e5b904a5094da2807eb2abc5a3d39ceea, 0xec1f2d611ad738622e6d3f376f888f523d8ce260, 0x9277882599e2d02f12754202006c812aa99b3bee, 0xb57b620d1615dc85754e63d43966249ed197cbed

Sources

Court record and coverage

• United States v. All Circle USD Coin (USDC), W.D.N.C. No. 3:26-cv-00834, complaint for forfeiture in rem (Doc. 1, filed Oct 2, 2026), via CourtListener RECAP: https://storage.courtlistener.com/recap/gov.uscourts.ncwd.125146/gov.uscourts.ncwd.125146.1.0.pdf; docket: https://www.courtlistener.com/docket/74908789/united-states-v-all-circle-usd-coin-usdc/
• Block Tribune, "Federal prosecutors in Charlotte seek forfeiture of $119,306 in stablecoin linked to romance-style investment scam": https://blocktribune.com/federal-prosecutors-in-charlotte-seek-forfeiture-of-119-306-in-stablecoin-linked-to-romance-style-investment-scam/

Victim and consumer reports

• California DFPI Crypto Scam Tracker (entries "accgn[.]club" and "cwgmain[.]cc"): https://dfpi.ca.gov/consumers/crypto/crypto-scam-tracker/
• Reddit r/Scams and r/CryptoScams, cwgmain victim posts (Apr 2025): https://www.reddit.com/r/Scams/comments/1kbokuz/ and https://www.reddit.com/r/CryptoScams/comments/1kbowc2/
• CWG Markets impersonation notice (Feb 2025, reprinted): https://www.yocajr.com/orgnews/303752
• Reddit r/CryptoScams, "Nexus Equity: my experience and documented red flags" (Oct 6, 2026): https://www.reddit.com/r/CryptoScams/comments/1wyyx7b/nexus_equity_my_experience_and_documented_red/

On-chain (Etherscan, BscScan, Tronscan; checked Oct 16, 2026)

• Unlimited approval from A.M.'s wallet (0x7731…cf25): https://etherscan.io/tx/0x2e489d5e8c3183df293da8a39d4f0b210243785cf6d8338c16ce6d17fe700544
• Pulls into the target: May 27, 2025, May 30, Jun 2, Jun 5; post-freeze pull, Jul 24, 2025
• Puller: https://etherscan.io/address/0x8e301b925a607e7bc91f2a18338bcafb69729698
• Forfeiture target: https://etherscan.io/address/0xe6d328eb45bd03b2cbb801a0c4a93c993f735b76; Circle blacklist transaction: https://etherscan.io/tx/0x902ce469bf8e3ff6397d376d80d6f5caed26693712f638776bf819b295f7559b; USDT move after the freeze: https://etherscan.io/tx/0x41b20799c540772a6d2cc91238ccf027739e840680af8951730b6feb6438f7dd
• qsjt66 network: hub, 0x0a27237c…, 0xfd015fe4…, 0x3d71f13e…, 0xf8d838f3…, interest payer; Binance deposit addresses 0x9ae4ac74…, 0x227fe7a3…, 0x6ec0fc1d…
• AccGN: 0x92275b6c…, 0xc3f5afb6…, 0x454eb9a3…; Allbridge example: https://etherscan.io/tx/0x8669edf760087f4f4641eb0a8a38eedf62c680c3c2c77e49af6adc962ace9a02; Wanchain status: https://bridge-api.wanchain.org/api/status/0x0b57b0bba13c932ff6546944da384124a2df14ed7c69c49554060c4da832737c; BNB Chain bridge example: https://bscscan.com/tx/0x5d626a9125977843e89e2ed48f23d2d0b003dba1b54ce29dfb798015c87860e5; collectors 0xd7093a21…, 0xe0b2cf6c…
• TRON: TNgvWRdn…, TEJSqsQ5…, TG3a9dxj…, TRiTSCYf…; Tether USDT contract (isBlackListed): https://tronscan.org/#/contract/TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t
• cwgmain: deposit address, 0xface4ebd…, HTX 48 transfer, HTX 48, 0xea9da77b…, MEXC 16 transfer, MEXC 16
• Nexus Equity (BscScan): 0x5ae2ae2e…, 0xfadb1907…, 0x73ea814e…, 0xec1f2d61…, 0x92778825…, 0xb57b620d…, 0x579810ef…, Binance 51

Sanctions and freezes

• OFAC SDN list (Sanctions List Search and SDN.CSV, Oct 16, 2026): https://sanctionssearch.ofac.treas.gov/
• Circle USDC contract (isBlacklisted): https://etherscan.io/token/0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48#readProxyContract; Tether USDT contract (isBlackListed): https://etherscan.io/token/0xdac17f958d2ee523a2206206994597c13d831ec7#readContract

Related BlockintAI research

• Eight Domains, One Chat Account, $6.9 Million Through One Wallet: How Pig-Butchering Kits Are Built and Cashed Out