“No investment is required; keep a balance in your own wallet and mine for free” sounds low risk. In reality, the wallet balance may be the target.
This article is a redacted real case. Identities, complete addresses, social accounts and transaction hashes are not published. Exchange labels remain leads requiring verification.
What happened
A user met an online contact on a content platform. After more than a month of conversation, the contact promoted a “free mining” project: no transfer to a platform was supposedly required, only a USDC balance in the user’s own wallet.
The user moved about 3,500 USDC into the wallet. Immediately after the first “reward” claim, nearly all USDC was transferred out. The project’s support team demanded another deposit to release a frozen account, while the promoter urged further payment and then disappeared.
What the chain showed
- A reward token entered the wallet, creating the appearance that the project functioned.
- The claim interaction triggered a contract approval or call, after which approximately 3,572 USDC was moved by a fund-execution contract.
- A primary application contract handled interface and status functions while a separate proxy contract used token permissions and executed the transfer.
- After two intermediaries, the incident funds joined proceeds from other victim sources in a large consolidation address.
- Downstream branches reached candidate addresses labeled by third parties as Binance, HTX and Gate.io user accounts.
The strongest intersection
During the chat, the promoter had sent the user a small amount of ETH from an address whose funding source intersected with the gas used to create the mining token. That address had also transferred value to a candidate exchange account downstream of the stolen funds.
This intersection does not prove identity or criminal intent by itself. It does connect the user-contact address, token-creation system and downstream fund path within one on-chain relationship graph, giving it material investigation value.
Practical lessons
- Assets remaining in your own wallet are not automatically safe; token approvals can authorize third-party transfers.
- “Pay another deposit to unfreeze the account” is a common secondary-payment tactic.
- Preserve the approval transaction, contract addresses, website domain, original chat files and payment records.
- For wallets that retain value, review approvals and move assets when necessary to prevent another loss.
Case status: the organized materials were submitted to local police for further investigation. Public content does not disclose the handling authority or victim identity.