When another person controls every investment step, a victim may not even know which assets were held or where they were stored. That information gap becomes especially damaging after a loss.
This article is a redacted reconstruction based on submitted materials and on-chain records. Names, identity documents, complete addresses and transaction hashes have been removed. An on-chain association is not a judicial finding.
What happened
An office worker joined a crypto investment through an acquaintance. With little experience in wallets or transfers, the reporting party only made the requested payments while another person handled purchasing, custody and selling. Several early small trades appeared profitable and gradually reduced the victim’s caution.
The victim later invested about CNY 120,000. Early the next morning, the operator said that the wallet had been stolen and that another related wallet had also been compromised. The victim was then told that crypto was unprotected, the loss had to be accepted, and the only solution was to invest again and earn it back.
What the chain showed
- The two affected wallets sent approximately 16,800 USDT and 17,300 USDT.
- The transfers reached different first recipients and then converged on the same consolidation address.
- Funds were divided among intermediary addresses, partially returned and reconsolidated, and ultimately moved toward a candidate address with a real-world connection to a person involved in the case.
- The intermediary address received its first gas funding from that candidate address. The same address had previously exchanged small test amounts of TRX with the victim during wallet instruction.
- An address connected to a family-relationship lead also had historical interaction with the intermediary path, but control still requires platform, device and account evidence.
Professional assessment
Verified facts: funds from both affected wallets converged on one on-chain consolidation system, and the intermediary’s initial gas funding came directly from a candidate relationship address.
Analytical inference: gas provenance, fund returns, final destinations and earlier test transfers collectively support investigating whether the addresses were controlled by the same person or by closely cooperating actors.
Evidence boundary: transactions between addresses do not by themselves prove identity, theft or intent. Device forensics, login records, chats, payment records and witness interviews are still required.
Practical lessons
- Do not hand wallet creation, seed storage and every transaction to another person.
- Early small profits may be part of trust building and do not establish that the arrangement is genuine.
- Preserve both fiat-payment records and blockchain transactions so real-world relationships can be connected to the fund path.
- If the same person supplies another wallet download after claiming the first wallet was compromised, stop and verify independently.