Sample case · E.D.N.C. 5:24-cv-00634

One real DOJ case,
traced blind.

A pig-butchering scam posing as the Bitkan exchange. Everything on this page is public: the court filing and the blockchain. Hound saw only the victim’s transfers and data from before the first freeze.

$0Mstolen
0transfers
0sto trace
0leads
0/9seized wallets among them
01

What the victim had

Seven USDT withdrawals from their Crypto.com account to the scam’s deposit address, February to April 2023. That is all Hound started from.

DateToTransactionUSDT
Feb 4, 20230x96c9…50fd0xb98eb419…f375e4199,990.00
Feb 5, 20230x96c9…50fd0x7ee31d25…c5432c199,990.00
Feb 6, 20230x96c9…50fd0x0abf6160…33ec2d87,990.00
Mar 8, 20230x96c9…50fd0xd4958efe…e9f3fa199,990.00
Mar 9, 20230x96c9…50fd0xb97b4008…89f2bc180,790.00
Apr 21, 20230x96c9…50fd0x8bee73b5…30d2d7199,990.00
Apr 22, 20230x96c9…50fd0xa36b1507…c96272108,141.79
Total1,176,881.79

Cut-off: Ethereum block 19,673,401 (April 2024), before Tether’s first freeze. Tether’s freeze list was hidden from Hound.

02

Where the money went

Hound followed every hop out of the scam address under two accounting rules (first-in-first-out and last-in-first-out): 89 wallets, 4 to 8 hops deep. The diagram shows the four main branches; each hides 2 to 6 more wallets.

VictimCrypto.com Scam deposit0x96c9…50fd Collector0x7c97…728c 0x40d2… 0x02b7… 0x1345… 0x4ce3… Seized A · +1 holding Seized E · F Seized C · +1 holding Seized B · H OKX deposit OKX ×4 · Bybit · KeySecure
Victim’s transfersScam walletsStill holding: freezableExchange: records request
03

What Hound handed over

Fifteen leads, ranked. Wallets still holding the victim’s money first, then exchange deposit addresses where a records request can identify the account holder.

#WalletTypeVictim USDTDOJ
010x1ebc…3208Holding275,663–
020xf643…05d6Holding249,800Seized A
030x8b10…e3f4Holding199,990Seized C
040x06ec…5cdcHolding192,917Seized F*
050x1291…b553Holding180,790Seized E
060x6275…0e61Holding151,718Seized B
070xd9b5…e693Holding60,000Seized H
080x7545…0cc6Holding46,393–
090x4a25…e238Bybit deposit78,334–
100x313e…d369OKX deposit40,700–
110x0e74…b783KeySecure 140,190–
120x9723…0138OKX deposit24,851–
130x7eb6…1ef2OKX deposit24,569–
140x5041…081aOKX deposit20,938–
150xbda2…96f2OKX deposit14,732–

Amounts are the victim’s money Hound attributes to each wallet, under whichever accounting rule reached it. *Wallet F holds money DOJ traced to a second victim, so it is a real seizure but not this victim’s funds.

04

Checked against DOJ

Where the FBI traced this victim’s money to a seized wallet, Hound’s amounts land on theirs.

Wallet C199,990DOJ 199,990 · exact
Wallet B151,718DOJ 151,708 · $10 apart
Wallet E180,790DOJ 180,790 in USDT, plus ETH Hound didn’t start from
Wallet A249,800DOJ 287,980 · 87% of it

What Hound missed, and why

DFed by the April 22 transfer. Not reached within the trace.
IHound followed the money through I to a Bybit deposit, but I had already passed the money on, so it isn’t listed as a lead.
GHolds another victim’s bitcoin, which never touched this victim’s transfers.

DOJ filed this forfeiture complaint in November 2024, 21 months after the first transfer. Source: United States v. 4,992,845.06 USDT, E.D.N.C. 5:24-cv-00634, FBI declaration (Dkt. 1-1).

Have a case like this?
We’ll run it with you.