The Fraud Fund Rate Card: Inside KISSPAY's USDT-to-INR Network

A rate card that prices its own crime

Most underground USDT-to-INR channels dress up what they do. KISSPAY doesn't bother. Its published rate card, posted to a network of Telegram channels it runs in parallel, prices four categories of funds:

Stock funds: 1 USDT = 108–110 INR Cash deposit: 1 USDT = 109–115 INR Hybrid funds: 1 USDT = 115–125 INR Fraud funds: 1 USDT = 125–135 INR

No euphemism, no coded language. The highest-priced tier is labeled, in plain text, "fraud funds." The pricing logic is the same one we've documented elsewhere in this space: the hotter and more traceable the money, the higher the rate the operator charges to move it, and the shorter the goodwill they extend if something goes wrong.

We spent time mapping what's actually behind this rate card: the channels, the operators, the wallet, and the circuit it feeds into.

A network of near-identical channels

KISSPAY doesn't run one Telegram channel. It runs at least five, all posting the same "Super-large supplier: We have equity funds and hybrid funds" pitch, all offering UPI, IMPS, RTGS, NEFT, CDM, and ATM payment rails, and all reachable through the same rotating cast of contact handles. The channel usernames themselves carry the operator's own signature: KISSPAY99999, KISSPAY999999, KISSPAY9999999, each a live, active channel with real subscriber counts (307 to 1,149 members). A separate, more heavily-trafficked channel operates under a deliberately obscure handle, its bio pointing back to the KISSPAY brand, with over 1,100 subscribers.

The operator identifiers follow the same repeated-digit pattern as the channel names: @kiss_6666666, @kiss_777777777, @kiss_888888, @kiss_99988, @kiss_520520, alongside a rotating set of Hong Kong WhatsApp numbers. This isn't incidental. The same vanity-digit style shows up on-chain: TLh3BKdo78uWVt7SjDq95UKzk4g8666666, TErtWhZPCJoYrvPEqWZCep16EL88888888, and TU8JZPmFDtzp9h6ptT39jVD4mg99999999 all recur as major counterparties throughout the wallet network below, a consistent operator fingerprint stamped across both the Telegram identity and the blockchain activity.

One of the channels posts hourly, sometimes every 20–30 minutes, cycling through the same boilerplate and an updated list of contact handles. The volume of posting looks automated: less a storefront than a constantly-refreshed directory, designed to make sure a customer can always find a live, unbanned way to reach the operation.

The wallet, and what's actually behind it

The channels publicly advertise a single TRON wallet, TQ5V3vogU7szfJvD4i8PSZLbgwq35Cd29t, as KISSPAY's collection address. On-chain, it's been active since October 2025, still transacting as of this writing. In that time it has processed 2,297 transactions with 88 distinct senders and 60 distinct recipients, moving $891,105 in USDT — received and sent balancing to the cent, the same near-zero-balance, pure-pass-through signature we've documented in every wallet of this kind: money doesn't stay, it moves through.

That collection wallet is the visible front door, and it's the smallest node in its own circuit. Tracing its top counterparties out one and two hops reveals a network of relay and consolidation nodes carrying far more volume than the advertised wallet itself:

Those five nodes alone, a small fraction of the full circuit, account for $48.8 million in combined lifetime USDT volume. The wallet KISSPAY tells its customers to send money to is roughly 4% of that total; the real financial weight sits one and two hops downstream, in nodes the public never sees. And the pattern holds at every scale: four of the five nodes above show received and sent balancing to within a few hundred dollars on multi-million-dollar totals, several to the cent. That's not incidental. Sustaining a near-perfect pass-through balance across millions of dollars and thousands of transactions is consistent with automated sweep logic, not a wallet anyone is trying to accumulate a balance in.

The largest node, the feeder aggregator (TQGTLNMDLrRFpsqagNHYMLPDfwWy4Snvgv), connects to hundreds of other addresses on both sides: 2,707 distinct senders feed into it, and it distributes to 283 distinct recipients. At the center of the circuit sits a clear consolidation point, TADbqEb4U2jWwfLUqAZUQEYMeSX7CayXky, a wallet receiving from 759 distinct senders while paying out to only 35, a textbook sweep structure that gathers scattered inflows and routes them out through a small number of controlled exits.

On the exchange side, the picture is straightforward. The circuit draws USDT inflows from Binance's own hot wallet infrastructure, and its largest single outflow, $193,000 across 63 transactions, goes directly to TGNB9QhWrzWBAsAy9Bdu5q8LrjV9j8uCm2, a confirmed Gate.io deposit address. That's the shape of the operation end to end: USDT sourced from a major exchange, laundered through a multi-tier relay network carrying tens of millions of dollars, and swept back out through another exchange for final liquidation.

What the rupees actually look like

We reviewed over 1,500 photos posted across KISSPAY's channels documenting the INR side of the operation. Unlike the wallet-screenshot evidence common elsewhere in this space, KISSPAY's proof-of-work photos are almost entirely UPI and bank-transfer receipts — Paytm, PhonePe, Google Pay, and direct bank transfers — with the recipient and sender names blurred out before posting, though the bank names and partial account numbers remain visible.

The reach is broad. Across the photos we reviewed, transactions touch more than twenty different Indian banks and payment platforms, including SBI, ICICI, HDFC, Axis, Kotak, Punjab National Bank, Yes Bank, Canara, Federal Bank, Bandhan, Union Bank, Bank of Maharashtra, Central Bank of India, IDFC First, IDBI, and IndusInd, among others. Individual transactions run as high as ₹6.98 lakh (roughly $8,400) in a single transfer, consistent with the "hybrid" and "fraud" fund tiers the rate card prices at a premium.

What we're confident about, and what we're not

Everything here is built from public, independently verifiable sources: the channels' own Telegram content, and on-chain TRON/USDT-TRC20 transaction data. We have not identified the real-world individuals behind the @kiss_* handles or the WhatsApp numbers advertised publicly on the channels, and we are not asserting that every bank account or UPI ID visible in these photos belongs to a knowing participant — account rental and unwitting mule recruitment are common in this space, and a name on a receipt is not proof of intent.

What we can say with confidence: KISSPAY operates a coordinated, multi-channel Telegram storefront that explicitly prices USDT by the criminal origin of the funds, including a tier labeled outright as fraud proceeds; its advertised collection wallet feeds into a multi-tier relay circuit touching thousands of addresses; and its India-side settlement reaches across the mainstream Indian banking and UPI ecosystem — not a narrow, isolated corner of it.

We'll keep watching this network.

CoinCandid tracks and publishes on-chain wallet cluster analysis using Dune Analytics, Bitquery, OSINT, and open blockchain data. Methodology available on request.