The Wallet That Wasn't: Correcting the Record on SFI Group's Flash USDT Operation

A wallet address circulated as the confirmed link to @sfigroupflash was wrong. The real one has moved $120.5 million, and it does not behave like a funnel.

A Diwali offer that's still running

SFI Group of Industries sells what's known in the industry as "Flash USDT," cloned or fake stablecoin dressed up to look real on a wallet screen, sold to buyers who believe they're getting genuine, tradeable USDT. Its Telegram channel, @sfigroupflash, has been live since August 2025 and is still posting today. Its pitch hasn't changed much in a year: a "Diwali Dhamaka" offer promising ₹900 for $50 of USDT, a tiered "demo price chart" running from ₹18 to ₹30 per USDT, and a referral program paying commission to anyone who brings in new buyers. All classic bait, all still online.

We set out to verify the on-chain wallet tied to this operation, and in the process found that a wallet address previously circulated as the confirmed link to this channel was wrong. Here's what actually checks out.

Following the money to the real wallet

We pulled the channel's full message and media history, 271 messages, 249 photos, spanning a year of activity, and searched it for wallet addresses.

What does appear, twice, are real Tronscan transaction receipts posted by the channel itself: TLGXiZv8DppjkokhfzNByU4EVqmX9mtU3S sending 49,850 USDT on June 12, 2026, and 10,000 USDT on June 19, 2026, both with visible transaction hashes we verified independently on-chain. That's the actual wallet behind this operation, established from evidence the channel posted itself, not from a claim we had to take on faith.

A bigger, older wallet than a 199-member channel would suggest

The scale doesn't match a small retail operation. TLGXiZv8... has moved $120.5 million in lifetime USDT volume since April 2025, over 33,500 transactions to and from more than 7,000 distinct counterparties, and it's still active: its most recent transaction was six days before we pulled this data. Received and sent balance to within $106 on $120 million of throughput, the same near-zero, pure-pass-through signature we've documented in every wallet of this kind across our previous investigations. Its own current balance, at the time of writing, is $7,145.

A 199-subscriber Telegram channel selling fake USDT to retail buyers doesn't organically generate that kind of volume or counterparty spread on its own. Whatever this wallet actually is, a shared piece of liquidity infrastructure SFI Group has access to, or something they more directly control, it's operating well beyond the scale its public storefront implies.

The paperwork behind the storefront

The channel doesn't just post wallet screenshots, it also posts its own claimed business identity, and that identity is worth checking too. A "Diwali Dhamaka" promotional graphic from October 2025 lists a GST registration number, 37ALZPI0196D1ZR, under the name "SFI Group of Industries." We checked it against public GST records. It's a real, registered number, just not for that business.

That's a second correction to the public record, layered on top of the wallet one. The channel is showing customers a real GSTIN, presumably to look legitimate, that belongs to a different, unrelated, and no-longer-active registration, under a different name than the one on the graphic. We are not asserting Shaik Mohammed Ismail has any connection to this Flash USDT operation. A lapsed proprietorship's genuine GST details being lifted to dress up an unrelated storefront is a distinct explanation, and at least as plausible on the evidence we have, and it fits a pattern we've flagged elsewhere in this space: borrowed or unwitting third-party paperwork used to manufacture apparent legitimacy, the same category of risk as an account or a wallet rented from someone with no knowledge of what it's being used for.

Contact details follow the same rotating pattern we've seen in the wallet addresses of other channels in this space, five distinct Indian mobile numbers surface across the channel's year of posts, split across labeled "Sales," "Service," and "WhatsApp" teams. Every post, across a full year, routes email contact to the same single address: infosinsonfinance@gmail.com, a free Gmail account, not a domain tied to the "SFI Group of Industries" name it's posted alongside.

One photo posted to the channel on July 7, 2026 is worth flagging on its own: a screenshot of a mobile wallet app's "Main Wallet" screen showing a $368,817,112.46 balance, a listed 24-hour gain of "+6492974248.58%," and a BTC holding of 5,821.2115 coins priced at $63,356.43 with an identical multi-billion-percent gain figure. These aren't real numbers, and the figures don't reconcile with each other. This is consistent with the manipulated-balance display that "Flash USDT" tools are built to produce: a wallet screen showing a buyer whatever number the operator wants them to see, unconnected to any real, spendable balance.

Where the money comes from, and where it goes

Both ends of this wallet run through centralized exchanges, and not a handful of them. Across the 498 days to 25 August 2026 it withdrew $31.37 million from eight labeled exchange venues and deposited $46.96 million straight back into the same eight. Binance sits on both sides: 69% of everything withdrawn, 59% of everything deposited, $49.17 million in total. HTX, Bitget, Bybit, MEXC, OKX, BingX and the payment processor AlphaPo make up the rest.

That is $78.33 million of exchange-labeled flow against roughly $241 million of gross two-way volume, about a third of everything the wallet does. The remainder moves through thousands of unlabeled counterparties with no identifiable source. Deposits exceed withdrawals by $15.6 million, so the wallet is a net supplier of funds into exchanges, not a place where exchange money comes to rest.

We checked whether that money only ever moves in the direction a simple hub-and-spoke model would predict, in through senders, out through receivers, nothing sideways. It doesn't. Mapping all direct pairwise transfers among TLGXiZv8... and its 16 largest counterparties turned up 63 separate transfer relationships, well beyond the 16 a pure funnel would produce, including 36 that connect two counterparties to each other directly, without ever touching the hub. One of those direct links, between two of the wallet's own top non-exchange counterparties, moved $126.1 million across 164 transactions, more than the hub's own $120.5 million lifetime volume. This is a mesh of interconnected wallets that TLGXiZv8... sits inside, not a clean single-point funnel.

On the outbound side, the top ten recipients by volume account for $28.79 million, the largest single one receiving $5.88 million across 91 transactions. Beyond that, the wallet fans out to 2,677 further recipients, a distribution pattern, not a handful of large settlements.

Everything here comes from three independently checkable sources: the channel's own posted content, on-chain TRON/USDT-TRC20 transaction data, and public GST registration records.

We'll keep watching this one too.