They Blurred Their Own Receipts. The Ledger Had Them Anyway.

A Telegram marketplace recruits Indian bank accounts for a daily commission, and points its 6,447 members at one vendor's channel as the official proof that commissions get paid. That proof channel pixelates its payment screenshots. We checked most of them against the TRON ledger using nothing but the amount and the clock, and they match. Two are published here.

The marketplace, not the storefront

Start one layer above the wallet. @spog03, “India & China Payment Business Platform”, has 6,447 members and does not sell accounts itself. It is a classifieds feed. Vendors post back to back, distinctly worded, all recruiting the same thing: “Urgent need! BOI JKB(New) AGB IDBI UPGB APGB. Run quickly! High volume! High commission!” A pinned listing reads SBM Bank, 50,000 rupees per account, must last 10 days or more, full daily limit used.

What makes it a platform rather than a crowd is the trust layer. The pinned post carries two buttons: Contact Us, and Commission Proof Channel. Both resolve to SkyPay's own infrastructure: @skypay_3344_003 for contact, and @SkyPay_Payment_BackUp_01 for proof. The channel's bio states the relationship in its own words: it welcomes members to an “india bank recources group”, names SkyPay's backup channel as its affiliate, and lists the same customer-service handle.

We did not infer that link; the marketplace published it. And it collapses a step. The channel whose receipts we matched is not just one vendor's storefront. It is the marketplace's designated proof channel, the place 6,447 prospective mules are sent to confirm that the money is real.

“Submit your accounts and earn money”

SkyPay - Official Channel describes itself as a trusted payment gateway company from Hong Kong. Its bio is a recruitment pitch: it needs “a large number of corporate accounts”, and it will pay you for yours. 10,624 people are subscribed. The listed contact, @skypay_3344_003, resolves to a real Telegram user called SkyPay TOP1. The channel we read is the backup, @SkyPay_Payment_BackUp_01, and the “_BackUp_01” in that handle is itself a finding: this operation already assumes it will be taken down, the same mirror-channel resilience we have documented across this series.

What it actually sells is not vague. Across 30 days we pulled 170 messages. Every single one carries a media attachment; 79 carry captions, and the captions are a product catalogue: a specific Indian bank account type, bundled with a merchant QR collection code, priced by the day.

BOI is Bank of India. APGB, which appears just as often, is Andhra Pradesh Grameena Bank. MQR is a merchant QR code, the UPI collection handle tied to the account. Daily commissions in the sampled captions run from a few hundred rupees to roughly ₹96,766. Strip the jargon and the offer is simple: lend us your real bank account, we will run other people's money through it, and we will pay you every day it stays open.

The register is the interesting part. “Submit your accounts and earn money.” “Good volume, good percentage. Thanks for trusting us.” That is the language of a delivery-app referral bonus, not of a laundering desk, and that is precisely why it works on people who do not realise that handing over an account makes them the name a fraud victim's money traces back to.

The receipts they tried to redact

To prove it pays, SkyPay posts payment screenshots. Before posting, it pixelates the sender address, the receiver address and the transaction hash. The instinct is sound: do not hand strangers a hash they can paste into an explorer. Against a public ledger it is useless.

What the blur leaves legible is the amount and the clock. That is enough. We never tried to recover a pixel. We took the source wallet the channel had itself exposed, TY3gCW3TDGkCXqZsgfKJohCv1ip6VYYwyx, and searched its outbound ledger for each screenshot's amount at that screenshot's minute, correcting for UTC+8.

We ran that check across most of the payment records posted to the channel. They resolve to real transfers out of that one wallet. Two are reproduced below: 603 USDT at 6:27 PM on 19 September, and 295 USDT at 7:01 PM on 20 September. Both hit to the second. A single match could be coincidence; a run of them is an identification.

The wallet behind the receipts is a payout engine

Matching the receipts is the hook. What sits underneath is the finding. TY3gCW3TDGkCXqZsgfKJohCv1ip6VYYwyx is an unlabeled consolidator, two to three months old, still transacting today: 1,129 distinct senders, 311 distinct receivers, 1,793 transfers in and 2,153 out.

Its rhythm is the point. One sender, TS3R1wvdcTydUdb1uZBr5SB6HBCiivAJSY, wires it a float of roughly $20,000 about once a day, almost every day since at least 27 August. Within hours that float is broken into dozens of small transfers, commonly $88 to $2,600, to a rotating set of receiving addresses. One bulk deposit in, many commission-sized payments out, every day. That is not a generic wallet shape. That is exactly the plumbing a marketplace advertising “commission per day” would need to build.

One hop up, the money stops behaving like payroll

The wallet funding those commissions is not a clean funnel. TS3R1wvdcTydUdb1uZBr5SB6HBCiivAJSY sends the payout wallet $1.98 million across 99 transfers and takes $1.24 million back across 97: near-matched counts in both directions, the bidirectional shuttling signature we flagged in the TVnmcuVCze mesh earlier in this series.

Its own ledger repeats the shape at a larger scale. 327 senders, only 8 receivers, and one dominant counterparty: TCZ9g9WrHip8PcsN6Vs3E2QNsJyQhyCtup pushes it $2.5 million over 132 transfers and receives $90,629 back over five. That same address also appears directly on the payout wallet's ledger at a fraction of the size, around $20,000 in and $40,000 out. One node showing up twice in a three-hop trail at wildly different scales is the strongest structural signal here: it reads as a shared settlement point the cluster routes through.

Why this one matters differently

The other operations in this series sold something to buyers: fake identity packages, counterfeit USDT. SkyPay is recruiting, not selling. What it wants is the human infrastructure every one of those operations depends on, real bank accounts in real names, with working UPI collection codes, rented by the day.

That makes the victims harder to see. The account holder is paid, feels employed, and is the only named person in the chain when a fraud complaint finally lands. The fiat leg, the BOI and APGB accounts and the merchant QR codes, is outside anything a blockchain trace can reach. What the ledger can show is the other end of the same arrangement: the wallet that funds the commissions, the float that arrives every morning, and the dozens of small payments that leave every afternoon.

The proof channel existed to answer the operation's own credibility problem. Nobody hands over a real bank account on a promise, so the marketplace gave its members somewhere to go and look. That decision is what made the whole chain traceable, from a 6,447-member classifieds feed down to a single confirmed transfer.

SkyPay took one precaution with its receipts and it was the wrong one. Blurring a hash protects nothing when the amount and the minute are still on screen and the ledger is open to everybody. Receipt after receipt resolves to the same wallet, one that has been paying out a fresh $20,000 float every day for a month.

You can pixelate a screenshot. You cannot pixelate a blockchain.