Sold By The Same Sky: A Counterfeit-USDT Storefront Traces Into a Second Half-Billion-Dollar Network
A 900 USDT payment for fake tokens lands, two hops later, in a $541 million consolidator that shares its top senders and its final hub with a network we mapped from an entirely unrelated marketplace.
“Not recommended for trial use”
Some storefronts hide what they sell. This one does not. 高仿USDT 高仿黑U 假USDT 高仿假U, reachable at @USDT_jingfang_u, roughly “high-copy USDT, high-copy black-U, fake USDT, high-copy fake-U”, is a Telegram channel with 4,797 members whose entire business is counterfeit USDT: tokens engineered to look real in a wallet interface while being worthless, unretrievable, or both.
The pinned message does not pretend otherwise. “High-copy USDT is vulnerable to [complaints/reversal], not recommended for trial use... provide video verification. If I send you USDT and you complain...” Buyers are told payment is required before delivery, and the channel closes with a thank-you to “boss” for trust and support: the language of a running operation, not a one-off scam.
We pulled the receipt behind one of those “thank you, boss” posts.
The receipt, verified
At 2026-09-02 17:16:54 UTC, September 3 at 01:16 China time, 900 USDT moved from TLFPZdoUbtKBEKPQN4rjKVCt2iLPpotqpo to TVnmcuVCzerzsMkkVuTd8Zc8M6i2PwMcas. We confirmed the transaction hash directly against the TRON ledger rather than reading it off the screenshot.
TLFPZdoUbtKBEKPQN4rjKVCt2iLPpotqpo is a small collector: 63 senders feed it, and it forwards almost everything it takes in to just one place.
The junction wallet
TVnmcuVCzerzsMkkVuTd8Zc8M6i2PwMcas is where this stops being a story about one storefront. It is a consolidator, and its counterparties are not new to us. It receives from the reconvergence hub at the center of our prior investigation into a $542.5 million wallet nexus tied to a completely different Telegram storefront, a romance-scam photo-package vendor. It receives from a labeled OKX hot wallet. It sends money back to that nexus’s origin wallet. And it sends into an address that turned out to be the door into something much bigger.
A second nexus, comparable in scale to the first
TWqcMjV7Wq2RHe2CSiKQHpkn6A7B2AWUPe is not a mesh wallet. It is a consolidator on the same scale as the network we had already mapped: 18,493 distinct senders, 75,905 received transfers, sweeping $541,397,501.94 across 99 transfers to TJz2aG1DNGnGxUEQvjKhutQiMLVgEKXHmf.
From there the money keeps moving through the same layering pattern as everything else in this case: near-perfect pass-through at every hop, each wallet holding a near-zero balance between transfers. And at the end of it, the finding. TWkf4riXtGejsr6rfRnHAasmFz86U3tUMN sends $22 million, across 11 transfers, into TXHX2NUvcgft4zs6MkkUtdNVERPTavHDWN: the exact same reconvergence hub that anchors the first network. Two chains that each move roughly half a billion dollars, discovered from two entirely different Telegram storefronts selling two entirely different products, terminate at the same address.
It is not just the hub. The feeder wallets are shared too.
We checked TWqcMjV7Wq2RHe2CSiKQHpkn6A7B2AWUPe’s own biggest senders against the list we had already built for TG83Fk56S2mycAUMYHZyZp9wMg6DCf4bUn in the earlier investigation. Of the six largest wallets feeding the new origin, four are also top-ten senders into the old one.
Different transfer counts, different totals, clearly separate ongoing relationships: this is not a duplicated record. It is the same set of upstream wallets routinely paying into both origin points. Two “separate” nexuses, discovered independently from two unrelated storefronts, draw from the same feeder pool and drain into the same hub. That is not two networks. It is one network with at least two public-facing doors.
The wallets are new, and several were born the same night
None of these addresses are old. TRON exposes no “created” field, so we dated each one by narrowing before_time until activity disappears, the same method we used on the first chain. Four of the five middle-chain wallets were activated within a seven-minute window on July 31: the same batch-provisioning signature the first article found in its own middle chain, where three wallets came alive within eight minutes on August 14.
The detail that matters most is at the edges. TWqcMjV7Wq2RHe2CSiKQHpkn6A7B2AWUPe’s first activity, June 30 at 23:54:45, comes less than an hour after that of TY5GbYptAvxpqAoE6XXz3qTfiziHjiArCP, June 30 at 23:00:45: the loop-back wallet anchoring the other end of the first article’s chain. Two wallets sitting at opposite corners of what looked like separate half-billion-dollar structures were provisioned on the same night, an hour apart.
What we are confident about, and what we are not
The transaction that opened this thread, the identity of every wallet named above, and every dollar figure came from direct ledger queries, cross-checked against the raw transaction hash rather than the screenshot text. The hub merge and the four shared feeder wallets are both independently verifiable and, in our view, the strongest evidence in this case series that we are looking at one operation, not several.
We are not asserting that the 高仿USDT channel’s operators personally control any wallet beyond the collector that received their buyer’s payment. A storefront and the wallets three or four hops downstream of it are not automatically the same hands.
What we can say with confidence: a storefront selling counterfeit USDT to nearly 5,000 members has a payment trail that, within two hops, enters a wallet also touched by a labeled OKX address, by the laundering chain of an unrelated romance-scam marketplace, and by a second half-billion-dollar consolidator that shares its own top senders with the first, all of it converging on one hub.
We’ll keep pulling this thread.