The Menu That Prices Stolen Money: Inside a China–India USDT Laundering Pipeline
A rate card with a conscience, for pricing, not ethics
Most crypto-to-fiat conversion ads look the same: a rate, a minimum order, a contact handle. One message posted to a Chinese-language Telegram channel called WORLDPAYRMB in July and August 2026 looked the same at a glance, until you read the line items.
HACKED FUND: Rate 125-132, minimum order 200 USDT, protection time 15 minutes STOCK FUND: Rate 118-123, minimum order 500 USDT, protection time 30 minutes GAME FUND: Rate 113-115, minimum order 500 USDT, protection time 1 week
"Hacked fund," "stock fund," and "game fund" are not neutral labels. In the vocabulary of underground Chinese-language money-laundering-as-a-service operations, they mean, respectively: stolen or hacked cryptocurrency, proceeds from fake investment/trading-platform scams (the "pig-butchering" playbook), and proceeds from illegal online gambling. The channel prices each category differently, and the pricing tells its own story: hacked funds, the hottest, most likely to be frozen or clawed back by an exchange, carry the highest rate and the shortest "protection time," the operator's own risk window before a transaction is considered final. Payment is required upfront, in USDT, with release promised within fifteen minutes.
This is not incidental marketing copy. It is closer to a price sheet for laundering money by its criminal origin, posted openly, in a public channel, with over 1,900 messages of supporting history.
We spent several weeks tracing what's actually behind that price sheet: the wallets, the transactions, the Indian bank accounts, and the exchange infrastructure that make it work. Here's what we found.
Where it started: a 22-day-old wallet moving six figures a week
Our starting point was a single TRON address, TL8VMS73Y4sapNBR1mCvs336HczWT6HQpX, posted to the WORLDPAYRMB channel on August 10, 2026 with the caption: "THIS IS OUR COMPANY'S PERMANENT WALLET ADDRESS."
On-chain, in the 90 days we could observe: $822,747 received, $811,154 sent, across 490 transactions and 93 distinct counterparties, a net balance of essentially zero. The wallet itself was 22 days old at the time of posting. A brand-new address, doing six-figure weekly volume, with money leaving almost exactly as fast as it arrived: the signature of a relay, not a store of value.
One hop out, we found the real hub: TFcS1kz4ZxaecZDJDybqoZf75oBisdwh39. Its full lifetime, dating back to September 1, 2025 (roughly 11.3 months at time of writing): $52.15 million moved, split almost exactly evenly between $26.09M received and $26.07M sent, with a net balance of +$18,885, effectively zero, on more than fifty million dollars of throughput.
Mapping the top 25 counterparties of both wallets against each other, not just against our two targets, surfaced 49 direct edges, several moving over $300,000. This isn't a simple hub-and-spoke structure; it's a mesh. Roughly a third of TL8VMS's counterparties overlapped with TFcS1kz4's.
We then aged the full 117-address cluster built from both wallets' counterparties. Roughly 20% were created in the trailing two months. One satellite wallet, only 39 days old, had already absorbed $324,411 from the larger hub. A stable, year-old core, continuously spinning off fresh, short-lived satellites: that's not organic usage. It's wallet rotation, designed to keep any single address's exposure low.
Who's actually paying: not a war chest, an exchange
Here's where the investigation took an unexpected turn. WORLDPAYRMB doesn't just advertise, it posts proof: thousands of screenshots of individual USDT transfers, apparently meant to demonstrate the operation is real and paying out.
We pulled 1,773 of those photos and ran them through OCR and QR-code decoding (many wallet apps embed a "view on blockchain explorer" QR code directly in the transaction receipt). That yielded 1,322 real, verifiable transaction hashes, a direct, independently checkable link between the channel's own promotional material and the TRON blockchain.
What we expected to find was a small number of dedicated "collection wallets," rotated periodically. What we actually found was different, and arguably more interesting: every sender wallet that recurs across these screenshots is a massive, shared exchange or OTC hot wallet, not bespoke infrastructure.
The most-used one, appearing in 84% of the transactions we sampled between November 2025 and April 2026, resolves to TFTWNgDBkQ5wQoP8RXpRznnHvAVV8x5jLu, identified by Arkham Intelligence as HTX's own exchange hot wallet (tagged EU/UK Sanctioned on Arkham, 625 pages of transfers, a live balance north of $1.7M). On-chain, it shows 9.5 million total transactions and $67.9 billion in lifetime volume. The Telegram-app label attached to it, "秀娱传媒公户," a Chinese phrase meaning roughly "Xiuyu Media corporate account," turns out to be nothing more than a private nickname the poster gave the address in their own wallet app.
Over the following months, at least five more mega-scale exchange or OTC addresses cycle through the same role, each with transaction counts in the hundreds of thousands to millions, and lifetime volumes from $870 million to $37 billion. None of these are bespoke wallets built for this operation. They're liquidity the operation drew on, transaction by transaction, the way any OTC desk sources funds from an exchange account.
That's not damning by itself: plenty of legitimate businesses fund payouts off exchange withdrawals. What makes it relevant is what happened next.
The wire that connects everything
We checked whether any of those six recurring exchange wallets had ever sent funds directly to either of the two hubs from our original on-chain investigation: TL8VMS and TFcS1kz4.
They had. Twelve transactions, totaling $35,617, moved directly from three of the channel's own documented funding sources straight into the two wallets at the center of this investigation:
TL8VMS73Y4...received $32,334 across 9 transactions from three of the exchange wallets.TFcS1kz4...received $3,284 across 3 transactions, including two directly from the HTX hot wallet itself.
This is the piece that ties the whole picture together. It isn't a resemblance in behavior or a coincidence of scale, it's a traceable deposit trail. The same liquidity sources that fund WORLDPAYRMB's day-to-day, publicly-screenshotted customer payouts also seeded the two wallets that our original cluster analysis flagged as the operation's layering infrastructure.
We also checked recipient overlap across the 212 transactions we fully resolved: 202 distinct recipient addresses. Almost every payout goes to a brand-new, one-time address, consistent with the fresh-wallet churn we'd already identified in the broader 117-address cluster.
The Indian banking layer: fifteen accounts, one signature
The rupee side of the operation runs through rented business current accounts. We obtained and analyzed 42 single-day bank statements, leaked or shared inside the same Telegram channel, spanning at least fifteen distinct accounts across seven-plus banks (Axis Neo, IndusInd, ICICI, SBI, HDFC, Bandhan, Bank of Baroda) and nine Indian states, registered to businesses with names like clothing traders, poly-bag manufacturers, an automobile dealer, and a cinema.
We're withholding full account numbers and direct contact details in this piece; we don't know whether the named account holders knowingly participated, unknowingly rented out access, or had their identities used without full awareness, and we have not independently verified the authenticity of every leaked document beyond internal consistency. What we can describe with confidence is the pattern, which repeats identically across every account:
- Every statement covers a single calendar day.
- Every account opens and closes near zero: no meaningful balance carried overnight.
- Each account processes hundreds to tens of thousands of same-day IMPS "P2A" payments, typically ₹100–3,000 each, to distinct beneficiaries.
- Across all 42 statements: 181,009 total micro-payment narrations.
No ordinary clothing wholesaler or poly-bag trader generates that transaction pattern. It is the textbook signature of rented payout infrastructure: accounts used purely to receive a lump sum and immediately fan it out below the radar of any single large-transaction alert. And it maps, category for category, onto the channel's own July 2026 rate card, which separately advertises "Standard Corporate," "Premium/Priority," "Pay-in," and "Payout" account tiers across exactly this set of banks.
What we're confident about, and what we're not
Everything in this piece is built from three independently checkable sources: public on-chain TRON/USDT-TRC20 transaction data, a public Telegram channel's own message and media history, and PDF bank statements found within that channel. We cross-referenced all three against each other rather than relying on any single source.
We have not identified the real-world individuals operating this network. A wallet address is not a person, a Telegram handle is not a verified identity, and the presence of a company's name on a leaked bank statement does not establish that company's owners knowingly broke the law: accounts can be rented, borrowed, or compromised without the registered holder's full knowledge. We are not naming the individual account holders in this piece for that reason.
What we can say with confidence, because it's directly measurable: the on-chain behavior of both hub wallets (near-zero balances sustained over months on tens of millions of dollars of throughput, continuous fresh-wallet creation, deep mesh interconnection) matches known layering infrastructure rather than ordinary commerce; the channel explicitly and publicly prices its service by the criminal origin of incoming funds; the Indian banking layer shows a uniform, repeated fan-out signature inconsistent with the businesses it's registered to; and the channel's own documented funding sources have a direct, traceable financial link to the wallets at the center of this investigation.
We'll keep watching this cluster. If the satellite wallets go dormant on the burner-infrastructure timeline we'd expect, or new connections surface, we'll follow up.
CoinCandid tracks and publishes on-chain wallet cluster analysis using Dune Analytics, OSINT, and open blockchain data. Methodology available on request.