Noobie need help (massive scam)

[CryptoNoobie96]

Hello everyone,

I'm writing on behalf of a friend who recently became the victim of a sophisticated crypto scam, and I’m hoping to get some advice or help from this community.

My friend works in OTC crypto trading, exchanging USDT for cash with a small fee. A new person recently arrived in our city asking about buying Euros with USDT. They got in contact, and everything seemed fine at first. They completed a few trades with relatively large amounts (50k–100k), and things appeared to go smoothly.

Then came the trap.

This new person sent a large amount of USDT to my friend’s wallet. As usual, my friend first sent a small portion (1k USDT) to another wallet and converted it into BTC to verify the funds were legit and spendable. Everything checked out, so he handed over the full amount in cash.

However, not long after, all the USDT suddenly vanished from his wallet. The person disappeared and left very little trace.

One crucial detail: this same person actually recommended that my friend set up and use a cold wallet to handle transactions with him — a suggestion that now appears to have been part of the scam setup.

I'm not an expert in blockchain, but I started investigating using tools like TRONSCAN and quickly noticed suspicious patterns. The funds were broken down into many small amounts and moved through a complex network of wallets — classic money laundering behavior. It looks like a large-scale operation.

I followed the case of Malone — the Asian guy and his group who stole 100 BTC from a whale — and how @zachxbt helped trace the wallets, find accounts that had been opened without VPNs, and even track down the physical location of the attackers.

I know this is technically possible, and even though I’m a beginner in crypto tracing, I refuse to give up without trying. If anyone here can offer advice, tools, or guidance on how to trace the scammer or follow the money trail deeper, I would be extremely grateful.

Thank you in advance for your time.

[Trêvoid]

all the USDT suddenly vanished from his wallet ?

this same person actually recommended that my friend set up and use a cold wallet to handle transactions with him.

Name of the cold wallet?

[CryptoNoobie96]

Imtoken

[Coyster]

Imtoken

Did this person just direct your friend to use this wallet, or did he also set up the wallet for your friend. I don't use Imtoken, but i know it is a non-custodial wallet, so if this person was involved in setting up this wallet, then maybe he also kept a copy of the seed phrase and used that to steal the funds.

That said, Imtoken is not a cold wallet, though they have a hardware wallet (Imkey pro) that they sell, was that what your friend bought?

[noviesol]

USDT cannot vanish from your wallet. It has to be sent somewhere. Maybe u can post the wallet adress that received the USDT.

[albon]

Did this person just direct your friend to use this wallet, or did he also set up the wallet for your friend. I don't use Imtoken, but i know it is a non-custodial wallet, so if this person was involved in setting up this wallet, then maybe he also kept a copy of the seed phrase and used that to steal the funds.

That said, Imtoken is not a cold wallet, though they have a hardware wallet (Imkey pro) that they sell, was that what your friend bought?

I strongly support what you wrote, and I believe that this is 99% what happened in OP's friend's case.

It’s clear that the scammer either set up the wallet for him and kept a copy of the seed phrase, or he gave him a fake wallet download link that contained a virus, which allowed him to steal the assets of the wallet.

USDT cannot disappear on its own, and as noviesol mentioned, by using a blockchain explorer to check the wallet address that held the USDT, we can find out exactly where the funds went.

[AHOYBRAUSE]

USDT cannot vanish from your wallet. It has to be sent somewhere. Maybe u can post the wallet address that received the USDT.

Exactly that. Vanishing is nonsense. Everybody knows that basically every transaction is visible. OP did you even check what happened? Did your friend create his wallet himself or did anybody else have access to it, or at least the seed?
Sounds all a bit odd.
Problem is, once the money is gone there is nothing that can be done in 99.9% of the cases.

[CryptoNoobie96]

Hi again, and tx everybody for your replys and time.


My friend set up the wallet together with the scammer — it's likely that the scammer configured something himself or infected my friend's phone with malicious software. I have the scammers' phone numbers (possibly eSIMs), one with a US prefix, another from the UK, and another from Romania. There are at least three individuals involved.

We can also obtain clear images of their faces from security cameras.

I have identified the wallets where the stolen funds were transferred. I've been tracing them and analyzing how they move the funds around. Now I need to identify and locate the individuals behind this.

[Upgrade00]

My friend set up the wallet together with the scammer — it's likely that the scammer configured something himself or infected my friend's phone with malicious software.

It must not have been a malicious software. They could have simply copied the seed phase when the wallet was created and then imported the wallet at a later time. For someone who has been transacting huge amounts, your friend made a rookie mistake.

You can file a police report with the information you have and hope that you will be able to track them, this is your best bet at recovering the funds

[Coyster]

My friend set up the wallet together with the scammer —

It is weird that you friend runs a small and local crypto exchange service and he agreed to create a wallet together with a complete stranger, how could he have done that. It is very obvious how your friend lost his funds, the next step is to try to recover it.

We can also obtain clear images of their faces from security cameras..

Since the scammer has a "face", which he showed to your friend, then there is hope, report the case to the police and if they agree to take up the case, they can identify the scammer and start searching for him, that is if he is still in that country.

[Bitcoin_Arena]

For someone dealing in crypto, your friend made a very huge mistake creating and configuring the so-called “cold wallet” with the stranger. That there was definitely the point of attack.

Regarding trying to recover that money, you have very little luck. You will need to involve lawyers, court, and law enforcement to help you in case you end up tracing the exchange addresses of the attacker.

All I can suggest is another good tracing tool: https://intel.arkm.com
You can actually post a bounty over there where some members will help you trace where the coins ended up in an exchange for a reward: https://intel.arkm.com/exchange

[SFR10]

If anyone here can offer advice, tools, or guidance on how to trace the scammer or follow the money trail deeper, I would be extremely grateful.

I have identified the wallets where the stolen funds were transferred. I've been tracing them and analyzing how they move the funds around.

In case you're still looking for some tools to help you more with the tracing part, you can refer to "one of my posts" from last week.

• In addition to those tools, you can also try Chainalysis's crypto investigation services:
  
  • Reactor Crypto & Blockchain Investigations
  • Rapid Crypto Triage Solution

[CryptoNoobie96]

If anyone here can offer advice, tools, or guidance on how to trace the scammer or follow the money trail deeper, I would be extremely grateful.

I have identified the wallets where the stolen funds were transferred. I've been tracing them and analyzing how they move the funds around.

In case you're still looking for some tools to help you more with the tracing part, you can refer to "one of my posts" from last week.

• In addition to those tools, you can also try Chainalysis's crypto investigation services:
  
  • Reactor Crypto & Blockchain Investigations
  • Rapid Crypto Triage Solution

Thanks a lot, Ill try these tools.

I get photos of the scammers too, and his name and country (probably use fake id) but i get the faces, I try tools like PimpEyes but dont find anything, do you know where can i try to search?

[SFR10]

Thanks a lot, Ill try these tools.[...] I get photos of the scammers too, and his name and country (probably use fake id) but i get the faces, I try tools like PimpEyes but dont find anything, do you know where can i try to search?

You're very welcome. Unfortunately, I don't know a good alternative face search engine, but regarding reverse image searches, I can name a few that I've used in the past with some success:

• TinEye, Yandex image search and Reverse image search.
  ^{- It's worth noting that none of the above tools came close to the success rate that I had with the old reverse image search engine of Google and the current Google Lens option is really bad (there's a way to disable it in Chrome, but the end result will still be from Google Lens)!}