A scammer posted his own receipt to look legit. I followed it for three hours. It ended at Binance.

There's a guy on Telegram selling fake USDT.

To prove he's real, he pins a receipt to his channel — an actual transaction, "100,000 USDT, confirmed onchain," with a link you can click and verify.

That's the trick. The receipt is real. What he sells you isn't.

I clicked the receipt. Mostly to see what a scammer's wallet looks like.

It wasn't his wallet. It was a 2-of-3 multisig — the kind of setup a company uses, three keyholders, two signatures to move anything. Weird thing for a Telegram scammer to be touching. So I pulled its history.

Fifteen months. $812 million in. $807 million out.

I read that twice. The wallet keeps almost nothing. It's not a wallet — it's a doorway, and money only ever walks through it.

Somebody went to the trouble of institutional-grade key management to build a doorway.

I wanted to know who was feeding it, so I went one step upstream to the wallet pouring money in.

Except it wasn't a wallet pouring money in. It was 69,591 of them.

Almost seventy thousand addresses, a couple thousand dollars each, all draining into one collector that bundles them and sweeps the total forward in $900,000 gulps.

That's not customers. That's a funnel. And if each of those is a payment, a lot of them are people who got the exact scam I started from.

At this point I'm just following the water downhill, and downhill is the cash-out. The money fans out and lands in a handful of addresses.

Arkham has labels on three of them. OKX. Kraken. Binance.

I want to be careful here, because it matters: those exchange labels come from Arkham, not the exchanges, and I'm not saying anyone at those companies knew anything. B

ut the path is there. Every hop, every hash, on a public ledger, sitting in the open the whole time — the same open ledger those exchanges are legally required to watch.

I opened a scammer's receipt because I was curious what was behind it.

What was behind it was seventy thousand victims, a doorway nobody owns, and a clean exit through three of the biggest companies in crypto.

All of it, every address: https://bitquery.io/investigations/812m-ghost-wallet-nobody-flagged