USDT on TRON was used to facilitate $1.6B Ponzi scheme

USDT on TRON remains one of the most actively used stablecoins. The asset is often used for illegal purposes, as in the recently revealed $1.6B Ponzi scheme. 

Blocksec research discovered a $1.6B Ponzi scheme that moved funds through USDT on TRON. On-chain research tracked several tiers of connected wallets, all linked to a platform presenting as a Hong Kong health technology group. 

Over the past 16 months, Blocksec intercepted $1.6M in traffic using USDT on TRON, though some of the funds may be internally recycled. The wallets performed different functions, including funds collection, intermediate addresses, payout channels, and a shared exchange liquidation point.

How USDT on TRON was used for a Ponzi scheme

The ability to draw in funds came from a legitimate sounding company, Verily HK. The firm presented itself as an investment platform for health tech. The platform’s name resembles Alphabet subsidiary Verily Life Sciences, which produces AI-driven healthcare and medical devices. 

VerilyHK tried to spoof the business model, claiming AI health tech, big data analytics, and medical devices as its main source of business.

A victim brought attention to the company, revealing the deposit and payout address, allowing Blocksec to track the movement of funds to connected wallets. 

VerilyHK was active between October 2024 and February 2026. The company used a rotation of at least 15 collection addresses, divided into eight distinct generations and shifting over the 16-month period.

Over time, the addresses saw a growing turnover, handling hundreds of millions of dollars per month. The final generation of wallets moved $900M in under four months, for a total of $1.6B. Not all of the turnover signifies direct funds taken from users, as some of the transfers may be internal transactions.

USDT on TRON sent to Huione-related addresses

On-chain data reveals funds flowed between the Ponzi hub and addresses linked to Huione Group. The Cambodian escrow service has been linked to multiple exploits and hacks. In this case, the hub may have handled around $4.6M. Additional deposits of $4.2K and E1.5M were made directly to two Huione Group addresses. 

The Huione Group wallets may have been used as a laundering channel, coinciding with previous discoveries that Huione was a critical node in the money laundering process. 

The scheme was not noticed until clients reported losses. However, the mapping of wallets may help in future investigations, especially linked to USDT on TRON.

USDT on TRON expanded to a supply of over 86B tokens, with more than 73M holding wallets. The TRON version has been linked to illegal usage, but only a fraction of the addresses have been frozen.

The token usually handles around 34M transactions per day, near an all-time high. Around 15K transactions are for $1M or over, making up the bulk of daily fund transfers. USDT on TRON is the second busiest stablecoin, following the BNB version. The token shows sustainable growth, but may be facilitating illegal crypto usage due to still limited oversight.