Live Wallet Tracker — NTI-LEAVITT-2026-001

Layer 1 — Crime Wallets

Fraud Collection & Dispersal Wallets

These are wallets directly involved in receiving and moving the fraud proceeds. Clicking any address copies it to clipboard. Click "TronScan" to see live on-chain data.

NTI-WALLET-001 | LAYER 1

FRAUD COLLECTION WALLET

Primary address given to victim for all payments. Received $7,080 USDT across 8 transactions.

Crime Wallet Swept — $0

TGf5bSmBBUPAY7bhsGhmafeD8w19h6sLdb

Total Received

$7,080 USDT

Current Balance

$0.00 (swept)

Active Period

May 10 – Sep 10, 2025

Transactions

88+ (TRON + USDT)

Network

TRON Mainnet (TRC-20)

Status

Abandoned — Post-fraud

TronScan ↗ Report on ChainAbuse ↗ View All Transfers ↗

NTI-WALLET-002 | LAYER 2 SINK

PRIMARY CRIMINAL SINK

Received the majority of swept funds from collection wallet. Still holds $116.94 USDT — immediate Tether freeze target.

Crime Wallet Freeze Target

TSt36w9edfNJaCQs433MyUNeHYBajoJTzK

Est. Total Received

~$2,000 USDT

Known Balance

$116.94 ← FREEZE

Priority

HIGHEST — Immediate

TronScan ↗ ChainAbuse ↗ Request Tether Freeze ↗

NTI-WALLET-003 | LAYER 2 SINK — GATE.IO EXIT

GATE.IO EXIT WALLET

Gate.io provided energy to this wallet via delegated energy system. Holds $366.94 USDT — the largest freezable balance in the entire network.

Crime Wallet Freeze Target

TLSptUxetSpjB8xRS6QrnJwuBY7Q7cuMyh

Total Received

~$1,500 USDT

Known Balance

$366.94 ← FREEZE

Last Activity

Aug 17, 2025

Gate.io Link

Energy delegation confirmed

TronScan ↗ ChainAbuse ↗ Request Tether Freeze ↗ Gate.io Compliance ↗

NTI-WALLET-004 | LAYER 2 — ACTIVE CYCLING

ACTIVE CYCLING SINK

Still showing activity as recently as March 25, 2026. Confirms operation is ongoing.

Crime Wallet ACTIVE

TCnJ7ngFdc639YumMhkJ1nR8RW5s7DUHNA

Balance

$4.27 USDT

Last Activity

March 25, 2026

Significance

Proves operation still running

TronScan ↗ ChainAbuse ↗

Layer 2 — Exchange Wallets

Exchange-Connected Wallets — KYC Targets

These wallets belong to or are directly connected to regulated cryptocurrency exchanges. Each exchange holds KYC records (name, ID, address, phone) for the account holder. A law enforcement subpoena or attorney legal process letter to these exchanges will identify the fraud operator's real identity.

NTI-WALLET-005 | BYBIT — KYC TARGET #1

BYBIT HOT WALLET

Bybit exchange hot wallet. Sent 3 separate TRX gas payments to the fraud collection wallet in August 2025 totaling ~$30 TRX. Operator has a Bybit account — KYC subpoena will reveal real identity.

Exchange KYC Subpoena Target

TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa

Exchange

Bybit (KYC-regulated)

TRX Sent to Fraud

~$30 TRX (3 transactions)

Gas Dates

Aug 11, Aug 23, Aug 31 2025

Wallet TRX Balance

$235M+ (exchange account)

Subpoena Scope

Operator's KYC identity

What to Request from Bybit

Submit a KYC request to Bybit for the account holder who made withdrawals from this hot wallet address to TGf5bSmBBUPAY7bhsGhmafeD8w19h6sLdb on August 11, August 23, and August 31, 2025. Request: full name, government ID, date of birth, address, phone, email, and IP logs. See the Legal Brief for the draft compliance letter.

TronScan ↗ Email Bybit Compliance ↗

NTI-WALLET-006 | GATE.IO — KYC TARGET #2

GATE.IO ENERGY DELEGATION SOURCE

Gate.io delegated energy to the Gate.io exit sink wallet. Operator has a Gate.io account. Second independent KYC subpoena path.

Exchange KYC Subpoena Target

Exchange

Gate.io (KYC-regulated)

Confirmed Link

Energy delegated to TLSptUx…

USDT Exits

$1,500 confirmed withdrawal

Subpoena Value

Second ID path — backup

Email Gate.io Compliance ↗

Layer 3 — Operator Wallets

Gas Operators & Infrastructure Wallets

These wallets served as the operational infrastructure — providing TRX cryptocurrency gas to fund the fraud wallet's transaction fees. Every time the criminal sent USDT, they needed TRX gas. These wallets provided it.

ID	Label	Wallet Address	Role	Key Data	Actions
NTI-W-007	Primary Gas Operator	TJDENsfBJs4RFETt1X1W8wMDc8M5XnJhCe	Operator	Sent 54 TRX (May 15), 44.9 TRX (May 15), 44.9 TRX (Aug 31) to fraud wallet	TronScan ↗
NTI-W-008	Dark Energy Market	TCvnWqQ2hFqqHFjpcCyRDZYb261G6WYdo4	FinCEN Target	$27.3M TRX (~7.5M TRX) — mass energy provider, 100s of wallets, possible unlicensed MSB	TronScan ↗
NTI-W-009	GasFree4uCOM Service	TDMUk4h... (energy service)	Operator	GasFree4uCOM energy token airdropped to fraud wallet — commercial energy rental service	No direct action
NTI-W-010+	Additional Sinks (6 wallets)	Various small dispersal wallets	Crime	Received <$50 USDT each. Spam airdrop recipients (HASH8NET, tron.ink, Pay.bi)	View on TronScan ↗

Transaction Data

USDT Transaction Timeline — All 8 Confirmed Deposits

The following 8 USDT TRC-20 transfers were identified in the transaction CSV as direct fraud proceeds deposited to the fraud collection wallet. Method signature a9059cbb = ERC-20/TRC-20 transfer(address,uint256).

#	Date	Amount (USDT)	Phase	Method	Sweep Status	TronScan
1	May 10, 2025	$3,000.00	Phase 1	`a9059cbb`	Swept within 48hrs	View ↗
2	May 13, 2025	$280.00	Phase 1	`a9059cbb`	Swept	View ↗
3	May 14, 2025	$200.00	Phase 1	`a9059cbb`	Swept	View ↗
4	May 15, 2025	$300.00	Phase 1	`a9059cbb`	Swept	View ↗
5	May 17, 2025	$300.00	Phase 1	`a9059cbb`	Swept	View ↗
6	Aug 5, 2025	$1,000.00	Phase 2	`a9059cbb`	Swept	View ↗
7	Aug 11, 2025	$1,000.00	Phase 2	`a9059cbb`	Swept — Same day Bybit sent gas!	View ↗
8	Sep 1–10, 2025	$1,000.00	Phase 3	`a9059cbb`	Final sweep — wallet abandoned	View ↗
TOTAL		$7,080.00 USDT	8 confirmed fraud payment transactions — all swept within 24–48 hours

Important Note on the $36,150 vs $7,080 Gap

The victim claimed $36,150 in total losses. We traced $7,080 to this specific TRON wallet via the transaction CSV. The remaining ~$29,070 may have been paid to: (1) different TRON wallets not captured in this CSV, (2) via other payment methods, or (3) some payments may have been in non-USDT form. The $7,080 is the forensically confirmed minimum on-chain amount — the on-chain evidence does not contradict the victim's claimed total loss. Law enforcement investigation will establish the full payment record.

Supporting Evidence

TRX Gas Activity — Operator Coordination Evidence

The timing of TRX gas sends to the fraud wallet is forensic evidence that the operation was actively managed. Gas was sent specifically to coincide with expected victim payments — showing premeditated operational coordination.

Date	Gas Sender	Amount TRX	Significance
May 10, 2025	TJDENsfBJs4... (operator)	54 TRX	Same day as first $3,000 victim payment — clearly prepared in advance
May 15, 2025	TJDENsfBJs4... (operator)	44.9 TRX + 44.9 TRX	Two sends on same day — preparing for Phase 1 multi-sweep operations
Aug 11, 2025	TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa (BYBIT)	40.1 TRX	BYBIT — same day as victim's $1,000 Aug 11 payment. Operator account at Bybit confirmed.
Aug 23, 2025	TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa (BYBIT)	45.9 TRX	BYBIT — preparing for August 25 sweep cycle
Aug 31, 2025	TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa (BYBIT)	56.6 TRX	BYBIT + Operator (44.9 TRX) — dual-source gas for final Phase 3 collection cycle

Forensic Significance of Gas Timing

Bybit sent gas to the fraud collection wallet on August 11, the exact same day the victim sent $1,000 USDT. This means either: (a) the operator was monitoring victim payment activity in real-time and immediately funded the gas, or (b) the operator anticipated the payment. Either scenario confirms active operational management and direct Bybit account access. This "gas timing correlation" is forensic evidence linking the Bybit account holder to the fraud operation.