An elderly Florida resident was contacted by someone impersonating a major bank's fraud-prevention team. Over a series of calls, the caller convinced her that her account had been compromised and that moving her funds into cryptocurrency was the only way to protect them from further attack — a variant of the "pig-butchering" scam that increasingly targets retirees.
Before asking her to move any money, the scammer seeded a fake $10,000 USDT "investment balance" into a wallet app installed on her phone. She could see the balance grow. She could never withdraw it. It existed only to build trust and justify the next request.
Across three separate visits to cryptocurrency ATMs, she converted $61,000 in cash to Bitcoin and sent it to wallet addresses the scammer provided. By the time her family recognized the fraud, her phone had been wiped and the only surviving evidence was a set of screenshots.
Scanned blockchain events within a tight time window around the reported scam calls, matched the partial wallet address visible in the victim's screenshots to the full on-chain address, and verified the match through independent transaction endpoints.
Profiled the wallet that funded the fake balance and identified it as an active ~$2.6M USDT pass-through — a laundering hub moving stolen funds for what appeared to be more than one victim.
Used energy-delegation patterns and account-creation lineage on-chain to prove that multiple, seemingly unrelated wallets were centrally controlled by the same operator — the technical backbone of the entire attribution.
Mapped downstream fund flows to more than eight major KYC exchanges, identifying the specific hot wallets and deposit addresses involved so counsel could target subpoenas precisely rather than broadly.
Analyzed 2,196 operator-side transactions for timing patterns, revealing an organized human shift operation with a distinct weekday/weekend rhythm consistent with a specific working timezone band.
Checked every identified address against the OFAC SDN list, CryptoScamDB, and ScamSniffer to rule out (and rule in) known-bad actors and confirm no overlapping designations were missed.
Used Arkham Intelligence to name additional exchange endpoints and independently confirm deposit-address attributions, adding a second, commercially licensed source behind every citation in the final report.
Two fund flows converge at the same wallet infrastructure: the real Bitcoin the victim was defrauded of, and the fabricated USDT balance used to convince her to send it.
The funding wallet was confirmed as an active ~$2.6M USDT pass-through — part of a centrally controlled, multi-victim operation, not an isolated actor.
More than ten Binance accounts withdrew a combined $1.09M directly into the operation's treasury wallet — the clearest path to real-world identity.
Binance, OKX, HTX, Bybit, Bitget, KuCoin, MEXC, and additional custody/card services confirmed as touchpoints — each a viable subpoena target.
Analysis of 2,196 operator transactions showed 3.5x more weekday than weekend activity — consistent with an organized shift operation in a UTC+1 to UTC+3 timezone band.
A portion of the Bitcoin proceeds remains parked in a wallet eligible for freeze requests; the remainder was routed through a since-dormant consolidator.
No prior public attribution existed for this operation. This engagement produced the first documented identification of its infrastructure.
Every engagement ends with materials counsel and law enforcement can act on immediately — not just a technical write-up.
"Cascadia didn't just give us a wallet address — they gave us a legal packet ready for the subpoenas. Every exchange we approached already had a named account, a dollar figure, and a citation trail. That's the difference between a blockchain report and a case we can actually work."
Initial consultations are confidential. We assess your matter and advise on scope, timeline, and deliverables before any engagement begins.
Book a Consultation