On-chain capital flow exceeds 55 billion USDT: An analysis of a certain payment platform's operating model

Recently, a service called a certain payment platform has attracted significant attention from regulatory authorities. The platform is suspected of participating in the reception, transfer, and withdrawal of fraudulent funds, particularly through the frequent use of USDT on the TRON network. To gain a deeper understanding of its on-chain behavioral characteristics, we conducted an in-depth analysis based on publicly available data and professional tools.

The data in this article covers the period from January 1, 2024, to June 23, 2025.

on-chain capital flow analysis

Total Deposit and Withdrawal Overview

• Total withdrawal amount: 57.247 billion USDT
• Total Deposit: 54.476 billion USDT

Data shows that the platform has experienced a massive inflow and outflow of funds over the past year and a half, with a total exceeding 50 billion USDT. Notably, the amount withdrawn consistently exceeds the amount deposited, with a difference of 2.771 billion USDT, presenting a clear characteristic of "net fund outflow."

Weekly Fund Movements

The platform's capital flow remains active, with significant peaks occurring at the following three time points:

1. July 8, 2024: A significant peak first appeared, with both deposits and withdrawals exceeding 1 billion USDT.
2. March and May 2025: Two withdrawals amounting to nearly or exceeding 1.1 billion USDT.

Transaction Volume Analysis

The number of withdrawal transactions has shown a ladder-like increase since February 2024, peaking on May 12, 2025, with nearly 150,000 transactions in a single day, demonstrating "high-frequency withdrawals" characteristics. In contrast, the number of deposit transactions fluctuates less but shows an overall upward trend, averaging nearly 140,000 transactions per day, indicating that user activity remains stable.

It is worth noting that the peaks in withdrawal amounts in March and May 2025 coincide with a simultaneous increase in the number of transactions, with the two peaks almost overlapping.

User Behavior Analysis

Active Users Count

Since the beginning of 2024, the number of active deposit addresses on the platform in the TRON network has grown from less than 30,000 to over 80,000, showing a stable growth trend. This indicates that the platform continues to attract new users, but the growth rate has slowed down.

Active Address Analysis

Withdrawal Address TOP 3

1. Address 1: Withdraw 816 million USDT, interacts with multiple high-risk addresses.
2. Address 2: Withdraw 580 million USDT, suspected to be a wallet controlled by a certain guarantee platform.
3. Address 3: Withdraw 512 million USDT, with funds transactions with multiple platforms.

Top 3 Deposit Addresses

1. Address 4: Deposited 1.665 billion USDT, suspected to be a wallet controlled by a certain guarantee platform.
2. Address 5: Deposited 449 million USDT, possibly a hot wallet of a certain platform.
3. Address 6: Deposited 436 million USDT, which may also be a hot wallet of a certain platform.

Active Time Analysis

By analyzing 10 randomly selected ordinary user addresses, we found that:

• Withdrawal transactions are mainly concentrated between 01:00 and 16:00 UTC, with a high-frequency period from 07:00 to 13:00.
• Deposit operations are mainly concentrated between 03:00-10:00 UTC, overlapping partially with the withdrawal period.

International Regulatory Dynamics

Recently, multiple international regulatory agencies and law enforcement authorities have taken a series of actions against the platform and its associated entities:

• In July 2024, a stablecoin issuer froze an address related to the platform, involving an amount of approximately 29.62 million USDT.
• In May 2025, the U.S. Department of the Treasury proposed to ban U.S. financial institutions from providing services to the parent company of this platform.
• In the same month, a United Nations report indicated that the platform has become part of the Southeast Asian online scam ecosystem.
• A blockchain analysis company reported that another major crypto black market platform, alongside this platform, processed over $8.4 billion in suspicious transactions.
• On May 15, 2025, a guarantee service related to the platform announced its cessation of operations.

Conclusion

By analyzing the capital flow, transaction frequency, and active addresses of this payment platform on the TRON network, we provide foundational data support for further understanding its on-chain activities. This data reveals some characteristics of the platform's operations and raises considerations regarding its compliance and risk management.