{
  "name": "TrxTr4c3r scam site deposit addresses",
  "scope": "Deposit addresses published by reported scam platforms, and any direct link from that address to a known service. Nothing else.",
  "version": "0.4.0",
  "updated": "2026-09-23",
  "count": 7,
  "labels": [
    {
      "address": "0x88c3d62860d59a51fa43adf84a20c040606ed3d6",
      "chain": "ethereum",
      "role": "deposit address",
      "control_status": "not established",
      "control_basis": "published on the site's deposit screen (E004) and nothing beyond that. The address is itself an exchange deposit address, so it belongs to an account holder, and no evidence identifies that holder as the operator rather than an unconnected customer. The 24,083.271289 USDT inbound may be a third party's own account flow. No payment instructions have been obtained from the operator to test it",
      "scam_domain": "proderivfxt[.]com",
      "reported_by": "scambuster.fr",
      "linked_platform": "Bybit",
      "link_basis": "the deposit address is itself an exchange deposit address: Etherscan labels it \"Bybit: Deposit Address\" and its Funded by field reads \"Bybit: Deposit Funder\". Arkham agrees. Corroborated on chain by seven gas top-ups from the exchange funder and a sweep to an exchange hot wallet after each deposit",
      "link_confidence": "vendor label, unverified",
      "first_seen": "2024-06-25T23:45:11Z",
      "last_seen": "2025-11-19T02:38:23Z",
      "total_received": "24083.271289 USDT; 2.553457859091488910 ETH",
      "episode": "THE LAST HOP #002",
      "post_url": "https://trxtr4c3r.substack.com/p/the-last-hop-002-they-skipped-the",
      "tag": "#verified",
      "added": "2026-09-07"
    },
    {
      "address": "TSCcYez4hGLiDRna3kQXiwF6SbU6BX4GcL",
      "chain": "tron",
      "role": "deposit address",
      "control_status": "not established",
      "control_basis": "published on the site's deposit screen (E003). Exchange deposit behaviour identifies the address type, not the account holder. Same open question as the Ethereum rail on the same site",
      "scam_domain": "proderivfxt[.]com",
      "reported_by": "scambuster.fr",
      "linked_platform": "Bybit",
      "link_basis": "the deposit address is itself an exchange deposit address per Arkham and Tronscan. Corroborated on chain by a 20.000000 TRX gas delivery from the exchange funder followed by a sweep 3 minutes 3 seconds later",
      "link_confidence": "vendor label, unverified",
      "first_seen": "2025-03-31T18:14:30Z",
      "last_seen": "2025-07-07T01:51:24Z",
      "total_received": "210.000000 USDT",
      "episode": "THE LAST HOP #002",
      "post_url": "https://trxtr4c3r.substack.com/p/the-last-hop-002-they-skipped-the",
      "tag": "#verified",
      "added": "2026-09-07"
    },
    {
      "address": "1AvNHAYFJAbm6vQGvX7qy8VdzUTWm5LL62",
      "chain": "bitcoin",
      "role": "deposit address",
      "control_status": "not established",
      "control_basis": "published on the site's deposit screen (E005) and never used. An address with zero transactions carries no control evidence in either direction",
      "scam_domain": "proderivfxt[.]com",
      "reported_by": "scambuster.fr",
      "linked_platform": "",
      "link_basis": "none. The address has never been used, so nothing can be said about what it is",
      "link_confidence": "n/a",
      "first_seen": "",
      "last_seen": "",
      "total_received": "0 BTC, zero transactions ever",
      "episode": "THE LAST HOP #002",
      "post_url": "https://trxtr4c3r.substack.com/p/the-last-hop-002-they-skipped-the",
      "tag": "#verified",
      "added": "2026-09-07"
    },
    {
      "address": "bc1qk078dgjfkrxu6upw749krxp5j8v8rws0hf8d3m",
      "chain": "bitcoin",
      "role": "deposit address",
      "control_status": "circumstantial",
      "control_basis": "published on the logged-in deposit screen (E002). The sibling collector bc1q9ukttq2pkqn5x9nf6866dyajntfl7avnhv5q96 funded this address's first UTXO and the address route-tested to CoinCola 7 minutes 27 seconds later, which is how an address the operation set up behaves. Co-spend test closed negative and definitive: 17 spends, all single-input, so common-input ownership can never be established here",
      "scam_domain": "a1cryptotradings[.]com",
      "reported_by": "scambuster.fr",
      "linked_platform": "CoinCola",
      "link_basis": "the deposit address forwarded to addresses Arkham attributes to CoinCola, one hop out",
      "link_confidence": "vendor label, unverified",
      "first_seen": "",
      "last_seen": "",
      "total_received": "0.01254526 BTC external inflow",
      "episode": "THE LAST HOP #001",
      "post_url": "https://trxtr4c3r.substack.com/p/the-fake-trading-platform-that-gave",
      "tag": "#verified",
      "added": "2026-09-07"
    },
    {
      "address": "15hGjv1tTUoty2MGPzzYLhJkF2QahoYGaA",
      "chain": "bitcoin",
      "role": "deposit address; also the checkout address on the site's NFT store",
      "control_status": "not established",
      "control_basis": "published on the logged-in deposit screen and served identically to a second account, so the site hands the same address to every user. A live operator, asked how to pay, directed the target back to that deposit screen and called it \"your trading account wallet address\" (E016), which is the only pointer toward operator control. The chain runs the other way: the domain was registered 2026-09-20 and every transaction on this address predates that date, so nothing on it can have come from this site. An address with years of prior history is not an address the operation set up",
      "scam_domain": "afiliatemktplc[.]live",
      "reported_by": "scambuster.fr",
      "linked_platform": "Bybit",
      "link_basis": "labelled a Bybit deposit address by Arkham, MetaSleuth and Breadcrumbs. Single ecosystem, no independent corroboration, and no chain record carries an entity name",
      "link_confidence": "vendor label, unverified",
      "first_seen": "2024-08-04T07:41:47Z",
      "last_seen": "2026-08-22T23:10:00Z",
      "total_received": "0.07903100 BTC gross across 110 transactions, which on a UTXO chain includes change returning from its own spends and is therefore not an inflow figure. Balance zero. None of it after the domain was registered on 2026-09-20",
      "episode": "THE LAST HOP #003",
      "post_url": "https://trxtr4c3r.substack.com/p/i-found-a-scam-site-that-was-two",
      "tag": "#verified",
      "added": "2026-09-23"
    },
    {
      "address": "TXyrzj428kRbC2rpay1NZEyFVdPAB4pD4y",
      "chain": "tron",
      "role": "deposit address",
      "control_status": "not established",
      "control_basis": "published on the logged-in deposit screen and served identically to a second account, so the site hands the same address to every user. A live operator, asked how to pay, directed the target back to that deposit screen and called it \"your trading account wallet address\" (E016), which is the only pointer toward operator control. The chain runs the other way: the domain was registered 2026-09-20 and every transaction on this address predates that date, so nothing on it can have come from this site. An address with years of prior history is not an address the operation set up",
      "scam_domain": "afiliatemktplc[.]live",
      "reported_by": "scambuster.fr",
      "linked_platform": "Bybit",
      "link_basis": "labelled a Bybit deposit address by Arkham and MetaSleuth. Its last sweep went to TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa, the same Tron address episode 002 reached, which is corroboration of the label rather than a chain fact",
      "link_confidence": "vendor label, unverified",
      "first_seen": "",
      "last_seen": "2026-09-14T23:20:03Z",
      "total_received": "not established. Confirmed activity on 2026-09-14: 58.000000 USDT in, 45.000000 USDT in, 103.000000 USDT swept out the same day. None of it after the domain was registered on 2026-09-20",
      "episode": "THE LAST HOP #003",
      "post_url": "https://trxtr4c3r.substack.com/p/i-found-a-scam-site-that-was-two",
      "tag": "#verified",
      "added": "2026-09-23"
    },
    {
      "address": "0x9c6b30ecfe4f136785b7554c9cf18e476d0e33e0",
      "chain": "ethereum",
      "role": "deposit address; served for both the ETH and the USDT-ERC20 rail",
      "control_status": "not established",
      "control_basis": "published on the logged-in deposit screen and served identically to a second account, so the site hands the same address to every user. A live operator, asked how to pay, directed the target back to that deposit screen and called it \"your trading account wallet address\" (E016), which is the only pointer toward operator control. The chain runs the other way: the domain was registered 2026-09-20 and every transaction on this address predates that date, so nothing on it can have come from this site. An address with years of prior history is not an address the operation set up",
      "scam_domain": "afiliatemktplc[.]live",
      "reported_by": "scambuster.fr",
      "linked_platform": "Bybit",
      "link_basis": "Etherscan carries the public name tag \"Bybit: Deposit Address\" on this address, which is an explorer-published label and stronger than a graph vendor's. Arkham, MetaSleuth and Breadcrumbs agree. Still a label, not something the chain states",
      "link_confidence": "explorer name tag plus vendor labels, unverified",
      "first_seen": "2026-04-15T06:45:11Z",
      "last_seen": "2026-07-07T18:30:35Z",
      "total_received": "50.000000 USDC and 5.000000 USDT, lifetime, plus two junk transfers (a zero-value BUSD and an advertising token). Native transaction count is zero: the address has never sent anything and has never paid gas. None of it after the domain was registered on 2026-09-20",
      "episode": "THE LAST HOP #003",
      "post_url": "https://trxtr4c3r.substack.com/p/i-found-a-scam-site-that-was-two",
      "tag": "#verified",
      "added": "2026-09-23"
    }
  ],
  "control_note": "A row records that a reported scam site PUBLISHED this address. It does not record that the site's operator controls it. CASE-2026-008 traced six published deposit addresses across six chains and found none operator-controlled: three never used, three belonging to uninvolved third parties. Read control_status on every row before acting on one."
}