Unveiling On-chain Abnormal Fund Flows: An Astonishing Transaction of Over 55 Billion USDT in One and a Half Years

Recently, a platform called Huiwang Payment has attracted widespread attention. This platform is suspected of participating in the receipt, transfer, and withdrawal of fraudulent funds, especially frequent USDT transactions on the TRON chain. To gain a deeper understanding of its on-chain behavioral characteristics, we conducted a detailed analysis based on publicly available data.

On-chain Fund Flow Overview

Total Deposit and Withdrawal Amount

• Total withdrawal amount: 57,246,854,379 USDT
• Total deposit amount: 54,475,887,524 USDT

The data shows that there has been a large amount of inflow and outflow of funds on the platform over the past year and a half, with withdrawal amounts consistently exceeding deposit amounts, resulting in a net outflow of 2.771 billion USDT, demonstrating a clear "net capital outflow" characteristic.

Weekly Capital Flow

The flow of funds on the platform remains active, with significant peaks occurring at the following three time points:

1. July 8, 2024: A significant peak first appeared, with both deposits and withdrawals exceeding 1 billion USDT.
2. March and May 2025: Two withdrawals amounting to nearly or exceeding 1.1 billion USDT.

Transaction Count Analysis

The number of withdrawal transactions has shown a stepwise increase since February 2024, reaching its peak on May 12, 2025, with nearly 150,000 transactions in a single day, exhibiting the characteristic of "high-frequency withdrawals." In contrast, while the number of deposit transactions has increased overall, the fluctuations are relatively small. It is noteworthy that the peaks in withdrawal amounts in March and May 2025 coincided with a simultaneous rise in the number of transactions.

User Behavior Analysis

Active Users Count

Since the beginning of 2024, the number of active deposit addresses on the TRON chain has grown from less than 30,000 to over 80,000, showing a stable growth trend. This indicates that the platform is still continuously attracting new users, but the growth rate has slowed down.

Active Address Analysis

Withdrawal Address Top 3

1. TWS84SZ2GE2EgyZDCrfVuEJXpoXYuBxteS - 816 million USDT
2. T9yFi9yxwBUjMbHwBFKDdwFdBwvzUAqBfR - 580 million USDT
3. TTSSC4TEYtQMAMURND6i1FPYaaBJMGY4ed - 512 million USDT

These addresses have been active for a long time since 2023, with rich on-chain traces. Among them, the first address not only withdraws coins from multiple platform hot wallets but also interacts with some addresses marked as high risk. The second address is suspected to be a wallet address controlled by a certain collateral platform. The third address interacts with multiple trading platforms.

Top 3 Deposit Addresses

1. TL8TBpubVzBr1UWPXBXU8Pci5ZAip9SwEf - 1.665 billion USDT
2. TPEpdLYtHr8cN1Jbwf6CGNB9Ppho7L2otr - 449 million USDT
3. TM1zzNDZD2DPASbKcgdVoTYhfmYgtfwx9R - 436 million USDT

Among them, the deposit of the first address reached 1.6 billion USDT, which is 1.3 times the highest withdrawal amount address. The earliest transaction can be traced back to 2022 and is suspected to be a wallet address controlled by a certain guarantee platform. The other two addresses are suspected to be hot wallet addresses of a certain trading platform.

Active Time Analysis

Statistics on the operation time of 10 randomly selected ordinary addresses ( UTC ):

• Withdrawal transactions are mainly concentrated between UTC time 01:00-16:00, with high-frequency periods from 07:00-13:00.
• Deposit operations are mainly concentrated between 03:00-10:00 UTC, which partially overlaps with the active period of the withdrawal address.

International Regulatory Dynamics

Recently, multiple international regulatory agencies and law enforcement authorities have taken action against the platform and related entities:

• In July 2024, Tether froze an address related to the platform, with an amount of nearly 30 million USDT.
• In May 2025, the U.S. Department of the Treasury proposed to prohibit U.S. financial institutions from providing services to related groups.
• The United Nations Office on Drugs and Crime has pointed out that a certain guarantee platform has become part of the "cyber scam industrial ecosystem" in Southeast Asia.
• Elliptic reports that Telegram has banned thousands of crypto crime channels related to "some guarantee".
• On May 15, 2025, a certain guarantee platform announced its cessation of operations due to being blocked by Telegram.

These data and analyses provide foundational support for further understanding the platform's on-chain activities and highlight the increasingly complex regulatory challenges in the cryptocurrency space.