A crypto trader lost about $2.1 million in USDT after scammers took over a business partner’s Telegram account and used it to request a transfer, according to on-chain investigator VAL. The case highlights how social engineering can be combined with blockchain transfers that are fast, public, and difficult to reverse once completed.
The victim reportedly sent a small test payment of $10 first and received confirmation from the compromised account. After that, he transferred 2,151,772 USDT. By the next morning, the Telegram chat had been deleted and the account stopped replying.
How the transfer unfolded
The scammers are said to have posed as the trader’s business partner through a hijacked Telegram account. Using that access, they convinced the victim to treat the wallet request as legitimate.
Before making the full transfer, the trader sent $10 USDT as a test. After the account confirmed receipt, he proceeded to send 2,151,772 USDT, turning what appeared to be a routine payment check into a multimillion-dollar loss.
Where the stolen funds went
Investigators said the USDT was quickly moved out of the receiving wallet, then converted into TRX before being sent to deposit addresses tied to MaskEX. That sequence made tracing more complex, but blockchain records still provided a visible path for part of the money.
About half of the stolen amount was followed through later withdrawals, according to the investigation. VAL said transaction timing analysis also helped identify a separate wallet believed to hold the remaining funds.
Tether freeze captured part of the funds
Tether later froze a wallet holding about $1 million on Oct. 29, six days after the theft. Those funds remain frozen while the victim continues efforts to recover the money.
The freeze did not cover the entire amount taken. Investigators said only part of the assets could be contained in that wallet, leaving the rest dependent on tracing work and any follow-up action linked to the identified addresses.
What is confirmed next
The wallet believed to contain the remaining funds has shown no activity for two months, according to investigators. That inactivity has become a key part of the current picture, alongside exchange-linked deposit addresses and the blockchain trail already documented.
For now, the confirmed next step is continued recovery efforts based on transaction records and exchange data. The case remains centered on attribution by investigators, the frozen $1 million wallet, and the still-unresolved destination of the rest of the stolen USDT.
Source: Coin Edition