Analysis of On-Chain Capital Flow Behind Over 55 Billion USDT

Recently, a platform named Huiwang Payment has attracted widespread attention. This platform is suspected of being involved in receiving, transferring, and withdrawing funds related to scams, especially frequently conducting USDT transactions on the TRON chain. To gain a deeper understanding of its on-chain behavioral characteristics, this article provides a detailed analysis of the platform's USDT deposit and withdrawal activities on the TRON chain based on publicly available data.

Overview of Fund Flow

Total Deposit and Withdrawal Amount

• Total Withdrawal Amount: 57,246,854,379 USDT
• Total deposit amount: 54,475,887,524 USDT

Data shows that the platform has experienced a large amount of inflows and outflows over the past year and a half, with withdrawal amounts consistently exceeding deposit amounts, resulting in a difference of 2.771 billion USDT, indicating a clear "net capital outflow" characteristic.

Weekly Capital Trends

The platform's capital flow remains active, with peaks occurring at the following three time points:

1. July 8, 2024: A significant peak is first observed, with both deposits and withdrawals exceeding 1 billion USDT.
2. March and May 2025: Two withdrawals amounting to nearly or exceeding 1.1 billion USDT.

Transaction Volume Change

The number of withdrawal transactions has shown a staircase-like increase since February 2024, peaking on May 12, 2025, with nearly 150,000 transactions in a single day, demonstrating the characteristic of "high-frequency withdrawals." In contrast, the number of deposit transactions fluctuates less but shows an overall upward trend, with daily deposit transactions steadily growing to nearly 140,000.

It is worth noting that the peaks in withdrawal amounts in March and May 2025 were accompanied by a simultaneous increase in the number of transactions.

User Behavior Analysis

Active User Count

Since the beginning of 2024, the number of active deposit addresses on the TRON chain has grown from less than 30,000 to over 80,000, showing a stable growth trend. This indicates that the platform is still continuously attracting new users, but the growth rate has slowed down.

Active Address Analysis

Withdrawal Address Top 3

1. TWS84SZ2GE2EgyZDCrfVuEJXpoXYuBxteS: 816 million USDT
2. T9yFi9yxwBUjMbHwBFKDdwFdBwvzUAqBfR: 580 million USDT
3. TTSSC4TEYtQMAMURND6i1FPYaaBJMGY4ed: 512 million USDT

These addresses have been active for a long time since 2023, with rich on-chain traces. Among them, the first address not only withdraws coins from multiple platform hot wallets but also interacts with addresses marked as "OFAC Sanctions", "Theft", and "BingX Exploiter". The second address is suspected to be a wallet controlled by a certain guarantee platform. The third address interacts with multiple trading platforms.

Top 3 Deposit Addresses

1. TL8TBpubVzBr1UWPXBXU8Pci5ZAip9SwEf: 1.665 billion USDT
2. TPEpdLYtHr8cN1Jbwf6CGNB9Ppho7L2otr: 449 million USDT
3. TM1zzNDZD2DPASbKcgdVoTYhfmYgtfwx9R: 436 million USDT

Among them, the deposit of the first address reached 1.6 billion USDT, which is 1.3 times the highest withdrawal amount address. The earliest transaction can be traced back to 2022, suspected to be a wallet address controlled by a certain collateral platform. The other two addresses are suspected to be hot wallet addresses of a certain trading platform.

Active Time Analysis

By analyzing 10 randomly selected regular deposit and withdrawal addresses, it was found that:

• Withdrawal transactions are mainly concentrated between 01:00 and 16:00 UTC, with the peak period being from 07:00 to 13:00.
• Deposit operations are mainly concentrated between 03:00 and 10:00 UTC, overlapping partially with the active periods of the withdrawal address.

Certain addresses experience a surge in transactions during specific time periods (e.g., 02:00-03:00), while some withdrawal addresses have almost no transactions from 15:00 to 00:00 the next day.

International Regulatory Dynamics

Recently, multiple international regulatory agencies have taken action against the platform and related entities:

• In July 2024, Tether froze an address related to the platform, with an amount of nearly 30 million USDT.
• In May 2025, the U.S. Treasury proposed to prohibit U.S. financial institutions from providing services to the group.
• The United Nations Office on Drugs and Crime lists it as part of the "cyber fraud industrial ecosystem."
• The Elliptic report indicates that the platform processed over $8.4 billion in suspicious transactions.
• On May 15, 2025, a related collateral platform announced it would cease operations due to being blocked by Telegram.

This analysis provides foundational data support for understanding the platform's on-chain activities, facilitating further research into its operational model and potential risks.