A Search Bot’s Wallet, and the Billion Behind It

A $118,605 deposit address belonging to a Telegram black-market search bot. Nine outbound paths checked. Eight lead back into the same mesh. Seven hops later, one counterparty relationship handles $1.07 billion, and not a single node of it appears in either of the two most-used compliance databases in the industry.

It starts small, and it isn’t supposed to lead anywhere

超搜 (ChaoSou), Telegram bot @cszwbot, is a Telegram search bot with 105,789 monthly users. It indexes and monetizes access to money muling, counterfeit and compliance-flagged USDT, stolen-card fraud, KYC-bypass account farms, illegal gambling, and prostitution solicitation, all in one searchable directory, with its own built-in USDT wallet.

TBRdQCfUu33bSJziHWoj9QArxV82KVt4E5 is one of that wallet’s rotating deposit addresses. On its own: $118,605 processed, 550 senders, unremarkable by the standards of anything else we’ve documented in this investigation.

That should have been the whole story. It isn’t.

Every door out of this wallet leads back to the same building

We checked nine of TBRdQCfUu’s direct outbound recipients, expecting the scatter of unrelated addresses most wallets produce. Instead, eight of the nine tie back into the same small handful of anchor points. Five route significant money to the same confirmed OKX exchange hot wallet. Four independently touch one specific unlabeled address. Three touch another. Four transact directly with each other. This isn’t a wallet that happens to be adjacent to something bigger, it’s a wallet sitting inside a dense, pre-existing mesh from its very first hop.

Gather quietly from 2,187 directions, then sweep

One of those nine recipients is a vanity address ending in nine ones, TVqpWKbBYAJAM3sm3gnAz7i8o111111111, just six to seven weeks old, confirmed by binary-searching its actual transfer history rather than trusting a stale summary field that told us it was two and a half years older than it really is.

It collects from 2,187 senders, most of them small, unlabeled, dust-level contributors. Classic structuring: gather quietly from many directions, then sweep. It sweeps on a near-weekly schedule, in $96,000–$125,000 tranches, alternating between two wallets that were created on the exact same day and have barely moved money since. Textbook parking wallets.

Pull on one thread, and the scale multiplies at every step

Following just the sending side of that wallet, seven more verified hops later, the scale has gone from $338,000 to a node handling 1.07 billion dollars in a single counterparty relationship. Each hop escalates. Each hop was checked directly against the transfer ledger, not assumed.

The money comes back to where it started

At the top of that climb, the chain does something a random escalation wouldn’t do: it loops. Money leaves one address, passes through three more hops, and roughly 13% of it — $143.9 million — returns to the exact same address it started from. That’s not coincidence at this scale. That’s either one operation moving its own money through intermediaries, or an extremely tight, repeated bilateral relationship between two large entities. Either way, it’s structure, not noise.

It deliberately sheds the one enforcement tool that exists on this chain

Running in parallel, several of these same addresses convert USDT into USDD through Sun.io’s real, publicly confirmed SmartExchangeRouter contract, verified by finding the actual bot-timed, sub-two-minute relay transactions, not assumed from behaviour alone.

This matters because USDT can be frozen by Tether at law enforcement’s request, and has been. USDD, issued by the TRON DAO, cannot. Converting through this specific contract doesn’t just move value — it strips away the single lever that could otherwise stop it.

Four ghosts keep reappearing

Across branches reached completely independently of each other, the same unlabeled addresses keep showing up: as a sender here, a bidirectional partner there, a funder somewhere else. One address, TZ29k1iPA8TNLTW43bc6sDDXZbcGHSbpik, is simultaneously a $12.5 million USDT recipient, the confirmed funder of a separate node in the USDD network, and a receiver from three different upstream sources. That’s not adjacency. That’s the same small set of hands touching multiple parts of the machine.

Nobody official has this on their radar

We checked the entire chain, every major node, against two independent professional compliance databases: Bitquery and BlockSec/MetaSleuth. Every single major exchange wallet we’ve encountered anywhere else in this investigation got tagged instantly by at least one of them. Here: nothing. Not the billion-dollar node, TNo9eGDGMY8g9XGH7kNAMQePE5ut2YRWUH. Not the $149 million relationship. Not one of them. At this scale, that absence is itself the finding.

What we’re confident about, and what we’re not

Why this is worth publishing

Because it starts at a documented black-market directory, not a hunch. Because the structuring, the parking wallets, the circular flow, and the deliberate freeze-evasion aren’t individually damning, but together they form a coherent, deliberate shape. Because the mesh at the origin is provably dense, not a single coincidental path we got lucky following.

And because nothing here is on the map of the two most-used compliance tools in the industry, which means either we’ve found something nobody else has, or we’ve found the edge of what on-chain tooling alone can actually see. The piece is “here is a real, verified, unlabeled network moving at exchange scale, discovered by following a black-market search bot’s own payment wallet” — not a claim about who’s behind it.

We’ll keep watching this one too.