The Persona Factory: Inside the $542 Million Circuit Behind a Romance-Scam Photo Marketplace

A marketplace’s own collection address sweeps into a four-hop, five-branch laundering structure built in a single eight-minute window, and a slice of the money comes back to where it started.

A 300 USDT receipt, and where it actually went

Telegram’s “guarantee” (担保) system exists to make strangers trust each other long enough to trade. A buyer and seller who have never met route their payment through a neutral group with its own escrow rules, its own bots, and its own enforcement: legitimate for ordinary commerce, and just as useful for commerce nobody wants traced.

Group 1129, full name 公群i组1129-供押3338U套图/素材/人设/执照P图/ps/作图公群（月结）, 4,655 members, 333 online at last check, runs exactly this system for one specific product line: fabricated identities. Its own pinned Guarantee Form spells out the inventory in plain text: “Package Designs/Materials/Character Designs/License Editing/Photoshop/Illustration”, billed monthly. In practice, that is the raw material of romance scams: curated photo sets of a fake person, backstory materials, and doctored ID or license documents, sold to whoever is running the con.

The group has the organizational furniture of a real business. 新币i组审核专员 reviews listings. 新币i组巡查 patrols for violations and pays bounties on reports. i建群53号 owns the group. And 格温-套图 24小时在线(唯一号), “Gewen-Tutu, online 24 hours, sole account”, sits inside it carrying the role 供方负责人: supply-side lead. This is the vendor account for the photo-package operation itself, operating in the open, with a bot relaying its own payment confirmations back to the group (“Amount received: 300 U.”) as they land.

We pulled the thread on one of those payments. The group’s pinned Guarantee Rules name TVHyoh1EowFtqso7WyecQFfzctQXTo6iyJ as its own unique receiving address: not a customer’s personal wallet, but the marketplace’s official collection point. Its ledger behaves accordingly. It takes in from 1,149 distinct senders across 1,537 incoming transfers, and sweeps out to just 21 distinct receivers across 40 outgoing ones.

One of those 21 destinations, for exactly $300 in a single transfer on August 26, 2026 at 15:27 local time, is TG83Fk56S2mycAUMYHZyZp9wMg6DCf4bUn. We did not read that address off a screenshot: we pulled the transaction hash itself from the TRON ledger and confirmed the receiver character for character. So the link is not “a customer happened to pay this wallet.” It is the group’s real payment infrastructure sweeping into a small, deliberate set of downstream addresses, and this is one of them.

That address is not a dead end. It is the mouth of a $542.5 million circuit.

Four hops, one purpose: get the money past this address

$540,508,634.83 of it, in 101 transfers, goes to TYkE8VwX1SGHM3Q2CA29nka5U2F2khKAj5, which, after folding in roughly $2 million from 75 smaller senders of its own, passes essentially the whole sum forward: $542,508,634.83 to TEECjwHqVG8sDmM3VtscjuCaRe5p351MU7. That wallet has exactly one receiver on record. It sends $542,508,635.00, in 83 transfers, to TDU61o35UEe5hdB3R16c116DrPSV4kiyKz.

Three hops, three consolidator-style wallets, one figure moving forward almost untouched. This is classic layering, structured to put distance between a deposit address and wherever the money actually settles.

The fan-out: five branches, four of them the same destination

At TDU61o35UEe5hdB3R16c116DrPSV4kiyKz, the single incoming stream splits five ways. The first four are not really four separate destinations at all: they are parallel single-hop conduits that all deliver, almost dollar for dollar, to the same address, TXHX2NUvcgft4zs6MkkUtdNVERPTavHDWN. Splitting one stream into several independent-looking wallets that quietly reconverge downstream is a standard way to make a trace look like it dead-ends in several places when it does not.

The fifth branch is different. TJzMy8ZaPZnarASwCLw7y6bb5pmdFQmf3Y does not reconverge with the other four. It is a separate hub in its own right, with 5,443 receivers and 10,501 senders on its own ledger: a distinct lead we have not pursued yet, not a branch of this one.

The hub, and the loop back to where this started

TXHX2NUvcgft4zs6MkkUtdNVERPTavHDWN is the endpoint of the traced chain: $536,608,631.92 confirmed arriving from the four branches plus the direct transfer, against a ledger of 21,877 distinct receivers and 8,259 distinct senders overall. That is a genuine dispersal hub, not a relay.

Here is the finding that makes this a closed loop rather than a one-way pipe. TXHX2NUvcgft4zs6MkkUtdNVERPTavHDWN pays TY5GbYptAvxpqAoE6XXz3qTfiziHjiArCP $9,022,807.00 across 359 transfers. And TY5GbYptAvxpqAoE6XXz3qTfiziHjiArCP, independently, on its own ledger, pays $3,541,402.09 across 244 transfers directly into TG83Fk56S2mycAUMYHZyZp9wMg6DCf4bUn: the same wallet this entire chain started from, and the same wallet that received the 300 USDT payment for romance-scam materials.

A trusted front, and a pipeline built three weeks ago

TRON exposes no “created” field, so we dated each wallet by binary search on its earliest ledger activity. The result splits the structure cleanly in two. The group’s public-facing collection address has been live since at least December 2024, roughly 21 months: old enough to look established to a buyer being asked to send money to a stranger. Everything behind it is new.

The three middle-chain wallets were all created and activated inside an eight-minute window on August 14, 2026. TYkE8VwX1SGHM3Q2CA29nka5U2F2khKAj5’s very first transaction on record is the $4,000,000 inflow from the origin wallet at 16:38:00. That is the signature of a pipeline built to order for this money, not repurposed infrastructure that happened to be lying around.

What we’re confident about, and what we’re not

Two figures in this chain are modeled rather than itemized line by line. The $541.97 million arriving from the other 17,985 senders is the origin wallet’s confirmed total inflow minus the one sender we traced individually; we have not broken those deposits down one by one. The roughly $527.6 million of further dispersal out of TXHX2NUvcgft4zs6MkkUtdNVERPTavHDWN to its other 21,876 receivers is the same kind of modeled remainder. Both are honest aggregates of confirmed totals, not fabricated detail.

Every address, dollar figure, and transfer count above came from a direct ledger query, cross-checked this session, including the one number that mattered most.

We’ll keep tracing this one.