Peel chains: how stolen USDT spreads across addresses and how to trace it

How a peel chain works

The pattern repeats from case to case:

1. A large sum arrives at a new address.
2. Almost at once two transfers leave it: a small one to an exchange or exchanger deposit, and the large remainder to the next new address.
3. The step repeats dozens of times until the remainder runs out.

This lets the scammer cash out in parts without drawing attention to one large sum, and makes the search harder.

How to spot the chain on-chain

• The addresses are new: each has almost no history before the transfer.
• Money does not stay: it leaves within minutes or hours.
• Branch amounts look alike, and the remainder shrinks every time.
• Branches end at exchange or exchanger addresses, or at bridges to other networks.

Where to look for leads

The branches matter more than the main line. The address a branch went to often turns out to be an exchange deposit: from it the exchange can find the account. The account holder is not necessarily the scammer: it may be a mule, a P2P seller or another victim, but for an investigation it is the main lead.

Mixed money counts as fully tainted: do not rely on one rule like “first in, first out”; look at all earlier and later outflows.

Build the address’s link graph in GuardPay /wallet-graph to see the branches in full, and if the money was stolen from you, start a trace in GuardPay /stolen: it collects the exchanges on the funds’ path and prepares letters.

What a victim should do

1. Save the hashes of all transfers from your wallet.
2. File a police report and attach the path of the funds.
3. Write to the exchanges that received branches, with the hashes and a request to preserve the account data.

The detailed order is in what to do if you were scammed. And beware of anyone promising recovery for an upfront fee, see recovery scams.