ONYXAML
Forensic trace · Free

Where your funds went: a free trace

Enter the address YOU SENT USDT TO (the scammer's address). We trace outgoing flows across 2 hops and answer the question that matters: did the funds reach an exchange that can actually freeze them, and what should you do next. TRON, Ethereum, BNB Chain and Solana.

TRACE · USDT · TRON / ETH / BSC / SOLANA

This is the RECIPIENT address from your transfer; copy it from your wallet's or exchange's transaction history.

A 0x… address is checked on Ethereum and BNB Chain at once. Solana takes a few minutes.

When a trace helps

What you get

Main destinations

Where most of the funds went: addresses, amounts and their share of the total outflow.

Recipient status

Platform labels, the Tether blacklist, OFAC sanctions and scam databases for each major destination.

Pass-through chain

If the funds are split through new addresses, we follow the main flow until it reaches a known platform or the trail ends.

Deposit address signal

If nearly all the flow from an address goes straight to one platform, we mark it as a likely deposit address.

Action plan

What to do now and in what order, based on what the trace shows.

Second-scam warning

How to tell a real route from services that promise recovery for an upfront fee.

How it works

  1. We read the address's outgoing USDT transfers from public blockchain sources.
  2. We screen top destinations: public explorer labels for exchanges, Tether blacklist, OFAC sanctions, scam databases.
  3. For unlabeled destinations we take a second hop to see where the funds went next.
  4. We show an honest result and concrete steps. Every trace enriches our own graph, so the next victim sees more.

What to have ready

Why not to wait

Next step

Frequently asked questions

I was scammed out of USDT. Can the funds be recovered?

Sometimes, yes. Guaranteed, never. The real mechanisms: an exchange-side freeze (if the funds reached one and you or the police acted fast), Tether's blacklist (on law-enforcement request), a civil claim. Anyone promising 'guaranteed recovery' is a scammer.

What does 'funds reached an exchange' mean?

Outgoing transfers from the scammer's address landed on an address labeled as a platform (e.g., an exchange hot wallet). That's good: unlike a private wallet, the exchange knows the account owner and can freeze funds upon request.

Why is the trace free?

A first-pass trace is 2 hops over public data; it costs us almost nothing. Only the deep forensic report and case support are paid, and not everyone needs them.

Will you share my data?

We ask for a contact only to save the result, send it to you and get in touch about this check. We log the checked address, the result and your contact. We don't pass them to advertisers or other companies. A report on an address stays anonymous.

Which networks does the trace support?

TRON, Ethereum, BNB Chain and Solana. A 0x… address is checked on Ethereum and BNB Chain at once. Solana takes a few minutes, and we can't yet identify exchanges among the recipients there.

What does "the trail ends" mean?

Within the analysis, the funds did not reach a known platform. That doesn't mean they vanished: the full report goes deeper.

What Onyx can do for you

Not only unfreezing. Pick the step that fits where you are right now.

Urgent situation?Direct Telegram contact