HyperFund / HyperVerse
on TRON: the MOF
withdrawal network

Seven findings, each with the section that carries it

1. One wallet, D, received 88.9% of its MOF from H, a wallet Arkham labels as HOO's hot wallet: 479.1 billion MOF in 166 transfers, December 2021 to July 2022. D then sent MOF in 577,233 transfers to 137,028 addresses. Sections D, E · how concentrated those recipients are is not established
2. Two HyperVerse MOF withdrawal records match, to the two decimals the record shows, D's payments into an address that the OKEx app itself presented as a MOF deposit address. Sections E, H · third-party video published 26 January 2022
3. Eight wallets in the case appear in OKX's published proof-of-reserves files, signed with their own keys on six dates between 20 April and 8 September 2026. That OKX also held them in 2021–23 is inferred, not proven. Section H
4. A USDT deposit to a HyperVerse-issued deposit address was traced on chain: swept, one minute after the address received its gas, to a collector whose every USDT outflow (652 transfers, about 449.7 million USDT) went to TXWmd. A second deposit followed the same sequence. Section F · the collector's outflow rests on an indexer read, not yet a registered pull
5. TXWmd, the source of 84% of UE's USDT, balances exactly over its full history (2.36 billion in and out). From October 2025 a newly created wallet, TFATrK, takes 80% of its inflow from the same payers. Section I
6. Kehua Cipher's analysis of the OKX deposit address TUrCAT re-derives from chain records: all forty of its transaction hashes match. Where this audit reads some figures differently, it says so. Section J
7. 93.9% of the MOF that D's recipients later sent to H equals, deposit by deposit, what D had paid them since their previous deposit. Two readings fit: exchange deposit addresses, or member wallets passing payouts on whole. For one address, which Hoo's own app displayed as a deposit address, the first reading is established. Section D · tool-derived

What rests on what

This report is for anyone who wants to check the work for themselves: every address, transaction and source is here to be checked, not taken on trust.

This is a comprehensive forensic audit of a network, not a one-wallet check. It marks every claim with the kind of evidence it rests on:

• signature A cryptographic signature, verified here: the holder of a key signed a message. Dated by the message, not by the chain history.
• chain Blockchain records: rows from a registered pull of the TRON indexer, or a direct read of a TRON full node. Reproducible from the addresses in section L.
• screen A platform's own screen, captured by someone else: what an exchange app or the HyperVerse site displayed. Corroborated against the chain where possible.
• label A label: a tag applied by an explorer or analytics service (TRONSCAN, Arkham, OKLink). A lead, never a finding.
• tool Tool-derived: computed by a tested script on files too large to re-read in a session. The tool, its test and its input hashes are stated.
• allegation Court filings: allegations unless they record a plea or a judgment.

Screenshots of a member account's HyperVerse and Hoo pages are used in section F. They are described only as a member account.

The evidence base behind every figure in this report

Scope. The TRON blockchain only. Two token contracts carry the findings: MOF and Tether USD (USDT). Every amount is counted per contract address, never by symbol, because any contract can call itself “USDT”. HyperFund's earlier, Ethereum-era activity is Part 2.

The chain pulls

Seventeen pulls are registered. Tallied together, they come to 1.74 GB. Each is held unchanged and identified by its SHA-256 hash. “End confirmed” means that, after the indexer's cursor ended, two re-queries from the last row returned nothing new. “Balances” means the pull's flow for that token equals the token contract's own balanceOf read on a full node.

“Ends probed”: pulls taken before the tool's end-confirmation was added; their stream ends were re-probed afterwards. Full hashes and addresses are in section L. Record counts per pull are in the tally file scale_tally_20261008T100553Z.json (25f37c75de38), which re-hashed all seventeen pulls against the register; every hash matched.

Other sources

Method

• Who created an account. The account's creation time is located on a full node; blocks N and N+1 are searched for the address; the one creating transaction is hashed against its ID and its signer recovered from the signature. A transaction with one byte changed recovers a different address, as it should.
• Proof-of-reserves. For each listed row, the public key is recovered from OKX's signature over “I am an OKX address” under TRON's message prefix, and the address derived from it compared with the row. A changed signature fails; a correct signature against the wrong address fails. 96 of 96 verified, and the Hashbook verified them again independently with a different library.
• Balance tests. A pull's net flow per token is compared with the contract's balanceOf. An exact match cannot rule out a missing inflow and outflow of equal size.
• Lookalikes and dust. Zero-value transfers and lookalike addresses (address poisoning) are excluded; no row is filtered by its US-dollar value.

The contract, its decimals, when it arrived, and an anomaly in its amounts

The contract

• chain MOF is the TRC-20 contract HYPERFUND:TOKEN:TTn3Sw-YGC8aW:CG. A full-node read of its decimals() returns 16. Every MOF row in every registered pull is on this one contract.
• Amounts are grouped by contract address, never by symbol: any contract can call itself “MOF”. Kehua Cipher's analysis (section J) named MOF by symbol only. The pull of the address it studied fixes the contract.

When it arrived

• screen A HyperPay notice dated 15 November 2021 announced MOF's move from ERC-20 (Ethereum) to TRC-20 (TRON) at a ratio of 1:1000, for 30 November 2021. This is the platform's own statement. The notice's date and ratio are NOT re-derived here.
• chain The TRON MOF series of H, TXWmd and UE all start in December 2021: H's first inbound MOF on 3 December, TXWmd's on 7 December, UE's on 14 December. MOF before that date was on Ethereum, which is Part 2.

The 2⁶³−1 anomaly

Some MOF raw amounts are a whole amount to eight decimals plus exactly 9,223,372,036,854,775,807 raw units (2⁶³−1, about 922.34 MOF at 16 decimals). The example read on chain is a transfer from H to H: raw amount 44226066266331304154775807, which the pull decodes correctly as 4,422,606,626.6331304154775807 MOF. H signed it.

Effect on section D's payment matching: the 32 non-self rows can almost never equal a payment, so they fall outside the exact classes. That is at most 0.18% of the deposit value matched there.

Price

MOF is not valued in US dollars anywhere in this report. Arkham prices it at or near zero. allegation The SEC complaint (¶39) gives its last quoted price as $0.00001949, on 4 September 2023.

H, the distributor D, and the payout-to-deposit match

H

• label Arkham: “Hoo.com: Hot Wallet”. CrYptOG's own TRONSCAN name: “[HOO] MOF distribution wallet 2”, a prior conclusion.
• chain H's MOF-only pull (6a7b8ead1778) covers 3 December 2021 to 29 October 2022. 89.07% of H's gross inbound MOF is H paying itself: 1,089 H-to-H transfers, 4,681,438,558,325.05 MOF, 1 February – 19 March 2022. Every figure below excludes them.
• chain Excluding them, MOF in is 574,204,884,366.10 in 103,339 rows from 52,006 senders, and MOF out is 573,452,989,636.05 in 13,247 rows to 4,915 recipients. H's balanceOf, 751,894,730.05 MOF, equals that net flow.
• Sender shape. 72% of H's senders sent once. The top 10 carried 28.1% of value, the top 100 58.0%, the top 1,000 73.8%. The median sender's total is 1.04 million MOF.
• The end. H's last MOF inflow was 30 transfers of 100,000,000 MOF (the last 99,999,250) from TM1zzN, 00:44 to 01:16 UTC on 27 October 2022. Its last payments out were on 29 October 2022.

H to D

• chain H sent D 479,078,796,787.79 MOF in 166 transfers, 27 December 2021 to 3 July 2022. H's pull and D's pull agree on every row. That is 83.54% of H's outbound MOF.
• chain It is 88.9% of D's MOF intake of 538.76 billion. D's side is NOT re-derived in any session: it rests on the terminal output of D's pull.
• chain H also sent D 3,050,000 TRX in 16 transfers: the fuel D needed to pay its transfers out.

The overlap

tool Of H's 52,006 MOF senders, 50,884 (97.84%) had first been paid MOF by D. They sent H 298.93 billion MOF, 52.06% of its inbound net of self. Computed by overlap.js (835c371582bb), output 617903a17ed6.

The payout-to-deposit match

tool For each overlap address, paymatch.js (1b0cd40f16bc) compared every deposit into H with what D had paid that address since its previous deposit. Its planted test (297c44af40af) passed 21 of 21; a control with one payment moved by 10⁻⁸ MOF failed, as it should. Inputs: D's pull ff0a4fb74c07 and H's pull 6a7b8ead1778. Output 442983e1816d. Exact integer arithmetic; no value filter; MOF contract only. These figures are tool-derived and are not re-derived in a session.

• Addresses. For 49,629 of the 50,884 (97.53%), every deposit into H is exact. For 48,315 (94.95%), the total deposited equals the total D paid, to the unit. For 366 (0.72%), no deposit is exact.
• Timing. From each payment to the next deposit, the median is 26 days (p10 19 hours, p90 141 days). Where the deposit equals the payment exactly, p10 is 11 minutes and p25 is 19 hours. Where a deposit sums several payments, its oldest payment is a median of 37 days old. Lags were shortest in February–April 2022, the months H's flows peaked.
• Outliers. Three of the 20 largest depositors sent H far more than D paid them, among them TM1zzN (905,377.28 MOF from D; 2,999,999,250 to H). They were fed MOF by someone other than D.

Two readings fit this pattern: exchange deposit addresses swept into the exchange's hot wallet in batches, or member-controlled wallets holding untouched payouts and later sending the whole balance to H. The match alone does not separate them. It shows order and amount on the same address; it does not show that the same coins moved.

Labels on the overlap addresses

label On 6 October 2026, not logged in, Arkham labelled 19 of the 20 largest overlap addresses and 30 of 30 of H's senders drawn at random (seed 20261006) as “Hoo.com Deposit”. The 20th of the top 20 is TM1zzN, labelled “OKX: Hot Wallet”. D, used as a control, carries no label. Arkham does not say how it derives these labels. If it infers them from sweeping behaviour, the label repeats the match above rather than confirming it.

One address, named by Hoo's own app

screen An intelligence screenshot held in the AAA archive (original source not recorded) shows Hoo's own deposit page displaying TMERnP as an account's TRC-20 deposit address. A second screenshot from the same archive shows a HyperVerse account's “Add Address (MOF-TRC20)” list including it. They show what the screens displayed, not whose accounts they were.

chain TMERnP's registered pull (0b717f4a9cde, all four streams end-confirmed) has 14 MOF transfers in, every one from D, and 4 out, every one to H. Each sweep equals, to the last unit, D's payments since the previous sweep.

• In equals out: 8,192,977.2496447 MOF. Five of its six USDT deposits were also swept to H, among them 577.868 USDT from TM1zzN.
• The TRX for its sweeps came from TTEiss: 8 transfers, each just before a sweep, 6 of them by 3 to 6 seconds. That is a pattern like the one OKX's gas wallet shows for OKX deposit addresses (section J).
• What it establishes: for this one address, the deposit-address reading holds, and H is the sweep target of an address Hoo's own app issued. It does not establish that reading for the other 50,883 overlap addresses.

D: how it was activated, where its MOF came from, and two withdrawals matched

Activation: H → TJtj → F → D

chain A TRON account comes into existence when it first receives TRX. For each account below, the block whose timestamp equals the account's create_time (block N) contains no transaction naming it, and block N+1 contains exactly one: a signed TRX transfer that succeeded. The node stamps a new account with the previous block's time, which is why the creating transaction sits one block later.

Activation shows whose key sent the first TRX. It shows nothing about who holds the new account's key. H carries a HOO label, and a 9,999 TRX transfer from an exchange hot wallet looks exactly like a customer's withdrawal, so H → TJtj does not show HOO controlling TJtj.

D's shape

• chain MOF in: 463 rows, 538.76 billion, about 89% of it from H. MOF out: 577,233 transfers to 137,028 addresses. These counts are NOT re-derived: they rest on the terminal output of D's pull.
• chain On the same terminal output, the signed count reconciles: 577,236 outbound TRC-20 rows plus 27 failed calls equal D's 577,263 signed contract calls. D's MOF balanceOf, read on a full node, 20,481.52342608, equals the pull's net flow.
• chain UE sent D 18,176,289,266.90 MOF in 18 transfers, 19 April – 8 May 2022. The first was read on a full node: signed by UE.
• How concentrated D's 137,028 recipients are is not established.

Two withdrawals, matched

screen A third party's publicly posted YouTube video (ID cHDHck7l5Ms, published 26 January 2022) shows one HyperVerse member's screens. Three groups of frames are used, each hashed and filed:

• Frame 25 (04cf4ea0206a): the OKEx app, Deposit → MOF → network MOF-TRC20, displaying TRourR as the deposit address.
• Frames 27–28 (2a5e8e1bde39, 1153faa87233): the HyperVerse withdraw page, asking 749,238.822 MOF, showing a fee of 4,774.637 and a “received quantity” of 744,464.185. Its withdrawal-address field shows the last 28 of TRourR's 34 characters; the first six are cut off by the field.
• Frame 32 (df03ab145555): the HyperVerse withdrawal record.

Contrast and sharpness enhanced for legibility. Content unchanged; original frames hashed and filed.

• The fee. The amount paid, 744,440.47263, is 23.71 MOF below the screen's estimate of 744,464.185. The fee actually deducted was 749,238.822 − 744,440.47263 = 4,798.349 MOF, not the 4,774.637 shown. The screen says its fee is “calculated in real time” and “floating”. The gross amount appears nowhere on chain, as expected.
• Timing. The record does not show its time zone. Read as UTC+8, each payment landed about 24 hours after the record time. The zone is not established, so neither is the lag.
• chain TRourR's whole history (pull f6a4990288bd, all four streams end-confirmed): 8 MOF transfers in, all from D, 4,629,141.81251413 MOF, 31 December 2021 – 8 April 2022; 7 out, all to TM1zzN, each 4 to 57 minutes after the payment it clears. Thirty-seven minutes after the 744,440.47 MOF arrived, TRourR passed it to TM1zzN. Its TRX came from TBREsC, four top-ups.

One deposit traced, a second confirmed, and the USDT network behind them

One deposit, traced

screen Screenshots of a member account show its HyperVerse “Deposit Address” page (usdt_trc20) displaying DEP, and a Hoo withdrawal of 251 USDT to that address: 250 arriving, 1 USDT fee.

• Basis. DEP and COLL rest on TronGrid reads made on 6 October 2026 and paged to exhaustion, plus full-node reads of the three transactions. They are not a registered pull. COLL's 652 outbound rows are therefore an indexer count. In the one minute 01:58–01:59 UTC on 17 December 2021, COLL received 38 USDT deposits: it collects from many addresses. Its full inbound set was not pulled.
• The gas wallet. TLvugr was created on 18 January 2021 by TTHvZy (1,000 TRX; node read, signer recovered). TTHvZy had sent TXWmd its first USDT in October 2020 (NOT re-derived). UE funded TLvugr with 3,595,178 TRX in 57 transfers, March 2021 – April 2022. TK88Wt (section G) paid it 40 TRX on 3 March 2021, after it existed.
• An indexer gap, proven here. TronGrid's sender-side index returned no outbound row for DEP, while the full node shows DEP signed the 250 USDT transfer and the receiver-side index shows it arriving. Pulls built from the sender side can under-count outflows.

A second deposit, the same sequence

chain TBEHsub's registered pull (52cf79c08119, all four streams end-confirmed) has seven rows in all. TRONSCAN states the same two TRC-20 transfers.

The 1,200 USDT came from TM1zzN, an address OKX signed for in 2026 (section H): consistent with a withdrawal from OKX to this address. That TBEHsub was a HyperFund deposit address rests on a HyperFund deposit-page screenshot (h5.thehyperfund.com) held in the case file; the chain shows the pattern, not the platform.

A third: a different collector

chain TWNH39 (pull fdca9cc365e4) swept every USDT it received, whole, to TNMqcn: 1,400.59 USDT in three sweeps, each signed by its own key and each within two minutes of a gas payment. Two of its three deposits came from H. TNMqcn sent TXWmd 384.49 million USDT up to 22 October 2022, and sent TGE9iU 42.45 billion MOF (section G). label TWNH39 is described as a “hyperpay deposit address” in a 2024 note of third-party testimony, recorded with a question mark. Which product “hyperpay” meant is not established.

UE

chain Full pull 9fa1ed1f2a0c, created 27 February 2021, last row 2 January 2023. Its signed count reconciles: 211,115 outbound TRC-20 hashes within 211,133 signed contract calls.

• USDT: 1,758,832,636.99 in, from 80 senders; 1,758,832,636.70 out. 84.15% of the inflow came from TXWmd.
• Out, by value: 58.18% to TJtj (1,023,249,958.00 in 264 transfers). 72% of all outbound value left in 340 transfers of a million or more.
• Out, by count: 209,660 payments to 46,268 addresses. Median 158 USDT; p10 20, p90 2,074. 81% of payments were under 1,000 USDT.
• Over time: monthly payments rose from about 1,000 in early 2021 to 33,192 in April 2022, then fell. None after October 2022.
• MOF: 41,205,204,996.31 in, 96.96% of it from TGE9iU; 44.11% out to D, 41.53% to THpScN.

TJtj

chain Full pull 1622c3db13eb. TJtj has no MOF: zero rows on the MOF contract over its whole history. It is a USDT pass-through: 1,095,699,976.27 in from 49 senders and 1,095,699,976.22 out to 97 recipients, May 2021 – April 2023, peaking at 135–162 million a month from September to December 2021.

• In: 93.39% from UE; 4.93% from TXWmd.
• Out: 62.23% to F; 20.12% to TSyi14 (label Arkham “Hoo.com Deposit Address”); 9.54% to TCDqFA (Arkham “Binance Deposit Address”).
• Its signed count does not reconcile: 643 outbound USDT transactions against 439 signed contract calls. The excess of at least 204 is not explained, so a TJtj outflow is called TJtj's own act only where the transaction was read.

TXWmd and TGE9iU were created by the same key

chain Both are single-signature TRX transfers that succeeded, each the only transaction naming the new account in block N+1. Each transaction's hash was checked against its content, and the signer recovered from the signature: both recover to TK88Wt's own key. A copy with one byte changed recovers a different address, as it should.

TK88Wt is small

• chain Full pull 21064561dcc3, created 24 June 2020: 95 signed transactions in its life. TRX out: 67 transfers to 46 addresses, July 2020 – March 2024. 30 of the 46 only ever received 20 TRX or less from it.
• It topped up TGE9iU with 27 and 18 TRX in January and February 2022, the months TGE9iU's MOF relay to UE began.
• It paid TLvugr, the gas wallet of the traced deposit (section F), 40 TRX in March 2021. A node read shows that was not TLvugr's creation.
• Total USDT through it: 2,408.28.

TGE9iU relays MOF into UE

• chain Full pull df11edf5bbfc. MOF in: 42,514,401,471.17, 2 January – 14 September 2022, 99.84% of it from TNMqcn and 0.16% from COLL.
• MOF out: 41,901,050,353.66, to April 2023. UE took 95.35% (39.95 billion, 69 transfers).
• The difference, 613,351,117.51 MOF, equals TGE9iU's balanceOf as read on 6 October 2026 (NOT re-derived here).

OKX, HOO and HyperPay: what was shown at the time, and what came later

The scope names three exchanges. For each, the table separates evidence from the scheme's own period (2021–23) from evidence that came later, and marks every item with what kind of evidence it is. It ranks nothing: the reader can weigh a contemporaneous record against a later signature.

Each wallet links to TRONSCAN at its first mention in this report; every full address, linked, is in section L.

Label sources · Arkham: H · TM1zzN · TJbHp4 · TBREsC · TUrCAT · TFATrK  |  OKLink: TUrCAT · TFATrK

TXWmd's full history, and the hand-over of its payers

TXWmd, whole history

chain Pull ae3641c8ffae, all four streams end-confirmed, covering TXWmd's indexed history from 22 October 2020 to the pull on 6 October 2026. Every contract call TXWmd signed has its outbound TRC-20 row.

• USDT balances exactly: 2,357,178,405.891139 in, from 286,857 rows and 44,856 senders, and the same amount out. The running balance never goes below zero and ends at zero.
• Out: 2,617 transfers with value, to 66 recipients. UE took 62.79%. Another 1,692 zero-value rows name 138 other addresses: that is address poisoning, not activity by TXWmd.
• MOF: 1,923,914,678.10886848 in and 1,390,147,930.09186 out, December 2021 – December 2022. TXWmd's MOF balanceOf, read on a full node, is 533,766,748.01700848: exactly the difference. TXWmd still holds that MOF.

Two regimes of inflow

• None of the nine collectors that fed TXWmd before the change, COLL and TNMqcn among them, sends after 22 October 2022.
• After the change the median inflow is 322.50 USDT, but value sits in large rows: 63.78% of it in 6,645 rows over 10,000 USDT.
• Volume falls over time and concentration rises again as it does: 276.5 million in 2023 (top 10 senders 28.7%); 120.0 million in 2024 (41.4%); 77.5 million in 2025 (73.9%); 31.8 million in 2026 to 21 September (87.0%).
• The largest post-change sender, TKGTx3, sent 73,184,072.96 USDT in 1,014 rows (13.08%). It takes no register tag: another address shares its first and last six characters.

Where TXWmd paid after the change

chain 560,094,931.07 USDT left in 1,147 transfers to 24 recipients. The largest took over from one another, with little overlap in time:

This is an observation about timing. It says nothing about who controls these addresses.

TFATrK takes over TXWmd's payers

• chain TFATrK was created on 29 October 2025 by TSApnS (97.562002 TRX; node read, signer recovered). TSApnS had paid TXWmd since November 2022 and is TFATrK's largest USDT sender (21.89%).
• chain Pull 86f7ad93a6df, end-confirmed, to 6 October 2026: TFATrK is still live. USDT in, 171,946,223.90 from 4,928 senders. 2,137 of those senders had also paid TXWmd after the change, and they carry 80.40% of TFATrK's inflow. TXWmd itself supplied a further 15.11%. Together, 95.51%.
• TKGTx3 and TSApnS began paying TFATrK within two days of its creation and kept paying TXWmd until August 2026: the two ran in parallel for about ten months.
• USDT out, 171,774,044.11 in 47,609 transfers to 22,277 recipients; median 495.50, p90 4,000. Many small payments to many recipients: the shape UE had in 2022.
• chain TGkgcj was created on 6 August 2025 by TDaSqW (100 TRX; node read). It took 55.1 million USDT, 54.26% from TXWmd and 42.65% from TDaSqW, and passed 26.14% of it to TFATrK and 65.97% to one other, unpulled address. TDaSqW also exchanged USDT with TXWmd in both directions (28.6 million from TXWmd, October 2023 – July 2025; 4.0 million to it).
• label OKLink calls TFATrK “Exchange: HyperPay”; Arkham calls it “CoinW?”, with its own question mark. The labels conflict, and the chain supports neither.

Where it holds, where it is read differently, and the questions it put

Kehua Cipher's analysis is cited with his agreement. It is a third party's work from TRONSCAN exports, so this audit checks each of its figures against TUrCAT's own registered pull (733614f81366, ends probed, balances checked; TRONSCAN states the same 977 transfers).

TUrCAT as an OKX customer deposit address

• chain Created by TBREsC on 28 December 2021, by an account-creation transaction read on a full node, signer recovered.
• chain Fuelled by TBREsC: 135 TRX top-ups. Each of TUrCAT's 191 outbound transfers with value had an earlier TBREsC top-up (NOT re-derived since 5 October); the median lead was 19.7 minutes.
• chain Swept to OKX: 100% of its MOF and 85.6% of its USDT went to TM1zzN. The rest of its USDT went to four further hot wallets and to TJbHp4.
• signature TBREsC, TM1zzN, TJbHp4 and the four further hot wallets all appear in OKX's published proof-of-reserves files, signed with their own keys, on six dates between 20 April and 8 September 2026 (section H). So every outflow with value from TUrCAT went to an address whose key OKX demonstrated in 2026.
• screen TRourR, which the OKEx app itself displayed as a MOF deposit address (section E), shows exactly the same pattern: paid by D, fuelled by TBREsC, swept to TM1zzN.

On that basis CrYptOG assesses TUrCAT as an OKX customer deposit address. Kehua Cipher's reading of a “rapid pass-through to OKX” describes the same rows; on this reading they are OKX sweeping its own deposit address rather than a person forwarding funds. D's 246 MOF payments would then have been credited to one OKX customer's account.

The questions Kehua Cipher's analysis put

Kehua Cipher's analysis closes with ten questions for a forensic analyst. This is where each one stands.

1. 1

   Reproduce TUrCAT's ledger from node or API data, and check that the explorer exports are complete.

   Done. TUrCAT's registered pull matches TRONSCAN's own total of 977 transfers, all forty of his transaction hashes match, and the full-node balances equal the pull's flow. The exports were not complete: their end date is the edge of the export, and activity runs to June 2026. TRONSCAN's count of 667 TRC-20 transfers against the pull's 664 is still unexplained.

   AnsweredSection J
2. 2

   Validate the TRONSCAN label on TM1zzN as OKX, using independent sources.

   Done, and beyond labels. TM1zzN appears in all six of OKX's published proof-of-reserves files, signed with its own key; all 96 signatures for the case's eight OKX wallets were verified here. That proves OKX held the key in 2026. That it held it in 2021–22 is inferred.

   AnsweredSection H · J
3. 3

   Was TUrCAT a unique deposit address, a self-custody wallet, or an address run by a service?

   Assessed as an OKX customer deposit address. A wallet OKX signed for created it and fuelled every sweep, and everything it sent with value went to wallets OKX signed for; TRourR, which the OKEx app itself showed as a deposit address, behaves the same way. Only OKX can confirm it.

   AnsweredSection J · E
4. 4

   Cluster the addresses related to TUrCAT by timing, funding, activation and shared counterparties.

   Considered, and deliberately not done through TBREsC: it is shared OKX infrastructure, so clustering through it would create exactly the false link the question warns against. The network upstream of TUrCAT is mapped instead.

   PartlySection D · E · F
5. 5

   Find timing and amount fingerprints that could help OKX match the account.

   Largely overtaken. If TUrCAT is an OKX deposit address, OKX can name the account from the address alone. The 23 transfers from OKX's hot wallet into TUrCAT have not been analysed here.

   Partlynot in this report
6. 6

   Value MOF at the time of each transaction, using reliable market data.

   Not attempted, by design: this audit never puts a dollar value on MOF. A defensible valuation needs contemporaneous price and liquidity evidence.

   OpenSection C
7. 7

   Test whether TBREsC's TRX top-ups come before TUrCAT's transfers, and identify the service behind TBREsC.

   Done. Every one of TUrCAT's 191 outbound transfers with value had an earlier TBREsC top-up, with a median lead of 19.7 minutes. TBREsC is in OKX's proof-of-reserves files: the service is OKX.

   AnsweredSection J · H
8. 8

   Trace the 200,000 USDT round trip between TVhawS and D.

   In part. The round trip itself is not re-derived. TVhawS is the wallet this audit calls F, and a full-node read shows F created D, so it does connect to the case's infrastructure. Whether it had an innocent purpose is not established.

   PartlySection E
9. 9

   Compare incoming USDT deposits with depositors' own exchange records.

   Outside this audit. It needs the depositors' exchange records, which this audit does not hold.

   Opennot in this report
10. 10

    Preserve the blockchain data with cryptographic hashes and reproducible scripts.

    Done. Every pull and node read is SHA-256 hashed and registered; every tool is hashed, with its test stated.

    AnsweredSection § · L

The analysis also lists records to request from OKX and from a depositor's exchange. Those belong to a case file and are not repeated here.

What the SEC complaint alleges, and the criminal cases by docket

The SEC complaint

allegation D. Md., Civil Action 1:24-cv-00296-RDB, Document 1, filed 29 January 2024. 31 pages. The PDF was saved from sec.gov and hashed (c1b7987a5f4a). Each paragraph below was found as an exact string in the PDF's text; a control with one word removed was not found, as it should not be.

• The complaint does not name Founder B.
• It mentions TRON once (¶76, page 20), in a quoted promotional claim about a mining operation. It does not mention TRC-20, OKX, OKEx or HyperPay.
• ¶104 alleges that about $140,000 was sent to a digital wallet in a defendant's custody or control between 23 February and 8 May 2023. It gives no address, and nothing in this audit is linked to it.

Criminal cases (US Department of Justice, District of Maryland)

allegation Press release 24-106, 29 January 2024, describes a “$1.89 billion” cryptocurrency fraud scheme run from June 2020 to November 2022 under the names HyperTech, HyperCapital, HyperVerse and HyperNation. Dockets 24-CR-21, 24-CR-1 and 23-MJ-03185-CDA, before Judge Richard D. Bennett. As the DOJ case page showed on 5 October 2026: one defendant pleaded guilty, with sentencing continued to 7 January 2027; one was sentenced on 23 July 2026 to 32 months; one case is pending. The indictment and plea agreements have not been read for this audit and are cited by docket only.

Published investigations

secondary Danny de Hek's history of HyperVerse (dehek.com, 30 July 2023) and his video investigations are an investigator's publications. They guided where this audit looked; no finding here rests on them.

Regulator warning

New Zealand's Financial Markets Authority posted a HyperFund warning on 30 September 2021 and updated it on 20 December 2021, adding thehyperverse.net and stating that it was “concerned HyperFund may be operating a scam”.

Every address named in this report, in full, each linked to TRONSCAN

Each address is given in full so it can be checked on TRONSCAN, not read. The label beside it is this audit's register tag; a role word in a tag is used only where a source establishes it.

Where a quoted “CrYptOG name” follows the tag, it is the private name tag CrYptOG gave that address on TRONSCAN while reading the network by hand. Each one records why the address caught his eye. They are leads, not findings: a role, an owner or an amount implied by a name is not established by it. What this report establishes about each address is set out in the sections above.

Said plainly, so nothing above is read as more than it is

• Who controlled any address in this audit.
• Who held the eight OKX-signed keys before April 2026.
• Whose exchange accounts TUrCAT, TRourR or TBEHsub served, and whether TRourR's other MOF inflows came from the same HyperVerse account.
• The time zone of the HyperVerse withdrawal record, and so the roughly 24-hour lag between record and payment.
• That UE's payments were member withdrawals. D is established as a withdrawal payer for two matched records only; the rest of D is shape.
• Which reading of the payout-to-deposit match holds for all 50,884 addresses. For one, TMERnP, the HOO deposit-wallet reading is established.
• Who the post-2022 senders to TXWmd and TFATrK are.
• TFATrK as HyperPay, and what “hyperpay” meant to the people who used the word.
• Why H sent MOF to itself, and why some MOF amounts carry the 2⁶³−1 term.
• TJbHp4's activity after each stream's last fetched row, and any total or ratio for it.
• TJtj's unexplained outbound transactions.
• Any wallet behind the SEC complaint's ¶104.
• Anything on Ethereum, including the DAOversal attribution of two later wallets (Part 2).