MetaTronics — Technical Forensic Audit

Prepared byCrYptOG On-chain forensic investigator · Avengers Anti-Fraud Alliance

MetaTronics: every payout checked, and where the money came fromBNB Smart Chain and TRON · the operator’s records tested against the blockchain, wallet by wallet

A complete audit of the MetaTronics payout infrastructure across two chains. Every automated row in the operator’s withdrawal ledger is reconciled against primary chain data; the funding chain is traced back to a payment gateway; the cross-chain crossing is characterised statistically and confirmed at both ends; and nine address attributions carried in the 3 August 2026 interim report are corrected or withdrawn.

NetworksBNB Smart Chain · TRONEvidence pulled22 September 2026SupersedesInterim report, 3 August 2026ReferenceAAA-2026-METATRONICS-001

AScope and questions

What this audit set out to answer.

1. Do the transfers in the operator's withdrawal ledger exist on the blockchain as described?
2. Which wallets fund the payouts, and what funds those?
3. Is there any trading anywhere in the network?
4. Where do member deposits enter?
5. Does the branch leader's claimed investment appear on chain?
6. Are the interim report's address attributions correct?

Questions 1 to 5 are answered. Question 6 produced nine corrections, set out in section K.

BEvidence inventory

Primary sources, with provenance and limits. Full hashes in Appendix 2.

CThe ledger and its three proof levels

What each row can and cannot establish — this governs everything downstream.

The ledger's own Methodology sheet defines three levels of blockchain proof. The distinction is not cosmetic: two of the three are the operator's reconstruction rather than its record.

Two structural checks on the file itself: all 4,517 hashes are well-formed for their stated network, and every hidden hyperlink in the Explorer link column contains its own row's hash and points at the correct explorer. No internal inconsistency was found.

DReconciliation results

Ledger against primary chain data, matched on hash, recipient and amount simultaneously.

BNB Smart Chain

3,536 ledger rows from the automated payout wallet, $418,914.19 requested and $418,770.19 sent. All 3,536 matched. Coverage was assembled from ten export windows; two initial files returned exactly 5,000 rows and were re-pulled after the truncation was detected, closing gaps of 50.8 and 71.7 hours. Merged coverage is continuous from 22 Jul 05:33:37 to 22 Sep 18:24:56.

TRON

711 ledger rows from the automated TRC-20 payout wallet. All 711 matched. Requested $89,854.17 against $87,721.17 on chain — a difference of exactly 3.00 on every row without exception.

Rows the operator could not resolve

Pulling the operator's own upstream wallets resolved 22 of the 436 level-3 rows: five from hub B (4–8 Jul), fourteen from wallet A (9 Jul – 1 Aug), one from the current funder (11 Sep), and two more from the funder's outflows. All are member withdrawals paid from a funding wallet rather than a payout wallet, which is why the operator's own reconciler — searching only the wallets it knew — never found them.

EBNB Smart Chain topology

One payout wallet, a rotating series of funders, and no upstream the operator controls.

The automated payout wallet received real USDT from exactly four addresses across the covered period, totalling 577,720. They hand over in sequence rather than operating in parallel.

Wallet A's own export records 58 transfers and 193,480 to the payout wallet; the four-transfer difference falls on 20–21 July, before the payout wallet's export window opens. Both figures are correct for their windows, and the difference establishes that the payout wallet was active before 22 July.

Retention

Wallet A: 268,159.71 in, 268,159.42 out, 0.29 retained. Current funder: 374,959.20 in, 373,665.47 out, about 1,294 retained. Payout wallet: 577,720 in, 571,061.74 out, about 6,887 retained. No wallet accumulates.

Signed activity

Wallet A signed 551 transactions: 546 plain transfers, 3 approvals, 2 calls to bridge contracts, zero failures. No DEX router, no perpetuals venue, no lending or staking contract appears anywhere in its history.

Upstream of the funders

Every source of funds into the funding wallets resolves to third-party infrastructure: the Bridgers contracts, the HOT Bridge treasury, and Binance hot wallets. No operator-controlled wallet upstream of the payout system exists on this chain. The money arrives already bridged.

FTRON topology

A hub an order of magnitude larger than the ledger implies.

The TRON hub was created on 11 January 2026. In the portion exported — 3,948 of a stated 8,237 transfers — it handled 1,826,293.52 USDT in and 1,781,510.86 out, paying 1,091 distinct counterparties.

Inflows are concentrated in a small set of large senders which also hand over in sequence: 579,163.93 from the payment gateway (Jan – Jul), 370,227.17 from a second address (30 Jul – 19 Aug), 255,750.00 from a third (Jan – Jun), then several more from late August onward.

The TRC-20 payout wallet

184,191.53 in — of which 184,050.00 came from the hub in 68 transfers — and 184,049.57 out to 464 counterparties. It retained 141.96 over eight weeks. Outside the ledger's 711 rows it made 441 further payments worth 96,328.40 to 147 addresses, which is the platform's other branches.

The 3.00 deduction

Every ledger row on this wallet is exactly 3.00 short. The wallet retains effectively nothing, and TRON resource costs are met by delegated energy and bandwidth visible in its transaction list rather than by deducting from the transfer. The charge is therefore levied on the member and is not a network cost passed through. Across the ledger's 711 TRON rows that is $2,133.

GThe cross-chain crossing

How TRON money becomes BSC money, and how that was established.

Method

Bridge settlements carry no shared identifier on either leg, so the link was tested statistically and then confirmed by identity at both ends. For every BSC inflow of 100 USDT or more into the two funding wallets, we searched the TRON hub's outflows for a preceding transfer whose value exceeded it by a plausible service fee, within a bounded window.

The matched pairs are not scattered: each BSC recipient corresponds to a particular TRON destination at a consistent fee.

The confirmed pair

One pair was opened end to end. On 25 August at 16:51:39 UTC the hub sent 10,000 USDT to the crossing wallet (f5e3e264a86fb06732deb3fb2b50e29873e99eb1588fbc9a0996655e94d81b58), a plain transfer(address,uint256) with no memo. At 17:00:09 UTC, eight minutes later, 9,946.87 BSC-USD arrived at the funding wallet from an address BscScan labels HOT Bridge: Treasury (0xaad1ca96f91154f5e2dd39e18541950644d89b6a83f3f9c44d647b9d5bb07aa3), signed by the bridge's own relayer.

The crossing wallet's own export then closes the loop structurally: created 16 August 2026, four inbound counterparties only, 395,026.91 in and 391,791.20 out, of which 276,800 goes directly into the Bridgers contract on TRON. A shared service address would show hundreds of inbound counterparties; four is an operator wallet.

HThe deposit side

Why no deposit address exists, and where the record actually lives.

The hub's largest funder carries TronScan's public tag Heleket Hot Wallet 2. It operates at the scale of shared infrastructure: 1,269,652 transactions, 2,272,569 transfers, 2,070,000 TRX staked, with counterparty panels showing tens of millions moving across more than a hundred accounts on each side.

What Heleket is. By its own description it is a crypto payment gateway: a merchant integrates it into a website, app or Telegram bot, the gateway issues the customer an invoice, watches the chain for the incoming funds, reports the payment status back to the merchant's system, and credits the merchant's balance, which the merchant then withdraws to a wallet of their choosing. Published fees start at 0.4%. Merchant sign-up is by email address, and trade-press coverage describes basic onboarding as requiring no identity verification. These are the operator's own published claims and third-party write-ups, not findings of ours, and they are recorded here because they determine where the deposit record sits rather than because they establish anything against Heleket.

It settled 579,163.93 USDT to the hub across 209 transfers between 12 January and 30 July 2026. That is a processor paying out to a merchant.

IThe branch leader's wallet

Identification, payouts received, and the $200,000 claim.

Identification

The interim report held only a four-character fragment at each end of this address, which matched six addresses in our corpus — five of them poisoning look-alikes. The identification was closed by a video frame the account holder published, showing all 40 hex characters in the platform's own withdrawal form, matching character for character including the EIP-55 capitalisation pattern, with zero differences.

What the ledger records

79 payouts, $92,921, across two of his accounts plus one other account paying to the same address. His $1,800 withdrawal in the video is request #10616, paid 4 July 2026 — the earliest withdrawal on that account and one of the 436 rows the operator could not resolve. It was resolved here: hub B paid it at 15:07:24 UTC, seven seconds before the ledger's timestamp.

The $200,000

Full history pulled: 30 November 2022 to 22 September 2026, 874,300.60 USDT in and 864,234.19 out, running $30,000–90,000 a month long before MetaTronics existed. Between registration on 3 March 2026 and the first payout on 4 July the wallet sent 95,480.84 across 63 transfers to 62 addresses, largest single 9,950, and no destination received 20,000 in aggregate. Only one of its 46 outgoing payments in the July–September window went to a ledger member's wallet.

Not corroborated No investment resembling $200,000 left this wallet in the relevant window. Not excluded A deposit from another wallet, from an exchange account, or on an unexamined chain.

A separate finding on the same account

Ledger row #9256 records a $10,000 payout at 15:25:34 UTC on 4 June 2026. No operator wallet made it. The chain shows 999.99 arriving from Binance: Hot Wallet 11 at 15:20:52 and 8,999.99 from Binance: Hot Wallet 10 at 15:25:39, totalling 9,999.98, five seconds after the ledger's timestamp. Whether the operator paid him by withdrawing from an exchange account, or the row was written against his own withdrawals, is not established.

JData contamination

Why naive exports of these wallets overstate everything.

18,693 of 18,788 inbound rows on the BSC payout wallet — 99.5% — are dust below 0.01 USDT from address-poisoning campaigns, including look-alikes of the branch leader's own wallet. Counterfeit tokens using homoglyph symbols (U5DТ, BEP-20 TOKEN*) appear throughout. Every figure in this audit is filtered to the authentic contract address on each chain:

• BNB Smart Chain: 0x55d398326f99059fF775485246999027B3197955 — displayed by BscScan as Binance-Peg BSC-USD; the contract's own name() and symbol() return Tether USD / USDT, and the explorer flags the mismatch itself.
• TRON: TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t — confirmed from the transaction record rather than from memory.

Forged transfer events

Of 1,115 outbound USDT rows claiming wallet A as sender, 576 were not signed by wallet A. 573 of those carry zero value — spoofed events on the genuine contract. Only three carry value, 220.33 in total, two of them to a common aggregator router. The interim report's finding of forged outbound events is confirmed, and bounded: no meaningful value left that wallet without its signature.

KCorrections to the interim report

Nine attributions withdrawn or revised. A report is only as good as the claims it retracts.

Seven "funders" are Binance hot wallets

The interim report identified eight wallets funding hub B and paying the branch leader around $114,000. Public explorer labels on his wallet pages identify seven of them as Binance infrastructure — Hot Wallet 10, 11, 12, 13, 16, Binance 51 and Binance Hot Wallet. Four of the interim report's per-funder totals match these addresses' inbound totals closely. The money was the leader withdrawing from his own exchange accounts.

Two "funders" are bridges

One address carried as a hub B funder is HOT Bridge: Treasury. Another, carried as the largest unexamined counterparty at 183,409, is a verified Bridgers1.1 contract tagged as a bridge. Both tags are withdrawn.

Wallet A's scale was understated

The interim report described roughly $4,000 through wallet A, from an export ending 10 July. It went on to fund 193,480 of payouts and pay 277 counterparties.

Root cause

Every withdrawn attribution originated in amount-and-time matching without confirming the address itself — the same method the operator's ledger uses for its level-2 rows. The lesson applies to both: a matching amount at a matching time identifies a transfer, not a party.

LConclusions

1. The operator's automated payout records are accurate as records. 4,247 of 4,247 verified against primary chain data, zero mismatches, so allegations that the withdrawal records are fabricated are not supported. This is a finding about bookkeeping, not about solvency: an accurate record of a payout says nothing about where the money for it came from, and conclusions 2 to 5 address that separately.
2. No trading exists anywhere in the examined network. No venue interaction, no position, no retained capital, on either chain. The single "Swap"-labelled transaction is a transfer into a bridge.
3. The operation holds no float. Retention runs from 0.29 to about 6,887 USDT per wallet against roughly $577,000 through the BSC side and $1.8 million through the TRON side.
4. Funds flow TRON → BSC. Deposits are collected by a payment gateway on TRON; payouts are made on BSC from bridged funds. The BSC side is an exit, not an origin.
5. Member deposits are off-chain by design. Collected through a processor, so the deposit ledger exists only in the processor's and operator's systems.
6. The ledger is a fraction of the platform. The BSC payout wallet alone paid 2,525 recipients and the TRON hub 1,091; the ledger covers one branch.
7. Both payout wallets were still operating at publication, 22 September 2026, while members report withdrawals failing since 14 September.
8. The branch leader's claimed $200,000 investment is not corroborated by the wallet he published, and is not excluded by it.
9. A $3.00 charge on every TRON withdrawal is levied on members and is not a network cost.

MRecommendations

For members

• Withdrawals being paid is not evidence that a platform is solvent. On this evidence, payouts are funded by recent inflows rather than by returns.
• Keep your own records: request IDs, amounts, dates, and the transaction hash for anything you received. The addresses in Appendix 1 let you check your own history independently.
• Treat any recovery service that approaches you, particularly one asking for a payment first, as a second fraud.

For investigators continuing this work

• The deposit record sits with the payment processor. A reasoned abuse report to the processor, and to the platform's own database custodian, is the only route to the total taken.
• Pull the remaining TRON material: 4,289 hub transfers not yet exported, and the two large funders capped at 10,000 rows.
• Do not spend further effort looking for a deposit address on chain. It does not exist.
• Re-verify any address inherited from earlier work before citing it. Nine attributions failed that test here.

For regulators and processors

• The operator's database and the processor's merchant records together contain the complete deposit and withdrawal picture, including the identity data neither chain holds.
• The ledger examined here is accurate where it is automated, and should be treated as a lead where it is manual — its manual rows misattribute exchange and bridge addresses as company wallets. The distinction is documented in its own Methodology sheet.

NLimitations

• Ledger scope. One branch, 4,953 rows of an unknown platform total.
• TRON exports are partial. 3,948 of 8,237 hub transfers; 178 of 449 crossing-wallet transfers; two funders capped at 10,000 rows. Every TRON figure is a floor.
• BSC window. The payout wallet export opens at the ledger's first payout, not the wallet's first activity, which is known to be at least two days earlier.
• Bridge crossings are correlational. 53 tight matches with consistent per-route fees and confirmed bridge identities at both ends, against 5 under null controls. One pair alone would not be evidence.
• Entity labels are third-party. Binance, Heleket, Bridgers and HOT Bridge identifications come from explorer and Arkham labels, checked for consistency but not independently confirmed against those companies.
• Admin notifications were transcribed by hand from screenshots and should be replaced by source material for any formal use.
• No deposit totals. Not available from any source we hold.

Ap 1Address register

Tag and full address together, every time. Addresses are never shown truncated.

Operator wallets — verified by chain reads

Third-party infrastructure — not operator wallets

Ap 2File inventory and hashes

SHA-256 of the primary sources, so any figure can be traced to the file it came from.

The BscScan exports were pulled as ten windowed files for the payout wallet, 39 pages for the branch leader's wallet, and single files for each funding wallet; the TronScan exports as one file per account. All were re-hashed at the point of use. Where two exports overlap, they were compared row by row in both directions before merging: three overlapping spans matched exactly, with no rows present in one file and absent from the other.

Ap 3Tests and controls

Every check that could have failed, and what it returned.

Ap 4Further captures

Screen captures referenced in the sections above, retained for the record.