The USDT has been transferred to the counterparty’s designated wallet, and on-chain records confirm the successful transaction. Nevertheless, the counterparty claimed that the funds had not been received and subsequently drove away with the cash originally intended for settlement.
In such circumstances, the first issue for the party disposing of the crypto assets to assess is not whether the virtual asset transaction itself carries policy risks, but ratherwhether the counterparty lacked any genuine intent to perform from the outset and merely used the pretext of “offline cash settlement” to defraud the disposer of USDT.This determination directly affects three key issues: whether the counterparty’s conduct constitutes suspected fraud; how the affected party should report the matter to the authorities and preserve evidence; and whether the transferred USDT can still be traced, frozen, and recovered.
On July 23, 2026, the Laiyang Public Security Bureau announced a similar case.The affected party intended to sell USDT worth RMB 47,000. The counterparty, citing the risk that online transfers might trigger bank risk-control measures, requested cash settlement in a suburban parking lot. After the affected party transferred the USDT to the designated wallet, the counterparty falsely claimed that the funds had not arrived and, while the affected party was verifying the on-chain records, fled by vehicle.Further police investigation revealed that the individuals involved were also suspected of using over-the-counter transactions to convert and transfer illicit proceeds for telecommunications and online fraud syndicates.
Accordingly, the focal point in assessing such cases is not a general discussion of whether “USDT transactions are protected by law,” but rather an examination of whether the counterparty had a genuine intent to perform when obtaining the USDT, and whether they fabricated facts or concealed the truth, thereby causing the affected party to act under a mistaken belief and dispose of property. Even if the transaction itself entails policy or compliance risks, this does not automatically mean that the fraudulent conduct does not constitute a criminal offense, nor does it preclude the affected party from reporting the matter to the authorities.
If the counterparty fails to pay after receiving the crypto assets, how can fraud be distinguished from a transactional dispute?
The core distinction between the crime of fraud and ordinary transactional disputes lies not in whether the counterparty ultimately made timely payment, but in whether the counterparty already harbored the intent of illegal possession at the time of obtaining the USDT.
If, from the outset of the transaction, the counterparty used false identities, induced the transaction by offering prices significantly above market levels, insisted that the seller transfer the crypto assets first, and pre-arranged vehicles, accomplices, and wallet operators, and then immediately fled, blocked communications, or rapidly moved the assets upon receipt of the USDT, these facts more strongly indicate a lack of genuine intent to perform.
Conversely, if both parties’ identities are clear, the counterparty has the capacity to pay, and the dispute arises during performance—such as regarding on-chain confirmation, address entry, settlement amounts, exchange rates, or fees—and the counterparty remains in contact, acknowledges the payment obligation, and continues to propose solutions, the matter may more closely resemble a breach of contract or other civil dispute.
Transaction Identity
More indicative of fraud:Use of false identities, temporary accounts, or unverifiable contact information
More indicative of a transactional dispute:The identities of both parties are relatively clear, and there is a history of normal transactions or verifiable interactions
Transaction Arrangements
More indicative of fraud:Luring with high prices, demanding delivery in remote locations, or insisting that the seller transfer crypto assets first
More indicative of a transactional dispute:The transaction terms are generally normal, and the dispute arises during the performance process
Performance Preparation
More indicative of fraud:No genuine readiness to pay in cash, or displaying false cash or false balances
More akin to a transactional dispute:Possesses payment capacity, but disputes arise regarding receipt of funds, amounts, or delivery conditions
Conduct after obtaining USDT
More akin to fraud:Immediate flight, blocking contacts, changing phone numbers, deleting accounts, or refusing restitution
More akin to a transactional dispute:Continuing communication, acknowledging the debt, and negotiating payment or restitution
Personnel and fund arrangements
More akin to fraud:Division of labor involving traffic diversion, on-site coordination, wallet operations, and vehicle escape, with USDT rapidly transferred
More akin to a transactional dispute:Typically, these are merely performance disputes between the transacting parties, where the assets have not been obviously concealed or dispersed.
One cannot draw a conclusion based solely on one indicator. Ultimately, it is still necessary to consider the preparations made prior to the transaction, the manner in which the USDT was obtained, the destination of the assets, and post-transaction conduct, to determine whether the counterparty lacked genuine intent to perform from the outset.
Upon discovering that the counterparty has absconded, what evidence should be preserved first?
When filing a police report, a single screenshot of a transfer is usually insufficient. While it may show that a transaction was initiated from a certain address, it may not prove wallet ownership, the reason for the transaction, the agreement between the parties, or the counterparty’s conduct after obtaining the USDT.
What is truly valuable is a complete chain of evidence that mutually corroborates the facts:
Transaction Agreement
Key Materials to Preserve:Source of group chats, private chat records, price quotes, quantities, delivery sequence, and the counterparty’s account details and mobile phone number
Primary Matters to Prove:To prove that a genuine transaction agreement existed between the parties, and to establish who proposed conditions such as transferring cryptocurrencies first or conducting offline delivery
On-Chain Delivery
Key Materials to Preserve:Exchange orders, deposit and withdrawal records, wallet addresses, transaction hashes, block confirmation times, token types, and network types
Primary matters to be proved:To prove that USDT has been transferred to the counterparty’s designated address and confirmed on-chain
On-site circumstances
Key materials to preserve:Time and location of the transaction, vehicle information, accompanying persons, audio and video recordings, parking records, and leads from nearby surveillance footage
Primary matters to be proved:To assist in identifying the actual individuals involved and reconstructing the on-site delivery and escape process
Post-incident conduct
Key materials to preserve:Payment demand records, call recordings, screenshots showing blocking, and the counterparty’s explanations regarding “non-receipt”
Primary matters to be proved:Demonstrate the counterparty's abnormal conduct after acquiring USDT and the possible intent of illegal possession.
In addition to the aforementioned materials, you should promptly preserve the original mobile device and account, export backend records from the exchange, and inquire with nearby parking lots, merchants, or property management offices about their video surveillance retention periods. Do not continue transferring crypto assets to the counterparty, pay any so-called "security deposits," or delete chat histories at the counterparty's request.
Proving that "I transferred the crypto assets" is only the first step; more importantly, you must prove "why I transferred the crypto assets, what commitments the counterparty made, and what the counterparty did after acquiring the USDT."
Will the public security organs accept the case? How should the report be presented when filing?
Pursuant to the Provisions on the Procedures for Handling Criminal Cases by Public Security Organs, public security organs shall accept reports filed by citizens in accordance with the law, ascertain the circumstances, prepare written records, and register the submitted evidentiary materials. Upon accepting a case, they shall also prepare a Case Acceptance Registration Form and issue a Case Acceptance Receipt.
However, a distinction must be drawn:Acceptance of a report does not mean that the public security organ has decided to initiate a criminal investigation for fraud.
The handling authority must still examine whether criminal facts exist, whether the counterparty had the intent of illegal possession, whether the available evidence can identify the perpetrator and trace the flow of funds, and whether the case falls within its jurisdiction.
When filing the report, it is advisable to present a complete chronological narrative: how you met the counterparty; who proposed exchanging cash for USDT; the quantity, price, and sequence of delivery agreed upon by both parties; why an offline location was chosen; when the USDT was transferred to which address; when the transfer was confirmed on-chain; how the counterparty denied, delayed, or fled; and what communication, vehicle, on-site, and wallet clues are currently available.
Do not make statements that are clearly inconsistent with chat records, exchange backend data, or on-chain data, such as claiming that you "have never traded USDT" or "did not know what asset was being transferred," merely to exaggerate the circumstances of being defrauded.The more complex the case, the more accurate the statement of facts should be, rather than temporarily fabricating a version that appears safer.
If only a wallet address is available, is it possible to identify the person and recover the USDT?
Wallet addresses typically do not directly display real names, but this does not mean they are entirely untraceable. Law enforcement authorities can combine on-chain addresses with know-your-customer (KYC) information from centralized exchanges,()deposit and withdrawal records, login devices, IP addresses, communication accounts, vehicle information, and on-site surveillance footage, among other clues, to gradually identify the actual controller of the wallet.
However,“on-chain traceability” and “asset recovery” are two distinct matters.Asset recovery generally requires at least the following three stages:
On-Chain Tracing
Core Issues:Which addresses received the USDT transfers, whether the funds entered centralized exchanges, and whether cross-chain transfers, conversions, or fragmented transfers occurred
Practical Implications:Determines whether a clear fund flow path can be promptly established
Identification of Individuals and Asset Control
Core Issues:Whether the controlling person can be identified through KYC, device, IP, communications, and on-site information, and whether freezing, seizure, and other measures can be taken in accordance with law
Practical implications:Merely seeing an address does not equate to having control over the assets
Recovery and return of illicit proceeds
Core issues:Whether the corresponding assets have been seized or frozen, and whether ownership, the scope of involvement in the case, and the victims' losses can be confirmed
Practical implications:After assets are placed under control, they may only be returned in accordance with law following criminal proceedings
Therefore, after an incident occurs, one should promptly preserve the address, transaction hash,()and timestamps, and report the case to the authorities without delay. Delaying for several days while waiting for so-called "wallet recovery" or "system unfreezing" often only provides time for further dispersal and transfer of the assets.
After reporting the case, why might the authorities also investigate the reporter's other transactions?
When investigating the facts of fraud, the police may simultaneously inquire about the reporter's source of USDT, transaction frequency, source of cash, method of profit, and whether they have ever exchanged or transferred assets on behalf of a third party. These inquiries are part of reconstructing the complete transaction chain,It does not mean that the reporting party automatically becomes a criminal suspect merely by being questioned.
However, if the reporting party has long engaged in over-the-counter USDT exchange services, frequently accepts funds from unknown third parties, trades at obviously abnormal prices, continues to conduct exchanges despite knowing that the funds may be involved in telecom fraud or gambling, or simultaneously undertakes customer solicitation, cash collection, and crypto asset transfer while taking commissions based on transaction volume, their own conduct may also be subject to further scrutiny.
Therefore, “being defrauded on this particular occasion” and “all past transactions were risk-free” are not the same conclusion. For ordinary, sporadic transactions involving fraud, evidence should be preserved promptly and a report filed with the police; for frequent transactions, complex sources of funds, or cases where bank cards have already been frozen or investigative assistance records exist, it is necessary to clarify one’s own role and organize evidence before providing a detailed statement.
What key issues can lawyers address when intervening?
In such cases, the value of lawyer intervention lies not only in drafting a police report, but also in helping the client separately clarify the “facts of the fraud” and the “background of their own transactions.”
First, verify chat records, exchange platform records, wallet addresses, transaction hashes, and on-site materials to form a complete timeline for the police report and an evidence inventory; second, analyze whether the counterparty had prior intent of illegal possession, focusing on false identities, high-price inducements, delivery arrangements, escape behavior, and gang division of labor; third, organize on-chain fund paths and related clues to facilitate accurate submission of addresses, hashes, and transaction nodes to the investigating authorities; fourth, assess the client’s prior over-the-counter trading activities, sources of funds, and profit methods to avoid inaccurate or contradictory statements in interview records; fifth, if the public security organ decides not to initiate a case or fails to act for an extended period, apply for reconsideration, review, or seek supervisory oversight of case initiation in accordance with the law, depending on the specific circumstances.
Concluding Remarks
An offline cash-for-USDT transaction in which the counterparty refuses payment after receiving the crypto assets and flees is not necessarily merely a “crypto industry trading dispute.”
The key to determining whether the matter can be handled as a fraud case lies in proving three elements:Both parties indeed formed a transaction agreement; USDT was delivered in accordance with the counterparty’s requirements; and the counterparty engaged in deceptive and evasive conduct before or after obtaining the assets that sufficiently reflects their intent of illegal possession.
For victims, the earlier chat records, exchange platform backend data, transaction hashes, on-site surveillance footage, and vehicle information are preserved, the more conducive it is for the public security organs to determine the nature of the case and trace the flow of funds. On-chain records can help track assets, but they cannot replace the investigation into the actual controllers, devices, identities, and on-site facts.
Therefore, when the counterparty delays by claiming “funds not received” or “wallet frozen,” one should not continue transferring crypto assets, add margin deposits, or delete records. Transactions should be stopped immediately, evidence preserved, and a report filed with the public security organs as soon as possible. For those involved in high-frequency over-the-counter trading, third-party funds, or with prior records of frozen bank cards, it is also necessary to concurrently assess their own criminal risks to avoid a victimization case giving rise to new issues due to confused or inconsistent statements.
/ END.
*This article is an original work of Mankun Law Firm. It reflects only the personal views of the author and does not constitute legal consultation or legal advice on any specific matter. For reprints and legal inquiries, please contact customer service:mankunlawyer。
About Mankun
