The Ad They Couldn't See: How Korean Investigators Tracked a USDT Scam Back to Instagram – PC Tech Magazine

When a Korean professional working in the United States decided to sell part of his USDT, he did what most people do: he looked for the best rate. He found one on Instagram.
The ad promoted a P2P exchange service offering a 2–3% better rate than he could get elsewhere. On a five-figure amount, that difference adds up, so he clicked through and started an exchange.
Before processing it, the site asked for one more step: a quick AML check to confirm his USDT wasn’t linked to illicit activity. Compliance checks are normal in the industry, so nothing seemed strange. He connected his wallet and approved the transaction the site put in front of him.
That approval was the attack. About $25,000 in USDT left his wallet, and the exchange never happened.
A Signature, Not a Hack
Technically, nothing was hacked. Connecting a wallet to a website only shares its address. Approving a transaction is different. A malicious token approval gives another address permission to move tokens out of the wallet, and it can be written to cover the full balance. It stays valid until it’s revoked, so the attacker never needs the victim again. That’s also why anyone holding tokens should regularly review and revoke old approvals in a block explorer.
An Investigation Across the Pacific
The victim turned to an OSINT investigation team based in South Korea. Tracing the stolen USDT on-chain pointed to a Drainer-as-a-Service operation. One group builds the phishing sites, draining scripts and dashboards, while affiliates rent the kit, run the ads and bring in victims keeping as much as 80% of each theft.
The team also needed the ad itself. It was the entry point of the scam and the most concrete thing to report to Instagram. The campaign may well have been paid for with a stolen card, which would make the advertiser account a dead end, so a preserved copy of the ad and its landing page mattered even more.
There was one problem. The ad was aimed at users in the US, and the investigators were in Korea.
Becoming a Local
Instagram ads are targeted by country, age, interests and device, and scam campaigns often use cloaking, showing the real landing page only to users who match the targeting. Meta’s Ad Library helps, but scam ads rotate quickly. To see what the victim saw, the team needed an account that looked exactly like an ordinary American user.
They built one from scratch: a new email address, a consistent browser profile with a matching time zone and locale, and a connection through a residential proxy with a US IP address. Platforms easily flag datacenter IPs, while residential ones look like a normal home connection.
Instagram also asked for a phone number. A Korean number would contradict everything else about the account, and getting a physical US SIM card to Seoul would have taken weeks. VoIP numbers are frequently rejected, and free public SMS sites are useless for this, since anyone can read the codes and the numbers are heavily reused.
The team used a temporary phone number from Tell A Bot. The code arrived, and the account was live. Because temporary numbers can be reassigned later, the usual precaution is to switch two-factor authentication to an authenticator app right after sign-up.Then the team used the account like a real person would, following finance and trading pages similar to the ones the victim followed. Eventually, ads for a P2P exchange started appearing in the feed.
Evidence First
Scam ads can vanish within days, so the team preserved everything while the ad was live: screenshots, ad and advertiser IDs, the landing page URL, UTC timestamps and SHA-256 hashes for every file. On-chain, they mapped the flow of funds to suspected P2P traders who converted the stolen USDT into cash, and documented a closed, invite-only community where affiliates coordinated and shared payout screenshots.
They were just as careful about what the evidence didn’t prove. A shared wallet doesn’t mean a shared identity, and a trader who handled stolen funds isn’t automatically part of the scheme.
What It Takes, and What It Doesn’t Do
The proxy, the browser setup and getting a verification SMS were the easy part, as long as the team paid for quality. The hard part was keeping the account believable long enough for the ads to appear. Nothing about that is guaranteed, and a research account can break a platform’s rules even when the investigation itself is legal.
The investigation doesn’t return the money on its own, either. Investigators can’t freeze funds or issue subpoenas. What they can do is give Instagram the evidence it needs to remove the ads and accounts, and give lawyers a documented trail to take to exchanges, courts or law enforcement.
For anyone selling crypto, the lesson is short. If a service beats every rate you’ve seen and then asks you to approve a transaction to “check” your funds, close the tab.
 

source