Quote from: Otoh on March 14, 2025, 11:33:23 PM

Many thanks Lafu, much appreciated, yes I feel that these particular scammers are probably better organised than many, unfortunately, especially as in that they haven't rushed to cash out into fiat and blow the loot ASAP without care about any traceability

You are very much Welcome Otoh , every little step i can contribute to that case and you get you some hints about it is it worth to know how and the things was and are.
I know that feeling as i or some of my Accounts got hacked back in the days where i havnt got that knowledge that i have now.
As you mentioned sometimes it needs the hard way to learn from some mistakes and so i learnd of mine , thats why i fighting against Malware links and Scammers.
I learnd my lessons early in the days when Bitcoin was worth just about 90$.

Quote from: Otoh on March 14, 2025, 11:33:23 PM

My friend has written it off as to needing to learn a lesson the hard way, and doesn't expect that they'll see any of the coins back again,
but we would still like to track what has happened as much as possible, and how it all progresses when the coins move again

Thats for sure a good and in the same way a bad reason to learn the bad things and how can be the things with Crypto.
Every time check the links and all other things twice before make the next move.

But i have some good news for you and your Friend even it wont be bring back the funds!

I have some speciall Contacts that have the possibility to have fully access to the chainalysis.com Software and i asked about if they can look into that case !
I got some Answer about it.

Quote from: Otoh on March 13, 2025, 08:16:32 PM

$500 reward for the first person to ID what the bc1qlddfc5psmhfp4z6ckzwp7nhxrwsa7dfp8gz383 addie is,
where they sent a token amount just after the scam, and then withdrew it back again.

The Address you asked about bc1qlddfc5psmhfp4z6ckzwp7nhxrwsa7dfp8gz383 is one of 1.733 Addresses that belongs to the Bridging service of thorchain.com
Also the other Addresses that have been involved of that Scam has some connections to that Service.

Code:

bc1qun3ue8c5j4qgs72qefs9szsngs6ledu83f048z
bc1qkwmp6tsjhfsykzelxrfd4cksvd8efgk8zfce9l
bc1qt5jmqzneu07mguuzmcq96gtldzt9p8aqdd7qc2

So that main Address you asked for is an Address from thorchain.com and that other Addresses have the same connection to it.

At the moment there is saddly nothing more i can tell , i have some screenshot from the chainalysis software from my contact that i will be send you on a PM as nobody else should be see that..
Apart from that all the information that belongs to the Address from where the funds that got stolen from your friend will be handled with care and dont get into other Hands.
Hopefully that helps a bit in your case.