UPI-to-Crypto Conversion Fraud — Layered Cash-out

StatusOpen
Investigation report
CP-2026-017

UPI-to-Crypto Conversion Fraud — Layered Cash-out

Generated 27 Oct 2026, 13:25 UTC

Case information
Victim loss
₹4,75,000
Status
Open
Created
14 Jun 2026, 09:20 UTC
Seed evidence

Victim-reported outbound transfer immediately following a fraudulent investment-app conversion of ₹4,75,000 to ETH.

0x71a4e8f2c9d0b6a13f5e8c2a9d4b7f01e6c3a8d5f2b9e6c1a4d7f0b3e6c9a2d5

Investigation scope

Network expansion reached depth 4, discovering 14 entities and 17 transactions in 2.14s.

High-priority entities
E09UNKNOWN

Consolidated inbound value was forwarded onward within 25 minutes of the final convergent deposit. Three independently-branched layering chains (E06, E07, E08) converge on this wallet within a 5-minute window. Three distinct upstream counterparties converging directly, above the case-network median.

HIGH78
E10POTENTIALLY ASSOCIATED

Highest betweenness centrality in the discovered network; sole connection point between this case's cluster and a wallet cluster also seen in Case CP-2026-021. Received and forwarded 98.9% of consolidated value within 40 minutes. Interacts with counterparties across two separate investigations.

HIGH81
E11UNKNOWN

Received approximately 93% of the total value traced from the seed transaction. Two large, independently-sourced inflows converge here from separate branches of the network (E05 direct branch and the E09→E10 layered branch). Receives from counterparties spanning both the layered and direct branches of the traced flow.

HIGH88
Money-flow summary
  1. E00 → E01 · 2.50 ETH · TX001
  2. E01 → E02 · 0.700 ETH · TX002
  3. E02 → E06 · 0.680 ETH · TX006
  4. E06 → E09 · 0.670 ETH · TX009
  5. E09 → E10 · 1.80 ETH · TX012
  6. E10 → E11 · 1.78 ETH · TX014
  7. E05 → E11 · 0.540 ETH · TX013
  8. E11 → E02 · 0.050 ETH · TX015 (circular return)
Cross-case connections

Wallet E10 acts as the bridge/consolidation point in CP-2026-017 and receives a direct exchange deposit in CP-2026-021 within 18 days of the first case's seed transaction. Both cases show rapid forward-and-out movement through this wallet within under an hour of receipt.

Limitations and confidence

All findings in this report are derived from deterministic transaction-graph analysis and behavioral pattern detection over the entities and transactions discovered during network expansion. Priority scores and behavioral indicators reflect investigative significance, not legal conclusions. Attribution labels are limited to KNOWN, POTENTIALLY ASSOCIATED, or UNKNOWN tiers based on the evidence on file; no wallet is asserted to belong to a named individual without a corresponding evidenced label. This report should be read as an investigative aid supporting further inquiry, not as a determination of wrongdoing.