The RR Crypto Mystery - Euros, bitcoins and a ride on Ethereum (ETH): follow the missing money of investors on the blockchain!

You have followed it with us in recent weeks: the scandal of the Dijon-based association RR Crypto is stirring up the cryptosphere and causing violent upheavals well beyond our still emerging ecosystem. Millions of euros collected by an association from unsuspecting individual investors, a charismatic boss whose actions are still far from being cleared up, a rather unconventional structuring in Estonia alongside a business partner with a sulphurous reputation: all the ingredients of a curious whodunit have been brought together and have kept the curious observer on the edge of his seat since the affair came to light.

However, if it is possible to draw some broad lines to try to understand what happened to the funds concerned, many questions still remain unanswered: Who really controlled the funds managed by the RR Crypto association on a daily basis… and what did the association and its leaders do with this money? But also, how much did this missing money really amount to? Indeed, if the first hypotheses drawn from several sources close to the RR Crypto microcosm evoked very varied amounts starting at 40 million euros, it is today allowed to doubt it: if the analysis that I am going to deliver to you today does not have the pretention to be completely exhaustive and that I am certainly missing many pieces of the puzzle, it remains possible that the amounts involved are indeed much less – even if they probably amount to at least about ten million euros

As you will see, if the official window announced to investors that the investments were managed from a corporate Binance account that had recently been “reset ” – an assertion that has since been officially denied by the exchange– a careful analysis of the fund movements on the various blockchains involved will tell you another story, where the actual trading seems relatively secondary… and which makes one wonder about the veracity of the various “investment statements” sent each month to each investor, in theory detailing his personal positions, and since the beginning of 2021 the composition of the global portfolio announced as managed by RR Crypto.

During our blockchainized peregrinations, you will also notice that if public blockchains (like Bitcoin and Ethereum) are transparent, they are not necessarily very talkative. We will see together how to make such a reading, and with which tools, because beyond the case of RR Crypto, it is indeed a habit that any investor in crypto-currencies should take: make research

It is important to do extensive research on any project before betting a single cent, not to believe any label of respectability to dispense with this research, to question and doubt the speeches put forward by the various projects… and even more so when the promised returns are crazy – in which case, the simplest advice will always be the following: if it is too good to be true, it is false, and it is better to run away without risking a cent.

RR Crypto, a well-tried machine to collect investors’ money

For those of you who followed the previous episodes of this sad summer soap opera, you will have noticed that we had made a hypothesis to try to follow some of


RR Crypto funds

: start from a reception address given to investors wishing to deposit their money and “invest” with RR Crypto, and try to follow the funds from there. That’s exactly what we’re going to do today, but differently, because we have to be honest: in our previous research, we considered a working hypothesis as a truth way too quickly, and we were wrong. Let’s go hunting for RR Crypto funds together, tool by tool, blockchain by blockchain… and let’s try to see more clearly!

With the help of aggrieved investors and sources linked to RR Crypto’s organizational chart, we were able to recover a number of documents: emails related to the association’s daily activity, deposit or withdrawal confirmations made by clients, practical daily information, or even monthly statements issued to investors. Using these various data, we were able to identify a recurring pattern in the functioning of RR Crypto: when an investor signed up for RR Crypto, he was directed by a salaried advisor of the structure to an exchange platform to create a personal account, verify it and then fund it, before finally sending the funds converted into bitcoins or crypto-dollars to receiving addresses controlled by RR Crypto. Over time, and according to information gathered by the Coin Journal, different exchange platforms have thus been used to allow customers to convert their euros into crypto-currencies, and the receiving addresses provided to RR Crypto customers have changed more or less regularly over time.

<img width=”849″ height=”96″ src=” 849w,×37.png?strip=all&lossy=1&quality=66&ssl=1 324w,×25.png?strip=all&lossy=1&quality=66&ssl=1 218w, 384w, 768w” alt=”” />Extract from RR Crypto mail, December 2020. The RR Crypto Mystery - Euros, bitcoins and a ride on Ethereum (ETH): follow the missing money of investors on the blockchain! Extract from RR Crypto mail, August 2020.

We have therefore aggregated these addresses, and with the help of tools adapted for each of the blockchains concerned, we have tried to trace the trail of as many funds as possible that are concerned and a priori managed by RR Crypto. Let’s make it clear from the start: the review of funds I’m going to propose today does not necessarily (and most probably not) cover all the funds that have been captured by RR Crypto. I am most likely indeed missing receiving addresses provided to other clients, both on Bitcoin and Ethereum, I have no visibility into likely cryptocurrency exchanges on major exchange platforms that could have allowed RR Crypto to trade USDT, ETH or BTC for other cryptocurrencies and then withdraw them ; and a substantial unquantifiable portion of funds were also exchanged for other cryptocurrencies using swaps without KYC, thus directly between the other blockchains involved, making tracking very tedious.

But don’t let that stop us from trying to get a clearer picture anyway! Let’s go!

The strange flow of liquidity on Ethereum

Ethereum and Tether (USDT): basics and how tracking works

To understand how we tracked RR Crypto transactions on Ethereum, we need to delve into the basics of how the network works for a moment. But don’t worry, it will be quick!

The Ethereum project is based on a general state idea. That is, we can have a state of all the Ethereum accounts at a certain moment, as if we had taken a picture. We will then send a transaction that will change this state to a new one. In the transaction, we must specify a from and a to which are the two accounts concerned by the transaction (and therefore which modifies the state of the accounts), fields which are absent in Bitcoin transactions for example. This principle is the same for all ERC-20 type crypto-assets issued on Ethereum (like the Tether dollar which we will talk about soon). It therefore allows to observe in a condensed and precise way all the transactions that have concerned a given address, and to draw tracking data over time. For example, if we look at one of the deposit addresses provided to R

See also  Software bypasses Nvidia's hash rate lockout

R Crypto to send their euros converted to Tether (USDT), one can harvest a lot of useful information :

Détails avec Ethplorer des transferts au fil du temps sur une adresse de dépôt de RR Crypto : 0xa7A281A54348F47F151c28b510Ae0DEB28b3c181.RR Crypto deposit address mining details 0xa7A281A54348F47F151c28b510Ae0DEB28b3c181 , source: Ethplorer, JDC data.

For our purposes, we will use two specific tools for our further research:

  • The Ethplorer blockchain explorer, offering a collaborative approach to exploring Ethereum and its transactions (as well as the multitude of ERC-20 tokens issued on Ethereum), as it is possible to publicly annotate a transaction or an address (while providing or not providing evidence to justify these annotations).
  • The tools offered by Scorechain: the Luxembourg startup offers its services to exchange platforms, French PSAN players or various institutions (such as banks and auditors) to track transactions on the Bitcoin, Ethereum and some other blockchains (XRP, Litecoin, Dash, among others). I thank them very much for their responsiveness and help throughout our investigation: they provided us with access to their tools, allowing us to aggregate all the data we collected, and to draw some lessons, as you will read soon.

First, using the tools offered by Ethplorer, and once all the receiving addresses have been identified, it already becomes possible to cross-check and observe certain systematic activities on certain addresses. Using the information gathered from the affected investor community, we can present 4 main addresses that were used to harvest USDT and USDC funds from RR Crypto customers:

  • 0xa7a281a54348f47f151c28b510ae0deb28b3c181 – which we will name <a href=”” target=”_blank” rel=”noopener”>ETH1,
  • 0x003915dcc9e97b91f3d376a883810dbce4c235d7 – which we will call ETH2,
  • 0xb5c0ea0437e7914404f64ed2d6240d006a85fdbf – which we will call ETH3,
  • 0x754fa31ca70e4037a751d45ad395d58e1362bf07 – which we will name ETH4.

N.B.: for each address, a precise analysis of the probable sources of supply and withdrawals is provided, by clicking on the links attached to items ETH1, ETH2, ETH3 and ETH4


As an example, if we look again in more detail at address 0xa7A281A54348F47F151c28b510Ae0DEB28b3c181

, we can see that funds were received from well-known exchanges but also broken down from other RR receiving addresses provided to customers. Funds sent by customers from their favourite exchanges were thus captured and then held or redirected to other addresses, also controlled by RR Crypto. Réception de fonds en USDT, immédiatement répercutés vers d'autres adresses contrôlées par RR Crypto.Partial details of the transactions of the RR Crypto deposit address 0xa7A281A54348F47F151c28b510Ae0DEB28b3c181, source: Ethplorer, JDC data.

One of these addresses caught our attention, we’ll talk about it right away: a very substantial portion of the crypto-assets involved have indeed been transiting through a strange gate linking the Ethereum blokchain and the Waves blockchain. This kind of automated platform has notably

t allowed RR Crypto operators to send cryptocurrencies to and from either of these two blockchains.

The various deposit addresses provided to RR Crypto customers that we have been able to identify all have links (in deposit and in withdrawal) with a curious address: 0x6871eacd33fbcfe585009ab64f0795d7152dc5a0. This address, you know it, because we introduced it to you by taking it for what it was not in one of our previous articles: as some wise readers on social networks pointed out to us, it is an automated address, allowing to transfer cryptocurrencies from Ethereum to the Waves blockchain, to retrieve on Waves addresses these assets, to use them on the Waves blockchain if desired, and also to withdraw them back to Ethereum if needed.

Le Journal du Coin got in touch with knowledgeable sources, and it was possible for us thanks to their precious help to retrieve a complete summary of the Waves addresses corresponding to the Ethereum addresses used by RR Crypto. From there, we were also able to retrieve all subsequent withdrawal transactions to Ethereum, allowing us to reconstruct a credible entity that we believe is RR Crypto.

As a qualified technician who assisted us in this research told us:

“The gate in question is just a tool. It allows you to go from Ethereum to Waves, from Waves to Ethereum, and then other solutions exist from to get other cryptocurrencies, like Bitcoin. You can use it to use some of the services of like yield research for example, or to try to hide your tracks, even if it’s not very smart. Regarding your case, they did pass funds through, and then they gradually removed everything. There is mostly USDT, some ETH, and some BTC. These people may have been good at raising money, but they weren’t really good at leaving no trace: there’s plenty of it. “

Qualified source who assisted JDC in its investigation.

We are making all of this aggregated data available to you in the form of a downloadable spreadsheet by clicking here. Once these new addresses and transactions are incorporated into Ethplorer, a first observation is obvious: by aggregating all these identified transactions, the total amount that would have passed through these addresses would correspond to at least 7.5 million USDT/USDC, or 6 million euros. There are also 4.33 bitcoins recovered from the gate (or 116,000 euros at today’s rate), and a very residual amount of ETH. The withdrawal addresses for all the USDT/USDC, bitcoin and ether funds are available in the downloadable table, if you’d like to explore them too.

Comments on Ethereum

Each deposit address provides valuable information, even if the interpretation of the information is not clear.

ation will again be left to professionals. To deliver the following graphical representations, we rely on Scorechain’s dedicated tool, Exploration Tool

, which is still under development but very enlightening. Its interest is twofold: to make intelligible the information already available, but also to help find new ones.

Using the previous data collected on the Gate Waves passage, we have identified some 232 withdrawal addresses scattered in the post-gate. This suggests that the funds raised have largely migrated to the Waves blockchain, before being gradually withdrawn to a multitude of addresses, and then back to various platforms.

The main ETH1

deposit address, for example, aggregates deposits from, Binance, Kraken, and various other smaller addresses. You will note that nearly 6.7 million USDT flowed directly from this address to the gate Waves we mentioned. Le parcours de 6,7 millions de dollars vers le gate Waves, depuis une adresse de réception de fonds de RR Crypto.Sending 6.7 million dollars from the RR Crypto ETH1 receiving address to the gate Waves, source: Scorechain, JDC data.

See also  Less crime but more hacks, Decentralized Finance still has everything to prove

Regarding ETH2

, funds were raised from a wide variety of platforms – Nexo, Freewallet and Binance. According to Scorechain’s analysis, some of the funds sent to Gate Waves were then returned to


: approximately $1.6 million and more than 2,400 ETH were recovered from the gate but also from other external sources. Récupération de fonds depuis le gate Waves vers une adresse de dépôt authentifiée de RR CryptoRecovery of funds from Gate Waves to an authenticated RR Crypto deposit address; Source: Scorechain, JDC data.

These funds did not stay there for long: the astute reader will note that these particular funds were soon redirected to Binance, mainly.

The RR Crypto Mystery - Euros, bitcoins and a ride on Ethereum (ETH): follow the missing money of investors on the blockchain!

Concerning ETH3, nearly 2.7 million dollars were collected there and then migrated: by exploring in the prof

On the receiving addresses, beyond the Waves gate alone, this address contributed to redirecting 2.7 million dollars to – eventually

– a large part of the corpus of gate exit addresses. Adresse identifiée comme ETH3 Adresse identifiée comme ETH3

Concerning ETH4

, all the funds collected from and Binance, in particular, were withdrawn to a account. The RR Crypto Mystery - Euros, bitcoins and a ride on Ethereum (ETH): follow the missing money of investors on the blockchain!

In the current state of the Exploration Tool

software, it is not possible for us to investigate further: the 232 post-gate withdrawal addresses are therefore far from having given up all their secrets: The RR Crypto Mystery - Euros, bitcoins and a ride on Ethereum (ETH): follow the missing money of investors on the blockchain!

It would indeed be necessary to be able to aggregate all the withdrawal information from these various addresses again. A quick observation leaves little room for doubt as to what happened to the funds that passed through them: while some are still stored on these addresses, others have since also been repatriated to exchanges such as (two examples of withdrawal address analyses, here, or here

). <img width=”652″ height=”88″ src=” 652w,×44.png?strip=all&lossy=1&quality=66&ssl=1 324w,×29.png?strip=all&lossy=1&quality=66&ssl=1 218w, 384w” alt=”” />Example of the destination of the funds from one of the 232 post-gate Waves withdrawal addresses

Observations on Bitcoin in post-gate Waves

Regarding the few bitcoins recovered through gate Waves, their path is more winding. A number of addresses have been identified by our knowledgeable contact, and you can find them if you feel like it in the summary spreadsheet provided earlier in the article. A first portion of the funds has not necessarily moved, while another one refers to significant address clusters pointing to Binance, Coinbase, and also some isolated wallets

. Parcours d'une partie des bitcoins retirés depuis Waves.Mapping of a first portion of bitcoins recovered from the Waves gate by RR Crypto, source: Scorechain, JDC data.

A second portion redirects to Wirex, the crypto neo-bank that currently no longer offers a classic IBAN gateway, but a functional crypto debit card in euro

. Seconde partie de bitcoins récupérés depuis le gate Waves.Mapping of a second portion of bitcoins recovered from gate Waves by RR Crypto, source: Scorechain, JDC data.

Various destinations with uncertain goals

If it is possible to reconstruct

While we have been able to identify some of the movement of funds, it is very difficult to interpret exactly what happened to them: according to our information, which has since been confirmed by some of the association’s partners on social networks, RR Crypto was paying at least some of its contributors directly in crypto-currencies – it is therefore possible and likely that at least some of the withdrawals made to foreign exchange platforms constituted payments from advisors, contributors or other close associates.

It should also be noted that until the affair broke, withdrawals were being honored to customers who requested them: actual withdrawals were confirmed to JDC by some investors as late as mid-May 2021, which contradicts RR Crypto’s official rhetoric of any disappearance of funds from Binance as of March 2021. Furthermore, the chain analysis clearly shows that movements to and from RR Crypto controlled addresses were still taking place until June 2021, often to repatriate funds to exchanges like and Binance. Even if it is not possible from this data alone to determine what the money in question was used for, it is clear that it seemed to circulate within the RR Crypto entity

. Retrait le 13 mai 2021 vers, Source : Ethplorer, données JDC.Withdrawal on 13 May 2021 to, Source: Ethplorer, JDC data. <img width=”1145″ height=”233″ src=” 1145w,×66.png?strip=all&lossy=1&quality=66&ssl=1 324w,×44.png?strip=all&lossy=1&quality=66&ssl=1 218w, 384w, 768w” alt=”” />Deposit on June 1, 2021 of funds from, and immediate referral to a Binance account, Source: Ethplorer, JDC data.

No real visibility once funds have been moved back to exchange platforms (Binance,, or other DEX). Naturally, the platforms do not comment, and it will be up to the law enforcement agencies in charge of the investigation to clarify the exact details of these interactions on exchanges: were the withdrawals in question made on behalf of one and the same client, or were the RR Crypto funds really managed by several traders afterwards? How much of these funds were then converted into other cryptocurrencies and withdrawn from these platforms? How much of it was simply converted back into euros and again somehow taken out of these various platforms, some of which offer convenient debit cards – debit cards that several people close to the case confirm to have seen being used for sometimes lavish spending in some well-known local Dijon venues.

Need a break? Go discover the French Neo-bank DUX and its Bitcoin savings plan

(affiliate link)<<

RR Crypto liked other people’s bitcoins

But, as you will have understood, it was not only about crypto-dollars, since customers were also invited to make deposits on BTC addresses. Here, the task will not be easier: if some well-informed people confirm that these deposits in bitcoins represented a minimal part of the total collected by RR Crypto – and a priori these deposits in bitcoins were intended for a few specific customers handpicked, it is still possible to identify an entity that could correspond to RR Crypto, and having handled a congruent share of bitcoins. The information available on the bitcoins managed by RR Crypto is quite sparse at the moment, but it was possible to authenticate the use of a specific receiving address: 38DNPMyq4jKkEWBGJgQHe2FndXXhFLehwg

, and we will come back to this soon.

To understand how specific entities can be identified on the Bitcoin blockchain, we need to quickly go over the basics of Bitcoin. Rest assured, this won’t take long!

Bitcoin’s UTXO system

On Bitcoin, the balances of different addresses are not stored in the same way as on a traditional bank ledger. This is called the UTXO (Unspent Transaction Output) model with an unspent output. Thus, the balance of a Bitcoin address is obtained by adding up all the outputs to that address that have not yet been spent. As you might guess, it is then possible to link transactions from a given address or transaction ID, and

See also  Bithumb to restrict foreign accounts without KYC

to reconstruct the entire history attached.

Bitcoin UTXOIllustration of Bitcoin’s UTXO model – If someone moves $150,000 in multiple transactions and gets it back at the exit, they can easily be identified at the exit.

It is with the help of these kinds of heuristics that it becomes possible to make assumptions about who controls what: if funds end up spread across a multitude of bitcoin addresses, but ultimately replenish themselves, they create links that algorithms can exploit – although it should be kept in mind that these are far from infallible, and can be fooled by certain bitcoin mixing processes

, for example.

Clustering and identification of the same entity

In absolute terms, this is actually how exchange platforms proceed when assisting law enforcement in charge of investigations such as the RR Crypto one: if an external observer will no longer see anything of the internal movements of a platform such as Binance or once cryptocurrencies are deposited there, the fact that a client account is subject to strict KYC will make it possible for investigators to determine a posteriori the responsibilities of each


ANON-3000599177: RR Crypto, are you there?

For our part, we will use two specific tools for our further research:

  • The Bitcoin blockchain explorer, developed by the Samurai Wallet team and offering a collaborative approach to the exploration of Bitcoin and its transactions, since it is possible to publicly annotate a transaction or an address (while providing or not elements to justify these annotations), but also an automatic clustering of certain entities, according to their transactions precisely.
  • The tools offered by Scorechain.

Let’s start by observing what’s going on using OXT, on the famous confirmed RR Crypto receiving address you were talking about earlier:

<a href=”″ target=”_blank” rel=”noopener”>Adresse de réception bitcoin confirmée de RR Crypto, base de l'enquête.Bitcoin receiving address 38DNPMyq4jKkEWBGJgQHe2FndXXhFLehwg, belonging to RR Crypto; source: OXT, JDC data.

The interest of OXT, beyond its collaborative aspect, is to allow the identification of certain entities, as soon as they seem to control several addresses, as we quickly explained before.

It turns out

that this address refers directly to a strange entity

, labeled as ANON-3000599177. Entité OXT correspondant probablement à RR CryptoEntity controlling a receiving address belonging to RR Crypto, identified by the tool

An analysis of this entity allows us to determine that it may correspond to an operator managing this set of addresses from France, and mainly on weekdays:

<img width=”1206″ height=”486″ src=”//’%20viewBox=’0%200%201206%20486’%3E%3C/svg%3E” alt=”The OXT Explorer can identify the times and days of the week that the RR Crypto entity was most active.” L'explorateur OXT permet d'identifier les horaires et les jours de la semaine auxquels l'entité RR Crypto était la plus active.Temporal patterns attached to this RR Crypto entity.

OXT also allows you to directly extract all the addresses involved in this entity, as well as all the transactions supposed to constitute it. If you want to explore them on your own, just

go to

the entity’s web page on OXT

. L'explorateur OXT permet de déterminer les différentes transactions auxquelles l'entité RR Crypto a pu prendre part.Transactions of the set of addresses identified as related to this RR Crypto entity.

It is also possible to the trained eye to see that a number of these transactions seem to have transited through Wirex, but also through Binance and

Regarding Wirex, a number of the addresses involved are labeled as such when we check them in the OXT explorer, or in the on-chain tracking tools of Scorechain. So the bulk of the bitcoin flows seem to have ended up on Wirex.

<ahref=”″ target=”_blank” rel=”noopener”>The RR Crypto Mystery - Euros, bitcoins and a ride on Ethereum (ETH): follow the missing money of investors on the blockchain!Address linked to RR Crypto, identified by OXT as being managed by Wirex.

Regarding Binance and, the link is also identifiable as withdrawals (and deposits) have been made between addresses controlled by both platforms (or by clusters of addresses strongly suspected by on-chain monitoring operators to belong to them).

The RR Crypto Mystery - Euros, bitcoins and a ride on Ethereum (ETH): follow the missing money of investors on the blockchain! Consolidation of funds involving an address of the RR Crypto entity, and terminating on Binance.

With the help of more developed tools, it thus becomes possible to reconstruct part of the movements of funds observed between the different entities, in order to reconstruct again a mapping of movements attributable to RR Crypto on the Bitcoin blockchain. To do this, we will once again use Scorechain’s dedicated Exploration

Tool. Remember again that the latter is still under development, and therefore does not necessarily incorporate the same data as OXT. Thus, if OXT attaches Binance addresses to RR Crypto, Scorechain attaches the same addresses but does not identify them by name on this mapping, for example. <img src=”″ alt=”Mapping of fund movements from the RR Crypto entity, to and Wirex, in particular.” />Mapping of RR Crypto entity’s fund movements, source: Scorechain, Exploration Tool, JDC data.

The mystery of the real destination of the funds

In conclusion, we can therefore see that according to all these data, the various funds raised by RR Crypto have transited and migrated to some well-known platforms of the cryptosphere, whether it is Binance, or Wirex


It is difficult to determine exactly what happened to them: only law enforcement agencies will be able to knock on the door of the platforms concerned in the hope of clarifying this situation. However, the informed reader will note that all this seems quite contradictory to the official speech of Vincent Ropiot and the managers of RR Crypto, according to which the funds of the association would have been stored in a Binance account.

Let’s recall that Binance has already expressed itself on the absence of a “professional account” held by RR Crypto on its platform – but if the chain analysis shows any movement of funds to one (or more) Binance accounts managed by RR Crypto, and whose owner(s) is (or will be) identified by law enforcement agencies in the future.

Extrait de mail RR Crypto expliquant que le compte Binance de l'association est paralysé momentanément. Extract from an RR Crypto email, dated June 3, 2021, explaining that the association’s Binance account is being verified.

Only one thing is certain: the case, as complex as it is, has not finished spilling ink.

Many thanks to the investors who agreed to provide us with data, to the Scorechain teams for allowing us to use their blockchain flow monitoring tools and for their responsiveness, to the Nigma Global teams for their attentive listening, to the teams providing free blockchain explorers as complete as OXT and ETHplorer, as well as to the other unnamed sources without whom we would not have been able to move forward as we did.

>> It’s time to check out the French neo-bank DUX and its Bitcoin savings plan (affiliate link) <<