World Liberty Financial (WLF) executed a series of on-chain transfers totaling approximately $2.7 million to a little-known Chinese Web3 user operating under the name @Andypiggie, whose wallets later routed those funds, almost entirely, into Binance, the world’s largest cryptocurrency exchange.
On December 10, Disruption Banking exclusively reported that WLF’s USD1 stablecoin has been propped up by +$300 million from DWF Labs, a controversial market maker based in the UAE, led by Andrei Grachev. DWF Labs has previously faced scrutiny over its opaque trading practices and its role within Russian- and Chinese-speaking crypto-finance networks.
Using Arkham Intelligence to visualize blockchain activity, WLF receives funds (in green) and pays an array of wallet addresses (connected in red). The thickness of the red or green band shows the frequency of transactions. WLF often pays in batches of around $60,000.
What began as a close look at a single counterparty, a pseudonymous Chinese Web3 user known as Andypiggie, quickly revealed something unexpected: the flows associated with him were not isolated. They were structurally identical to transfers occurring across a network of wallets, all ultimately tied to WLF.
Once mapped out on-chain, these transactions look less like an isolated payment and more like the first visible strand of a much larger architecture.
The diagrams below show how the Andypiggie wallet behaves: receiving sizable USD1 batches from WLF, converting them via Kyber, and depositing the proceeds into Binance through a predictable staging address. Yet the deeper we went, the more it became clear that this pattern was not unique to Andypiggie.
The Money Trail: From WLF to Andypiggie to Binance
Whether this flow represents compensation, liquidity operations, OTC activity, or a method for WLF to move funds unobtrusively remains unclear, but the operational pattern is unmistakable.
WLF sent 15 transfers, almost all in the $60,000 range, to a single wallet attributed to Andypiggie, totaling ≈ $2,609,850 USD. In the image below, the WLF/Andypiggie transactions are isolated from the rest of Andypiggie’s activity.
Once the USD1 tokens reach the Andypiggie wallet, they do not remain there. Instead, each tranche is quickly forwarded to Kyber Network, where USD1 is exchanged for USDC. The return amounts match closely with the incoming USD1, usually to within a fraction of a percent.
The purpose of this step is clear: USDC is far more liquid, more exchange-friendly, and easier to off-ramp into centralized platforms. USD1, being a project-specific token, has little utility outside the ecosystem. Kyber serves as the conversion layer that turns an internal project token into real, monetizable stablecoin liquidity.
Screenshots from Phase II Stable token purchases match timelines on Andypiggie’s X account, helping link the pseudonymous identity to on-chain actions. Below, Arkham Intelligence Explorer documents Andypiggie’s purchase of $20,000 worth of Stable: Phase II.
The next day, Andypiggie announced his investment on X, attaching a screenshot of his on-chain activity.
(The tweet is translated from the original Chinese)
The most remarkable thing about Andypiggie’s relationship with WLF is that Andypiggie does NOT publicize it. On X, Andypiggie posts regularly, loudly proclaiming affiliations, but not WLF, by far the most prestigious. Why?
Andypiggie Emerges as Quiet Counterparty
When Disruption Banking expanded the search radius beyond Andypiggie’s addresses, new clusters emerged almost immediately. These wallets shared no obvious personal or social connection to him, and yet the transaction patterns were unmistakably similar: large, rhythmic transfers from WLF, followed by immediate conversion through DEX routers and final consolidation into centralized exchanges.
Each new wallet was operating like a node in a broader liquidation network, dispersing WLF’s assets across multiple intermediaries with remarkable consistency.
After each swap, the Andypiggie wallet receives USDC back from Kyber and almost immediately transfers those funds to Binance deposit addresses on the Binance Smart Chain.
The blockchain evidence reveals a clear and consistent pattern: value originating inside the WLF ecosystem is being transferred through a single intermediary wallet cluster associated with the entity known as Andypiggie, converted into liquid assets, and then pushed into Binance’s internal custody structure.
Once the funds enter Binance, they disappear from public visibility, leaving no on-chain trace of how they are eventually used or who ultimately benefits. Only Binance’s internal logs can reveal the identity of the account holder or the eventual disposition of the funds.
Andypiggie Pipeline: Ethereum Version
Parallel to the flows on BSC, there is a separate pipeline on Ethereum. In this version of the pattern, Andypiggie’s Ethereum wallet sends ETH to an address 0x9cc7e8e6b5fa930c5816690a83a740d92ce598c4. At first glance, this might appear to be another personally controlled wallet, but a closer review reveals something different.
The 0x9Cc7… address receives ETH not only from Andypiggie but from dozens of unrelated wallets, including individual EOAs, tagged protocols, and even some exchange-associated addresses. Almost all of the ETH that enters 0x9Cc7 is forwarded, typically within minutes, to a Binance hot wallet.
No funds remain in 0x9Cc7, and the address never behaves like a user wallet. It does not trade, sign transactions requiring gas, or interact with DeFi protocols in any meaningful way. It simply receives and forwards.
This pattern is the definitive signature of a Binance deposit address. These addresses are controlled entirely by Binance and serve as the first stop for user deposits before they are swept into the exchange’s omnibus hot wallet.
The fact that many unrelated users are simultaneously sending assets to this same address confirms this interpretation. In other words, 0x9Cc7 is not part of the Andypiggie wallet cluster; it is part of Binance’s infrastructure. Andypiggie is merely one of the users depositing funds through it.
Parallel Liquidity Routes, Same Outcome
This pattern appears across two chains, BSC and Ethereum, and across multiple asset types, including the project’s own USD1 token, USDC, USDT, and ETH.
Nothing on-chain indicates that these funds were recycled back into project-controlled wallets or used in observable reserve, market-making, or treasury-balancing loops. There is no observable evidence that any of these flows contribute to market-making, liquidity rebalancing, operational expenditures, or any other conventional business activity.
There is no return of capital to project wallets, no cycle of reinvestment, and no pattern that resembles reserves management. Everything moves outward, and nothing comes back.
The dispersion pattern does not appear to be random. It has a cadence, suggesting software orchestration. The tracked wallet is not paying a few vendors; it is distributing funds in a systematic way, like a Square Payroll-type service or a liquidation dispersal node like Kroll Restructuring Administration. Completely legitimate DeFi treasuries typically do not operate this way. A traditional grant program wouldn’t either. And, bulk Airdrops look nothing like these Arkham Intelligence crypto tracking diagrams.
What the Flows Do and Do Not Reveal About Treasury Use
These flows do not resemble on-chain reserve accumulation or circular treasury management patterns typically associated with reserve-backed stablecoin operations. It seems more consistent with the structured conversion of internal project value into off-chain cash or equivalents.
These flows represent the largest observed instance of structured, one-directional conversion of WLF-issued assets into externally liquid stablecoins and centralized exchange custody.
This wallet 0x53cc1b407B9Cb27EfEC629B35dbDa04D05B4FA27 (above) is an additional conversion hub. This wallet receives large inflows from Binance, World Liberty Fi, and other project-linked wallets, while simultaneously routing massive volumes into decentralized exchanges such as Kyber, 1inch, and Uniswap, and then further outward into MEXC, Gate.io, and other off-ramp destinations.
The directional shape of this wallet’s graph tells the entire story. Green flows pour in from WLF and exchange wallets; red flows streak outward into DEX routers and centralized exchange deposit addresses. Nothing flows back.
As with the earlier wallets, this one functions as a high-volume liquidation channel, but on an even larger scale. Where the Andypiggie pipeline operated in tens of thousands at a time, this hub handles flows so large and frequent that the graph resembles a jet engine rather than a wallet.
Pattern Repetition Across the WLF Ecosystem
Andypiggie might be a liquidity agent, an OTC executor, a settlement node, a community contractor, or a quiet middleman responsible for converting WLF assets into more liquid instruments.
WLF may be operating through multiple intermediaries, possibly outsourcing liquidity operations or transferring treasury funds using a pseudonymous network of DeFi-native actors.
The consistency in outflow sizes, timing, and endpoint (Binance) implies an operationally coordinated system.
These interpretations require no speculation beyond what is visible on-chain, but Disruption Banking sought out an expert.
Jonathan Reiter, CEO and Chief Data Scientist at ChainArgos, told Disruption Banking, “You see this all the time. You’ve got lots of people who are doing a bank wire for token-type money businesses. So you found an OTC desk/money mule, that’s almost certainly what you found. Because he’s minting these directly, he’s onboarded with World Liberty Financial’s procedure, some partner bank or trust, or something. He’s receiving them directly from the token contract. He’s an onboarded customer of their procedure bank. So, this says that Andypiggie is finding ways to get dollars for people into WLF. That’s clearly not good, but you would expect there to be a whole bunch of these dodgy characters doing this. That’s kind of the intended use case of the token.”
Reiter emphasized that his assessment was inferential and based on common patterns he has observed, not direct knowledge of the parties involved.
Standard Practice or Structural Opacity?
There are four models for interpreting Andypiggie’s role:
Option 1: Self-Funded Staging Wallet
Andypiggie receives various DeFi inflows and uses Binance for personal liquidity. Plausible, but unlikely to explain the scale and regularity of WLF’s transfers.
Option 2: Mule / Payment Router
Andypiggie acts as an intermediary who collects and forwards funds for a principal (possibly WLF). This aligns with the funnel behavior of the 0x9Cc7… wallet.
Option 3: Broker / OTC Escrow
A candidate explanation, but Andypiggie’s public persona as a gamer/Web3 developer does not reflect typical OTC desk behavior.
Option 4: Multi-Wallet Laundering / Dissociation Strategy
Some users split activity across staging wallets that all feed a single CEX. Andypiggie resembles a Justin Sun-type Gen-Z cutout, someone who might operate between jurisdictions or communities.
Open Questions for Tokenholders and Market Participants
WLF’s 2.7M in transfers to a Web3-native Chinese middleman, whose wallets promptly swapped and delivered the funds to Binance, raises pressing questions about internal treasury operations, contractor payments, and the role of pseudonymous intermediaries in DeFi ecosystems.
Disruption Banking’s analysis found that WLF sent large, discrete amounts of value to Andypiggie’s wallet, which then swapped or sold those assets, sometimes via decentralized exchange paths like Kyber, before routing the proceeds to Binance. The on-chain logs for wallet 0x9Cc7 show it functioned as a funnel wallet, receiving ETH from three upstream wallets.
This wallet conducted almost no on-chain economic activity beyond forwarding ETH and ERC-20 tokens.
If depositors or community members were led to believe that USD1 assets or treasury reserves were locked, circulating, or being used in ways that supported the project’s stated functions, the on-chain evidence contradicts those claims.
On-chain patterns indicate that funds received by the Andypiggie cluster were quickly liquidated or converted.
The on-chain pathways are clear. The motives and relationships are not.
Whether this represents liquidity operations, compensation, treasury restructuring, or discreet financial engineering, it is an emerging story worth investigating further. This analysis does not allege wrongdoing. It documents structural patterns that merit further disclosure.
Andypiggie’s identity, relationships, and public activity may hold the key to understanding why WLF needed an intermediary at all.
Author: Laird Dilorenzo
Laird Dilorenzo is a hatchet thrower and wordsmith.
The editorial team at #DisruptionBanking has taken all precautions to ensure that no persons or organizations have been adversely affected or offered any sort of financial advice in this article. This article is most definitely not financial advice.
