Why the first day matters
USDT on TRON is cheap to send and settles within minutes, which makes it a common rail for moving the proceeds of fraud. Funds can pass through several intermediary wallets in the first hours after a theft or a deposit to a scam site. What can still be frozen is usually reachable only while the trail is fresh.
Capture the transaction, not a screenshot
For each transfer, record the transaction hash, block number, block timestamp, the sending and receiving addresses, the token contract and the amount. A screenshot of a block explorer is a useful pointer, but it is not evidence on its own. Re-derive each record from a node, hash it when you save it, and note the node software and version you used.
Know where the money can stop
Funds become actionable when they reach a service that knows its customers — an exchange, a payment processor or an OTC desk that responds to lawful requests. Follow each hop until it reaches such a deposit address, and record when the funds arrived. That deposit endpoint, with its timestamp and amount, is what a freeze request or a report to authorities needs.
Expect the usual detours
Common detours include swaps into TRX or other tokens, bridges to other chains, and peel chains that split a balance into many small transfers. None of these ends a trace by itself, but each hop needs the same care as a direct transfer. Mark every inferred link as inferred, with a confidence level, and keep it separate from what the chain shows directly.
What to hand over on day one
A short package works best: the incident timeline, the list of transactions with hashes, the deposit endpoints reached so far, and a statement of what is observed and what is inferred. Keep watching the remaining addresses — funds that sit still on day one often move again later. The patterns in this note are anonymised composites; no service, institution or account is named.