Stolen mobile money shouldn’t become USDT.
Fraudsters turn stolen M-Pesa, OPay or card money into USDT within the hour. On-chain, there’s no reversal. Sieve stops the cash-out and blocks sanctioned wallets.
For exchanges, P2P platforms and fiat on/off-ramps serving African users, from Nairobi to Lagos.
Four ways the money goes missing.
Each looks like ordinary activity. Sieve scores every event in context, before the money moves.
- 01
Sanctioned wallets
A withdrawal to an address named by OFAC, such as a Lazarus Group wallet.
Caught by Sanctioned crypto wallet: over a thousand listed addresses, blocked outright
- 02
Crypto cash-out
Stolen money arrives and leaves as USDT to a fresh wallet within the hour.
Caught by Cash in, crypto straight out; crypto cash-out pattern
- 03
Peel chains
Funds split across five new wallets in one afternoon to break the trail.
Caught by Many new wallets in a short time
- 04
Travel Rule gaps
A transfer above USD 1,000 with no originator or beneficiary details.
Caught by Travel Rule information missing
Minutes of activity. One decision.
A story from the Crypto exchanges & on/off-ramps demo, run through the same engine as your events. Each reason is written for the analyst who acts on it.
- 09:02New account opened with basic KYC
- 09:07KES 120,000 paid in by M-Pesa from a strangerFiat in
- 09:22A new USDT withdrawal wallet addedNew payout wallet
- 09:28Withdrawal of KES 118,000 as USDT, on Ethereum
- DecisionBlocked
- 98% of the KES 120,000 paid in by M-Pesa is leaving as crypto
- Withdrawal wallet added 6 minutes ago
- Account opened 26 minutes ago
Blocked before anything reaches the chain. Once confirmed, the next account using that wallet or device is caught too.
Choose “Crypto exchanges & on/off-ramps” and these start enforcing.
Plain-English rules you can adjust, joined into fraud patterns. Everything else runs in Watch, scoring without acting, until you trust it.
- Sanctioned crypto wallet
- Cash in, crypto straight out
- Many new wallets in a short time
- Wallet address doesn’t fit the network
- Travel Rule information missing
- High-risk wallet exposure
- Crypto cash-out
- New-account cash-out
- Money mule
Send these events. One endpoint.
payout.requestedCrypto withdrawals: method crypto, asset, a crypto_wallet destination with its network, and travel_rule.transactionFiat deposits (mobile money, card, bank) and crypto deposits with the source wallet.customer.updatedNew withdrawal wallets, as payout changes.
await sieve.events.create({ type: 'payout.requested', customer_id: 'cus_1001', amount: 45200, currency: 'KES', method: 'crypto', asset: { code: 'USDT', amount: 350.25, network: 'tron' }, destination: { type: 'crypto_wallet', account: 'TR7NHqjeKQxG…', network: 'tron' }, travel_rule: { originator: { name: 'Wanjiru Kamau', account: 'cus_1001' }, beneficiary: { name: 'Wanjiru Kamau', address: 'TR7NHqjeKQxG…' }, self_hosted: true }, })
What your regulator will ask, answered.
Sieve supports your obligations. It doesn’t replace your compliance team.
- Kenya VASP Act 2025
- Transaction monitoring, sanctions screening and Travel Rule records in one audit trail.
- SEC Nigeria VASP rules
- The same monitoring, screening and Travel Rule records, to support your SEC Nigeria obligations.
- FATF Recommendations 15 & 16
- Travel Rule data checked above the threshold and stored encrypted.
- OFAC digital currency addresses
- Listed wallets are blocked in either direction, refreshed at each list sync.