Quick Promo investigation Report

Quick Promo: follow the money

An open investigation into the Quick Promo task scam in Curaçao. Built from public records and from victims who report.

The same two wallets sent $4.4 million to about 4,000 wallet addresses between 22 September and the end of October 2026.

Verified cases so far

No verified case published yet.

Reports received: 1. We check each report before it counts here. Amounts in US dollars, XCG 1.79 = $1.

Paid too? Report it

What one victim in Curaçao paid, and what came back

Checked against public records.

No verified case is published yet. When we have checked a report, its money flow appears here.

It is not one victim

$4.4 million

The same two wallets sent this much to about 4,000 wallet addresses between 22 September and the end of October 2026.

1 Sep1 Oct1 NovWallet 1$2.26M to 2,070Wallet 2$2.17M to 2,002
victim paysvictim is paiddashed box: no payouts seen
  • The site says "founded 2020, Denver". Its three web addresses were registered within 28 seconds on 30 August 2025.
  • The app is installed from outside the App Store and Google Play.
  • You pay to the bank accounts of private persons, and the persons change.

Limit: the blockchain shows wallets, not names. We cannot prove that every payment is for Quick Promo.

How the network connects

Each box is a web address, contact, bank account or wallet. Each line is a link we can show with evidence. Tap a date to see how the network grew.

Three quickpromo web addresses are registered within 28 seconds on 30 August. qp313.com, for sale in July, gets a new registrar record.

6 September: the sites go live. Paid press releases with a Denver dateline appear the same day. The app pages share code and point to qp789.com.

30 November: the Telegram link changes and the link to qp313.com is removed from quickpromo.top.

28 April 2026: qp338.com joins the network and gets a new certificate. The app calls it the official link.

From 22 September Wallet 1 pays out to thousands of wallet addresses. The wallets that fill it send round amounts.

Wallet 2 takes over from Wallet 1 on 16 October, filled by the same wallets. By the end of October it too has paid more than 2,000 addresses.

November: no payouts seen from 1 to 6 November in our data. quickpromo.top goes offline; qp313.com is still live. Reports come in here.

quickpromo.topquickpromo.vipquickpromo.livequickpromote.comqp313.comqp789.comqp338.comTelegramQuick Promo appWhatsAppRedotPay0x9d7d…⁠5d72Wallet 10xF083…⁠6f77Wallet 20xc2c3…⁠91A30x7eC5…e50B0x5277…⁠60F70x876CF1…0xBcFa…⁠2feb0xC965…dD76

new in this stepmoneylinkcontact

What links them (15)
  • quickpromo.top, .vip and .live: registered within 28 seconds at GoDaddy.
  • The app config on quickpromo.live names quickpromo.top as its channel.
  • The same config loads the logo from quickpromote.com.
  • The same config names qp338.com as the official link.
  • qp313.com and quickpromo.live serve the same code file and page title.
  • Both app pages point to qp789.com (og:url).
  • quickpromo.top linked to qp313.com until November 2025.
  • The Quick Promo app runs on quickpromo.live and qp313.com.
  • Contact on Telegram: t.me/QuickPromo2020, later t.me/QuickPromo_Csr.
  • Contact on WhatsApp: wa.me/12034669290.
  • Wallet 1 received 2,239,103 USDC, almost all from 0x7eC5…e50B (1,158,000) and 0x5277…⁠60F7 (1,049,000), in round amounts.
  • Wallet 2 received 2,162,650 USDC, mainly from 0xBcFa…⁠2feb (1,534,000) and 0xC965…dD76 (424,000).
  • 0x5277…, 0x7eC5… and 0x876CF1… fund both payout wallets.
  • One operation: Wallet 1 stops near 17 October, Wallet 2 starts on 16 October.
  • Payouts from both wallets reached a RedotPay deposit address. RedotPay collects its deposits in 0x9d7d…⁠5d72.

Full addresses

Tap an address to select all of it. The link opens etherscan.io.

How it unfolded

2025

  1. qp313.com shows a "for sale" page.

  2. First image uploaded to quickpromote.com (date in the file path).

  3. qp313.com gets a new registrar record.

  4. quickpromo.top, .vip and .live registered within 28 seconds (20:13:38 to 20:14:06 UTC), all at GoDaddy.

  5. The sites go live. Paid press releases with a Denver dateline the same day. The site claims "founded 2020, Denver".

  6. The Telegram link changes. The link to qp313.com is removed from quickpromo.top.

2026

  1. qp338.com gets a new record and a wildcard certificate: it joins the network.

  2. Wallet 1 (0xF083…⁠6f77) pays out, seen from 22 September: 2,257,509 USDC to 2,070 addresses.

  3. Wallet 2 (0xc2c3…⁠91A3) starts paying, filled by the same wallets as Wallet 1. Wallet 1 stops around 17 October.

  4. End of October: Wallet 2 has paid 2,170,995 USDC to 2,002 addresses. From 1 to 6 November no payment is seen.

  5. qp313.com is still live, with a new app build.

  6. quickpromo.top is offline. This site opens for reports.

webvictim paysvictim is paidwallet

Updates

  1. This site opens: the full investigation, the network and a safe form for victims.

  2. Second payout wallet traced: 0xc2c3…⁠91A3 paid 2,170,995 USDC to 2,002 addresses in October, filled by the same wallets as the first.

  3. quickpromo.top is offline. qp313.com was still live on 13 and 14 November.

The pictures to share

Tap a picture to open it. Save it or share it on Facebook or WhatsApp.

Check it yourself

Sources

  • The two payout wallets. Search them on etherscan.io and look at the USDC transfers.0xF083d75937FA87645fAe7a6504f669e13A3a6f770xc2c3184572b2062048c427074caB7fAF77A791A3
  • Web addresses and their registration dates (rdap.org):quickpromo.topquickpromo.vipquickpromo.livequickpromote.comqp313.comqp789.comqp338.com
  • Old copies of the site: web.archive.org. Bank and RedotPay screens: from the victim.
  • Also used: crt.sh certificates, Cloudflare DNS, urlscan and eth.blockscout.com. Nothing touched the Quick Promo servers.

Limits

  • The blockchain shows wallets, not names. We cannot prove that every payment is for Quick Promo.
  • No wallet here has a public label. Names need an exchange or the police.
  • That this is a "task scam" is our reading of the site's code, not a proven fact.
  • Verified cases are reports we checked against screenshots. Anyone can send a report, so nothing is shown before that check.
  • Public data collected 15 Nov 2026. 1 USDC = about $1. XCG 1.79 = $1.

Did you pay too?

You are not alone and it is not your fault. These apps are built to fool people.

  1. Stop. Do not pay "fees" to get your money out.
  2. Save screenshots of every transfer and chat.
  3. Report it to the MCB fraud team and to the police.
  4. Tell us too, with or without your name.

Do not go after the account holders. They can be victims too. Let the bank and the police do that.

Report Quick Promo

Did you pay Quick Promo (QP313, QP338)? Tell us what happened. We combine the cases and pass them to the bank and the police.

We never ask for your password, PIN or "seed phrase". Do not give them to anyone.

Please use initials only, no full names of people. Your initials, contact details, wallet address and screenshots are used only to check and process your report (and to pass the case to the bank and the police). They never appear on the website or in the pictures.

How much did you pay, and when? (optional) One row per transfer. Paid to: the bank account number or wallet address. On the site we only ever show the last 3 digits of an account.
More payments
How much did you get back, and when? (optional) Payouts from Quick Promo, in USD or USDC. If you filled in a 0x wallet above, we check the blockchain ourselves.
More payments

After a check we publish only amounts, dates, account endings and the scammers' wallets. Never your initials, contact, wallet or screenshots.