Fourteen panels we had been monitoring closed between January 4 and March 29, 2026. "Closed" is generous — most of them simply stopped responding to orders, then stopped responding to tickets, then the domain redirected to a parked page or to a brand-new panel whose dashboard was visually identical. This is the anatomy of those exits.
The shared infrastructure
Of the 14 panels, 11 shared the same domain registrar (a privacy-forward European registrar that does not respond to abuse complaints faster than 90 days). All 14 had Cloudflare in front. Twelve used the same NOWPayments merchant account ID, which is itself unusual — normally each panel registers its own merchant account.
Eight of them shared a Telegram support handle, three deep. The same handle appeared as "owner" on one panel, "support" on another, and "sales" on a third. The handle is in the same Telegram username cluster as four operators we had already flagged from 2024–2025 exits.
The wallet pattern
Crypto deposits across the 14 panels routed through a small set of intermediate USDT TRC-20 addresses that consolidated funds into one of two exchange-facing wallets. The on-chain trail collapses into a handful of withdrawals to deposit addresses on a single CEX, identified by reuse patterns. We do not publish wallet addresses publicly because it tips off the operators to vary their pattern next round, but we share them with researchers on request.
The timing pattern
Each panel followed a similar timeline: 6–14 weeks of clean operation with strong delivery and prompt refills, then 1–3 weeks of degrading support response time, then a marketing surge across Telegram with promotional pricing, then a 5–10 day period of unusually high deposit volume, then a sudden complete halt in delivery.
The marketing surge before the halt is the most reliable early-warning signal. A panel that has been quiet for six weeks suddenly running 30% discount promotions across multiple Telegram channels at once is almost always about to exit. The discount is the bait for one final deposit harvest.
The post-exit rebrand
Of the 14 panels, 9 had a successor panel live on a new domain inside 21 days of the exit. The new domain typically shares: the same panel-builder template skin, the same SKU naming conventions, the same support handle on Telegram (sometimes with a digit appended), and the same TRC-20 wallet cluster for incoming payments.
This is what we have been calling the quiet-rebrand pattern. The operator is not exiting the business — they are exiting the brand. The customer list, the dispute trail, and the negative reviews stay with the dead domain. The infrastructure and the operator continue on the new one.
How we caught the clusters
Four signals together: shared domain registrar, shared NOWPayments merchant ID, shared Telegram handle cluster, and shared TRC-20 wallet routing. Any one signal in isolation is noise — many legitimate panels use the same registrar, plenty share processors, Telegram handles overlap. All four together is a cluster, and clusters predict exits with uncomfortable accuracy.
What this means for buyers
- Keep balances small. If your balance is above $200 and the panel has been running less than 9 months, you are exposed.
- Watch for marketing surges that do not have an obvious calendar reason. The surge before the exit is real.
- Cross-check support handles across panels. If your panel's support handle appears on a second panel as a different role, you are looking at a cluster.
- Diversify deposits across at least two independently-operated panels. Real independence — not two panels in the same cluster.
What we are doing with the pattern
The cluster fingerprint now feeds into the trust score for every panel in our index. New panels with high overlap on registrar + merchant + handle + wallet routing start with a lower baseline score. None of this is foolproof — sophisticated operators will diversify their infra to dodge the fingerprint — but it raises the cost of running the exit playbook, and that is the win we have.
What we are not doing
We are not naming the wallet addresses in public, because public naming is exactly what makes the operators vary their pattern. We are not naming the specific 14 panels — they are already dead, and the buyers who were burned do not need a tombstone. We share the wallet and operator fingerprints privately with serious dispute investigators and law-enforcement-adjacent groups who request them.
Exit scams are not random. They follow a playbook, the playbook is observable, and the early-warning signals are public. The 14 panels that vanished in Q1 left enough fingerprint behind to make the next 14 marginally harder to run. That is the only honest framing for this work.