⚠️ Scam Report: Jerome Thomas (Telegram: @jerome_th / @satleaksjerome) – Fake SAT, IB, ACT, IELTS & TOEFL Leak Scam, 1,349.70 USDT Taken
SCAM
0
out of
5
👤 Scammer Information
- Name (Alias): Jerome Thomas
- Telegram Username:
@jerome_th— still active, profile advertises "open 24 hours" - Main Channel: https://t.me/satleaksjerome — "IB SAT ACT IELTS AP TOEFL leaks", 3,619 subscribers — still live
- Backup Channel: https://t.me/satleaksjerome1 — "JEROME THOMAS (BACKUP)", 90 subscribers
- Payment Wallets (USDT on Solana):
- Telegram Status Toward the Buyer: "last seen a long time ago" — he blocked him
- Amount Taken From This Buyer: 1,349.70 USDT
- Current Status: Still active. His main wallet received another payment on the day this report was published.
The same buyer was scammed by a second seller in the same period. See our companion report on acemaster / Rashid Harem (@acemasterx).
📦 What Was Promised
The channel name is the whole sales pitch: "IB SAT ACT IELTS AP TOEFL leaks" — leaked papers for
essentially every major international exam, delivered before test day, contact @jerome_th.
With 3,619 subscribers, the channel does the work that a fake testimonial can't: it looks established. That is the only product being sold here.
💰 Verified Transactions on Solana
The buyer paid three times over two weeks. Each payment was withdrawn from his Binance account, and
each one appears on the public Solana blockchain, sent directly from Binance's hot wallet
(5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9,
labelled Binance 2), to a wallet Jerome controls.
| # | Buyer's Binance receipt (KST) | On-chain amount | On-chain time (UTC) | Received by | Gap | Transaction |
|---|---|---|---|---|---|---|
| 1 | 2026-08-28 23:07:58 | 340.00 USDT | 2026-08-28 14:08:26 | BB8bo…MGiHp | 28 s | 43ncF3BB…pppoz3 |
| 2 | 2026-09-01 18:11:45 | 510.00 USDT | 2026-09-01 09:11:53 | BB8bo…MGiHp | 8 s | 5mfLboYK…p56M2 |
| 3 | 2026-09-10 17:26:39 | 499.70 USDT | 2026-09-10 08:26:46 | 9Nuw…T2nHgG | 7 s | 3ap2MPtN…feBrx |
Total: 1,349.70 USDT. Every receipt matches the blockchain within half a minute.
About the screenshot above: this is the buyer's full Binance withdrawal history and it covers both sellers he was scammed by. The 340 USDT (Aug 28), 510 USDT (Sep 1) and 499.7 USDT (Sep 10) rows are the payments to Jerome. The 999.6 USDT row of June 5 was paid to acemaster / Rashid Harem and is traced in that report.
🔍 The Two Wallets
Jerome collected from this buyer using two different Solana addresses. Both are worth looking at, because the blockchain says considerably more than the chat does.
Wallet 1 — BB8boLVUZQeFxUhFwtts3agDosvJbHUmgpg1px8MGiHp
- Active from 2026-07-24 and still receiving money today.
- 145 incoming payments totalling 12,261.72 USDT — this buyer is a small fraction of it.
- 47 of those payments came straight from Binance's hot wallet, totalling 5,945.28 USDT. That is the fingerprint of dozens of separate buyers each funding a withdrawal from their own Binance account, exactly as this buyer did.
- It does not hold money: 55 outgoing transfers move out 12,256.01 USDT, leaving a balance of 4.32 USDT.
- The bulk of it — 10,272 USDT across 44 transfers — goes to a single cash-out wallet,
D9kz8KiUzj7qJBmGV1dn41NhCXrArHxbJbqtRyHgsQ9g.
Wallet 2 — 9NuwzGR5ABAkAG7QjYTFE4hBtrSJDn8ck2tkU4T2nHgG
- A pass-through account: 6,924.80 USDT in, 6,924.80 USDT out, nothing kept.
- The buyer's 499.70 USDT arrived at 08:26:46 UTC on September 10 and was swept out 6 minutes
and 16 seconds later at 08:33:02 UTC, in transaction
LbpMY5pV…XoyD1z. - It went to
2qo8jvuc49pFmTjmUHLiARSV6ppPTaE7gw27ZJ6DnNZy— a Bybit wallet, listed under "Solana" in Hacken's published BYBIT Proof of Reserve report. In total 2,125.89 USDT has been moved from this wallet into that Bybit address. - This account's very last action, ever, was handling the buyer's money. It has been silent since.
The two wallets are the same operator
This is not guesswork. Wallet 1 has sent money directly to Wallet 2 on four occasions, 831 USDT in total:
| Date (UTC) | Amount | Transaction |
|---|---|---|
| 2026-07-24 19:20:56 | 200 USDT | 3yyJJfn3…JZHqAY |
| 2026-07-28 10:10:15 | 25 USDT | 3wuLr6U8…veHFB |
| 2026-08-12 16:45:05 | 600 USDT | YAUyyaaC…ji9Ty |
| 2026-08-20 10:05:24 | 6 USDT | 4Uncs7rf…W6c8E |
Switching addresses between payments looks like caution. On a public ledger it is the opposite: it ties both wallets, and everyone else's money in them, to one operation.
🧊 What Actually Happened
-
August 28 — 340 USDT. First payment.
-
September 1 — 510 USDT. Second payment, same wallet.
-
September 10 — 499.70 USDT. Third payment, to a different wallet. It was moved on to Bybit within six minutes.
-
September 11 — blocked. One day after taking the last payment, Jerome cut him off. The chat is a wall of unanswered messages:
"??" / "Bro?" / "why are you block me" / "bruh" / "??"
-
Nothing was delivered. No SAT, no IB, no ACT, no IELTS, no TOEFL, no refund — and no further contact.
The buyer's own summary, after realising two different sellers had done the same thing to him:
"I already got scammed by another 2 person so im broke as fuck"
⚠️ How to Protect Yourself
- 3,619 subscribers proves nothing. Subscriber counts are cheap and are the main thing being sold. The wallet behind this channel has taken 12,261 USDT from 145 payments and delivered what this buyer got: nothing.
- Paying more does not get you served. This buyer paid three times, and the third payment was the one that got him blocked. Each successful payment only proves you will pay again.
- A "backup channel" is planning for removal. @satleaksjerome1 exists so that the audience survives the next report.
- Money sent from Binance is traceable, and so is the exit. Every one of these three payments is permanently recorded, and the last one landed in a KYC'd exchange account at Bybit within six minutes.
- If you have already paid, report @jerome_th and the channel
@satleaksjerome to Telegram, file a scam report with Binance quoting
your withdrawal, and — if your payment reached
9NuwzGR5…T2nHgG— file with Bybit quoting the sweep transactionLbpMY5pVc4AqA6xRFCaoxj9m4W13rKXshddbJWaGTX79ufj4rWKVNUfxccghLRE1GcdGFyUtekdvGA362XoyD1z.
✅ Conclusion
Jerome Thomas (@jerome_th), operator of @satleaksjerome, is a scam. A buyer paid him 1,349.70 USDT in three transfers between August 28 and September 10, 2026, for exam leaks that were never delivered, and was blocked the day after the final payment. All three payments are confirmed on the Solana blockchain and match his Binance receipts to within 28 seconds. His two wallets are tied together on-chain, have taken over 12,000 USDT from 145 payments, and cash out through Bybit. The channel is still live, still has 3,619 subscribers, and is still taking money.
The same buyer was taken by a second seller in the same window. Read the companion report: acemaster / Rashid Harem (@acemasterx). Between the two of them they took roughly $3,850.
🧾 Chat Screenshots
The Account and the Channel
Payment Proof
Blocked
The Buyer's Own Report
