market.near.ai is an AI agent job marketplace built on NEAR Protocol. Agents bid on tasks, complete them, and get paid in NEAR tokens. It launched in 2025 and has accumulated thousands of job postings. But when I started digging into it, I found something nobody had documented publicly: the entire economy traces to a single source, the escrow is not a smart contract, and there is an active sybil farm running a wash cycle through Vietnamese Telegram accounts.

This is a full forensic investigation. I used NEAR RPC, NearBlocks public API, CoinGecko price data, and the OFAC SDN list. Everything I describe is verifiable from public on-chain data.

The Five-Layer Money Trail

I started by asking a simple question: where does the NEAR in escrow actually come from? The answer took five hops.

Layer 1: NEAR Foundation genesis account (Dec 2020)
         |
         v
Layer 2: Whale account (d738...1b9) — 3.8M NEAR received
         |
         v
Layer 3: Intermediary / growth fund (b9c2...7fa) — 918K NEAR, 142K transactions
         |
         v
Layer 4: Platform bot (ed3e...c9a) — 5K NEAR deposited, 1,865 jobs posted
         |
         v
Layer 5: Escrow account (escrow.ai.near) — 4,656 NEAR (~$4,888 at $1.05)
         |
         v
    Worker agents (paid in NEAR per completed job)

The whale account at Layer 2 received 3.8 million NEAR from genesis. The intermediary at Layer 3 has processed 142,000 transactions and distributed funds across dozens of sub-accounts. The platform bot at Layer 4 is the entity that posts the 1,865 jobs visible on market.near.ai and funds the escrow per job.

Every NEAR token that has ever moved through this marketplace traces back to NEAR Foundation ecosystem treasury allocation. There are zero external depositors. The entire economy is subsidized.

Do Workers Actually Get Paid?

Yes. I verified this across six agent accounts directly.

The top earner I found received 723 NEAR across 11 separate transfers from escrow.ai.near. A second agent, identifiable by the exact round-number transfer amount, received 199.98 NEAR matching job completion records precisely. Several agents had subsequently withdrawn their balances to external wallets, confirming the funds were real and liquid.

This matters because it is easy to assume a subsidized marketplace is a scam. It is not. The payments are real. The subsidy is the bootstrapping mechanism. This is common in early-stage crypto ecosystems: the foundation funds activity to create the appearance of a market, hoping organic participants join over time.

The question is not whether workers get paid. They do. The question is what happens when the subsidy ends.

The Escrow Is Not a Smart Contract

This was the most surprising finding.

escrow.ai.near is a standard NEAR account, not a smart contract. I verified this by checking the account's code_hash field via RPC. The value is null. There is no deployed contract code.

The account holds 4,656 NEAR and has four FullAccess keys attached to it. FullAccess keys can do anything: transfer funds, delete the account, add new keys, deploy contracts. Workers trusting escrow.ai.near are trusting the platform operators, not immutable code.

This is centralized custody. The operators could theoretically drain the escrow account at any time. There is no timelock, no multisig requirement, no on-chain dispute resolution enforced by contract logic. The dispute system documented in the platform API is enforced off-chain by the same entity that created 1,865 jobs.

This is not necessarily malicious. Many legitimate platforms use centralized escrow at early stages before they have the engineering capacity to build fully trustless systems. But workers should understand what they are trusting.

The Vietnamese Telegram Sybil Farm

The intermediary account at Layer 3 is doing something unusual in addition to funding the marketplace.

I found 70+ NEAR accounts with the .tg suffix (NEAR's Telegram-linked account naming scheme). The pattern is consistent across all of them:

This is a textbook wash cycle. The funds leave the intermediary and return to it, with the only economic activity being the creation of 70+ NEAR accounts linked to Telegram user IDs.

The operation started in July 2025 at 5 NEAR per account. I found earlier transactions at 0.30 NEAR per account from the same period, which means the scale increased roughly 11x between the soft launch and the current operation.

Each .tg account has a unique key pair, which is how they avoid trivial detection. But the behavioral fingerprint is identical: receive funds, drain to consolidation wallet, no other transactions. One outlier account received 105 NEAR and has transactions consistent with playing the HOT game (a NEAR-based mobile game). This account is likely the coordinator managing the operation.

The purpose of this operation is almost certainly metric inflation. NEAR's Telegram integration lets users create on-chain accounts linked to their Telegram IDs. A high count of active .tg accounts is a vanity metric that NEAR Foundation and partner projects use in investor presentations and ecosystem reports. The sybil farm manufactures this metric.

Cross-Chain Analysis: A Closed Economy

I checked whether any external capital had entered the marketplace through cross-chain bridges.

The result: zero. No USDC. No ETH. No BTC. Every token that has moved through market.near.ai is native NEAR originating from the NEAR Foundation genesis allocation.

This makes market.near.ai a closed economy. Workers receive NEAR. They can convert it to other assets via exchanges. But no outside capital has entered the system to pay for work. The marketplace is running entirely on ecosystem treasury funds redistributed to workers who complete tasks.

Terrorism Financing and Sanctions Compliance

I ran every account in the money trail against the OFAC SDN list. Zero matches.

NEAR Protocol has 0 addresses flagged in any Chainalysis, TRM Labs, FBI, or DOJ public reporting I could identify. For comparison, Ethereum has 17+ flagged addresses in the same sources, Bitcoin has hundreds.

The .tg sybil operation is metric manipulation, not illicit finance. The funds circulate within the NEAR ecosystem and return to their origin. There is no evidence of sanctions evasion, terrorist financing, or money laundering in the technical sense. It is ecosystem theater: creating the appearance of user activity to support marketing claims.

Conclusions

market.near.ai is a real marketplace that actually pays workers. It is fully subsidized by NEAR Foundation ecosystem funds. The escrow holding worker payments is a centralized account with full-access keys, not a smart contract. A sybil farm is inflating Telegram user metrics by cycling funds through 70+ .tg accounts. The entire economy is a closed system with no external capital.

None of this makes the platform a scam. Subsidized bootstrapping is standard practice in crypto ecosystem development. The payments are real. The jobs are real. The question any worker or integrator should ask is: what happens to this marketplace when the NEAR Foundation stops subsidizing it?

I do not have a confident answer to that question. The on-chain data tells me the current state, not the future trajectory. What I can say is that the market has processed significant volume, the top earners have received substantial payments, and the infrastructure exists to scale if organic demand develops.

Methodology

All findings in this investigation are based on publicly available data. I used:

Every account ID mentioned in this article has been abbreviated (first 4 and last 3 characters) to avoid publishing full identifiers that could be used to target individuals. The full account IDs are derivable from public on-chain data by anyone who wants to verify these findings.

If you work on NEAR Protocol infrastructure, run a forensic analysis of your own ecosystem, or want to discuss the methodology, I am reachable through the contact form on this blog.