I could already view on my wallet that I had this funds available so I lost attention.
It looks like he generated a TX for 3,79 BTC, sent from 1E3WStENAFUHj8rPpX6FTpS4KwHKZVFK3m to bc1q63nu0dh3ak6saku7xfdts55g6q6jsg9vwzlvl9, on 2021-07-19 18:29, using a fee of 1.005 sat/B:
https://www.blockchain.com/es/btc/tx/3f93b071087c384703e5ebbdb2f0b007470c9774e07d18b25188ef6c40a02adf
But then used a Replace by Fee to resend the same amount, on 2021-07-19 18:36
,to 16ZbnaPXxwVkWsHeAxcRtnCBccr35tuWAc instead, paying 201.047 sat/B to ensure it was picked-up quick, thus nullifying the first TX:
https://www.blockchain.com/btc/tx/034a8f4f6b88575ef28b314c8c42dfef63cee43d3a002c86f82953005045735d
I am gonna use this post of DdmrDdmr to continue. The bitcoin address used here 1E3WStENAFUHj8rPpX6FTpS4KwHKZVFK3m receives around 3.8 BTC via txid: https://btc.com/btc/transaction/7205197883218a6615ee6c014781b5a483893b77287423bfa99f5c78279bcf9a from just before transferring to victim here which uses inputs from address 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s . After the scammer sends and then nullifies the transaction by doing the rbf he sends back the amount to 16ZbnaPXxwVkWsHeAxcRtnCBccr35tuWAc. Now 16ZbnaPXxwVkWsHeAxcRtnCBccr35tuWAc sends back the amount to 129UStX6iT1TCiFhtar2XEuT73ZBbGjCyG which sends back the amount to 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s via this txid: https://btc.com/btc/transaction/c66c74de8c4a130b41d1339d1247dbbae4876bf855e79e25c1c7b13d8973cba1.
The address I have underlined here : 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s is the hot wallet of Binance (Proof: https://twitter.com/binance/status/961666467325358081) and here is what I think. The scammer made a withdrawal from his account at binance to 1E3WStENAFUHj8rPpX6FTpS4KwHKZVFK3m prior to transaction. He made the scam and then sent it back to Binance where he desposited to his deposit address: 129UStX6iT1TCiFhtar2XEuT73ZBbGjCyG.
Now I went through their blog about their KYC (https://www.binance.com/en/blog/421499824684902130/%E2%80%8BWhat-is-KYC-and-How-Is-it-Increasingly-Important-for-Crypto) and it seems like there is a level of account where they don't need KYC but in that case they have the limit that they will allow daily withdrawal of 0.06 BTC max but since the scammer makes a withdrawal to 1E3WStENAFUHj8rPpX6FTpS4KwHKZVFK3m with amount of 3.8 BTC , he had to submit his details at the exchange in order to push the level for big trades or make withdrawals.
Now all you need to do is to contact Binance and provide them with the transactions that made withdrawal to 1E3WStENAFUHj8rPpX6FTpS4KwHKZVFK3m which is https://btc.com/btc/transaction/7205197883218a6615ee6c014781b5a483893b77287423bfa99f5c78279bcf9a and transaction that was made to deposit back to 129UStX6iT1TCiFhtar2XEuT73ZBbGjCyG which is https://btc.com/btc/transaction/c66c74de8c4a130b41d1339d1247dbbae4876bf855e79e25c1c7b13d8973cba1 and ask them how to take steps in order to catch the scammer. I am sure Binance would be happy to help you out. I don't recall very clearly but I think in a case earlier they tried to help someone like this who was victim to a scam.