Defend Against Cybercrime with the Power of Community

ChainBounty · Ethereum mainnet · Activity window: November 1–4, 2026 · SentinelTX report CASE-CBE85A32, November 5, 2026SentinelTX's report on the publicly reported theft from an EU entity follows three Ethereum addresses through USDC transfers, ETH relays, and ETH-to-USDT swaps. It records a 9,582,349.791029 USDC transfer from the first starting address, four transfers totaling 20,000,000 USDC from the second, and 2,592 ETH dispersed from the third. These are separate observations within the traced activity, not components of a verified total loss.The distinction that shapes the report is between a recorded transfer and a complete account of where its value came from or ultimately went. A USDC route passes through a wallet with mixed funding. A relay reaches an address publicly described as a Kraken deposit address, but the report does not confirm that attribution. A reported USDT freeze also remains unconfirmed.1. Three starting addresses, one Ethereum-only scopeThe report uses three starting addresses, called seeds. Their public descriptions explain why they were selected; those descriptions are not ownership findings. Ownership of the three addresses is not established.Role / scope: Seed 1: reported exchange-paid wallet — Description in the PDF: 0x730bcb…723992. Its inbound exchange payout was not traced because the investigation ran outbound.Role / scope: Seed 2: reported swap wallet — Description in the PDF: 0x9eca05…015547. The report records USDC transfers to a resolver-labeled address and other downstream activity.Role / scope: Seed 3: reported frozen-USDT wallet — Description in the PDF: 0xa3a985…74ae0d. The report records ETH dispersal and a USDT holding, but does not confirm a freeze.Role / scope: Network and analysis window — Description in the PDF: Ethereum mainnet, chain ID 1. November 1, 2026, 00:00:00 UTC, through November 4, 2026, 12:35:00 UTC.Role / scope: Tracing depth — Description in the PDF: Outbound movements, up to three downstream hops per seed. Coverage of Seeds 1 and 2 is incomplete.Role / scope: Balance snapshot — Description in the PDF: Block 26341513, November 4, 2026, 12:41:11 UTC. These are historical balances, not current holdings.The report examines one publicly described withdrawal wallet and two additional starting addresses. It does not establish the full extent of the reported theft.The victim’s identity and the circumstances of the reported theft are not established by these Ethereum transactions. This article uses the broader description “EU entity” without identifying a victim or deriving a loss total.2. The USDC route passes through mixed fundingSeed 1 sent 9,582,349.791029 USDC to an intermediary at 22:06:11 UTC on November 1. That intermediary sent 5,270,291.000000 USDC to a second intermediary at 22:20:23 UTC. The second intermediary then sent Seed 2 a total of 13,495,000.000000 USDC in three transfers after midnight on November 2. The PDF summarizes this route as approximately 9.58 million → 5.27 million → 13.50 million USDC. [E1–E3]Stage: Seed 1 to the first intermediary — Recorded movement and meaning: 9,582,349.791029 USDC to 0xc80f1c…4a8ce4. E1.Stage: First intermediary to the commingled wallet — Recorded movement and meaning: 5,270,291.000000 USDC to 0xb40435…06d39b. E2.Stage: Commingled wallet to Seed 2 — Recorded movement and meaning: 13,495,000.000000 USDC across three transfers: 5,000,000.000000; 5,000,000.000000; and 3,495,000.000000 USDC. E3a–E3c.Stage: Attribution limit — Recorded movement and meaning: Only the approximately 5.27 million USDC inflow is observed coming from the Seed 1 branch. The report does not attribute the entire approximately 13.50 million USDC receipt to Seed 1.These amounts describe successive transfers, not separate losses to add together. The larger outgoing total at the second intermediary reflects the report's finding that it pooled funds from at least one other source; the rest of its inflow was not traced.Seed 2's own activity also has a separate chronology. It sent four transfers of 5,000,000 USDC each to 0x225a38…f2dc17, labeled “Rizzolver, Unknown” in the report, between 23:51:23 UTC on November 1 and 00:15:11 UTC on November 2. The report assesses these as swap inputs, but the corresponding ETH outputs were not itemized. Its public-source description of a UniswapX auction remains an attribution, not a confirmed identification of the resolver as a UniswapX filler. [E4a–E4d]The evidence does not establish which funds financed each resolver payment. No allocation of Seed 1-derived value to those payments is made here.Figure 1. The report describes Seed 1 → Seed 2 as a partial path through commingled funds. Display values are approximate: the first two transfers were 9,582,349.791029 USDC and 5,270,291.000000 USDC. Wallet B subsequently sent 5,000,000.000000, 5,000,000.000000, and 3,495,000.000000 USDC to Seed 2. Its other inflows were not traced. These movements are not a loss total.Color key: slate marks the selected USDC route and its displayed amounts. Direct labels identify each address role; color does not establish ownership or attribution. Equal-width arrows are not scaled to value.Address / role key: Seed 1 = 0x730bcb…723992; Relay A = 0xc80f1c…4a8ce4; Wallet B = 0xb40435…06d39b; Seed 2 = 0x9eca05…015547. Wallet B is the commingled intermediary, not an exchange or pool attribution.Attribution note: The funding source of each resolver payment is not established.Source: SentinelTX, Investigation report CASE-CBE85A32, November 5, 2026, pp. 4, 6–7 and 18–20.A separate transfer sent 7,166,580.962400 USDC from Seed 2 to the unlabeled address 0x52b335…e3fb09 at 00:00:47 UTC on November 2. This is the transaction summarized as approximately 7.17 million USDC in the narrative. The broader flow summary lists two transfers to that address totaling 10,661,580.962400 USDC; the single transaction and the aggregate have different scopes. [E5]3. Seed 3's ETH movements lead to a relay and a separate swap sequenceSeed 3's ledger records five outbound transfers totaling 2,592 ETH. One branch includes a 395 ETH transfer to 0xd359df…0a0573, followed by 395.999977992739261 ETH to 0xf5968b…014ae1 and 395.999955100039942 ETH to 0xfa6766…159556. The final transfer occurred at 10:11:47 UTC on November 3. The chronology displays those last two amounts as approximately 395.999978 ETH and 395.999955 ETH. [E6–E8]These three transfers are presented at their recorded amounts. The evidence does not establish that the entire onward amount originated from Seed 3.The final recipient, 0xfa6766…159556, is described as a Kraken deposit address in the public source cited by the PDF. The report does not independently confirm that attribution. The publicly reported onward sweep was beyond the three-hop depth and was not traced. The observed transfer therefore supports an endpoint lead, not a confirmed Kraken cash-out or an identified account holder.Figure 2. The resolved relay rows are ordered, not scaled to elapsed time. Seed 3 sent 395.0 ETH to R1. R1’s full-ledger outflow was 395.999977992739261 ETH, and R2’s was 395.999955100039942 ETH; the graphic rounds these to six decimals. The onward transfers are not attributed in full to Seed 3.Color key: slate marks the selected transfer times and quantities. Direct labels identify the source, relays, and recipient.Address / role key: Seed 3 = 0xa3a985…74ae0d; Relay R1 = 0xd359df…0a0573; Relay R2 = 0xf5968b…014ae1; Recipient R3 = 0xfa6766…159556. Full identifiers appear in the appendix.Attribution note: R3 has no confirmed service attribution. Its identification as a Kraken deposit address is an attributed public-source lead. The reported onward sweep was beyond the three-hop trace; the figure stops at R3.Source: SentinelTX, Investigation report CASE-CBE85A32, November 5, 2026, pp. 8–10 and 17–18.ETH-to-USDT swaps are a separate branchAt 17:10:23 UTC on November 3, Seed 3 sent 2,000 ETH to 0xb3a21e…f99762. That address subsequently funded 0x2fb89a…df8516, where the report describes two ETH-to-USDT swaps on November 4. This is separate from the relay described above. [E9–E11]Stage: First swap, 07:30:35 UTC — Recorded operation: 87.999 ETH was wrapped and sent out as WETH; 202,156.840322 USDT was received. E10.Stage: Second swap, 07:50:35 UTC — Recorded operation: 43.00091147 WETH was sent out; 98,911.866452 USDT was received. E11.Stage: Combined swaps — Recorded operation: The PDF classifies 130.99991147 ETH of input and 301,068.706774 USDT of output. The wrapping and WETH movements are parts of the swaps, not additional value to count again.Stage: Smaller onward payment, 08:25:23 UTC — Recorded operation: 5.000000 USDT went to 0x70e9b5…352a3c. E12.Stage: Main onward payment, 08:26:47 UTC — Recorded operation: 301,063.706774 USDT went to the unlabeled address 0x7ebce2…133fd4. E13.The printed rows account for the two USDT outputs through the 5 USDT payment and the 301,063.706774 USDT transfer. They do not establish a destination on another chain. The public-source USDT0/LayerZero description remains unverified, as do the report's other attributed off-Ethereum routes.4. Service labels and historical balances have narrower meaningsThe report lists five transfers to an address labeled “Chainflip, Exchange,” totaling 241.00 ETH, on November 2–3. Its narrative places them in the Seed 2 graph. The retained routing table identifies the sender as 0x05184a…d1b01e. These observations do not supply destination-chain settlement records or prove a completed conversion to cash. [E14a–E14e]At the balance snapshot, Seed 3 held two assets. The second ETH holding below comes from a ledger residual rather than a block-anchored balance read, a distinction the PDF explicitly preserves.Address / measurement: Seed 3: ETH balance — Quantity and stated limit: 1,858.999296273752596983 ETH at block 26341513.Address / measurement: Seed 3: canonical USDT balance — Quantity and stated limit: 1,142,716.43173 USDT at block 26341513, under Tether USD contract 0xdac17f958d2ee523a2206206994597c13d831ec7.Address / measurement: 0xb3a21e…f99762: ETH ledger residual — Quantity and stated limit: 1,559.999871347187806602 ETH. The PDF identifies this as ledger-derived, not a block-anchored balance read.Address / measurement: Freeze status — Quantity and stated limit: The reported Tether freeze remains unconfirmed. The available evidence does not establish the reason for the unsuccessful USDT transfers and approval calls.Unsuccessful USDT transfers and approval calls do not, on their own, establish a freeze. The ETH balances are not frozen assets or confirmed recoveries, and none of these snapshot quantities describes the present balance.5. What the report concludesThe report documents substantial transfers, relay activity and swaps. These movements do not establish how the exchange accounts were accessed, who controlled the addresses, or the victim’s total loss.The next investigative steps are to corroborate the publicly attributed Kraken endpoint, obtain confirmation of the reported Tether freeze, and seek relevant venue order and destination records. These are investigative leads, not completed actions or recovery assurances.Figure 3. The report separates observed movements from partial links and attributed claims. Seed 3’s five outbound transfers total 2,592 ETH. Its USDT balance was 1,142,716.43173 USDT at block 26341513 (2026-11-04T12:41:11Z), approximately six minutes after the analysis window closed. A balance is not proof of a freeze or a recovery amount, and the asset quantities are not combined into a loss estimate.Color key: slate marks section headings only. Evidence strength is stated in words, not encoded by color.Address / role key: Seed 1 = 0x730bcb…723992; Seed 2 = 0x9eca05…015547; Seed 3 = 0xa3a985…74ae0d.Scope note: Ethereum mainnet only; the outbound trace reached up to three hops. Seed 1 and Seed 2 coverage was incomplete. A direct funding link between Seed 2 and Seed 3 is not established. The report calls for corroborating the Kraken attribution, confirming Tether’s freeze, obtaining service order records, and establishing the remaining funding links.Source: SentinelTX, Investigation report CASE-CBE85A32, November 5, 2026, pp. 4–5 and 16–18.6. Selected evidence appendixThese IDs organize records reproduced from the PDF; they do not indicate a new investigation. Etherscan links below are navigation links constructed from the full Ethereum hashes printed in the PDF. The PDF remains the source for the descriptions, quantities, status, and timing. “Verified” is the report's status for a transfer, not proof of ownership, intent, victim linkage, or final destination.E1–E5: USDC route and Seed 2 transfersEvidence ID: E1 — PDF record: 0x9aa5e3281ce4c8d83f290e20e7c6a66b056965aab2468311115c10e1433050d8. November 1, 2026, 22:06:11 UTC; block 26322798; 9,582,349.791029 USDC; verified. PDF pp. 6, 18.Evidence ID: E2 — PDF record: 0x5a27bea73f50440194aab5744002757af96583a4f7002254d2c6af276f16e161. November 1, 2026, 22:20:23 UTC; block 26322867; 5,270,291.000000 USDC to the commingled wallet; verified. PDF pp. 6, 19.Evidence ID: E3a — PDF record: 0x3d20cf5a8034f5924c555470e1f4fe75e36704b0da6f25d53ba043afb81e85d4. November 2, 2026, 00:09:35 UTC; block 26323412; 5,000,000.000000 USDC to Seed 2; verified. PDF pp. 7, 20.Evidence ID: E3b — PDF record: 0x7e125322be3021b881bafa7a3ccfcba229d2d30511add1a991e4a12103ee2ae0. November 2, 2026, 00:14:11 UTC; block 26323435; 5,000,000.000000 USDC to Seed 2; verified. PDF pp. 7, 20.Evidence ID: E3c — PDF record: 0xbdd896d7ce518156ecd2d564e6eccb6199fa4fc01f67fc619177236429a13931. November 2, 2026, 00:18:11 UTC; block 26323455; 3,495,000.000000 USDC to Seed 2; verified. PDF pp. 7, 20.Evidence ID: E4a — PDF record: 0x04fd5b5e8fbb800f186656ff0dc22709bb40c2844b6ab00e98c36e6dd2510518. November 1, 2026, 23:51:23 UTC; block 26323321; 5,000,000.000000 USDC to the resolver-labeled address; verified. PDF pp. 7, 20.Evidence ID: E4b — PDF record: 0xc3e3296c6a57f3e340592e7afce01a3d76a4bf3e275fe6a71cea1f356272fcca. November 1, 2026, 23:56:23 UTC; block 26323346; 5,000,000.000000 USDC; verified. PDF pp. 7, 20.Evidence ID: E4c — PDF record: 0x0cc65b5600a9d58aed4c0aeb712caaf928f24dc30a6d205ea692436f724d5798. November 2, 2026, 00:11:59 UTC; block 26323424; 5,000,000.000000 USDC; verified. PDF pp. 7, 20.Evidence ID: E4d — PDF record: 0xf89d84a28d9868d361baee22036c2981bc412487a13fcdb339f5b337a06aa8c7. November 2, 2026, 00:15:11 UTC; 5,000,000 USDC. This row is stated in the chronology on PDF p. 7; no separate block or verification status is printed there.Evidence ID: E5 — PDF record: 0x66c8e8dcbe0750d8bfbfc298895b82fb5bb125ff123c8263d0aafdbd75205c07. November 2, 2026, 00:00:47 UTC; block 26323368; 7,166,580.962400 USDC; verified. PDF pp. 7, 19.E6–E9: ETH relay and funding of the separate swap branchEvidence ID: E6 — PDF record: 0x499ab00a77fc9dceeb7141e5a7d6565c36b936d6de7d052a3973986fb451c08f. November 3, 2026, 09:26:59 UTC; block 26333369; 395.000000000000000000 ETH from Seed 3 to the first relay; verified. PDF pp. 9, 22.Evidence ID: E7 — PDF record: 0xcd36c13ff7ad05d7aac27dd6ab7fd7191bb3fc7ed9e5b0e62bd532e4006bd377. November 3, 2026, 10:08:59 UTC; block 26333579; 395.999977992739261000 ETH to the second relay; verified. PDF pp. 9, 22.Evidence ID: E8 — PDF record: 0xfb7a6f5f819e12e9f5220564e03954c616d714a93c0f3626d3867d9f3a9bdca9. November 3, 2026, 10:11:47 UTC; block 26333593; 395.999955100039942000 ETH to 0xfa6766b362461a20046451b16277ec5f7d159556; verified. PDF pp. 8–10, 21. Kraken attribution is unconfirmed.Evidence ID: E9 — PDF record: 0x9c8279d0abf25b2e4c1c7e978517bc9176b5128647c6917ebc27120d562746db. November 3, 2026, 17:10:23 UTC; block 26335681; 2,000.000000000000000000 ETH from Seed 3 to 0xb3a21eb35ba99f2d9a2bc11f1f6fa17e00f99762; verified. PDF pp. 9, 22.E10–E13: swaps and onward USDT paymentsEvidence ID: E10 — PDF record: 0x504d03a1a6f90611d4ba874106463015ecbebf41a1dad7e2df54ebecfd239327. November 4, 2026, 07:30:35 UTC; block 26339966. Recorded legs: 87.999000000000000000 ETH wrapped, 87.999000000000000000 WETH sent, and 202,156.840322 USDT received; verified. PDF pp. 9, 23.Evidence ID: E11 — PDF record: 0xa8d8666e23819babb2f3653c95c17eaa9a369b010722fc99f1f9e92337cd5d08. November 4, 2026, 07:50:35 UTC; block 26340066. Recorded legs: 43.000911470000000000 ETH wrapped, 43.000911470000000000 WETH sent, and 98,911.866452 USDT received; verified. PDF pp. 9, 23.Evidence ID: E12 — PDF record: 0x7f008e0153463b9301dafd2554b6b1917ab31128e3a64cb6854f6d7ce5ec1ae9. November 4, 2026, 08:25:23 UTC; block 26340238; 5.000000 USDT to 0x70e9b573831d62bbc503b1b00bd611bac4352a3c; verified. PDF pp. 9, 23.Evidence ID: E13 — PDF record: 0x066846fd1d44770473109fe8e16f2a91b069d8019f179f0dafbc1728a9408803. November 4, 2026, 08:26:47 UTC; block 26340245; 301,063.706774 USDT to 0x7ebce287d5db06103152bd5dc114b8d5f2133fd4; verified. PDF pp. 9, 24.E14: service-labeled recordsEvidence ID: E14a — PDF record: 0xc92fb17f37ced481e4fb6d8506a85645322dba764d603d535d2d463ebbd9f082. November 2, 2026, 03:08:23 UTC; block 26324303; 50.000000000000000000 ETH to the Chainflip-labeled address; verified. PDF pp. 8, 21.Evidence ID: E14b — PDF record: 0x0983fc81da40e8f4cca0773f7b2e6ed307804e7924a1bd34e0d8322d16c9d4b8. November 2, 2026, 03:13:59 UTC; block 26324331; 100.000000000000000000 ETH; verified. PDF pp. 8, 21.Evidence ID: E14c — PDF record: 0xf5b035bca990e0de75dba21b42cbcb8f2b2e97cfe76f5fc8991d9def6259e860. November 2, 2026, 05:14:11 UTC; block 26324931; 45.000000000000000000 ETH; verified. PDF pp. 8, 21.Evidence ID: E14d — PDF record: 0x377743658f05b76d8a47e68201c217a2673aa0bd4c99f7878c280ff5d847eefd. November 2, 2026, 05:24:11 UTC; block 26324981; 32.000000000000000000 ETH; verified. PDF pp. 8, 21.Evidence ID: E14e — PDF record: 0x19820a17988318c2d56771b2a6349e6eca027549b61fa6937de02cc0fe8e2dd8. November 3, 2026, 21:51:59 UTC; block 26337084; 14.000000000000000000 ETH; verified. PDF pp. 8, 21.Address and role registerLabel: Seed 1 — Full address and role in the PDF: 0x730bcb1296758c377149d7409f98f041cf723992. Publicly described as exchange-paid; ownership unconfirmed.Label: First USDC intermediary — Full address and role in the PDF: 0xc80f1cd39dc15a341c4ff083ece7d526964a8ce4. Receives E1 and sends E2.Label: Commingled USDC intermediary — Full address and role in the PDF: 0xb4043516a2e5c20e6227ea074c4112457d06d39b. Sends E3a–E3c.Label: Seed 2 — Full address and role in the PDF: 0x9eca05d78f6751c91ab048858b7d21a67c015547. Publicly described as a swap wallet; ownership unconfirmed.Label: Resolver-labeled recipient — Full address and role in the PDF: 0x225a38bc71102999dd13478bfabd7c4d53f2dc17. “Rizzolver, Unknown.”Label: Other USDC recipient — Full address and role in the PDF: 0x52b335fd4d229c4b4ffa6190526e4b5fb8e3fb09. Unlabeled.Label: Seed 3 — Full address and role in the PDF: 0xa3a98584d410c4e32f9825f6af1168f4e774ae0d. Publicly described as frozen-USDT wallet; ownership unconfirmed; freeze unconfirmed.Label: First ETH relay — Full address and role in the PDF: 0xd359dfac0ec3032939f95839cba50b5ad10a0573. Single-forward relay in the report.Label: Second ETH relay — Full address and role in the PDF: 0xf5968bc4d8cd1c75a7ddb93b158689eff9014ae1. Single-forward relay in the report.Label: ETH relay recipient — Full address and role in the PDF: 0xfa6766b362461a20046451b16277ec5f7d159556. Service attribution unconfirmed; publicly attributed Kraken deposit address.Label: Separate ETH branch — Full address and role in the PDF: 0xb3a21eb35ba99f2d9a2bc11f1f6fa17e00f99762. Receives 2,000 ETH from Seed 3.Label: Swap address — Full address and role in the PDF: 0x2fb89a93a1908b1902da6b5a6e3459df75df8516. Site of E10 and E11.Label: Main onward USDT recipient — Full address and role in the PDF: 0x7ebce287d5db06103152bd5dc114b8d5f2133fd4. Unlabeled; bridge role unconfirmed.Label: Chainflip-labeled recipient — Full address and role in the PDF: 0xf5e10380213880111522dd0efd3dbb45b9f62bcc. “Chainflip, Exchange.”7. Source and scopeSource: SentinelTX, Investigation report CASE-CBE85A32, 5 November 2026. This article presents selected records and assessments from the report; it is not an independent on-chain validation. The report cites Bitquery’s EU theft investigation for public-source context.The analysis covers selected Ethereum activity. Some records predate the November 1–4 analysis window and provide background only. Coverage is incomplete; the recorded movements do not establish total incident loss or demonstrate that every listed transfer belongs to the incident. Values moving through successive addresses are not added together, and different assets are not combined into a loss estimate.The Seed 1 route passes through commingled funds. The evidence does not allocate Seed 1-derived value to individual resolver payments or establish a direct funding link between Seed 2 and Seed 3. Service-labeled transactions alone do not establish a case-linked cash-out, an account holder or settlement on another chain.The publicly reported Kraken attribution and Tether freeze remain unconfirmed. A historical balance is not a current holding, confirmed frozen amount or recovery. The report does not establish the victim’s identity, account-access mechanism or final destination of the funds. Other-chain routes remain outside the demonstrated scope.

ChainBounty · Bitcoin · Activity recorded from 30 October to 6 November 2026 UTC · SentinelTX CASE-ASYNCEB6, 7 November 2026The Bitcoin address reported in the BTCPay Server hot-wallet incident distributed funds to 20 unlabeled first-hop counterparties in the report’s retained first-hop set. SentinelTX’s report records 19.39799626 BTC across that retained set, including individual legs of 5.5 BTC and 4.71 BTC. These are gross address outflows, not an established incident loss or cash-out total.The distinction matters. The report documents transaction movements but does not establish who controlled the recipients, whether every payment was theft proceeds, or where the funds ultimately reached a custodial service. Small receipts continued on 6 November, and the reported address held 0.11396900 BTC at the report’s balance read. Neither observation, on its own, resolves the incident’s scope.1. What the report followsThe reported incident concerns BTCPay Server hot wallets on servers running version 2.4.1 or earlier. A hot wallet keeps the keys needed to spend funds on the server. The Bitcoin address examined here is associated with the incident in the reporting cited by SentinelTX; that association does not establish that every transaction belongs to the incident.This analysis covers the Bitcoin movements documented in SentinelTX’s 7 November 2026 report. Litecoin activity is outside its scope and is not included in any Bitcoin figure.Role / scope: S0: reported Bitcoin destination — Report description: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7. Starting address; vendor attribution remains reported.Role / scope: R1: largest retained first-hop leg — Report description: bc1qn3fze9w3c0m38y84v76qr2z5dz9cjx0hz4aeva. Received 5.5 BTC; no entity attribution.Role / scope: R2: second-largest retained first-hop leg — Report description: bc1q8hyw6c47t4cskvn655csdc8ym7wc7tcnj6ws4j. Received 4.71 BTC; no entity attribution.Role / scope: Network — Report description: Bitcoin only. The Litecoin address is context, not part of this trace.Role / scope: Recorded scope — Report description: Selected timestamped movements span 2026-10-30T13:45:55Z to 2026-11-06T23:54:17Z. Coverage is incomplete.Role / scope: Coverage limit — Report description: The retained outbound set contains 20 first-hop counterparties. No labeled cash-out endpoint is established.Source: SentinelTX CASE-ASYNCEB6, pp. 4–5, 13–17 and 23–24. Address labels S0, R1 and R2 are reading aids for this article, not entity attributions.2. Twenty retained first-hop paymentsThe report’s chronology records first-hop outbound payments between 30 October and 2 November. Six transactions are itemized with block, input/output and fee details. Their counterparty legs total 14.7891317 BTC. Fourteen further retained recipients total 4.60886456 BTC, giving the report’s 20-counterparty total of 19.39799626 BTC.The 20-counterparty set is a partial record of first-hop movements, not a complete inventory of payments during the period.The largest retained legsThe 5.5 BTC leg, E1, was recorded at 17:06:47 UTC on 1 November, in block 974153. The 4.71 BTC leg, E2, followed at 22:29:40 UTC in block 974185. Both appear as verified in the PDF’s Path Routing Evidence. That status concerns the retrieved transaction and its named addresses; it does not establish the identity or authority of the signer.Selected leg: E1 → R1 — Counterparty amount and timing: 5.5 BTC · 1 November 2026, 17:06:47 UTC · block 974153Selected leg: E2 → R2 — Counterparty amount and timing: 4.71 BTC · 1 November 2026, 22:29:40 UTC · block 974185Selected leg: E3 → R3 — Counterparty amount and timing: 1.3 BTC · 1 November 2026, 16:42:26 UTC · block 974150Selected leg: E4 → R4 — Counterparty amount and timing: 1.29504468 BTC · 2 November 2026, 00:53:51 UTC · block 974195Selected leg: E5 → R5 — Counterparty amount and timing: 1.11506206 BTC · 1 November 2026, 16:14:14 UTC · block 974146Figure 1. The five largest retained first-hop counterparty legs, shown on a common BTC scale. This selection is not an incident-loss total.Color key: Slate groups comparable Bitcoin amounts; color does not identify ownership or risk.Address / role key: Chart labels L1–L5 correspond to article recipients R1–R5, respectively. These are unlabeled first-hop counterparties; their full addresses and selected transaction records appear in the reference appendix.Source: SentinelTX CASE-ASYNCEB6, Transaction Chronology, pp. 11–13.3. Consolidation is visible; victim attribution remains openSeveral transactions consumed many inputs. E2, the 4.71 BTC leg, used 138 inputs. E4, the 1.29504468 BTC leg, used 105. A separate single-output transaction, E6, consolidated 20 inputs into one output of 0.86902496 BTC.SentinelTX assesses that this pattern is consistent with many small UTXOs accumulating at one collection address before redistribution. In the reported incident context, it fits a possible automated, multi-target hot-wallet drain. The qualification is essential: the report has not matched each input to an identified BTCPay instance or victim. Input count is not victim count.Five of the six fully itemized spends had two outputs. The report assesses the smaller second outputs as probable change, not confirmed change, and does not identify their receiving addresses. It therefore does not establish whether those outputs returned to S0 or moved to new addresses. E6, by contrast, had a single output and no change output.The distribution pattern also does not, by itself, prove laundering intent. SentinelTX explicitly allows alternatives such as service deposit addresses, OTC counterparties or wallets controlled by the same operator. Round amounts and close timing do not decide among those explanations.4. Later receipts and the balance are different observationsThe report records a partial sample of 21 receipts on 6 November, totaling 634,549 sats, or 0.00634549 BTC. This is not a complete daily inflow total.One documented receipt, E7, transferred 0.0021017 BTC from bc1quh87wd84ansf7ucwf6arge3kaem03ar20av3vv at 23:54:17 UTC in block 974868. The sender’s identity and the payment’s connection to the incident are not established.At 00:06:13 UTC on 7 November, a balance read against chain tip 974868 returned 0.11396900 BTC at S0. The tip’s block time was 23:54:17 UTC on 6 November. This is a balance at the reported read, not a claim about the balance when this article is read, recovered funds or a confirmed freezable amount.Figure 2. Separate observations from the report: the retained outbound set, the partial 6 November receipt sample and the subject-address balance. These quantities are not added together or treated as a loss reconciliation.Color key: Slate marks retained outflows, sage partial receipts and amber the balance snapshot. Labels preserve those distinctions without color; color does not indicate risk or certainty.Address / role key: All three observations concern S0, the vendor-reported Bitcoin destination.Source: SentinelTX CASE-ASYNCEB6, Executive Summary and Transaction Chronology, pp. 4–5 and 13–14.5. Where the trace stopsNo exchange deposit or bridge deposit is established within the examined activity. The reported address and the five largest first-hop recipients have no confirmed entity attribution. Coverage is incomplete, so the findings do not exclude other routes or later off-ramps.The report separately lists addresses with no outbound movement in the traced set. “Terminal” in that table describes the boundary of the retained trace. It does not establish that an address is permanently unspent, a final real-world destination or a custodial account.The continued receipts on 6 November are therefore unresolved. If they were further drains, they would matter for the duration of the incident. The report labels that interpretation unverified because the senders and circumstances have not been established. Unrelated payments to a publicly reported address remain an alternative.6. Conclusion and the report’s next stepsThe clearest result is transaction-level: the reported Bitcoin destination made the cited outbound payments, with the two largest retained legs at 5.5 BTC and 4.71 BTC. The retained chronology records 20 first-hop counterparties and 19.39799626 BTC. It does not establish that all of that value belongs to the BTCPay incident.The next investigative steps are to match consolidation inputs to individual victims’ transactions and follow the largest recipient legs toward a named service. A freeze or KYC request would require a transaction-level deposit anchor at an identified exchange. Litecoin requires a separate investigation.For affected operators, the report recommends preserving server logs, version information and relevant wallet records, reporting to the appropriate authorities, updating to BTCPay Server 2.4.7 and rotating keys that were present on an affected server. These are recommendations attributed to the report and its vendor/media context. They do not convert the observed address activity into a confirmed total loss or a promise of recovery.Figure 3. The report’s conclusion: cited Bitcoin movements are recorded; total incident loss, recipient control and exchange cash-out are not established. Its next steps are victim-level input matching and forward tracing to a named venue.Color key: Slate identifies section headings only; the written labels state findings and limits.Source: SentinelTX CASE-ASYNCEB6, Recommendations and Conclusion, pp. 18–20.7. Selected evidence and source notesThe records below are selected from the PDF. They are not a new on-chain audit or a complete evidence ledger. All times are UTC.E1 — Largest retained legField: Transaction — PDF value: 53c7f20ae0b3bd65e6596300bbb5ca962fb9787d40bd8ca03635cbab1a76659eField: Route — PDF value: S0 → R1Field: Time / block — PDF value: 2026-11-01 17:06:47 UTC · 974153Field: Counterparty leg — PDF value: 5.5 BTCField: Inputs / outputs — PDF value: 5 / 2Field: Other output / fee — PDF value: 0.01962723 BTC probable change, not confirmed · 0.00001116 BTC feeField: Reference — PDF value: Transaction Chronology, p. 11; Path Routing Evidence, p. 20, verifiedE2 — The 138-input consolidationField: Transaction — PDF value: 0753f5147dfb38fb85f4aba2f7bdfc40caa9ce466cf6273f2c02064260abe0c9Field: Route — PDF value: S0 → R2Field: Time / block — PDF value: 2026-11-01 22:29:40 UTC · 974185Field: Counterparty leg — PDF value: 4.71 BTCField: Inputs / outputs — PDF value: 138 / 2Field: Other output / fee — PDF value: 0.00019156 BTC probable change, not confirmed · 0.00040098 BTC feeField: Reference — PDF value: Transaction Chronology, p. 12; Path Routing Evidence, p. 21, verifiedE3–E7 — Additional cited recordsRecord: E3 — PDF value: 9e8056908abb41fe0c2800b83d36148c4f2d7c4509caf688cce55f2c2967b16e · S0 → R3 · 1.3 BTC · 2026-11-01 16:42:26 UTC · block 974150 · pp. 11 and 21Record: E4 — PDF value: d680e16a027e114d09a6915556c599227f7efa3a7fc20292bfcf4d06e562a557 · S0 → R4 · 1.29504468 BTC · 2026-11-02 00:53:51 UTC · block 974195 · 105 inputs / 2 outputs · pp. 12 and 21Record: E5 — PDF value: 3b4a4b785561d1bd6bf48afb35082d02cde2ac225cefaf3d531562c52374d462 · S0 → R5 · 1.11506206 BTC · 2026-11-01 16:14:14 UTC · block 974146 · pp. 11 and 21Record: E6 — PDF value: be5d005b7d7884815456b278c611294d82d6f0f7b08a966196fd77f5afd4ca08 · S0 → bc1qvc9lyhulpfup3r57nphttsdqdn8tdyxs4wp2mv · 0.86902496 BTC · 2026-11-01 17:06:47 UTC · block 974153 · 20 inputs / 1 output · pp. 12, 14 and 21Record: E7 — PDF value: 9af06a6fea858a23fd1f9da47982921c1084ca81c8816a77419993cf53bf9978 · bc1quh87wd84ansf7ucwf6arge3kaem03ar20av3vv → S0 · 0.0021017 BTC · 2026-11-06 23:54:17 UTC · block 974868 · p. 22, verifiedAddress registerLabel: R3 — Full identifier and role: bc1q8q4aqg9fyxch0k48wf2xcuqdfaqpc55un0mnsc · first-hop counterparty, no entity attributionLabel: R4 — Full identifier and role: bc1qjdqn0tqm4agmsq5njss2snuanyqu54mjkjm8gr · first-hop counterparty, no entity attributionLabel: R5 — Full identifier and role: bc1qwurqa0yzggsurz86mku3dqnf5pdnjkq0089vvt · first-hop counterparty, no entity attributionLabel: Litecoin context only — Full identifier and role: ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee · not traced in this reportSource and scopeSource: SentinelTX, CASE-ASYNCEB6, 7 November 2026, pp. 4–5, 11–20 and 20–22. This article presents selected records and assessments from that report; it is not an independent on-chain validation.The report cites the BTCPay Server security advisory as incident context. The subject address’s association with the incident remains reported. Ownership of the recipients, victim-level linkage, total incident loss and final disposition of the funds are not established.The first-hop outflows, partial later-receipt sample and historical balance measure different activity. They are not combined into a loss or recovery total. The coverage does not establish a complete transaction history or the beginning and end of the incident.

Two BNB Smart Chain transactions sit at the center of SentinelTX’s November 4 report on the Predict.fun incident: an 82,000 USDT drain on October 22 and a 5,700 USDT drain on October 27. Both were executed through the accounts’ normal user-operation machinery. Neither decoded transaction called a Predict.fun market or exchange contract.That pattern is consistent with misuse of an authorized signing credential. It does not, by itself, identify the signer or establish how a key was obtained. The report did not decode the signatures or validator modules. Its cross-chain account also has important limits: Ethereum bridge receipts remain unverified, one proposed onward path runs backward in time and is causally impossible, and a sanctions label asserted for a collector is unsupported.This article adapts SentinelTX report CASE-CB9FA6EF, dated November 4, 2026. It separates the transactions described in the report from wider public claims and retains the report’s material warnings. The confidential source PDF is not reproduced here.What the report coversPublic reporting summarized in the PDF describes two waves affecting 29 accounts, with 397,708 USDT taken and 166.8 ETH deposited into Tornado.Cash. SentinelTX used that reporting as a source of leads. The retrieved public article was incomplete, and those incident-wide figures are not the totals established by the two seed transactions examined here.The distinction matters because the report contains several different kinds of numbers: transfers out of smart accounts, later bridge deposits, ETH receipts, mixer deposits, and allocations assigned to particular tracing paths. Adding them together would recount funds or combine unlike assets.Measure: 87,700 USDT — Scope and limitation: The two seed drain quantities: 82,000 USDT and 5,700 USDT. Not a complete incident-loss figure.Measure: 397,708 USDT — Scope and limitation: Incident-wide amount reported by the public source, across 29 accounts.Measure: 42 ETH — Scope and limitation: The report’s itemized mixer-deposit headline: four 10 ETH legs and two 1 ETH legs. Not a validated attribution of all that ETH to the two BSC seeds.Measure: 166.8 ETH — Scope and limitation: Tornado.Cash amount reported by the public source.Measure: One further 1 ETH-pool leg — Scope and limitation: The chronology describes its gross amount as not itemized and displays a path-attributed share. The source’s differing presentations are retained in the limitations note.The investigation retained 36 movement rows, with readable timestamps from October 22 at 15:39:27 UTC through October 27 at 07:25:23 UTC. Its query windows extended from September 22 to November 4. A query window is broader than the transactions actually retained and does not establish complete coverage of every address.Two drains, five days apartFigure 1. The two seed transfers described in the report total 87,700 USDT. The bars compare the same asset and scope; they do not represent all affected accounts. Color key: Slate, October 22 seed; sage, October 27 seed. Address/role key: S1 and S2 identify the two victim smart accounts in the selected appendix. Source: SentinelTX, CASE-CB9FA6EF, pp. 3–6 and 15. The chronology marks the seed descriptions “unverified (auto-downgraded)”; the corresponding Path Routing Evidence rows are marked “verified.” See the source note.October 22: the larger seedAt 15:39:27 UTC, S1 transferred 82,000 USDT to a contract ending in de710. Thirteen seconds later, that contract sent 81,999.97 USDT to the BSC address labeled Relay.link in the report’s attribution database. A separate forwarding fee was also recorded.The Ethereum destination of that bridge leg was not resolved. The bridge explorer returned HTTP 429 on three attempts. The report therefore does not establish a completed Ethereum route for this 82,000 USDT seed, and it cannot be treated as an identified contribution to the later mixer deposits.Diagram 2. The common execution pattern and the report’s Wave-1 route, with its unresolved bridge boundary. The report did not decode the signer or validator. Color key: Slate groups the reported execution and BSC route. The amber-tinted box states the unresolved Ethereum boundary. Solid arrows show the report-described Wave-1 route, not independent verification; the dashed line is an unresolved boundary, not a confirmed transfer. Address/role key: Wave-1 smart account 0xd14ca6d1173a710706149a222b7e20324003a660; pass-through contract 0xeda13cffb9b1bb71b948c2b0132f04cf466de710; Relay.link BSC recipient 0x4cd00e387622c35bddb9b4c962c136462338bc31. ERC-4337 entry point 0x0000000071727de22e5e9d8baf0edac6f37da032. Source: SentinelTX, Investigation report CASE-CB9FA6EF, pp. 3–5 and 9, Executive Summary, Transaction Chronology and Transaction Typology. Wave-1 onward chronology is auto-downgraded; Ethereum destination unresolved after HTTP 429.October 27: a smaller seed and a shared pass-throughAt 06:01:44 UTC, S2 transferred 5,700 USDT to a different contract, ending in 82fba. That recipient made seven Relay deposits between 06:01:27 and 06:06:14 UTC. The executive summary presents their total as about 24,654.90 USDT; the fund-flow section records 24,654.894172 BSC-USD across seven transfers.Those seven deposits are activity of the recipient, not seven onward transfers that can all have been funded by S2. The first deposit, 2,544.97 USDT at 06:01:27, occurred before S2’s 5,700 USDT arrived at 06:01:44. The PDF explicitly flags a route that connects the later inflow to that earlier outflow as causally impossible. This is not an unresolved receipt that might eventually validate that ordering: the earlier transfer cannot be proceeds of the later one.The source identifies two bridge correlations involving this pass-through and collector C3 on Ethereum. It records 5,699.98424088292384761 USDT associated with 2.456393911612693978 ETH, and 4,844.988528623471693008 USDT associated with 2.088280124827178002 ETH. These are transaction-hash correlations, with Ethereum payout transactions not separately retrieved and receipts explicitly unverified. They should not be presented as verified cross-chain settlement.What the account operations showBoth BSC seeds were ERC-4337 bundle executions sent to the same entry point. The victim smart account was the sender of the user operation, and the decoded UserOperationEvent reported success. Each operation followed the same sequence: approve a USDT paymaster, pay its fee, then transfer USDT to the recipient contract.The paymaster fees were 0.185195505742016089 USDT for S1 and 0.174759053954175911 USDT for S2. The report says the approvals left near-unlimited allowances after the fees were taken. The same submitting address sent both bundles, while both pass-through contracts used the same forwarding-fee recipient.These similarities explain why the report favors a credential-misuse interpretation over an exploit of a Predict.fun contract. But tooling overlap is not proof of common control: the report expressly notes that public account-abstraction services can be shared. Its attribution database returned no label for the submitter or paymaster, and it established no value-bearing flow linking the two waves.Public claims about compromised API documentation and exported Privy keys supply a possible explanation for how credentials were obtained. SentinelTX did not verify that explanation. The careful conclusion is that the decoded behavior is consistent with an authorized-signer drain, while the signer’s identity and the route of key compromise remain unconfirmed.Ethereum deposits do not close every BSC linkThe Ethereum records show collectors receiving ETH and making fixed-denomination deposits into addresses labeled Tornado.Cash pools. They do not establish that every receipt came from the two BSC seeds.Collector C1 received three Relay.link payouts and deposited 10 ETH at 05:41:59 UTC on October 27. That mixer deposit preceded the 06:01:44 BSC seed by about 20 minutes. It cannot have been funded by that seed. The chronology says the BSC sources of C1’s funding payouts were not correlated, even though the executive narrative associates them with earlier Wave-2 drains.Collector C2 made two 10 ETH deposits at 05:53:59 and 05:54:35 UTC, then two 1 ETH deposits at 06:26:35 and 06:27:11. C1 also forwarded 0.277599 ETH, as displayed in the chronology, to C2 before those smaller deposits. C3 deposited a further 10 ETH at 06:07:11. Together, those six mixer legs make up the report’s 42 ETH itemized headline.C3’s own “Sanctioned” classification is unsupported: the report says no label lookup for that address was on record. That is distinct from the database labels returned for the 10 ETH and 1 ETH Tornado.Cash pool addresses. A pool’s service label does not identify the person controlling a depositor.No exchange-deposit leg was identified in the traces. The report also did not observe the LI.FI, Across or Railgun routes described by the public source. These are limits of the examined material, not proof that no other movement occurred.The conclusion and the remaining investigative workThe useful finding is specific: the report describes two smart-account drains using normal account-operation execution, followed by deposits to a Relay-labeled BSC address. The decoded seeds contain no Predict.fun contract call. Separately, it itemizes Ethereum mixer deposits, while leaving critical bridges between source funds and destination receipts incomplete.Figure 3. What the report supports, and where its conclusions stop. The USDT seed quantities and ETH mixer deposits have separate scopes and must not be added or treated as a completely attributed route. Source: SentinelTX, CASE-CB9FA6EF, pp. 3–4, 10–14 and 22.The report prioritizes obtaining Relay settlement and request records, preserving bundler and paymaster logs, and preserving key-export, documentation-server and authentication records. It recommends owner-key rotation for exposed accounts and revocation of the residual paymaster allowances. These are the report’s proposed responses, not actions completed in this article.Before freeze or KYC action, the report calls for closing the Wave-1 Ethereum route, itemizing C3’s other inbound transfers, resolving the additional mixer leg’s amount presentation, and examining the publicly claimed routes that were not observed. Its assessment of limited freezing prospects rests on the mixer deposits and absence of an identified custodial off-ramp in the traced set. Neither an operator identity nor a recovery outcome is established.Source and limitations noteThis is an adaptation of the actual SentinelTX-generated PDF, not an independent audit or a re-investigation. The source is classified confidential.The PDF contains the following material warnings, reproduced here with their original wording:Page 3: “INTEGRITY GATE — the integrity gate downgraded 9 claims in the text and flagged 1 finding for review. See the appendix at the end of this document for the full list.”Page 3, Label Evidence Gate: “The label claims below do not match the labels the tools actually returned in this session. The lookup result is the single source of truth and the narrative cannot exceed it. Re-verify before investigative use or external submission.”Page 3: “[unverified] 0x294dc89990f70ddb3067b0a8c917413a3e8d7c13 — narrative claim 'Sanctioned' / labels actually returned: none — the classification was asserted without any label lookup for the address on record — unverified assertion”Page 22: “[INV-5] (report-wide) — Hop 0 (block 130,037,922) → Hop 1 (block 130,037,883) is time-inverted — the later hop (funds out) settles in an EARLIER block than the hop that feeds it (funds in) → a causally impossible path (the cash-out tx precedes the deposit tx). Likely a destination's commingled total deposits counted as traced taint.”In plain terms, the C3 label is not supported, and the flagged Wave-2 route cannot establish that the later seed funded the earlier deposit. These warnings are not removed by successful report generation or the presence of a signed evidence manifest.The PDF also presents differing statuses and amount descriptions that this article does not silently reconcile. The chronology marks the two BSC seeds and the Ethereum seed “unverified (auto-downgraded),” while their corresponding Path Routing Evidence rows on page 15 say “verified.” Two bridge receipts remain unverified in the narrative. For chronology row 26, pages 7 and 11 describe the gross amount as not itemized and distinguish a 0.626278 ETH attributed share; page 19 separately prints a Transfer amount of 1.000000000000000000 ETH. The article retains the report’s 42 ETH headline rather than inventing a revised total.The source’s aggregate movement figures are not incident-loss figures. Its residuals are tracer-record calculations, not verified current balances. Retained transfers, a graph connection, shared service infrastructure or a label alone do not establish common control or incident attribution.Selected transaction and address appendixThe short IDs below are reading aids, not verification grades. The PDF provides full transaction hashes and addresses but no embedded public URLs. No explorer link or public-source URL has been reconstructed.Seed transactionsE1, October 22 BSC seed: 2026-10-22 15:39:27 UTC; block 129155430; 82,000 USDT. Hash: 0xe3ceb8ca8d391e33e6538f51ce8fbc4533ed08d38b07b2a4380bc22f072ecf0a. Source: pp. 3, 5 and 15; status distinction described above.E2, October 27 BSC seed: 2026-10-27 06:01:44 UTC; block 130037922; 5,700 USDT. Hash: 0x1dcc6393610d2158fa20fa436f7fbb6fd8f741b0580d627498d5673aebca9c72. Source: pp. 3, 6 and 15; status distinction described above.E3, Ethereum mixer seed: 2026-10-27 05:41:59 UTC; block 26282017; 10 ETH. Hash: 0x02f860b956253fe802fcd09d7dbb5c6bc55d9210977ee49098c96e3e556aad7b. Source: pp. 3, 5 and 15; status distinction described above.Address rolesS1, October 22 victim smart account: 0xd14ca6d1173a710706149a222b7e20324003a660.S2, October 27 victim smart account: 0xdd2be6e0d6db2212060ee3c691b13ff30777e79b.R1, October 22 recipient contract: 0xeda13cffb9b1bb71b948c2b0132f04cf466de710.R2, October 27 recipient contract: 0x8b001d7378dbc19c1c62e39c0fc9ffad84182fba.B, BSC address labeled Relay.link: 0x4cd00e387622c35bddb9b4c962c136462338bc31.E, ERC-4337 entry point: 0x0000000071727de22e5e9d8baf0edac6f37da032.P, USDT paymaster, no database label: 0x8b1f6cb5d062aa2ce8d581942bbb960420d875ba.Bundle submitter, no database label: 0x3cfdc212769c890907bce93d3d8c2c53de6a7a89.C1, Ethereum seed depositor: 0x3c9f6411cd1fbefaf33397145514ed2bf662eef9.C2, Ethereum collector: 0x85cd3ee47307bcaf9e1ada4230cc7646e603d429.C3, Ethereum collector with unsupported “Sanctioned” claim: 0x294dc89990f70ddb3067b0a8c917413a3e8d7c13.M10, database-labeled Tornado.Cash 10 ETH pool: 0x910cbd523d972eb0a6f4cae4618ad62622b39dbf.M1, database-labeled Tornado.Cash 1 ETH pool: 0x47ce0c6ed5b0ce3d3a51fdb1c52dc66a7c3c2936.Address-role sources: SentinelTX, CASE-CB9FA6EF, pp. 3–4, 9–11 and 25. The pool labels include “Mixer” and “Sanctioned”; these are reported database labels, not an independently updated legal-status assessment.