커뮤니티

On 17 October 2026, one Ethereum transaction repeatedly moved USDT into and out of BiFi's USDT market, exchanged most of the resulting surplus for WETH, and paid ETH to the transaction sender and a block fee recipient. This investigation asks two separate questions: how much USDT left the handler on a net basis, and how far the proceeds can be followed without assigning unrelated activity to the incident.The checked route is BiFi USDT handler → execution helper → Uniswap pool → WETH unwrap → ETH payouts. A same-transaction flash loan supplies temporary funding and is fully repaid. The asset path is supported by explorer event records and displayed internal transfers; it stops at the payouts, not at a confirmed exchange deposit or recovery.Who and what appear in the route?The handler is the contract that holds the market's USDT. The execution helper is another contract, called by the wallet that submitted and paid for the transaction. These are different roles: the wallet submits instructions, while the handler is the address whose token balance decreases. The role names below describe recorded activity, not the identity or intent of a person.USDT is a stablecoin token designed to track the US dollar, but the quantities here are tokens, not a historical dollar valuation. WETH is a token form of ETH that can be handled by contracts using the common ERC-20 token interface; unwrapping WETH releases ETH rather than creating a second asset gain. A flash loan is temporary funding that must be returned within the same transaction; otherwise the entire transaction is reversed. Its principal is not the amount lost by BiFi. An exchange pool swaps one token for another; its presence does not establish that the pool or its operator participated in an attack.RoleHow it is used hereBiFi USDT handlerSends and receives USDT during the repeated market interactions.Execution helperBorrows temporarily, interacts with the handler, swaps USDT and distributes ETH.Transaction senderSubmits Anchor A and receives its main ETH payout.Block fee recipientReceives a direct ETH payment inside Anchor A, separate from the transaction gas fee.Earlier deployerCreates a different contract one block before Anchor A; its relationship to the profitable execution remains unproven.Scope and three findingsScope itemBoundaryIncident anchors17 October 2026, 05:42:59 and 05:43:11 UTC; Ethereum mainnet.Accounting scopeAnchor A only: 142 displayed ERC-20 transfer rows; 141 USDT events independently cross-checked against decoded integer values and addresses.Follow-up window17 October 05:43:11–22 October 03:15:00 UTC; incomplete provider coverage, not a complete address history.Verification date22 October 2026; explorer and public-source reads may be later than the follow-up cutoff.Counting conventionToken quantities, no historical USD price estimate. Gas and direct builder payment reported separately.First, the handler's net outflow in Anchor A is 165,575.149730 USDT, not the much larger volume of repeated transfers. Second, the swap, residual USDT and ETH payouts can be reconciled without counting the same value twice. Third, the checked proceeds reach the transaction sender, but the reviewed records do not allocate the incident's ETH to a later cash-out or establish a completed refund.05:42:59 UTC: a deployment, not yet a proven causal linkAnchor B creates a contract from a different wallet in block 26,210,255. Twelve seconds later, Anchor A executes in the next block using a different helper. Both successful statuses, times and addresses were read directly in Etherscan. Deployment record · Execution record.The public DeFiHackLabs reconstruction describes the earlier wallet as the original exploiter and the later sender as a front-runner, meaning a participant that executes an opportunity ahead of someone else. We retain those descriptions as external claims. A twelve-second gap is not proof of copying, shared control or mempool observation. Establishing that relationship would require the relevant bytecode and execution comparison, and evidence of how the later transaction was selected or ordered.UTC / blockObserved event17 October 05:42:59 / 26,210,255Anchor B: 0x15b47e2c0daf723dec64c75b435079d3a1f8a6058b21b9a64dda4844e877a034. Deployer 0x7c78a049fff71609990017b58a959e926e6ec4c6 creates 0x8c0d729d03cb8ecbc79a62a68cdd67ccfa6a7b92.17 October 05:43:11 / 26,210,256Anchor A: 0x756c68055af7a0630aa0b56891ba4de14c56c39cbebe99e47eeb4728f4d6ad14. Sender 0xc0ffeebabe5d496b2dde509f9fa189c25cf29671 calls helper 0xe08d97e151473a848c3d9ca3f323cb720472d015.05:43:11 UTC: temporary funding and repeated market flowsHow much of the transfer volume represents money leaving the market? The helper receives 40,499,999.999997 USDT from the Morpho-labelled contract, then repeatedly sends USDT to and receives USDT from the BiFi handler. The flash-loan event records 40,499,999,999,997 base units; the final repayment returns the same principal. Anchor A events.Within this transaction, 54 transfer events run from the helper to the handler and 83 run back. These counts include zero-value events. The incoming and outgoing sums are large because the same capital is reused. Subtracting one direction from the other answers the narrower question of the handler's token movement. Think of this as reconciling one account: a large amount repeatedly entering and leaving is not the same thing as the final amount that left it. The table counts the recorded token movements, not the market's internal deposit claims.Handler ledger in Anchor AUSDTIncoming: 54 events141,270,327.667580Outgoing: 83 events141,435,902.817310Outgoing minus incoming165,575.149730Start Figure 1 at the temporary loan, move through the two-way market interaction, then read the swap stage. Solid arrows connect ordered accounting stages, not additional losses or equal time intervals.Figure 1. The flash loan nets to zero. The handler net outflow equals swap input plus helper residual. Colors group stages only; line width is not amount. Source: Anchor A decoded Transfer events and FlashLoan event.The net outflow is a transaction-level quantity, not a complete statement of protocol insolvency, affected depositors or unreimbursed user losses. The next step is to account for where that surplus went.The swap changes the asset, not the size of the incidentThe helper sends 165,574.514633 USDT to the Uniswap pool and receives 68.057203111718789216 WETH. The remaining 0.635097 USDT is the helper's net token change within Anchor A, not a current balance query. These two USDT quantities add to the handler's net outflow exactly.ReconciliationQuantityUSDT swap input165,574.514633 USDTHelper USDT net increase0.635097 USDTSum / handler net outflow165,575.149730 USDTSwap output68.057203111718789216 WETHUSDT and WETH are not added together as separate losses. They are different forms of value passing through the same execution. Likewise, the following WETH unwrap is not a new theft of ETH on top of the swap. Full transaction and event record.The ETH payout splits into two branchesWhere does the unwrapped ETH go? The WETH contract sends 68.057203111718789216 ETH to the helper. The helper also receives 145 wei with the submitted transaction. A wei is one quintillionth of an ETH; this tiny input matters when checking the payout to its final digit.Start Figure 2 at the WETH contract, then follow the helper's two payout branches. The gray box below the sender marks an allocation limit and has no onward transfer arrow. Both payout branches belong to the same transaction; their side-by-side placement is not a time axis.Figure 2. Solid arrows are ETH transfers in Anchor A. The dashed gray box is an evidence boundary, not an observed destination. Gas is not a helper payout. Sources: Etherscan internal transfers and the provider call trace.ETH accountingExact amountWETH unwrap into helper68.057203111718789216 ETHTransaction value into helper0.000000000000000145 ETHDirect payment to block fee recipient0.986829445119922310 ETHGross payout to transaction sender67.070373666598867051 ETHTransaction gas fee, paid separately by sender0.000845755321487776 ETHUnwrap plus transaction value equals the two helper payouts exactly. The sender's receipt is a gross payout, not automatically its final profit. Even subtracting transaction value and this gas fee would describe only a transaction-specific ETH change; it would not establish wider trading costs, earlier capital or the operator's incident-wide profit. A direct payment to a block fee recipient also does not establish its knowledge or involvement. Internal transfers and transaction fee.What the code supports—and what it does not yet proveA lending market records interest by updating accounting values over time. The DeFiHackLabs reconstruction proposes that an old interval without market activity was reused while the participant changed utilization—the proportion of deposits currently borrowed. In that explanation, repeatedly crediting interest at changing rates lets the participant withdraw more than it supplied. This is an external reconstruction, not a replay we independently executed. Reconstruction and assertions.Direct source inspection provides a narrower check. In Etherscan's currently published TokenHandler source, _checkFirstAction calculates the current block minus the last updated block, then calls setBlocks and syncActionEXR when the difference is positive. In the published interest-model source, _getInterestAmount reads the stored inactive interval and action accounting rates. _calcInterestAmount reads deposit/borrow totals and calculates rates from them; _getNewGlobalEXR multiplies a rate by the interval. TokenHandler source · Interest-model source.Those code relationships help explain the proposed mechanism. They do not establish the exact historical storage values or independently reproduce the exploit. The provider trace reports that the handler delegated calls to this logic address in Anchor A; delegatecall means code at another address runs using the caller's storage context. The inspected source is a present explorer publication, while the trace is provider-reported incident execution. Neither replaces a complete historical-state replay.The reconstruction also uses distinct block contexts: its comments refer to a 264,059-block interval at the deployment block, while its test rolls to the following execution block and asserts 264,060 blocks. We do not silently merge those values or present either as a historical value independently read by this investigation. The missing evidence is the incident-time storage snapshot, decoded full execution and a reproducible replay at the correct parent state.Why the onward trail stops at the senderThe bounded provider follow-up reviewed activity from 17 October 05:43:11 through 22 October 03:15:00 UTC, with limits of two outward hops and ten material transfers. Its source coverage is incomplete. The sender appears in repeated helper executions, so later balances and payments mix multiple activities. A later outgoing payment cannot simply be labelled the same 67.07 ETH because the address received it earlier.The observation window is a requested time boundary, not proof that every transaction up to that time was retrieved. No incident-specific exchange receipt or directly anchored refund was established in that review. This is not a finding that neither exists: unobserved records and unresolved allocation remain. We exclude surrounding tokens, look-alike addresses and unrelated service labels from the incident route rather than drawing a larger network that the evidence does not support.Response points and next recordsFor the market's maintainers, the concrete technical check is how an idle interval and changing utilization interact across repeated actions in one block. Historical storage, active implementation and the before/after interest accounting should be compared before a patch or root-cause statement is treated as validated. The source relationship suggests a targeted test, not a claim that every other market shares the defect.For fund-flow review, the priority is an anchored return transaction or a defensible allocation method at the mixed sender. A screenshot of its balance, a generic exchange label or an unrelated large payment would not answer that question. Full bytecode and execution records for the earlier deployment are separately needed to assess the claimed front-running relationship.The evidence supports one reconciled path: net USDT leaves the BiFi handler, most is swapped for WETH, WETH becomes ETH, and the helper distributes ETH. The accounting is substantially firmer than the attribution and historical root cause. Those differences are the conclusion of this investigation, not details to smooth away.Evidence appendixFull address registerRoleEthereum addresshandler0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3helper0xe08d97e151473a848c3d9ca3f323cb720472d015sender0xc0ffeebabe5d496b2dde509f9fa189c25cf29671builder0x4838b106fce9647bdf1e7877bf73ce8b0bad5f97deployer0x7c78a049fff71609990017b58a959e926e6ec4c6created0x8c0d729d03cb8ecbc79a62a68cdd67ccfa6a7b92morpho0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcbpool0x4e68ccd3e89f51c3074ca5072bbac773960dfa36usdt0xdac17f958d2ee523a2206206994597c13d831ec7weth0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2logic0x47be3d1def039bd85e7570864bb5148e7491a65fmodel0x29ecabde2c57b6d4183f915ebca1a25804a60db1storage0xfdc7d058bede981ea865fb64d06382a2206a1c42Full transaction anchorsAnchor / scopeTransactionB: deployment; block 26,210,255; 17 October 05:42:59 UTC0x15b47e2c0daf723dec64c75b435079d3a1f8a6058b21b9a64dda4844e877a034A: execution; block 26,210,256; 17 October 05:43:11 UTC0x756c68055af7a0630aa0b56891ba4de14c56c39cbebe99e47eeb4728f4d6ad14Transfer-event inventory for Anchor AThe tables below preserve all 142 explorer-displayed ERC-20 transfer rows in event order. They are not 142 separate transactions. USDT uses six decimal places and WETH eighteen in this inventory; the integer USDT event data were checked against every corresponding displayed amount and address. The separate WETH Withdrawal event records the subsequent unwrap; it is not an additional Transfer row. All these events share Anchor A's block and UTC time above.Event / assetFrom → toAmount12 / USDT0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb→ 0xe08d97e151473a848c3d9ca3f323cb720472d01540,499,999.99999714 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3121,257.48502916 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3484,544.91017918 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,795,238.89221520 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e37,238,802.15538922 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e330,860,156.55718524 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3026 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50028 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50030 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50032 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50034 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50036 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50038 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50040 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50042 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50044 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50046 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500Event / assetFrom → toAmount48 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50050 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50052 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50054 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50056 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50058 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50060 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50062 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50064 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50066 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50068 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00070 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50072 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00074 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50076 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00078 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50080 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00082 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500Event / assetFrom → toAmount84 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00086 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50088 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00090 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50092 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00094 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50096 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00098 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500100 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000102 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500104 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000106 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500108 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000110 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500112 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000114 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500116 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000118 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500Event / assetFrom → toAmount120 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000122 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500124 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000126 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500128 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000130 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500132 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000134 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500136 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000138 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500140 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000142 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500144 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000146 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3165,163.833793148 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d015247,951.408655150 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3121,257.485029152 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3484,544.910179154 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,795,238.892215Event / assetFrom → toAmount156 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e37,238,802.155389158 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e330,860,156.557185160 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e30162 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500164 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500166 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500168 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500170 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500172 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500174 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500176 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500178 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500180 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500182 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500184 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500186 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500188 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500190 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500Event / assetFrom → toAmount192 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500194 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500196 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500198 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500200 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500202 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500204 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000206 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500208 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000210 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500212 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000214 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500216 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000218 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500220 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000222 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500224 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000226 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500Event / assetFrom → toAmount228 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000230 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500232 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000234 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500236 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000238 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500240 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000242 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500244 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000246 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500248 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000250 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500252 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000254 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500256 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000258 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500260 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000262 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500Event / assetFrom → toAmount264 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000266 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500268 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000270 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500272 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000274 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500276 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000278 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500280 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000282 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3165,163.833793284 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d015247,951.408655286 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0150288 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0xe08d97e151473a848c3d9ca3f323cb720472d0150.000068289 / WETH0x4e68ccd3e89f51c3074ca5072bbac773960dfa36→ 0xe08d97e151473a848c3d9ca3f323cb720472d01568.057203111718789216290 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x4e68ccd3e89f51c3074ca5072bbac773960dfa36165,574.514633292 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb40,499,999.999997Evidence classificationClaimBasis / limitationUSDT totals, status and UTC timesDirect explorer overview and decoded event reads; integer calculations reproducible from the preserved inventory. Not an independent node consensus check.ETH payoutsDirect explorer internal-transfer display, corroborated by provider trace.Incident-time delegate targetProvider call-trace report; not independently replayed.Idle-interest exploit mechanism / front-runningExternal reconstruction plus limited direct source inspection; historical state, exact replay and ordering causality unconfirmed.Later cash-out / recoveryNot established; follow-up coverage and allocation incomplete.Sources are linked beside the claims and in the exact records above. Explorer labels are descriptive leads, not proof of human identity or culpability.

During the night of 17–18 October 2026, Qubic reported that weak wallet-seed generation had allowed an attacker to drain wallets. A seed is the secret used to derive a wallet’s signing keys: if its generation is predictable, the resulting address can remain valid while its funds are unsafe. The project reported around 2.94 trillion QU affected across 1,404 wallets. This review asks a narrower, reproducible question: what do the public transfers into one listed recipient establish, and where does the evidence stop? Project disclosure; Project explanation of the cause.The directly checked fund path is source addresses → recipient R1. Explorer exports show 205 receipts from 204 distinct sources into R1. One of these transfers and the two transfers from the repeated source were also opened individually with their transfer-event rows. The path drawn here ends at R1. Later containment code names a separate escrow address, but this review does not join R1 to escrow with a verified execution event or independently establish victim repayments. A later project announcement reports that repayments have begun; that attributed update is distinguished below from the checked transaction subset.The roles before the totalsQU is the native asset counted in the Qubic Explorer; the Explorer labels it QUBIC. This article uses QU consistently. A Qubic identity is the public address, not its secret seed. A tick is the network’s numbered processing step, which lets records be ordered without treating a browser’s clock display as UTC. A transfer event describes a balance movement; it is not interchangeable with a separately signed transaction.RoleMeaning in this reportSourcesAddresses recorded as sending QU into R1; being listed does not prove the owner’s identity or consent.R1One of seven initial recipient identities compiled by Qubicmap. The role describes receipt, not a proved person.EscrowAddress named by the official containment code as the intended destination of frozen balances.Frozen identityAn address included in a pinned code list. That list also covers at-risk funds, not only completed theft.The wallet code, the transfer record and the recovery mechanism answer different questions. Public source code can show what a patch was designed to change. Transfer records show who paid which public address and how much. Neither alone proves the attacker’s exact method, real-world identity or a completed refund.What was checked, and what was notMeasureScope / evidence levelReview checkpoint20 October 2026, 00:15 UTC. Historical observations gathered on 20 October; no common pinned state or continuous monitoring is claimed.Incident window17 October 23:42:01–18 October 01:26:19 UTC according to the community dataset; not independently reconstructed for all victims.Direct export subset205 unique successful-transfer rows, 204 source identities, 568,777,432,013 QU into R1. Quantities are transfer amounts, with no separate fee figure added.Individual detail checksThree transactions and their visible QU_TRANSFER rows: the last sampled receipt and both transfers from the repeated source.Whole-incident contextSeven dataset recipient rows sum to 2,939,606,531,944 QU and 1,404 listed source entries. Arithmetic checked; all source histories not replayed.Outside the verified pathMEXC deposit identity, onward transfers, escrow execution events, owner identity, full historical balances and completed restitution.The three principal findings follow from those boundaries. The receipt inventory reconciles to the community subtotal for R1. One address appears twice, explaining why transaction count and source count differ there. Finally, the later frozen-address list and escrow code establish a containment design, not transaction-level proof of recovery. The sections below explain the records behind each finding.17–18 October — receipts converge on one addressQubicmap’s incident checker lists seven initial recipients. R1 has the largest displayed subtotal: 568,777,432,013 QU attributed to 204 listed source addresses. Instead of adopting that row without checking it, we exported all three pages of the Explorer’s displayed signed-transfer table for R1, at 100 rows per page. The resulting 205 unique records sum to exactly the same amount. Community incident dataset; VNJZRGGRYRTKHANUZHLTHTSBQOFCTCJKUKLCVIWCSBRTZNYOJEVPGYDCDRCM.These exports independently support that one recipient’s displayed inventory. They do not independently establish every row in the community dataset, prove who owned the source keys, or replace a native consensus replay. In particular, the sum of the seven displayed source counts is not an independently deduplicated, cross-recipient victim count.Start Figure 1 with the source group at the top and follow the single solid arrow into R1. It represents the 205 exported QU receipts, not 205 different victims. The sample panel anchors one of those receipts to an individually opened transaction. The broken line underneath is an observation boundary, not a route to an unnamed service.Figure 1. Blue-gray boxes summarize the exported source and recipient roles. The solid arrow means recorded QU receipts; it is not scaled to quantity or time. The pale sage panel is one individual detail check, not an additional inflow. Full records and links are retained in Appendix B.The matching subtotal makes the community lead useful without making every wider allegation verified. The next question is why the Explorer gives 205 receipts while the dataset names 204 source addresses. That difference can be resolved inside the exported records, without guessing an extra victim.One source paid twice — transaction count is not victim countAt tick 85,362,890, the repeated source sends 17,065,760,963 QU into R1. At tick 85,371,060 it sends another 1 QU to the same recipient. Both transaction detail pages show the same full source and destination, and each contains a matching QU_TRANSFER event row. First transfer; Later 1 QU transfer.RecordQU / tick / eventpwjalmhztlijreususcvpefiruyddqtmxgahgozctclvxvwfctdzjjxcfvdl17,065,760,963 QU · tick 85,362,890 · event 19832786rmqdmmstqcugfblgthzbnwtrivdcwdpjdkrxodvcbgiszelbeqapasidnolc1 QU · tick 85,371,060 · event 19996143Counting this source once, rather than once per transfer, yields 204 distinct source identities across 205 receipts. The later 1 QU payment is not evidence of a test, a refund or a different attacker: its intent is not recorded. This local reconciliation also does not resolve a separate public discrepancy between 1,404 and 1,405 affected identities, or between seven initial recipients and eight wallets mentioned in later community commentary.The final sampled receipt provides a second type of cross-check. At tick 85,371,146, the Explorer transaction and event both record 106,444,954 QU from source S into R1. Qubicmap’s lookup for S returns the same hash, quantity and tick, classifying it as drained. That is corroboration of the dataset entry, not independent evidence of consent or ownership. Sample transaction; Sample event.Time requires a separate caution. Qubicmap explicitly labels this sample 18 October 01:26:10 UTC; the Explorer in the reviewed browser displays 10:26:10. The nine-hour difference is consistent with the local browser setting, but the exported CSV has no timezone label and raw UTC was not independently obtained. Appendix B therefore preserves its display time as recorded and orders records by tick. It does not silently relabel those timestamps as UTC.18 October — the patch changes seed generation, not existing keysAfter the reported transfer window, the wallet repository records a change replacing Math.random-based generation in the create-vault and seed-edit flows with a shared secure generator. The v4.26.4 helper reads random bytes through crypto.getRandomValues. It refuses to generate a seed if that capability is absent. Pinned wallet patch; v4.26.4 release.The helper produces 55 lowercase letters. It accepts byte values below 234, then maps each accepted value to one of 26 letters; rejecting the remaining byte values avoids giving some letters more possible inputs than others. This is a direct code observation, not a measurement of how unpredictable the random input on an affected device was (its entropy). We did not reproduce the attacker’s seed search, inspect a victim device, or establish which exact bundle every affected wallet ran.A public proposal opened on 12 February 2026 already discusses secure seed generation. Its existence is relevant history, but it does not by itself establish a decision-maker’s knowledge, intent, or the precise cause of every affected key. Likewise, publishing a patched generator does not replace keys created earlier or prove that every installed wallet has updated. Earlier public proposal, PR 229.19 October — a frozen list and an escrow designThe project’s earlier update reported a network halt at tick 85,371,949. On 19 October, Core PR 1048 was merged for v1.308.2. The pinned frozen-address file contains 2,797 distinct identities and specifies FREEZE_FROM_TICK 85,371,950. All seven dataset recipients and the individually sampled source occur in that exact list. The larger list must not be called 2,797 confirmed victims: the containment change also addresses at-risk funds. Project halt statement; Merged Core change; Pinned frozen-address list.The associated sweep code describes reducing frozen balances, increasing the escrow balance and logging QU transfers, alongside asset handling. A later commit explicitly sets the escrow identity preserved in Appendix A. This is a different type of evidence from an ordinary signed transfer: protocol-generated balance movements may not appear as signed transactions in an Explorer table. Sweep implementation; Escrow identity commit.Read Figure 2 from top to bottom as evidence stages, not a stream of money. The first box is the pinned code configuration. The second is an Explorer account-header observation. The dashed third box outlines the execution and reimbursement records still needed. The bottom panel separately identifies the later project announcement; it is not another directly checked transfer. There are no fund-transfer arrows between these boxes because this review has not verified those joins.Figure 2. Sage marks directly read repository configuration; blue-gray marks a separate aggregate Explorer observation; the dashed neutral panel marks missing execution and repayment evidence. The bottom panel is a later project statement, not an independently verified payment record. Vertical order is a reading guide only. These are not amounts to add together.The escrow account header displayed 2,836,660,961,867 QU and 1,441 incoming transfers during the 20 October review, with its latest incoming tick shown as 85,398,715. Its detailed Transactions and Events panels returned no records at that time. R1’s header likewise showed a later outgoing count, while the signed-transfer export contained only receipts. The Explorer’s Events feature warns that coverage is provisional. These mismatches prevent a transaction-level reconstruction of the sweep; an empty detail table does not prove that no protocol movement occurred. XMGUNWJYLLUUZANFEWJNNIDMXNSDMPOVFAHWOERKDDAWDREZLANHTFJBKMPB.Nor can the escrow header be subtracted from the incident total and called missing funds or recovered funds. The two figures have different populations and observation points. A recovery conclusion requires the actual sweep events, their source identities, quantities and ticks, followed separately by evidence of payments to entitled holders. None of those missing joins is drawn as a confirmed path here.20 October — the project reports restart and first repaymentsAt 18:14:20 UTC on 20 October (21 October in Korea), Qubic announced that the Computor quorum had approved recovery, the network was live again, the reclaim platform was open and the first funds had returned to verified owners. A following post said affected funds had been moved into protected escrow during the halt. These are newly read project statements, not independently matched sweep or repayment transactions. Restart and first-repayment announcement; Project escrow account.This changes the reported operational stage from planned containment to announced recovery in progress. It does not change the 205-receipt inventory or provide a verified recipient-by-recipient refund ledger in this review. The statement does not supply a repayment amount in the text examined; no recovery percentage is calculated. Figure 2 therefore keeps the directly checked code/header evidence separate from the project’s later announcement and draws no payment arrow.The project also states that the claim window runs until 1 May 2027. Readers should navigate from the verified project announcement for current instructions; this report neither submits a claim nor requests a seed. The source’s announcement of first payments must not be rewritten as full restitution. Project claim-window statement.What the wider claims still needThe project’s 18 October statement said 87.1% remained on-network and 12.9% had reached MEXC and been frozen. This is a dated project account. This review has not obtained and verified the complete MEXC deposit identity and transaction chain, an exchange confirmation, or a current freeze-status record. It therefore does not label any of the seven recipients as MEXC or call a payment a completed cash-out. Dated project funds-status statement.Open questionRecord needed / current boundaryWhole-incident tallyReplay and deduplicate every source history across all recipient groups; seven displayed row totals alone are insufficient.Seven recipients / eight later walletsThe additional full identity and its transition records; different stages may explain the counts, but that is not established.MEXC connectionExact deposit identity, native transfer/event records and attributable service confirmation.Sweep / repaymentSource-to-escrow execution events followed by separate holder-payment evidence. Code and header totals alone do not prove either.Root cause / identityAffected build and device-level evidence, attacker-method reproduction or attributable records; transfers alone supply neither.An alternative interpretation of the missing signed outbound records is a system-generated sweep rather than an ordinary signed transaction. The official implementation makes that technically plausible. It remains an interpretation until the relevant execution records are obtained. The same discipline applies to the two small-versus-large payments: a visible sequence is not a recorded motive.Where the next response should focusFor affected holders, the specific concern is the generation of the original secret, not an ERC-20 allowance. A software update can prevent the old generation path from being used again; it cannot make an already exposed secret unpredictable. Any migration or claim should use the project’s verified channels and current containment instructions, without submitting a secret seed to a checker. The public checker reviewed here uses an address, not a seed.For maintainers, the next evidence should join the approved release to its actual network execution: frozen identity, movement event, quantity, escrow destination and tick. For service investigators, the next separate task is the exact MEXC deposit trail and the service’s status record. For this report, the strongest completed result is narrower: one independently summed recipient inventory, a concrete explanation of its extra transfer, and a clearly marked boundary between containment design and demonstrated recovery.Appendix A — full address roles and source boundariesRole / evidenceFull Qubic identityR1 · exported receipt inventoryVNJZRGGRYRTKHANUZHLTHTSBQOFCTCJKUKLCVIWCSBRTZNYOJEVPGYDCDRCMS · individually checked sample sourceZNTRZHEVDZPLQGJFHVKUYYSKWNBAZBZDMGHMWSANCGXKEJOXVIZJXPQDZYLORepeated source · two individually checked receiptsIZOOJMBGEKCGZBMYIFEWRPCMMGUCMFOODFVWGEGZAHWWJLHGWRHVRQKBSSHIEscrow · official code identity, header onlyXMGUNWJYLLUUZANFEWJNNIDMXNSDMPOVFAHWOERKDDAWDREZLANHTFJBKMPBThe next table transcribes the community dataset, not seven independently replayed inventories. Only R1’s 205-row signed-transfer listing was exported and reconciled. “Source entries” follows the site’s grouping; a globally unique victim count has not been independently established.Dataset recipient / full identityListed source entries / QUR1 · VNJZRGGRYRTKHANUZHLTHTSBQOFCTCJKUKLCVIWCSBRTZNYOJEVPGYDCDRCM204 / 568,777,432,013 QUR2 · XVPYBEQNKNBKVCFPVGCFFNBZDEBDGJWVGDCBDBQBCFPRQKJNYXIJJWFDQXDI203 / 453,611,215,145 QUR3 · TFYIRQPKYCPQOEUGRZMKCFQNJKPDMPGGKSWISAYLXAIZKFWKAYRXJMZGYVLE202 / 414,758,635,767 QUR4 · JRDYPWVXWSKBXEIMGTHSVPWPMACDONYHRXPGMCNRJGRFQQDEXBADDGTBDIPO201 / 390,892,863,292 QUR5 · YBFJMLNSECZSQBLQUBUDLKYFJMIDYLZPNXAUGUKLTEBLJRHFHBIEPYSCRHWO199 / 379,522,533,375 QUR6 · VICIUULQUOHBIDLNMZNLPQPGSUDDLXUARWEGVOZIEGGFBELUXLMWHHYADJMN197 / 369,642,443,319 QUR7 · FSLWPFDDKMXCEGBTOJRBYOVMFULCQAQDAGAHJBVSAALWYMTZESNLCDUAVZBA198 / 362,401,409,033 QUThe seven quantities sum to 2,939,606,531,944 QU and their displayed source counts sum to 1,404. Frozen-list membership was checked against the pinned file for all seven recipients and the sample source. Membership describes the code’s target set, not the legal identity or guilt of an address owner.Appendix B — reproducible receipt inventoryThe following 205 records reproduce the three downloaded Explorer pages for R1, sorted by tick and hash. They are exported listing observations, not 205 individual detail-page or signature-replay checks. Every row has the same R1 destination given in Appendix A, input type 0 / Transfer, and the exported status Successful transfer. Full source identities and full transaction hashes are preserved. Amounts are exact QU integers; no USD valuation or additional fee estimate is included. The time column is the CSV’s browser display time on 18 October 2026, with timezone unspecified in the export—not a UTC claim.Receipt records 1–15Full transaction / QU / tick / display timeFull source identitykzmbprybxrynifebbcnhpumfozkgrwooahriezmymfwmdzhversdfhbhsrzn1 QUTick 85,358,7112026-10-18 08:42:01KASNLYSOXMDBLAIORZLAOTMZRIOAQXKMGUXSYVOGJHPAAPCYCZJZPQLFMPUOqccojabeomubqgxualmhaanyvnkffahkgpyaayuddairmpbzdascbahffaua1 QUTick 85,358,8122026-10-18 08:42:51TZDRKWYCSPMPXEBMOGDBOWTAZKUCHJTPCSRZGRWCHHVJLFWXCPRGEKQEEXKCxecinfqhvgpkpbxulphgtgjqrylauzrnczvbjsctkgbaeztwbtbpuifehhzi1 QUTick 85,359,5862026-10-18 08:49:20SPLUVFUYTYYNUCCVNVCGZGCWCDMADAIQDMAWPMURKAZFEIVWHXVIWTGCCQPFrfhjyhwajoicraoacoqnjrcmauraqayaykmvohfkxgjypoxvdgvmqtrbmmwb1 QUTick 85,359,6042026-10-18 08:49:29KYGYRXSQYCYFBHKPRFBJPWQFSGLDQCETADWDAVFHMGIBIAZEFUBYNRMBGBWFagrtlqrxppicodvduldkqljwepfgfalcsvzsonheqfehokghaeqnhneeyasg1 QUTick 85,359,6202026-10-18 08:49:37PLWVYDWFQXOVBFAKGQCPYLKFBKCAXKSKZGGNHZESYDELJQPSFGCUJJXEVTVKoesqvoattvnvtebaftbnumgcmrugezibozfwhvlmackaxfyxrwdycvvefjna1 QUTick 85,359,6372026-10-18 08:49:45IPIWJJMRSDKKZBJJDUGJCRYNHWLCDYZIEELOGTGFADVXUDCSMLXDTSXGFLCOgthgtqytkcuejfkpjtmblnyqoiceqsiqseehikhjsfvdxeiafbfgxigegmja212,742,939,086 QUTick 85,361,8592026-10-18 09:08:23PSIVKNHDUSLWRAEZJQAOQMUKYGCBUYGXQTKKZGIEKHHEHSKCKKYCUAPAFOMFlpspgmkxhmlseasrkyfaibkozkydslmjiaoegyrllcqzrzwhuzuwlwqeccel51,756,401,205 QUTick 85,362,8312026-10-18 09:16:30TYODSNDLGNDJVEFNMPACXEDOJRADMTPQAVJDQBKSZEYGMHNFVIFKRXHGSDLNsytrnjsydbguiaiikyiccznpggnfherhovgoebusmbgfznanlgxwfnifzbpi25,366,718,545 QUTick 85,362,8472026-10-18 09:16:38EDPSUEXTDTGHSFQRLHJHYKAKHBGBPEOMSRJHNMFSNDKMTKAIFMISVENEQJUNsraciimlofqwzafurukymzeopzdhbbfxducrwwjweahiqkmclevfotcbaihl21,118,078,476 QUTick 85,362,8652026-10-18 09:16:48EPKPWOLYQKSWCABARVUDIIBOQOKBCLHMSKCVXYORHGUSKJCVDRZQXOODVRDLpwjalmhztlijreususcvpefiruyddqtmxgahgozctclvxvwfctdzjjxcfvdl17,065,760,963 QUTick 85,362,8902026-10-18 09:17:00IZOOJMBGEKCGZBMYIFEWRPCMMGUCMFOODFVWGEGZAHWWJLHGWRHVRQKBSSHIugmlpkophuaxebvpgdsbqmtmcadcbkxqrgpeaqqlhgqjujrbzggponvbhxam14,378,018,567 QUTick 85,362,9062026-10-18 09:17:08AJONCVKYTRUFVACBOHDVBCYMYTSAZFRCUJWPCBPXAAVMIIJDRYPRYYAFGSAGojmewyvoysxzsfpzterifvogebcbyvppkuserhqpgdohjekvznzaktiaanse12,672,798,403 QUTick 85,362,9232026-10-18 09:17:16BOXZEAOSYPYNKFKNHSDMOJINUJOCZTGXKQXXNRGLXEIJCAZEJHZUPFECVSPBecncmspihotondgduyqdwncofynbpwhybffqftifqftqzivlmrkqzyaeysil11,372,064,965 QUTick 85,362,9462026-10-18 09:17:28YALBTQYLHXCMXCIIYHCWALTQEJMALDQUDCHBBBSMIGHUJDJTGWATTNMBILRKrblfngebzrxyxebuglheufnrwdefiwqjxksixttghbemypigkprkbptexbnm10,819,690,581 QUTick 85,362,9462026-10-18 09:17:28VQBTUXWCJTTCMCAGGUIQDTVMAMSAYAAXNULLHXSFOBOZVVUKEPIZZDCAYJKHReceipt records 16–30Full transaction / QU / tick / display timeFull source identityoqpbqdswaqwqtfdhaybfgrmefafddzddjmtagbhoscuumwgdoywqsfgbezyd9,754,066,043 QUTick 85,362,9642026-10-18 09:17:37VWDVFOFUWEAFEBRBFCPBOUQGEAODOTNLSPNXTJZBUBLCKYGZTXMVMUCGOBKHsijbfgbkhzlfzcpmgynufeeaiwxfvxkgpuackgashgwlobcsjnugrvgaukrb9,000,027,944 QUTick 85,362,9812026-10-18 09:17:45FPMCTILWDFNNGFYHIHFTGTAQDTZCJHFFKNAEWCAGADJZQALQTZLFWDFBVLRGukwdxvtfmjzpcafnpnmpsmxskylbvbxeyrdjttphtgfcorciplqvvoceptig8,337,564,524 QUTick 85,362,9972026-10-18 09:17:54TSWIERUTBTUEWAFAXJWXNXJBYJPCPUOTWTBGWUXXOAETHOZTJUYIQIRGEYLLfaredsjokwudgesazbjyqnqyfpncvistgtxaehwboevxwduobptlysrcybae7,579,688,282 QUTick 85,363,0132026-10-18 09:18:02HSOELKNOZBTNNCZALLXRBAIQPEXCKKVSIWBICQIMLCUXCJMHVKHEMDIAKMTOwdfvnpgsaidmehonilfmhibxuibgesiddiemdvarnbtkzuolajhiclmgtori6,787,011,016 QUTick 85,363,0302026-10-18 09:18:10MUXUVHVSVATKAEYGAPJITRSLOMDDNBSPXDYDFVSMQAZITYTUIXVHWCSFPECNiubcxsoijfrfaehpjjgzgfrwttgelpkfhtwxfwhjqftprorudrcabuwcmiil6,366,030,287 QUTick 85,363,0682026-10-18 09:18:30JYMLQRGJPTPRLEBTSJPIVWPZNFRBVFLCCWMRIVMVHDGWGJLESFMGXIXENFCCalwikiqvdfsrjcvlozwgdcwpsvkfvvtwppbezrydyaibckeqwimodasfxgxn5,714,667,283 QUTick 85,363,0842026-10-18 09:18:38PBFIQXQHCICJKCTOUQPKXXCNRADBZHWIQIPUCTOYHGFBNVOVXFHBGZWBLBJFrpyhvkgqsnewrbnjfyermhbiaiebptlbiwfllomlzgquelxbkorfldoafgjl6,057,884,318 QUTick 85,363,0842026-10-18 09:18:38LGLTZGLQKTOTYEEWSJDASVGCJUGAUTTJZGTSYGOLZGYVMVRRXVVBCHJAWOFAceckxgxkmlbysbnyzcnlgmmlprigqpvozslldzyoadxdgqzqdjevrqdfslti5,201,589,839 QUTick 85,363,1012026-10-18 09:18:46EPUGBZESRCWUOGHUZICXFDWRQLACQZNURGIYZOQGIEOFKPMBROLQIKDHQMZDddpmiragocjgxfcnadnvncxocywabsspduqrsbfnaeuwhpawypsnycucxjpa5,017,128,141 QUTick 85,363,1182026-10-18 09:18:55EIFORJHQTPYQHFTAXTHUEOJHFKMDMMPUIYLZDGLKLGKOBLFEYLQFBFKEYWYKklzgxjlghgyvnexwqovagxeaqpbfagznzehteqbdnfpecsbewgznotibuoel5,000,000,000 QUTick 85,363,1352026-10-18 09:19:03BLWAJAWFXNSWHGRSGOYYYLYYVOTCLBMXGSETMQHIIGZIASPUHTFKVMRBWMQBuwvfehpfcyrnxavksgtrktbyfovgjtfnixvimgngrctdldnergnzvuvbowkc4,697,398,495 QUTick 85,363,1522026-10-18 09:19:12EHZVSFKPQACRACISGYKWAVLJXELBNEPTNTSFATNWXEAMEXYAHMVUUOGGCZMNzcavownlosvgydolrftkjpvtopjglkutkeefmnpguemklkayskwykxkbytti4,414,748,788 QUTick 85,363,1682026-10-18 09:19:20EHSYFDWZHYRAQAIGLJLUJOCOTILBCHKONJBYOKPPUEZQOGAZCCWQMSUEQJLBvpyxsnhqhoxawgkzsnqzexvqrexbomsendzcevjtwamybmfjuvqgcqhavnaj4,074,866,216 QUTick 85,363,1862026-10-18 09:19:29ZCUNMOBFWNYVHGTHBIHWVXRTBJACVFPOHDXMRTZVJBDBCYEGKZWJSBAHKXHIedptxlwkhjheycnkxczreasjalealkrkngqwsfffpfsfjjschebsomobhlkl3,725,843,245 QUTick 85,363,2032026-10-18 09:19:37FXLGZDOFJTWJODZFPALRYPAXGVBDBLTCTWOMZWRXRGNJLMFIXBJNFWGCQDUCReceipt records 31–45Full transaction / QU / tick / display timeFull source identityvxspqporvgqmbafbjkzmaielpqcgaojfvxowlxogrfbkbzqjfvuakxibutbg3,924,612,435 QUTick 85,363,2032026-10-18 09:19:37WFKIYQSOJYWJSDXJFJZGYWRIEZODFSZRYRFIZUGETFPPZFITRLHURPUDNOCMglgkpmkposgbiexefupbndznbszgkhicefvlkyjnaestfjsguncxphtagnya3,555,429,774 QUTick 85,363,2212026-10-18 09:19:46NWDKZDYKXMWEZFJYGTKJVKVXPKRBGSLVNSFXGTNSKHIDVDYZJRQPEGSGMHKNssgxvdcnnyewgaoxdjmbiqgzysbgqqbehfwzedlmidzxfvfkvajpqevbpxik3,424,017,171 QUTick 85,363,2372026-10-18 09:19:54TRIOFGEXRZQREDXGWFZOHOUTXWYAWAJILPZWQMRQEGAOFNVSZHCPZLMAUIMHptoauavntmoyjaeyeptjnqoydldgdydgdimbrvnaofelqvivwnwdgqvgyite3,247,781,824 QUTick 85,363,2532026-10-18 09:20:02CGKLIPVFQOESXFPEMBHTPCNPBEUAZURDUDFRYSOQMDZTSGYQHMLZSWNBQFAAfynymhdjvcufwdhhlmzdikievppflwirlystqlyhaeegqqypxvsioebgyzjh3,197,102,035 QUTick 85,363,2702026-10-18 09:20:11MIRUWADIHXORIGGYNXIQFRFGXOQDYYHFJDTNQXYXUGORIONREWHMBXQCHJNCychusmwkkrkqobrhmjidmtkebocaxifqbfirjnrcbexcegidtrwfrncacurf3,000,000,000 QUTick 85,363,3092026-10-18 09:20:31BPKGWUHGMOZGNALTMWSZHARLPQRDBAQNIBAJHTNNZCFCSKMUULSNWDDHCZILbsajktwoakmtihebcwsenadpqobgpyuedfjjdjgybdjcvptyfxtltfchwipf2,845,360,475 QUTick 85,363,3272026-10-18 09:20:39WRWYHYWZQLOTREIYYXOPHVJLVVDAOYKZBOISVASCRGCKXKCFTIMFVVGHHJQGcxzfwkzlssesjcpzzvufgwardrpctywynvfxwgrksbqfhhdmupxhribgmeyh2,759,658,234 QUTick 85,363,3272026-10-18 09:20:39SAIJJORIJIAXBBOTBCYJWICHXGTBYSMNWGHWEHFXHAKLPDJPLLJCKVJENWJJqjezoconfkjznbjmywrwhdppgfxancraojilmnlecdiigxrpkxzpvuvaekhd2,501,199,943 QUTick 85,363,3642026-10-18 09:20:58SAUMYHMDZUTGXCJHVLPAPAKXNKNAEINSFNSTUNLUGDTZOWMWOZJKMXSFSAUDngvgxkiyomnwlakzdwvhuipirljdcsstylwxpqhyhbywigirhkbduageuryk2,396,783,689 QUTick 85,363,3832026-10-18 09:21:08FQDOSZPXMKQSFDTYZHPEMXBIZGCAPDRJJSGZSDQXMDSQFSMSYAHWGOOETQGHvrxiaxdppqveweisebbarjsmdyhfchawtbpjphvnvezkvghfhhvfzeugyaue2,249,918,358 QUTick 85,363,3992026-10-18 09:21:15PWWQYZJVJAKJCCSNDECPVVBCQRLCGDNGSSYJZOTBWGAGJBNIZLUXCAAGTSAJrwkbptuspwvfscsmetnitzkhutqfozsavshnhlwvudiimvhippcviaadozrm2,172,978,396 QUTick 85,363,4162026-10-18 09:21:24XCDZVYULADWVPCUHOVIBHEPCCCJBQTKOLJVPCEARKDZULBFXAHJSYNJBKOIDcotozmohdpiskffjhaiajbawigjgpbmknlvtieykxbtufctydooidxhcybjb2,129,573,252 QUTick 85,363,4322026-10-18 09:21:32RLZGDRAEGULLLBPUPFHQILAEMGHBBYXGYSFEHEYXBBFTWDEAMONPMEUFOIAEaeslbhoorxwmzaxpwatrwdzqwnjgczgwizgrmfodlgyrosikvlnevqqbbrbm1,999,595,479 QUTick 85,363,4482026-10-18 09:21:40WBBQHJJBHFOYTCWBSGURWBOKBMCDFGCCGSYDBNXXEBMZTXLVVMVWSWTDLFCLgokzcppyuulvqcapzjfyvbaxvsjdzfsqihlaodkufebbpytkpfabvwzacrej2,024,069,020 QUTick 85,363,4482026-10-18 09:21:40TTINTYYLMHYBOFYEVIMXSYRBURCBWQKQPWZMGDTUQEPDINQRTNFEYEICLEPOReceipt records 46–60Full transaction / QU / tick / display timeFull source identityhjtbeffilsbridxrjzjnhijnfrucbfkblhhueygbmetuicygeavghjgenmrl1,910,724,313 QUTick 85,363,4842026-10-18 09:21:58SDORRDIREXSYIBLEBTOTUJNHGGVBUPDAJMACBSRCGAVGJFFVVNULKKAHORLOkjhwxqffmpoodeaqziztybpactngcsdhwxgxgtpgkeuncoktgtjdfwkhdncn1,830,595,569 QUTick 85,363,5002026-10-18 09:22:06AFAUHXJYEPHMBFEHPCFKCNBTEOPALVWSTFGUCZCJQEAQNTOPZNZUSSOAZUABtkvylsrzepfjmcamcevyilwjoepfklnkozsjxwilretagzhvszwwxvlbxyxj1,770,947,401 QUTick 85,363,5172026-10-18 09:22:15FQJJRMWGYTVUZFAHULRJNCQGRSSAUGWDCYHKCFCXIHIMBRSDQZEZDAKACJNFtoroalyboskvdgdslzytnfgegtsakpesuoxslphklfqlfyebdsfqygmaebul1,718,218,570 QUTick 85,363,5342026-10-18 09:22:23PIJRJTIIPBOPGEQRNWTRTVOSFCHDODEZGUHVCCUPTDBQGWABHKJPTPPGLFGNupxwcqggqrgtqeaxjdlqkgkawmvbfygbsgpotcmmbcelcbvagvumeqchcstl1,664,726,712 QUTick 85,363,5512026-10-18 09:22:32MFQJQLETCBGNZEFPXNPXPJUEUDJCAKNJHRVYOEMITFJUJUZEFNOQETRCDWIFavvnzsxlkiqczgkgxmgrrxqiqefgphhsqkxkfstichbvkhynyojxfgfeqczb1,601,017,605 QUTick 85,363,5682026-10-18 09:22:40MONPENGZUYGDNBGRSYAOASVFXOGBOPWFJRUMOCDOHHJPHFOSGWABUHVGFBKGtdaownyayypuzggskuoinikqenefqapzqzakpwcqbakjyznptpiibbbcqfml1,513,044,159 QUTick 85,363,5852026-10-18 09:22:48NNXWEXIOWFDFWBXJHWBFUDEQCLRCNIEFHEFOVTZAHFDJJLXCQGBLJPQAUVQOotfbzsziydpubhtpymxyjegpjeiddaybjpcdkftctffmwtsmyolgwehfvlfk1,434,637,934 QUTick 85,363,6112026-10-18 09:23:01LXMFNXIBNBCCCARVQUOAISIWPIIAYJQCZKLIYBTQGHHPGDEIPKNDMWWCFRWDayvfwvytxrtelcemkkwzuamvxmcbaezogynissmghgstloeqntqfpkuggfzb1,375,135,152 QUTick 85,363,6282026-10-18 09:23:10TFLBOJMMJRCFRALYQPRIMXLVMOPDQBPCYGIQKKEJGEJSPOUNOOEIQPSGMJWExhsurqdhqsscuaqmmntsnfemgkchloxrgdodecllvbskdpzyptdfigkcpktc1,324,472,150 QUTick 85,363,6442026-10-18 09:23:19GDAOAUJCEPSGSGTEIQRLXXMLQKXBDVEBJPBMMKNOEGHPOLAQCJDFBTSEVHVOonwvlrxwhwvoagenbzrxuxfbuzabwfctdhmfnjkhedcsyburhdijpbjegbnm1,260,813,994 QUTick 85,363,6612026-10-18 09:23:27VWNQXIMMAKCGLGTDHFJFAZEUSKDBBRCDULXYKQGJFAQWFYENQIYUYWCFJOTBnalfkczccmchwayxbigtfysdpobbfftnlxgiudzrzdyrgryyznokgatcchej1,225,887,157 QUTick 85,363,6782026-10-18 09:23:36KNIRHZHHUJCBHFRNLUABMMZCCDCBPBEIWWGRZKMOAHNYXJLWTAWNLTFDIUAAumzxwtlorhwmwfyfoejjzlchltgbtxfigcdawvvojhiqtkroapnfmqxcocme1,204,619,018 QUTick 85,363,6942026-10-18 09:23:44QJWBQCJWMTOXEHBJZSJQLVNLRROAIWCAXOTWPKUDMDBKJFTOGZOEYLBAUWONhqibubvvjwnvjgnrrhpwcnovasidxfqbkvjzbhysucoemsydxlvygikewsai1,177,390,335 QUTick 85,363,7572026-10-18 09:24:16VSSECZMTLQHFOGFMPUBDIGXESWCBGRTBGHZXUUFHFAKLRVVZLOUHBJIDAASBppvpesndkamviearsedyfhekquyepyaqcccabofxrdzoguoenvbdwvxgnzfk1,107,254,001 QUTick 85,364,0662026-10-18 09:26:52SILVTLWPELACKHGNEZDSCXCVHMDDBVMVUQNYWUMFOAJUUNNITSHUELLFSTEHReceipt records 61–75Full transaction / QU / tick / display timeFull source identitygmqjlecspmfxvbnphpnuswpikfebdopiqwkvcbtxfevldyxjqgsvealghkai1,084,143,572 QUTick 85,364,0832026-10-18 09:27:00TOWAJBLWQTQAPFNWRHZOVKEHHVJBGJNLEOOBUJZASCYRNQSKNLEJOZRAQRYHmvztamwnmubkjbtdwynxdwhqyiehacifshnozdtwkcprkpyepfhuzltbpzun1,061,863,902 QUTick 85,364,0992026-10-18 09:27:08EKLFOALYHZFYMBPFKGLNDMQJHEABLZFASPIVNGFTTEWPAVOIEOAEBLBCWBVEhqmdvldphwqrlcbadqomeyfpbflgxxhmtsbnwfhowdsoxiptlkjmvgmdlovh1,047,275,320 QUTick 85,364,1162026-10-18 09:27:17FMVRSQIBAOXTMGTEMERVDRGLUZNAOAFQVNJNJFPQPCDJOVEPVAWQKOQENMQKcdlbdezaxnntzamtxuublxdtbrtbxqzltiheqcpvycoskfajpbbnrreaqede1,027,279,561 QUTick 85,364,1322026-10-18 09:27:25FDCIQLNKDXOBOCNKTXOGCWMWVOGBFSLHCWUVEDZQPESZOBXAYRBEHXXCXNCNzkrezdqgdqvjwflxodyvkspsjuchkewhjnbbyqnkhhvddyqmrtyglmvdkcoo1,011,997,337 QUTick 85,364,1492026-10-18 09:27:33SOEHPCYUYEWBOEWTMJTSREMGVFQCACQETHCJHXGBKFSMEPWOETPIANKFAYVJdfdyjwvsxlndwbovfplbttykukabggsiaubmhlmmjbkbdywpxjqxgmdflhkl1,004,249,575 QUTick 85,364,1672026-10-18 09:27:43NGYTBPLJPMQOWDSBNMVUDJUSBOYAZBJMONITXDSDSANWCQNLQLHFNASDANTDmpwicnztrwkqmgimtzxmsegvvbdhurcrdiputneijdjrwbpcwxtcghkgmugb1,000,300,000 QUTick 85,364,1672026-10-18 09:27:43EMSZXXFEZGBBHEHBGUIAERQDQXLCOUWXSBYQDAKJDBRGLTNOYBMGUZNDHCNMrbxgtkjqtlfifdkxekiahmxujokdjoprjtpxmfixidnbddlpyomcxwceatgj1,000,000,000 QUTick 85,364,1852026-10-18 09:27:52CUVHDLQVRUIOKDUEWIWBEJLBEZXASQKRVSLEPVCLEDOMCOPIEJKSUTHHNMYEuddwygqhjipiveoohagpjaynqbyedpzsiwdscuspqeuoghxhabsaqaheybqb976,312,184 QUTick 85,364,2022026-10-18 09:28:00SXMMLLLPICIFXEBZLVEPAPIBNEKCTIDCVLGUSCNUCGHLYBVDGUDKHFVEQJUMcseuzzhyhoudlhjonfeiaqzolzsgekqtbkrzkqraabtpvjokfpisewmajvhn951,293,830 QUTick 85,364,2192026-10-18 09:28:09NAMBSOAPCIQXPDHCUDRYLNEOAUIDRIPZKTEMCUJOBAFGGWJQNYLTIBZGQWLLcunzsjbyxcmvzgggjwyyjbvpokneabhhztnqllnzecsopnjtcrdsddbfokgl898,117,637 QUTick 85,364,2362026-10-18 09:28:17CMJBXIWZPOWORGOMUOZRKPVRWVTABSXXDEHFJKPMTCFAXUZVRSYIGPBBAKFEzwsabygmvomdneoqsdypqwnoagzfwhxeyyemwgtixcriqajvrtwlfpfhifng857,173,848 QUTick 85,364,2522026-10-18 09:28:26ZPOLURHJBSVTAHZAQYGGHGPUPFQCOQFPNCBXJDGWVAXRVJFNFHHQDVZCMPWIyrwfdeagqxbtugbqhslaqlxprwedarwlnbgylmdkaaadqvmhtxbfgebfivak831,920,983 QUTick 85,364,2682026-10-18 09:28:33XOGSCISFRRCVNDRHWWSVHMGMDAMAEZIQTGWTMRUBTGCVGFWURZGLEDIABYYIbaahlqsqiwppxcmkhhphbuptrnabbswbflbctbxjjgpzujrnktxpvqdfkuwm802,721,256 QUTick 85,364,2842026-10-18 09:28:42DGYYLNDHJIUOHASOKCUMDJZEHZRDREWOTJMMHDIFGEOXPYOJXQDLXFDBOLWLrjbziqtzrnhxofexrzqhetnzdzodixagzlqjwwrfrdudzbngzkrnkrdftmwm783,377,055 QUTick 85,364,2842026-10-18 09:28:42HZOUHPJHGAYWNEDOUQTDUOUKJAPCWFIYAPZBMZVPSFQYKBODGQNLFINFPVLFReceipt records 76–90Full transaction / QU / tick / display timeFull source identityxaibjkpnqllzqgemxwryaeioarrgudianttnbnlkugewtalbcmtmtufbobhe759,169,910 QUTick 85,364,3012026-10-18 09:28:50USUEWVENMAXYLASQXYMCAYFLHNCDOMDLUWKBQZWPPCOWVCGNCWEYXDSBDKWKdabwlvzeqltmjdogtkhfxzterzechxtpwxmvzqiozgksrzjyijbqnnehutkg724,377,202 QUTick 85,364,3172026-10-18 09:28:58HGIFDDHEHFZINAYKPLDLBJBXPMDCSWNEWPRXFWKGJECOVQDWOYSZEHQFWVODccquqnzwdvhadgahuqxdtmpzdtqbjuulisjhoeobkgfzknwrfkxahllfwbtn699,800,000 QUTick 85,364,3352026-10-18 09:29:07CUEYMHCCTJJCTDBNWLJISKERKNMAWCICEWZVJAYAYCYGFEBGACQSGKUEYCSIwywloobbaersjbwjyseizibnilfhljaydjjhugpvkejdfflsjxxfiyrefpqj665,810,813 QUTick 85,364,3522026-10-18 09:29:16DXQCIDKGTTZPZGYGJISIINOVGMCBTTYKULRXDOWRZGLPOKRLKZDUZRLDEOAMbvjhykmkqfxwkdbwxwrarfqnmrpaooghkblpqhxwgcirhdtgrbazzzvdoqec643,803,321 QUTick 85,364,3692026-10-18 09:29:25YZNCJJHHKIEVKAXAVITZIWFGJLTCMFUYAATJYVBFCEONBLZBFBXVPUEGATQJmwkxuioegechfhlxmhsvcgxvwdreboporegnyxwumdoogkehkhiijbpbqfpn600,448,003 QUTick 85,364,3852026-10-18 09:29:32ORCHKLNIRJSSMEVJXXTXDJEIVIGDSZQVNXVLBKBSWFSOYSFBCELJSMAEPBLIcjfxznckionmzfkhbextwudavnecsutinsvmmoxrvbfnyextchfaeknejfnc584,131,677 QUTick 85,364,4032026-10-18 09:29:41XRDWLXAFJMVLSEGCUWNRUDSHXSEDTWERLVBECGQRVBKQUKDQQKPYKVOGDCKOxftwhzpizjgzbfrnvtoxgfbsmxlduiresruajvnjkcdojgobyrpagvzbpcng538,706,028 QUTick 85,364,4032026-10-18 09:29:41FBQSFCPBQPLLFDHYLXZNDSLBFDODBNDQIKVKHELHFEPJIEUCFTPZNQHCORUBpcgmcgoccbxzceendascgxptiebasguwpvhxdekgfhcpbabuciipbjndjfpd502,579,362 QUTick 85,364,4202026-10-18 09:29:50ZJTSDJIXCSPURCVUWBZJIHYJKPUCPVPEFZYRANMHGFLBJLRLLZDKUYBFQHENzaaimvfgkulwzaddqqumfspzzgyfrigtbmkqlytypckeweesyenjjdhhlmfc480,436,394 QUTick 85,364,4422026-10-18 09:30:01ALJWNCBMNDAKPEXQHNQTLVEKMMABGKUKYDNPFTSRUAZGGAELCWTASBNENIKFullqjxovgzpwlemomerprwbiesialziachqyrepuuflqeypkollydvxeiuhk466,574,888 QUTick 85,364,4582026-10-18 09:30:09OCHWVUVSDAUKXBZDKFCUQNXULHXAKZCGQBHYBHSFHEYUCCNBCMPWGFLAHHHFahfanxgjtvcozfhtdhyxcsqpdxzgvzrxxxlgfzucxccixqjdginsuijeospi417,017,172 QUTick 85,364,5262026-10-18 09:30:43PNQPJJWVNEGWBDOWHOYNVDORWKGAVPUAFSVONKIAXGYXDSVJAPLXWIKAFBVEbatfijcuwgkeveqgtsobgwfsdcmbecbgctoutzwypbvlrrtwxgwixlffnrjm401,017,588 QUTick 85,364,5432026-10-18 09:30:52CHPHTXEIZIIRBGHKLAVJPPNMJYZCZZMUAOGGZLIGNDRUNPEFESWQQREDQFPLrockaxgdxykpzcthjtvdkufiquwairkqigewmwpsqalqdzvkpsrieaqdzsvo381,265,806 QUTick 85,364,5592026-10-18 09:31:00SUBGPWHGSFPRADXJZJNFXNMIWZSBJBQUSIGQIUJNJANXHGNCTVMEAORESQPMjjisdcwmdehynbtpnbalutjfgyqgzqmcojabfldgfdgdeviamlubhmbdgazc362,021,779 QUTick 85,364,5762026-10-18 09:31:08UEYBMETAHLDPZCIKQDVECVTFISJDOZZCAYGVKDTYPALRSKKHDGXYXNGBIZLHReceipt records 91–105Full transaction / QU / tick / display timeFull source identityophedbifwaaebfamvnstmszsjcjfwdiblyjnoswepgunrdraiemzaqoggsmg334,217,259 QUTick 85,364,5762026-10-18 09:31:08BBJZTFHUDZDWCGRDFTFQNGDWFTVCLFUBMXPVZCSUGHULQUDOLASPYKBDECFCtxdbshpiklpjdhpngklupklqjpsaetdmmolweyodgcafqjjwefjombzfiwri294,013,229 QUTick 85,364,6162026-10-18 09:31:28MHLTZYRBHAUJMGGBZJUCWBCXISLDSKDNLZJDBJPPAFOGVYTILCMIUECGIZBHnrvksrzbsbbiaeqvlerdvtiarmtazulojehwhijbzfzheqnvycklznrgrqvc270,168,956 QUTick 85,364,6322026-10-18 09:31:36YIFUJVWLNDALIAYOCEFYZOWGQZPCEPYEQXYDRYPVFAYGHLZTJXWQLXGGZXYEyqbqskgluacoxeaaycqshemqlweaawpriifuehdngdvrriruhwddkyidfkyk254,468,580 QUTick 85,364,6492026-10-18 09:31:45JILWXDLIHXHHFBDZZSTGDKGRPPBALAFYVAWJNXDNKAFEYKPNGLFITVHGVJLBnqfwxyuxzufucgipwibiwftqbjofpkikrnbhsqxztdcafprmvkfccprawmvo242,718,258 QUTick 85,364,6662026-10-18 09:31:53NIIRZOITCFHANGCYGUEZBRLSQTEDLVODJHDYVWBSUEUQBTGASEIRUYNAULRItihraxtzlvtuierexcdvxmhfeyhbhhvfjibewybcrabymylmsxwccpdakagm224,610,580 QUTick 85,364,6842026-10-18 09:32:02RLLFEFEVJDJOJGCDUDWYEPVZPNCAQPSNNHYPWACZCHNKOEUHTNAUIOPDGPYMeiuvwqofxrewcbwrvjspnxkidbbfqiyzywbjvbohudsadldoeqayltfhvkqk201,016,979 QUTick 85,364,7012026-10-18 09:32:10RKVRLVJZPXDJYGYQSOWSKDHUGTBCOYNLLCBVJDENJEOFIMLYRRYIWDXATDJKqddqnigawbezyavvwqiagokfysycpkbvpqcucqwkyfpyduyrblowhkqfnnnc212,003,557 QUTick 85,364,7012026-10-18 09:32:10XCCCGTRYFXNJZBPCVQMHAAUCOZBAAKQTGMNHOHEJQDSUDKAZSOORULQBUHDEzkbmuwdsfpmxtespgnslynojuyzbtzwwhadmcaaahepyftpmrgloatgcahug189,841,796 QUTick 85,364,7192026-10-18 09:32:19WUMCYFZICPSJCHFSEJGRUXKWQJFAZIBFMSTKTYPMFDMGYUGFHBVXZXIBSIECnvhlvustxhjnzeaiikezmjhlubeftoptevtdkbyiraciaazyqeplyeugecla178,681,008 QUTick 85,364,7442026-10-18 09:32:32KZYJKZAHRNQATFNNYQLWWTDOXIADNMYPVDQFBVNMBCRCBNIXXGPJGSXFLYWMlzwcuvkulxvmmfjmhhicyemtrktgoldwottdfyjgbcztmjdlglgicjbdihke163,230,273 QUTick 85,364,7612026-10-18 09:32:40TNQSLQBUTYXEDBQOEHTWNMKFVIQAFXXMZEUPKZKTOECGLLODANPIYWJDGBQDkknfkitfrbhyobmqvhkqgviopaddhdxxgfttctnerbvoyjxclbvbkhgfvcod157,606,226 QUTick 85,364,7792026-10-18 09:32:50HTQOUABIVWRJXBBQFFXIMPFSIQNDAEIJKNPFIVPDWBGCREKCTEDJQDYGTCSOerttlorkhhyfedjdmbgipsfeeeoblnegugdiqszsheeshloeaigxvjjbtkwe151,657,714 QUTick 85,364,7972026-10-18 09:32:58SRMKTSFGKHELIEYHRAYOSTAQVAZCNJPVVVRTCHAINCUTILJXGFCJRICBIIHHrkxirndayiomtbjpxsacofewjkyctotjsmqkcbjakaursaygdhpdcxjextze142,997,534 QUTick 85,364,8142026-10-18 09:33:07ZWYEKLAOUEHPDANOUUSGNSDIGWMBDJFHZXLGEAEVWEIZEPAXQEQBPKFCVNOMhbzclvqpwztfcftoeculusovttbbvwlxqllxfcjstanykdlmtphlqjigbbel136,892,296 QUTick 85,364,8312026-10-18 09:33:15PQJCXYAUVLEPFCFRGGFEXDPFVGIAJZVCQGDQIKXMQFOLFPCMQGOVKOVCYROJReceipt records 106–120Full transaction / QU / tick / display timeFull source identityayameazbhervifnlieukfsetwtibvbsiicgwsgwihhgwgeqvoqjznvyfscbg125,073,630 QUTick 85,364,8482026-10-18 09:33:24IAPRILKEGTLBCEZEESNCQYEHUETBSCSJKHMOGTVUNASJHLDXGRRXMNXGKYBJqevrgblispmvdhgkspucgsfjitzeqhklxkvbnxzeeaacbfqmmoqbnpzdostk117,317,768 QUTick 85,364,8652026-10-18 09:33:33YUAAMZQVUUWNZDVLAZRFXBXZFSGCLUGCIGRUTHWYIAYAWZXGREICVWSAVXDDzqjxzktwbvmuvemdkdskxrursyfbgqerlthwgecbrbgjlzszvhrhzdjfeqqc110,304,823 QUTick 85,364,8812026-10-18 09:33:41BODIVSKFUYMFDCNZKAHKXCWQCEHDENCGOHDBJGAAKESPWELVZCOSDHPEUBZFfuwaadcrcgnczdbhcssmmlbsmcwbohbsmenagenyrffqwknipllzabcefaxl103,522,211 QUTick 85,366,1342026-10-18 09:44:11ZJASAHNQDGVUDEWLNWJMYVYLFSVCAXERLORDXATHIGRKRGBFAHEVBQVDQRZHxlbjqyxmouhwehoaeekstxcqldabbyoyafnawlducbvftalrwcuajvraztce100,793,971 QUTick 85,366,1502026-10-18 09:44:19TCHXRNOTVOLFAHBQNPARNDVDANXBMBIAOYDDWSICVAIHDMLCJCSHBFNBLKZAbixisldqjtcqkgonkdnzcqzkgpcdeahnmmolwnfacbnamsxdlmdcoueccfde84,008,081 QUTick 85,366,1672026-10-18 09:44:27NAOWLCQWKGDPHCSSVWEUNFXMJAABSMBIXCXQZEMHFARTEEKZPASXIITDXZHKomoowngnamiyjgorsesusudsmylbhfeefupwysswybilnmtrdvgmhvhcigol93,360,188 QUTick 85,366,1672026-10-18 09:44:27ECZCURJWJPYBLGYUUSYEXSWYGHICRUJOSWJJNBLHPBYXLWZKSDLGRZXDAYMBrixjxaedrknuwfzcrghsozpcxvnerlaacqzbfedjzbkdnenvhvjtfkvexzli79,414,521 QUTick 85,366,1842026-10-18 09:44:36YJFQEGRQDBOBDEDENOZDATMKYJLADQOZOZIKHTKYFAMKTBNXXBKFOMBBSTSGjfsicrrdjbxynewjcqhfymccgkbbykqqhkvodefnmahxfjfbezdhsvifgdng69,409,988 QUTick 85,366,2072026-10-18 09:44:47ILNJXVHAUXDGGBTTUOITOQGPAYUCFTNCPXDKOCPUOCDOTPUWXBIGRVQDLIKComzphjeworfpzdpjpbmnrqpcijsfrutxtmopjpefrfqwpcdpybrukamazeji65,412,662 QUTick 85,366,2242026-10-18 09:44:56ILDFBBIXPQDPLFLMDSROOHRSNYBBQOPFNHBXEAOZHFMOLRRUJNEJSUZBHHRHzdyxbcpleovrxcfxntyzatfhoonaizzyvulgsnzodappxsbqkijettsdshaa56,772,914 QUTick 85,366,2412026-10-18 09:45:04RYPLPXDVIMFUMGYSRLEQVLCFKTKCPMTUHBLUQATNUBIXGEMJZJTVFKUCIPSJblyalvgvkhfwfbkdrmthifructjhdkgkutysazjqabfmivxtiwupfabevsyi52,891,882 QUTick 85,366,2582026-10-18 09:45:13ZPQGEPFHEUWTXGNYFFBCZDYBSVKCSTFULEIRNYBSWEMTZTEXVFHAOVMEIMOGeabgfctbjsgitfpejaxkyctfgbnadiqvhtxtqeadtgkjsoatwsapkjbdlvrb51,236,311 QUTick 85,366,3212026-10-18 09:45:45OQIBBYTGEHNXBGSLIZIDASJPJMPCRVAXOPOAWZPNIAWFAZPOVFAEWWFCZHXDfmeekyzckniqedcbzopyuckngeqbdezlemjbxganoazwktzubysyrzwbzskf44,398,777 QUTick 85,366,3472026-10-18 09:45:58XIINNRDAZRMCCCZDGOUPLRBQSGLCAYFSLHFHUKLOWCAIRVEACCQSWKFEEUSIoblckjupfblxebmzoaqurbencbaexsutlejazzmowgmrwiovcntwvkndmfqa48,042,756 QUTick 85,366,3472026-10-18 09:45:58YGKZHXBHUVWPUALMTMUOPKTDXUTAIYFPXYRMKFNNHDBWWXMBWZQUAAFFHAVHReceipt records 121–135Full transaction / QU / tick / display timeFull source identityffxykrqacyetvdltkoofriacwobcdelgfmzqlchmoamvdkeopjksgerajhub41,212,746 QUTick 85,366,3652026-10-18 09:46:07AVPNRFPEDCXULCILZOBMDSZCGWDDCJPKHFOGYORAICSOWZMCEXVNZBFBDPFLggxykimwfdqxjeduddvzkraxzbwdudhxwamoqwsglhhnldukbzdkzwraqjqf39,118,511 QUTick 85,366,3822026-10-18 09:46:15MVESVHAZKRRMUBUKSIHYSCZVXIFCOMUNQTITFANTMDBUEUBTVSUSSIMEPJHKzpcdvpcgxrfdzcmxxpmcyyadpgxcnbqjwtnbxihheevcjkxclmxzgstcqoib35,874,380 QUTick 85,366,3992026-10-18 09:46:23IRFXIUHYYGLEOBGETNDHRRNWBNNCCKZRJIWZFGZPGHPTBUODMWRGIKCFRSFNgjqvcsreimthdhbbzvnkxwzsqongevjfypbrodqpbeoksjfpsgsnkkjeljxm34,010,288 QUTick 85,366,4152026-10-18 09:46:31BPHIODFRIXUPZGWJQCQPJKHSWQCCQDHWOIHNKZDNZBFWZPXDRUAMCNQFEJHCjkcpfxxcksdkzcnjtamalzevbyegoubzucuyahjjifgaqoczluyolzefcdae31,881,620 QUTick 85,366,4322026-10-18 09:46:40SDWEWERYASJCOAERGZWCGNXAOJMANWOMUWRWBLBTJDGUVZHLHBKLMOZDETLKtbkvhiaiehdqxfblnztjqajewdqckacsvwjorlpisdeqodiojyszuuibwvjk30,268,916 QUTick 85,366,4502026-10-18 09:46:49RNPFUDQJYIBJWCXJIZWVGBOFBXNDUQPQOEXJFNPZRBNLCDAJNKWIWZCCVVFOiyhsgqerrwghccztrqahmzbiwxydsedtysshsmfjlcosncewlkwkyzheobpm23,360,548 QUTick 85,366,4662026-10-18 09:46:57LFKDTHEIFCTYJDMLTPOMHTVMXTOCQNTFKYCCJYZMGGIZOVTWBHWKKWDCALMJutnsqwtqxtibdeodwnskfkfsqxgdvkvinidhqdluxecjwhpmwwbuwxvctkdh25,695,514 QUTick 85,366,4662026-10-18 09:46:57UMQAWMNVSARKXGOKDETUAGFZIRKDHVRAXPZHVWEKYELHLCLVFSAMBSTDTMICkzmqrvxqawgqwehtlpidzhiqnfyeidtraxpkfggvverracmdudrcqjkefmhn21,453,036 QUTick 85,366,4822026-10-18 09:47:05IDPFNBKHZQEWVEXAVPFBDYGJECFBKMIGZIZZSFJSCBWMGLBRODKQOSUBMGQNyckjbkjmmxhlcalwfuksacxklvlbxlgqtcmpxfalmfxmkwxqxyxsdxugvujl19,900,227 QUTick 85,366,4992026-10-18 09:47:13PLWXSPPQIWEIEECYIVAZVVJYHIFCKIDAWPXPTKNWSFVDADWGQIHXUTHHEKUJbniodeqexkowfaznsrviaixxpblhebynebpsdtrzxggervdtewsbewmcfdbh18,324,937 QUTick 85,366,5182026-10-18 09:47:23FUBEOCYHUXSTBFVIZTHWEQDXBGDBXBSSEZJWOSWLBEDROVMPEDRVSRUFDUNCxjklkopfzccnvepqyytkaadulojgajapemmgatfldhvfxvxhrqmtbikfhqfe16,279,495 QUTick 85,366,5342026-10-18 09:47:31HDGCQOQVZMKRMGBZPPBBNTEMEKJDHKDMPUXILNWWKFDGWZKPLDBKJNPDDGAFszecyxrambwhbgnkzgtxtehvozgajpfylopplyoyqdohafbxbumqqnrfbilj13,969,716 QUTick 85,366,5502026-10-18 09:47:39RUKGKBHUZMGPWBINNVHVTIGLKKXAFYUNXPVURVBUJGIWXYRYPFQAKQTGYDULdjpbrajbngbwgayjsjxyynxdjoafvdkpxizvszkgwfzxpgazlpdndsqfthig13,322,262 QUTick 85,366,5672026-10-18 09:47:47UNQFHEYKKVICDHMONQHJQSQXKIADXBBNNLOEEJUPDBCVBJXQTSLWDBGDQVDJpkmweaqmziclvffgfnqthgjwfjsgknbslnrhxmujccaadoqujnyxebwdzewa12,030,812 QUTick 85,366,5872026-10-18 09:47:58YTNMXCTQCWURCBDNXPBESDGCEJDDPPXAWWCLKXYTYFCYQLPMXEBCJFVGVFIEReceipt records 136–150Full transaction / QU / tick / display timeFull source identitystlxizcbaridpgrigbagyqhbzdkhdlwwyjeptgmzeepecfmfgbmbcqubhzil11,454,590 QUTick 85,366,5872026-10-18 09:47:58KXFPTSBVUPXZZCUAUETMEFGJFMFCOJWMOAUQPIIZMFOCGWGZVIBUBQDGQHTEqbkhgpbbrqanxfdntszmsqmftvmdtkynucmzmxybcgcqthtxiwrwnmtbtolk10,278,303 QUTick 85,366,6042026-10-18 09:48:06UPVBLTQZJJBWPDIZDOQEEPLTKRKCGLKVQQHSVEVHXEZWOECXQHEHADWALZELwxgbcugjrsglegfrmopssnrbavqahajwkzaezpjcgccpghfgnlnqnsiheygb8,667,969 QUTick 85,366,6382026-10-18 09:48:23JLFWGACVYAVPDASPZABRNJUIQRGAHFGXPUNVXMCSOABECFNZCYNULJSDBYJNzopfxtatfrbmzgrpqwqjzgibvrcbzvxtnlikgkvlleamuvzfolrsmokesfjb8,246,975 QUTick 85,366,6562026-10-18 09:48:32ZIKNIOMQBRLALASQGNWMTJUAYHWCRMBQJCIWHSAGICFCNYYQJBVTFEUFYLWOmhyqukpqqvtgtgzduaoqxtuvlkygxibhqsniuthvjfwkxwgcktaysaxbezql7,091,775 QUTick 85,366,6762026-10-18 09:48:42UYQVDOBRFGHULAYPGFWUXEZJGMPCITXUUNLJGVAJICJHRVFTVEYHFLAHTWFNpyftmsfoevgbjcjyejxywighhdmdchplqkkxtugyjdjidnbsysnrlixbntdh5,520,718 QUTick 85,366,6922026-10-18 09:48:50PWISSLUJZEHKQDADWXNPWWROXAEDPKNCWFBNWSVJYCLSTKOHSGKBWMODBJWEzwpviouyiiblraytiwfmygiegncasvrqyrngkbgznahjelonzndvwifcyghc4,939,497 QUTick 85,366,7132026-10-18 09:49:01FPIMGGHPYGOZXFOQSPBXZJETNWYCYGHPRJOHFBLUGFWMVCDIWSMJXKBBYWOFslwoyfzkawoozcplazahoiajkgmacoimpdyfaauicbktgtjduqnyqzlghygj3,250,536 QUTick 85,366,7292026-10-18 09:49:09YKJOEOPGPIIJGEFSVOZWUSKELLBCXMLNFFUUCJEDCDTKOWVVGMPEJISAICHHdwvxrzocwleiudeefdmjmuvngnydfsjaskgfxxdcrbinldacwvdmpsucyebc2,392,959 QUTick 85,367,9842026-10-18 09:59:41GHQRRTFAMKDDEFXEVDCCSHTAJNIBDYHLKXTTTFSUUEYRGZDXDKYNKUEDHTILlxvtkerkjvojebkgijurmvqgkprchgixkihbvfgitctzbvdsxhvgzfecrtpo2,080,760 QUTick 85,368,0122026-10-18 09:59:54RKRBTKKGANTTMDWRWFUNQZZBKKBBHROYRLUFQWIPQBPQXDFMBCHTUCFBACZEixvshnrycdajqgxhugvsszizmmagfiorzvcdqbwvsdpdfeeeqrbmxhugseik1,887,966 QUTick 85,368,0292026-10-18 10:00:03QYZHONUXOEMLMFHMXDKESAAYUAKBRTPNGYWCFXKGRAIQAOHMFSIVXHKDDLSMwlytdjwzcssafawychqtktrxxldhbdrpqcddutlltafpxjaqdluxbjmabupg1,318,086 QUTick 85,368,0462026-10-18 10:00:11AHSBFJTDBFVZSAAHPASKCZDYYTJCEEUWMNSRASFMTFDHUZSZSQEOPVDCECWFgijlwsjgabvpobxrgxlkqzhkmspaesgkgafhdzrcraibuedhjwgywfxejqvi1,178,945 QUTick 85,368,0772026-10-18 10:00:27TNISXZTZDRYSIGBHSJEABGCOIIYCJEQFZMHBTAGHIHXUEJRIKFTUQGIDYEEEodvvbdnxdcdqdasgizfjvfgfwcwewfqvipzxohdepbhmlnqnslpxrrbelphj1,037,103 QUTick 85,368,0772026-10-18 10:00:27KCIKGMDRYUZRCCNGOWXFTLYBDGCDYOFVQIEYYZLSQAQYEKXXMVFSQMOAIKXBqanlvufopuvlccusbuzbtygjzteclalosxraqryezgyhkqqlgchkpkoavmch962,388 QUTick 85,368,0952026-10-18 10:00:36LQIZAKBEUBPNIAOBJCDBCQLIQQYCQGXOOXQLMMKBFGPFRLJZWJFIKATDABGHReceipt records 151–165Full transaction / QU / tick / display timeFull source identitygebqclvnntvhfggsngqhrgbsbjxgwjofoyckepegygpkcxvyogdgotndbdue755,999 QUTick 85,368,1122026-10-18 10:00:45STTIUIRUMLYXLBXNTZDVFBZYEOOAKUNCFISWPLYMYANDLCAQOXHFPVNGEEGOvjpdeocqhlpcybpkswjpzzalgcqafltplprerqnusaxvwahyjrpknrdhaera590,103 QUTick 85,368,1282026-10-18 10:00:53QCAQFFQARLQTHEMYGYUHGKRANUTAROHWXONUGAFFSGUUVDAQWFAQVRSEWPSLcfnxxzhzoihtkcqitiyzsoqgikicppnenokvtdlqidsbdwpcdfohbgtgvnsd517,635 QUTick 85,368,1452026-10-18 10:01:01NTBUSQJGOINSOCTMMZFVGBCFSAFDKGSERGUUUXPECAOCUXLNIQUMAWCCSGWMmreshyahnjkyxbtxzfapyqsahrlbudgumaovjapgtgvdzxlwkftbvaqgjcse380,855 QUTick 85,368,1622026-10-18 10:01:10GZTVMOVMDKBPTEQHKKBZWGRHZHBBEWUUIWKJFKNBCBJFKSCLITMBFMLCFJOKddxqpkxthfvancbslfyonwffcooerpgxluiipaqmagiojpzxyhwsmfffccmo309,297 QUTick 85,368,1782026-10-18 10:01:18AMPFZXXGSSYOXFEZJLFZCJTSPYOCLQXEFCFQNYZDSGURJJQTOFNGYOWDGNUKnkmtnbjpngdwlcgspwaksimxzfxcpkaorybvkmyiychtchowrrxvruyftqra249,140 QUTick 85,368,1942026-10-18 10:01:26ICLHFVEBONODPFIFEVIKZKRAYUZBTMWGNWKLMHCSXCEOVEYKVFUSSGXECXTCyufrdyimmclazdmledmnjypzxdncyrvezmhlriuhodkgatmorpqtvqbcoszc188,778 QUTick 85,368,1942026-10-18 10:01:26RLATELWZWLLBKCXDRLNIMMIQNJJAQKXEIPPBDBSZJGRHXSKAHHRJFQXAAUXFyglupthikmuxtgxobbyoaqpbswiceeglyindwtupycvaulcbzxwygxacddhj131,999 QUTick 85,368,2112026-10-18 10:01:35PYZLQQKYXOWDKFYEGXIKZZJXDLEALDFXGHBZNBMUXDKJWSNIOKEKPTYARRCGdukqihdvbrjkkcgacajkmknrhoacymioekosykkcacvhsrhvczsxijvdrjlf87,719 QUTick 85,368,2282026-10-18 10:01:43HIWVCCYGMXBZUFPTDWOCNEAYVBICBVZGECKXCPHARFTHRHXDQDHRFSEEACOBsllqkvwznkzvhatfhdbsgweoopfgocofcufredalkgvcrbwskqcfrqvcftgl50,366 QUTick 85,368,2452026-10-18 10:01:51NPIIAHZBRNTXMFCSZJASQGYSCGMAKZQUTLJFDLQMOCDLBZFFJKRHCVEFUWMGqvpyfajapdxkyceykvhpgeyojowacnoetngzfmyuwawxpdkxobsnymxbxmzl30,365 QUTick 85,368,2622026-10-18 10:02:00PIYHICMHIDMLXFENXONQFTECVNXATDOWYMFFXZMXSCMUQOPETNIVZYODJBINjzxftvtczgxifhugvlvbovjwbnjdjaxqcpahffwikcwabluzbovzyoadbhse22,637 QUTick 85,368,2802026-10-18 10:02:09DMYBQUXTPIGQUDJGNLGZJKELFGRDUZGVGJZHLOMTFFXRPOZOTGTCSNGBLVSJnhbzhwvnreajkctcslulfhhzgfkflbeqvjvkwlxtqcbgulvnjxnyzlhanayl19,439 QUTick 85,368,2962026-10-18 10:02:17GKYVGQYNRQIRQCMBJUIZGLWXRHECMETQSXQDXSYJZEGCEQRCQABICSGFVWADgbzgqayzfdjnzamszdjcxcyfzrycejfossoifiushdfjajdpqwfbobddevwd17,688 QUTick 85,368,3122026-10-18 10:02:25THSCFREZBXTUZCJALNCHNGBBIBCDNOOMTLGDUEDFCDHGHVCEMYLJRFYFKPZHobtnlxujhewnaavsxdfqnuyzrpydghamyucvmoklygdrffhginipjxgdsnan18,154 QUTick 85,368,3122026-10-18 10:02:25UEYWWUZQMLUGGBUCUREPOANAQUYCFZYBBPISORLDMFDKPOMWBFCVDHJCHOKKReceipt records 166–180Full transaction / QU / tick / display timeFull source identitynwiyvefdmqpctbaacpulrkqgptddjqolykdhgnndfcxxxxnmoupzohydbiaf17,639 QUTick 85,368,3292026-10-18 10:02:34VYOPKJSJQIOKZCIIPDHIZNHQZZTBTNAFDLZPPZJSYEMNQQIKYGAKSXLDHBYJsxvlzxcdqdmghdyyeivgmwtmldahribwdyitanfdzbmbwnnzeaskfqsbmcih17,639 QUTick 85,368,3462026-10-18 10:02:42PFBDMNGJNDFODDTTYTKJCCOCOEIAEKUAMGZLCCDWSCRALXUVITJYFXAHSPMGmetihighvlfxpgdlnevsxrcghqiddxhynfbeluqvubniawldwikbvldhjpln17,638 QUTick 85,368,3622026-10-18 10:02:50WDUTZQLGJCNLAHEPIQAPEALIEFPBANRICGHFPDTCCANTOZKBANCHALICMKGGcrentprrdnbllbfazxtejpedolgcrmwtgjhotwagcgmsyqglvrmyqrzejeen17,638 QUTick 85,368,4092026-10-18 10:03:14QVDLMZWMJQCZOCFMKXNKCDWTKHRCRFRJDROHIHPEFGWTJZLKGWUOPHYEIAGJmwsufdjvvsufraqlpdxnzohziytbzocxtnfltjsbobuhdpgymuwblrngugen17,622 QUTick 85,368,4262026-10-18 10:03:22HGFVVMYWGZOOVGATEZUYUQUGHHWAANOBUYLQSVSXPBWKUWWCLQARARUGQEFDnolznkhnpyuibbqebxnyhxzknyhatktvwvcigfidvfpjuipdchtpdlcdipjf17,610 QUTick 85,368,4452026-10-18 10:03:32RUHUZVLCTLTSAEHCYPACLYDDCHVCQTNYWPGOTYYASFIBWWNKCTKKJLFFCTZEdblgqaobrvqkpegkwuuhhzfvniigsiqeflukpokcjdoasvsijldzegchmlcf17,610 QUTick 85,368,4622026-10-18 10:03:40NCHUTUPDWACMVDUTGKDTNAUEHUSBJELHTZPABKZFJFHAVCPHGFIYDLGAZUSHvcsfctslpsxuvextbqhvadzwelnfplgtemqfvhyhjdagtxmwcfeonzbezbwn17,610 QUTick 85,368,4622026-10-18 10:03:40YFGJCWFCGPPWMCNOCPGEUTNBROXAAAGLIXGHOOTOPFKXYYVZXLOIPPHHYOBNohbzduqamparzaaodtuorymddwhbhkngzmyevhvpaghcqxoxtkrykkabwcvo17,599 QUTick 85,368,4792026-10-18 10:03:49YYIJPHFELSAEBGRVTANXSPEHVYOAXPCQSAJKJWYVHCZDRITGARRGAJDBLMWJdcvqdouseajvtbcfadqezjzxikndkpgokiqerjpqccbolketrjvciasbglwb17,598 QUTick 85,368,4962026-10-18 10:03:58MXQPAPLKAPRBPBHSRBTWKSEMLJIDSQVEJPYVVDYJEHLFJXSUVTGRWLPDCCQDmcohaxqvkscqsaizmqnvljkjhmceksaekhkahfgmhdloxxvwhtztguzfgirh17,598 QUTick 85,368,5122026-10-18 10:04:06QHYDCDAJWQEVGBXOPSMWLZCCJJACOISPKRMYBHPWFFPRRYEKMHXUKZNGPASLutmkssfwgknimgyjacmyvxixlrsedhmjxvdnslbvaekwsyhpumofuohaiudo17,597 QUTick 85,368,5282026-10-18 10:04:14BAXEZWWIFVSFEFBAOXZXZIZXLRPAAQEFIMVNGZNLUESDVMADABCZWPJCFMAMpdptqehmlgohlgoozndxjupqavqenmvbqqpeqcheidluuksaykklnbpeaccm17,593 QUTick 85,368,5472026-10-18 10:04:23YAVIGJXZUBJIJCTRTJFZDIIHLELCGQEOKJFILMXJICAQFGATWWNVMNQAADFBdtxnsjxoiruykhmsfrjhynlpjryadjojvknsnpummdbjgloruxiflyvcgbze17,590 QUTick 85,368,6082026-10-18 10:04:54MWRIAGDZIXDIBDOQZFRQKOEXTIDCGAGGTWCPICYCLHHUYJATRXIBJYMAMJSMgdavbpyauzicdhmdwnxbzxhpclfdfytiteuduwhqgcnkrhweuymnskldkfwm17,566 QUTick 85,368,6242026-10-18 10:05:02DYVELOLTYYZINGYXAMDNBLZVXCHAJCPKQSRBXYOIICDXIEPWZXZQURLDFEKGReceipt records 181–195Full transaction / QU / tick / display timeFull source identitypknylesyzyugmfdddowfeuewbbxabtnjnxfrcyvafaynczeeyftniojcpnok17,520 QUTick 85,368,6242026-10-18 10:05:02VIDUXUODWWDDCBPLZCTZAOCTPZKBGOFTTKFYYSXBTGZKHFLKNRQYUIAFTBGHopljnckfxbxapapldgyocedzjiygqtdtsvsjkrnfifjdcthgjebinnigprcb17,420 QUTick 85,368,6412026-10-18 10:05:10FFRYCFYJRUEVDDCYCMWQGNUXXZRDOZUJLBZCXXBEAFCQXGVFARFNCIZBAWRMebgelspurrpotamjuheamllxwudcqkizxvjpyxkgdbrrkpzgmfnwzwvclwzb17,258 QUTick 85,368,6712026-10-18 10:05:25HHRIMEMZHFQRABANYUMJIJSLJYRATUQLAJBBTLXAJHFMKKRZKBWNQYGFOUHBabfvkmzauqjysgyzleflaqbedlleiotkjxdkzhzifcnycyqengwyojnfxbvi17,183 QUTick 85,368,6882026-10-18 10:05:34FTTWEXFYVMXOCDUFWGRUTRKMVDEDMMIKTREATUANKERHQFDFXEXXUKWAYDDAbrprfgyzrsnzpbaskxalzwjekgvgbbnkgctkqmxhffwaxryooiisyzfffsjk17,181 QUTick 85,368,7042026-10-18 10:05:42AAQMXMOCGLRXRGWSAZBYKZISGNQDAERTKRCKKIFTVFMMCEIQDHWPDJWCXJTLavusjwvlbnopsgdmwrtlepjqllvckintaevpcnxkraipahxwiztntpdapjng17,178 QUTick 85,368,7222026-10-18 10:05:51RTBMDAOIDPOSDFRUQURVVFUPETABPRXNZXWNSBJZHGJAOISCISMMHVWDLLLNbrdzqltvdijtzfxwbfnoppydcpgfjlgiizkdcdrrndedaibnewqfnxfcnqgg17,173 QUTick 85,368,7392026-10-18 10:05:59BYFIIZWLZOTDOFUMRSQFWOLTXZCBEXEUDGNREQTSKDCWVVBWPEPBCPXGRCIMbbdcuuxrgozlrazxtuvrkqxozjaacseoxegvflamebddomcpjtdnmxcduezk17,173 QUTick 85,368,7552026-10-18 10:06:07VAFTVSYUEFVBHHDXXKVOFYWICHACRCNDYRVUWSBOSGMQLWDGPHSFNKDERXVKdkajrxugidpvwfxhtzuisldncuqblksjsajzfsxeoatmatvngrergtmdxnqh17,172 QUTick 85,368,7552026-10-18 10:06:07BVVTTKBNMGNLUDAUIJFPNWASHZNBQIHGRGCOCVCZICLSJSKTEDQTQRHFZJHCxoavznqmooeqnbisamwasimfnnzenukhvfnknjfzxbwsrdnuvowjvqedqtaf3,221 QUTick 85,368,7722026-10-18 10:06:16WBWECDPBSYUYCEQZYXPCOHRFZOACMFHHKMFURDDMMCAGIHHYGSHBFDOGYSKJdpfrfxqsprwmtcieyldzzjrkhvpbnikanpvvkxwzvfcnzmzzonyudvecljrn554 QUTick 85,368,7892026-10-18 10:06:24NWYWNJMOBSDBKFDAKYLSRSDYEJPCQGZMJGCTIKEBKAFMHBVJUFNDICHBWROJlmuveembvqvjkgkrgmukmtupqzwdpgjsoyggwvhimdqonggdigvrvrhbpmfl84 QUTick 85,368,8062026-10-18 10:06:33GVSTZSKWDLFTPFJYZSVLPZKTRECAYSOSIAJUGHHJVCIKAFBJZVOAJBEFMRBMzvbpwenurmjkbgkjwimyyytqtdkgtnkssezsbihfdhukydqbubwbpepcdega21 QUTick 85,368,8222026-10-18 10:06:41RHOTNFTZOWZBAGXWQFAMGQCLDEIBOURZDTOORGGYJFXXJFNZEUXGXYMFHZXLwmtaswoeuqrxdfetffwrucyhhlngibcaakhbzaojjfclinerkrjprqigepnj4 QUTick 85,368,8382026-10-18 10:06:49ACEYOYFUJRTSAGXMIALPVXTCJKDAKHVUJJXHNSAMHEKDCIWWYDENCYCHHETMitpekbjhwfyerfomhrnuclpdssrassjsiwfaexhrnfrrcyzjqhzbusrexrld1 QUTick 85,368,8542026-10-18 10:06:56PMWURSOSCQTEIGASRYSGKVQWEKSDCTSMLGBAAOZVUBFIDRETPWAZMEADTNJOReceipt records 196–205Full transaction / QU / tick / display timeFull source identityegbvwdhcggwqdbhjulzqwainxdwgjmcblufxnnzraezjxwhwsjodksdeoosl1 QUTick 85,368,8702026-10-18 10:07:05ODACZQSOHSKOQCQYJGQCPPINOKVBEJVDZLLSBLOGNAMFQGUJHFKPOJGGXNTMhzykixcbgprtogsftasacdqihyzcjctotakevafxyakxzsxxxkviomjavjrm1 QUTick 85,368,8702026-10-18 10:07:05PIBSBMVVVPMAZBRDVOHSFHCCGUMCTZUZWOKKWRQUUCAYIDLYEFXXEYHBQYYGrmqdmmstqcugfblgthzbnwtrivdcwdpjdkrxodvcbgiszelbeqapasidnolc1 QUTick 85,371,0602026-10-18 10:25:27IZOOJMBGEKCGZBMYIFEWRPCMMGUCMFOODFVWGEGZAHWWJLHGWRHVRQKBSSHIuaacbbofkzxkmcjicacozqdlokucsajezcxifwqwxbqfngckcyqpbfdgmbeb3,051,318,304 QUTick 85,371,0772026-10-18 10:25:35BLALTWKMUCRZCHTLZDTLGAOPBJLCWWMQJYMFQDPDTECOKTSIUDUJJJJFESUIdgekaoyklmmrwgfoemyjbiaaporbqmhuqfftkdgmmdguoaxiigqzribcamea2,615,329,703 QUTick 85,371,0952026-10-18 10:25:44YWUHJUJKTJVKMABEBASXYWTGTQBDNJNLOIFZJPMWDAUVKYLXPLXVMWIGBRUGqcyrhqtwvtylrcjzxpbkwxyqetwbvydztpprshlepgmgcyokclhhdscbuxbc1,477,595,306 QUTick 85,371,1122026-10-18 10:25:53FEPBMNIXODPSMACXUPIOMUTIMMUBOPTZFBXQHKATGGYVAGFNXGDLTKJECJHEyvnbxozgugdkghehohkixcarkeddmyubywaiolkqugxjaedixgwtlrbhnpbm1,149,608,746 QUTick 85,371,1122026-10-18 10:25:53EUTKBUBOQNGSLCYUJXELJSWALTIDJLTXRSJTTAGIAARNDLZVLIMJVUGDWKWMampejuomsdiirgldoihjellyepkfjnvvdcrevuvjwdpxiazjsqhccxgdandl307,533,611 QUTick 85,371,1292026-10-18 10:26:01KWVBTHOJHMBXXGDUEXISUYOMZNDDJYGASBFIFFJFVALRZZYGPKMIBRSGRTFIqpbsawbdgmtbaariwtbshtqzplfcmqxthjfznwnggcguusalqetfemlbswrn106,444,954 QUTick 85,371,1462026-10-18 10:26:10ZNTRZHEVDZPLQGJFHVKUYYSKWNBAZBZDMGHMWSANCGXKEJOXVIZJXPQDZYLOuozjjtcweklbxdcoikwxyeomtlvgrfqncvagfqduzepatadbxutmmtacefvm128,976,240 QUTick 85,371,1462026-10-18 10:26:10CZICVDINZHUVXESYAKMJPXZRNJRCRFKWADKZNDFBWDYWJPGEJHPXRGMCTOACMethod: the actual Explorer Download Page Data control was used on all three pages with 100 rows per page. Rows were deduplicated by full hash; distinct sources were counted independently. Integer addition gives 568,777,432,013 QU. Three selected transactions were separately opened and matched to their visible event rows. No private key was requested, no recovery action was executed and no address-owner attribution is inferred from these exports.Primary and attributed sourcesSourceUse in this articleincidentProject disclosure, attributed.causeProject root-cause account, attributed.haltDirect public repository or project record; implementation is not execution.snapshotProject’s dated 18 October claim; not a fresh freeze confirmation.mapCommunity compilation and explicit UTC sample, not independent loss proof.patchDirect public repository or project record; implementation is not execution.releaseDirect public repository or project record; implementation is not execution.proposalDirect public repository or project record; implementation is not execution.coreDirect public repository or project record; implementation is not execution.frozenDirect public repository or project record; implementation is not execution.sweepDirect public repository or project record; implementation is not execution.escrowDirect public repository or project record; implementation is not execution.recoveryAttributed project recovery statement; not independently matched payment evidence.escrow_statementAttributed project recovery statement; not independently matched payment evidence.reclaim_windowAttributed project recovery statement; not independently matched payment evidence.

ChainBounty · Report analysis · CASE-01D70140Ethereum mainnet · Recorded activity: October 19–20, 2026 · Based on the SentinelTX report issued October 20, 2026A SentinelTX investigation records a 50,655.918487 USDC receipt by a candidate externally owned account, followed by conversion to approximately 20.597338 ETH and onward transfers through a wallet with mixed-source funding. Its call-tree analysis assesses that two transactions made legacy smart-wallet contracts execute repeatedly against a MARK/WETH pool. The report calls the contracts “Argent-style”; it does not establish that they are the official Argent product.The distinction between recorded transfers and interpretation matters here. The source flags two routes that run backward in time and therefore cannot trace proceeds. Its separate October 20 transfer sequence reaches a Tornado.Cash Router address, but commingling prevents an exact allocation to this incident. No exchange deposit or corresponding mixer withdrawal is established.Key findingsThe candidate EOA received 50,655.918487 USDC on October 19 and converted it in a later transaction. The PDF’s exact ETH transfer amount is 20.597337757434388495; its narrative rounds that to 20.597338 ETH.The two seed call trees show 19 and nine inner executions. The signed-call replay mechanism is an assessment, while a recovery-deadline overflow, an owner change, and official product identity remain unestablished.On October 20, the EOA sent 20.68 ETH to a consolidation wallet. That wallet also had other inflows, then sent 5.05 ETH onward. Five 1.0 ETH transfers subsequently reached the Router; those overlapping stages are not separate losses.Report scope and limitsThis article adapts Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, a 46-page SentinelTX PDF issued on October 20, 2026. It follows the report’s records, assessments, and qualifications rather than presenting an independent on-chain investigation. “Candidate EOA,” “consolidation wallet,” and “staging wallet” describe transaction roles; they do not identify people or establish common ownership.The narrative specifies an incident window of October 18, 2026, 00:00 UTC, to October 20, 2026, 13:15 UTC. The executed queries were broader: two 32-day windows from September 18 to October 20. The 145 retained movement rows with readable timestamps span October 19 at 09:31:23 UTC to October 20 at 11:46:35 UTC; another 57 retained rows have no readable timestamp. A query interval is not the evidenced transaction span, and gaps between queries are not coverage. The PDF expressly says these records do not establish that the requested historical window or block cutoff was enforced. The three-hop maximum and latest block 26,233,589 describe cited routing rows, not complete investigation coverage.The source’s two time-order warnings concern routes joining the conversion at block 26,225,830 to seed activity at earlier blocks 26,225,798 and 26,225,803. A later receipt cannot fund an earlier transfer. Those joins are excluded from this article’s proceeds claims and diagrams. This does not erase the separately listed transactions, but it prevents treating the backward joins as a valid continuous money trail. The exact warnings appear in the source note.From funding to the USDC receiptAt 09:31:23 UTC on October 19, the candidate EOA, 0xc10609…872b02, received 0.09761 ETH from an address the report labels as the Tornado.Cash 0.1 ETH pool. SentinelTX assesses that the amount is consistent with a withdrawal net of a relayer fee. This is pre-incident funding provenance, not a destination of the incident’s proceeds, and it does not identify the original funder.The report’s control-transaction record then lists six successful submissions, with nonces zero through five:09:35:35 UTC, block 26,225,763: creation of 0x3c5884…3fb310. Contract code was observed; creation alone does not establish ownership or control.09:42:35 UTC, block 26,225,798: Seed 1 called the created contract with selector 0xc59705f3. It was not reverted; the trace contained 742 frames and reached depth 11.09:43:35 UTC, block 26,225,803: Seed 2 called the same contract with selector 0x522bffbe. It was not reverted; the trace contained 458 frames and reached depth 12.09:44:35 UTC, block 26,225,808: the created contract sent 50,655.918487 USDC to the candidate EOA.09:48:47 UTC, block 26,225,829: the EOA submitted a USDC approval call.09:48:59 UTC, block 26,225,830: the EOA sent 50,655.918487 USDC into the Uniswap V2 route and received 20.597337757434388495 ETH, approximately 20.597338 ETH.The USDC receipt and conversion are two stages involving the same token amount, not two amounts to add. The ETH output is a different asset and is not added to the USDC quantity. SlowMist’s approximately US$59,800 estimate appears only as a source-reported figure from its public incident-index snippet. SentinelTX does not reconcile that estimate with the retained USDC proceeds, and this article does not treat it as a recomputed loss.At 10:07:35 UTC, the EOA also received an unsolicited 1,000,000 PVC. The report records the transfer but sets it aside as non-economic because it was unvalued and no onward movement was observed. It is not included in the proceeds narrative.What the two call trees showIn Seed 1, the created contract made wallet-control-shaped calls through proxy-style contracts and shared implementations. It also called a counterparty labeled Balancer, which called back and transferred WETH. The report reads that call/callback structure as a flash-loan pattern; the selectors were interpreted structurally rather than fully ABI-decoded.Within the callback, MARK moved in large round trips between the created contract and the MARK/WETH pair. The narrative’s largest rounded legs were 412.07 million, 405.52 million, and 398.90 million MARK in each direction. These are gross trading movements, not retained proceeds. The evidence-set total of 13,474,585,249.833702 MARK likewise recounts movement and does not measure loss or prove that every included movement belongs to the incident.One entry with selector 0xaacaaf88 into 0x4e50ad…227394 produced 19 self-call iterations in Seed 1. In each iteration, wallet contract 0xe545b9…ee8f66 made two ETH payments:1.061908909163406246 ETH to the Uniswap V2 router for the ETH-to-MARK route. The report’s total across 19 iterations is 20.176269274104718674 ETH.0.025621353654900691 ETH to 0xd33814…4452e7. The report’s total is 0.486805719443113129 ETH. That recipient’s role is unverified.The trace’s 40.839344267652550477 ETH of total internal value includes the router’s WETH-wrapping forward and therefore double-counts that leg. It is not an incident loss. After the repeated buys, the report describes the created contract selling MARK back into the pair and taking WETH-side output.Seed 2 had the same reported flash-loan and churn structure, without the wallet-control-shaped frames. One entry into 0x4e50ad…227394 produced nine iterations through 0x5a79e5…a85440. Each contained a USDC approval, a Uniswap V2 swap through the USDC/WETH and MARK/WETH pairs, and a USDC transfer. No native-ETH internal value moved in that seed.SentinelTX assesses that one signed call was executed repeatedly: each entry carried a 65-byte field consistent with an ECDSA signature, then fanned out into repeated inner execution. It interprets the associated trading as induced buy pressure in a low-liquidity pool. That remains a mechanism assessment. The recovery-control-shaped sequence does not supply a decoded wrapping deadline or a decoded owner-change event, so neither the reported recovery-deadline overflow nor an owner change is established. No verified-source comparison to the official Argent product was made.Figure 1. The two October 19 seed call trees contain one entry followed by 19 and nine inner executions, respectively. Arrows show process sequence, not amounts or new transfers. Repeated execution of a signed call is the report's assessment; recovery-deadline overflow and an owner change are not established.Color key: Slate identifies Seed 1; sage identifies Seed 2. Color does not establish identity or responsibility.Address/role key: Both seeds called 0x3c5884…3fb310. The repeated entry was into 0x4e50ad…227394; the spending wallet was 0xe545b9…ee8f66 in Seed 1 and 0x5a79e5…a85440 in Seed 2. Official Argent product identity is unverified.Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026, pp. 7, 9–10.The downstream route mixes funding sourcesOn October 20, the candidate EOA sent 1.0 ETH at 08:56:23 UTC and 19.68 ETH at 09:03:11 UTC to 0xfba873…81364a, the consolidation wallet. The combined 20.68 ETH is an observed outward amount, not a fresh loss estimate and not a direct substitute for the swap output: the EOA’s listed inflows also include the earlier 0.09761 ETH funding and small other receipts.The consolidation wallet’s provider-listed inflows totaled 27.528000001 ETH across five transfers. Of that, 20.68 ETH came from the candidate EOA and 6.848000001 ETH from other senders whose sources were not established. At 11:17:23 UTC it sent 5.05 ETH to the staging wallet, 0x0d9ed4…f12f40. The presence of other inbound funding means the exact incident share of that onward transfer cannot be determined from flow data.The PDF gives a pro-rata assessment of about 75%, calculated there as 20.68 / 27.528, or roughly 3.79 ETH of the 5.05 ETH transfer. This is an allocation assumption, not identification of which ETH moved. It cannot justify describing all 5.05 ETH, or all five later Router transfers, as exclusively this incident’s funds.The staging wallet made five separate transfers of 1.0 ETH to 0xd90e2f…24f31b, labeled Tornado.Cash Router, on October 20:11:19:11 UTC: 1.0 ETH.11:32:47 UTC: 1.0 ETH.11:37:11 UTC: 1.0 ETH.11:42:47 UTC: 1.0 ETH.11:46:35 UTC: 1.0 ETH.These transfers total 5.0 ETH at the Router. The report stops there at a privacy boundary and establishes no corresponding withdrawals. It identifies no exchange-deposit leg. The Uniswap interactions are DEX swaps, not custodial cash-out events, and a service label does not identify the person behind a transfer.Figure 2. On October 20, the candidate EOA sent 1.0 ETH and 19.68 ETH to the consolidation wallet, which also had 6.848000001 ETH from other senders in its provider-listed inflows. It forwarded 5.05 ETH to the staging wallet, which sent five 1.0 ETH transfers to the Tornado.Cash Router. These are overlapping stages, not additive losses. Commingling prevents an exact case allocation; no corresponding mixer withdrawal is established. The dates of the other senders’ listed inflows are not asserted here.Color key: Slate identifies the candidate-EOA contribution; sage identifies other provider-listed inflows. Onward route arrows are charcoal. Equal-width arrows show direction, not amount.Address/role key: Candidate EOA 0xc10609…872b02; consolidation wallet 0xfba873…81364a; staging wallet 0x0d9ed4…f12f40; Tornado.Cash Router 0xd90e2f…24f31b. These are transaction roles and the report’s service label, not verified common ownership.Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026, pp. 5–6, 8, 13, 41–42.Residual movement is not a balanceSentinelTX separates provider-list arithmetic from a balance query. The figures below are inflows minus outflows minus listed gas fees over the provider-returned ETH rows, including rows at any date. They are not proof of currently held funds, incident-attributable holdings, or recoverable amounts:Candidate EOA: 12 inflows totaling 20.694952258434388495 ETH; two outflows totaling 20.68 ETH; gas fees of 0.009768389421759711 ETH; net listed movement of 0.005183869012628784 ETH. Separately, the narrative says the address record showed 0.005184 ETH on October 20.Consolidation wallet: five inflows totaling 27.528000001 ETH; one outflow of 5.05 ETH; gas fees of 0.000043631071701 ETH; net listed movement of 22.477956369928299 ETH, approximately 22.48 ETH.Staging wallet: three inflows totaling 5.0500000515 ETH; five outflows totaling 5 ETH; gas fees of 0.014022238141291632 ETH; net listed movement of 0.035977813358708368 ETH.The report’s expert-opinion section discusses the approximately 22.48 ETH figure as a possible recovery opportunity if funds later reach a custodial venue. That assessment does not turn the flow-derived residual into a balance or establish how much belongs to this incident. Onward movement beyond the listed 5.05 ETH leg is not established.ConclusionThe report’s most concrete result is the sequence of recorded token receipt, conversion, and later ETH transfers. Its call-tree interpretation connects repeated wallet execution with MARK-pool trading, but the exact defect and official product identity remain unresolved. Downstream, the consolidation wallet’s other funding prevents a precise incident allocation, and the Router marks the end of the established route rather than a confirmed cash-out.SentinelTX identifies the other consolidation-wallet senders, the unknown Seed 1 ETH recipient, and decoded module calls as useful next leads. Those are recommendations in the source, not completed findings. The two reverse-time joins cannot support a proceeds trail; neither the gross trading totals nor the approximately 22.48 ETH residual establishes a loss or a recoverable balance.Figure 3. The report records the USDC receipt, ETH conversion, and subsequent transfers, while treating the repeated-execution mechanism as an assessment. Official product identity, recovery overflow, owner change, and exact downstream case allocation remain unestablished. Its two impossible backward-time paths cannot support proceeds tracing, and no exchange deposit or corresponding mixer withdrawal is identified. The figure’s approximate 20.597338 ETH is 20.597337757434388495 ETH in the Path Routing Evidence (p. 14).Color key: Slate marks section headings only; the written labels distinguish records, assessments, and limits.Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026, pp. 10, 12–14, 42–43.Source and limitations noteSource: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026. Main references: executive summary and value distinctions, pp. 4–6; chronology, pp. 7–8; call-tree interpretation and attribution tiers, pp. 9–11; conclusion and limitations, pp. 12–13; exact transfer amounts, pp. 14–38; aggregate movement definitions, pp. 38–40; collection boundaries, pp. 41–42; native warnings, pp. 42–43. The PDF’s public lead is attributed to the SlowMist incident-index snippet at the SlowMist incident index, not to an independently reviewed full incident notice.The original dossier is marked confidential. This article adapts its findings and qualifications; it does not reproduce the complete source dossier.Exact native warning count: the p. 4 banner says, “INTEGRITY GATE — the integrity gate flagged 2 findings for review. See the appendix at the end of this document for the full list.” The two findings appear in “Automated Integrity Check — Warnings (Report Integrity Gate),” pp. 42–43. They are reproduced verbatim below:[INV-5] (report-wide) — Hop 1 (block 26,225,830) → Hop 2 (block 26,225,798) is time-inverted — the later hop (funds out) settles in an EARLIER block than the hop that feeds it (funds in) → a causally impossible path (the cash-out tx precedes the deposit tx). Likely a destination's commingled total deposits counted as traced taint.[INV-5] (report-wide) — Hop 1 (block 26,225,830) → Hop 2 (block 26,225,803) is time-inverted — the later hop (funds out) settles in an EARLIER block than the hop that feeds it (funds in) → a causally impossible path (the cash-out tx precedes the deposit tx). Likely a destination's commingled total deposits counted as traced taint.Plain-language consequence: both flagged paths would require the October 19 conversion to fund seed activity that had already happened. They are causally impossible, not merely unconfirmed. Neither is used as a proceeds route in this article or its figures. The warning’s suggestion about commingled deposits is the source’s explanation, not a separately established repair.The source retains several different scopes and levels of certainty. Its abstract says transfer verification does not record who signed or authorized a transfer, while the seed and control sections identify the candidate EOA as the submitter/signer. This article uses the transaction role without treating it as a verified personal identity or proof of authority. Service labels are provider attributions reproduced from the report, not new determinations of ownership or current legal status. The executive summary calls 09:35:35 UTC the EOA’s “first recorded activity,” while also recording the earlier 09:31:23 UTC inbound funding; both events are retained here without redefining that source label. The abstract does not identify terminal endpoints or exchange attributions in its cited inputs, while later sections supply the Router service label; neither establishes a mixer withdrawal or a cash-out.The prose also describes the staging transfer as “exactly 5.05 ETH,” while the full provider-list arithmetic gives 5.0500000515 ETH across three inflows. The former is the single consolidation-to-staging transfer; the latter is a broader list total. The PDF’s flow-derived residuals are not balance queries. Its requested incident window, executed query windows, and retained transaction span remain distinct. Provider page limits and high-volume exclusions mean the collected and followed rows are not every address’s whole history.The PDF’s aggregate movement totals expressly do not determine loss or establish incident connection. Where its “Amount” and “Transfer amount” columns differ, that difference alone does not establish case attribution. Some USD cells use transaction-date prices, spot fallbacks, or recovered session valuations; the record does not attribute each figure to an individual price source. This article therefore keeps the reported SlowMist estimate separate from native quantities and does not introduce a new USD valuation.Other stated limits include unknown sources and role for 0x11bf2e…067e26, whose provider-listed inflow is 0.06078317119380398 ETH; an unestablished identity for the MARK/WETH pair; and an unverified role for 0xd33814…4452e7. Claims of a signed-call replay or pool manipulation remain assessments despite the stronger language in the report’s expert-opinion section. The PDF describes a signed manifest and report fingerprint; this adaptation does not claim independent cryptographic verification or clean substantive findings.Reference addresses and transactionsFull identifiers below reproduce the source for the movements and roles discussed above. Short forms in the article use the first six and last six hexadecimal characters.Candidate EOA: 0xc10609ce5c032db92e562e463b1234aab0872b02.Created contract and USDC sender: 0x3c5884377cca79ff221936aea4a5df43293fb310.Repeated-entry contract: 0x4e50adfc953551286bbd7fee2b2b846d1d227394.Seed 1 spending wallet: 0xe545b9a69bff1bf0ed2e922551dda4afc8ee8f66; Seed 2 spending wallet: 0x5a79e5772493cf4329682d202aa2d28f85a85440.Other wallet-control-shaped contract: 0xf490557d67d934440677a4f16793d5ef319b8ef5.MARK token: 0x67c597624b17b16fb77959217360b7cd18284253; MARK/WETH pair: 0x6f23d2fedb4ff4f1e9f8c521f66e5f2a1451b6f3.Seed 1 unknown ETH recipient: 0xd33814c56fdacdc7f084a5443d600ee5464452e7.Consolidation wallet: 0xfba873b1e5d0256301b87ce74f79a30d6781364a; staging wallet: 0x0d9ed4bbb6efeda5471cae1aa5f4bbe0e8f12f40.Pre-incident funding pool: 0x12d66f87a04a9e220743712ce6d9bb1b5616b8fc; downstream Router: 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b. These are distinct roles.Uniswap V2 router: 0x7a250d5630b4cf539739df2c5dacb4c659f2488d; USDC/WETH pair: 0xb4e16d0168e52d35cacd2c6185b44281ec28c9dc; Balancer-labeled counterparty: 0xba12222222228d8ba445958a75a0704d566bf2c8.Other provenance address with unestablished role: 0x11bf2e0d39d8589c96171a4102ea39c834067e26.Transaction references, as printed in the PDF:Pre-incident 0.09761 ETH funding: 0x6871f0e18429be8a40b5cc4d358b140ca987bee61ab00d6f652ccb59df631f63.Contract creation: 0xaadeff6c257a9339cc82c53ee44870d399b4e81de085f2c7f22464421060d4d2.Seed 1: 0xbfed8d33561ed5f9cbd0f4e62a5bbd20187a64f3e22180148dcb58ed6ebaa795.Seed 2: 0xa0ee8f914205a948c79eca039b7d8265537eb220472c9be1455d3321f1bd571b.USDC receipt: 0xc041e86d96df91df94bb585506865139fe17bebd8473d840cff2e7c4808a2756.USDC approval: 0x5e41d5d735133bbf715c55349aa5626e46c9deab986c56c57718330aa576939a.USDC-to-ETH conversion: 0xc220bb3c307f7317f4fa12e67220c77bc767db64a61587ebdebdbb442e00f0ce.Unsolicited PVC receipt: 0x5dfecdfd733721cc4679e376c0f455019b1512128f61e4b5beb2bc91decd52a4.1.0 ETH to consolidation: 0x5b0ee213efea42fa4fbfdb1d6049c715643d63c54357ba6980d34dec30077e7c.19.68 ETH to consolidation: 0xce8fb63bd9145b205f172243a485e535de627f0810a274d1ff6d3c0a7cc6946a.5.05 ETH to staging: 0x1d7d1d4e7fd61938f1a908292888bd4d2b4ba570cc8713de95633ed00ab7bdc1.Router transfer at 11:19:11 UTC: 0x1ba62ed4886fd6b8feae723f66597b4f3940af914b1168bc93ef43de026bdb1b.Router transfer at 11:32:47 UTC: 0x124eadf281340cfbb707b4f88d117808af4ab628c1ea2736450a15d29caa887d.Router transfer at 11:37:11 UTC: 0x6655185342c5cf5863b4dd0b1d1af67fb9a9ad886e480182d1d8d39824ee5dc2.Router transfer at 11:42:47 UTC: 0x5ff8fa2b97db68b116485c187b34caefabe439054f74423a63549d10716fb214.Router transfer at 11:46:35 UTC: 0x36deeddccc9d47ab702f8857c5cdf2f0f2de018720341345eae6d56b5089f5ba.Article version 1.0 · October 20, 2026 · Based on the native SentinelTX PDF.

On 25 July 2026, a researcher reported wallet-draining activity and named an Ethereum collecting address. Two days later, Triple-A said unauthorized access had affected wallets holding its own treasury assets, while client funds were unaffected. The company did not name the investigated addresses in that statement. This review therefore follows the researcher’s leads without treating every movement as independently proved victim loss. Original researcher alert; Triple-A statement.The checked token route is source S → collector C → four DAI recipients. One recipient, R, also sends ETH through a router into two explorer-labeled Tornado Cash pools. These are connected address roles, but the trade that would connect the DAI and ETH legs has not been reconstructed. The confirmed diagram stops at the Ethereum pools; no withdrawal recipient or Zcash continuation is established.Read the roles before the amountsDAI is a token: its contract maintains a ledger of balances. ETH is Ethereum’s native asset and pays execution fees. A DAI transfer can attach zero ETH to its contract call while still moving tokens. The transaction’s target contract and the recipient named in a token Transfer event answer different questions. A router forwards a call or payment to another contract. A mixer is designed to make a deposit difficult to match with a later withdrawal; observing entry does not identify an exit.Short nameRole in this reviewSSource of the seven checked DAI receipts.CCollecting address named in the researcher’s alert; ownership not independently attested.RReceives ten checked DAI payments from C; submits the 28 checked ETH deposits.A / B / DThree separate recipients of the checked 11 August DAI payments.Router / poolsContract destinations in the checked ETH transactions; names are explorer labels.These short names avoid asking the reader to memorize addresses. They describe movements, not people, common control or criminal intent. Full underlined Ethereum address links appear in Appendix A. The Etherscan nametag for C is corroborating attribution context, not a company ownership record.What was checkedMeasureBounded scopeReading checkpoint19 October 2026 KST. Historical explorer records, not a continuous trace to a pinned cutoff block.DAI recordsSeven incoming and thirteen outgoing canonical DAI Transfer events, each checked with transaction details and raw event amounts.ETH records28 unique successful transactions on 6 August; displayed router-to-pool forwarding checked for every row.DAI list coverageAll five visible token-holder pages read: 107 transfer rows, 97 unique hashes. Small incoming rows were not all independently checked as raw logs.Not measuredVictim-confirmed loss, a historical or current fixed-block balance, DAI-to-ETH execution, post-mixer payout or Zcash delivery.Three findings guide the chronology. First, three earlier DAI receipts materially change the former four-receipt account. Second, thirteen exact DAI departures can now be reproduced without counting an approval as a payment. Third, all 28 listed August pool deposits have transaction-level support, but their 2,620 ETH subtotal is not a verified incident-loss figure.28 July — seven receipts, not just the last fourThe earliest checked receipt is at 11:24:35 UTC: S sends 100 DAI to C. At 11:25:59, it sends 10,000 DAI. Thirty-six seconds later, another receipt carries 2,042,954.555997589733765540 DAI. These three earlier transactions are essential to understanding how much DAI reached C from S. I01 transaction; I02 transaction; I03 transaction.At 11:44:59, a further 100 DAI arrives. The next two large receipts are separated by another small payment: 2,798,804.533028033525749663 DAI at 11:45:47, 100 DAI at 12:11:59, and 5,018,134.251077767199891897 DAI at 12:12:35 UTC. The same canonical token contract, source and collector are named in the checked events. I04 transaction; I05 transaction; I06 transaction; I07 transaction.UTC, 28 July 2026DAI received (6 decimals)Evidence11:24:35100.000000I01 transaction11:25:5910,000.000000I02 transaction11:26:352,042,954.555997I03 transaction11:44:59100.000000I04 transaction11:45:472,798,804.533028I05 transaction12:11:59100.000000I06 transaction12:12:355,018,134.251077I07 transactionThis compact table truncates amounts to six decimals; Appendix B preserves every raw integer and full precision. DAI uses 18 decimal places: each event’s integer amount is divided by 10¹⁸ to express tokens. The seven raw event amounts sum to 9,870,193.340103390459407100 DAI. Selecting only the last four would give 7,817,138.784105800725641560 DAI and omit the earlier 2,053,054.555997589733765540 DAI. The broader receipt selection repairs the accounting comparison; it does not establish the origin of S’s assets or prove treasury ownership.6 August — DAI payments and ETH deposits interleaveAt 02:59:11 UTC, C sends 100 DAI to R. At 03:01:23, it sends 1,000,000 DAI to the same address. The first checked ETH pool deposit follows at 03:20:11. The order is consistent with a later conversion, but does not itself supply the trade, settlement or authorization that would prove one. O01 transaction; O02 transaction; P01 transaction.Four more 100 DAI / 1,000,000 DAI pairs follow at 06:26:59 / 06:28:11, 06:42:35 / 06:43:23, 06:55:59 / 06:57:11 and 07:22:23 / 07:24:23 UTC. Together, the ten payments send 5,000,500 DAI to R. The ETH deposits continue during this sequence, so the diagram must not imply that every DAI payment finished before every ETH deposit began. The full transaction links and log positions are retained in Appendix B.R’s 28 checked deposit transactions span 03:20:11–07:37:23 UTC. Twenty-six send 100 ETH each through the router to the 100 ETH pool; the final two send 10 ETH each to the 10 ETH pool. That gives 26 × 100 + 2 × 10 = 2,620 ETH. The window measures these selected deposits, not the duration of the underlying compromise. Transaction fees are separate and excluded from this subtotal.Deposit groupUTC on 6 AugustChecked amountP0103:20:11100 ETHP02–P2606:34:59–07:32:3525 × 100 = 2,500 ETHP27 / P2807:36:47 / 07:37:232 × 10 = 20 ETHStart Figure 1 at R, then follow the router’s branches to the two pools. Solid arrows show ETH movements; the branch captions state transaction counts and quantities. The two stages carry the same ETH, so adding the router receipt to its forwarding would count it twice. The layout is schematic, not proportional to time or amount.Figure 1. P01–P28. Sage boxes mark the sending and receiving roles; blue-gray marks the forwarding router. Solid arrows mean displayed asset movement, not identity or legal attribution. The 2,620 ETH appears at both stages but is counted once; no post-pool recipient is shown.This is stronger than a list of hashes alone: every selected record now has a success status, block, timestamp, fee and displayed internal forwarding. It is still an explorer-record check, not an independent execution replay. Nor does verifying the deposit inventory prove that all deposited ETH was purchased with C’s DAI or belonged to the reported incident.11 August — three further DAI recipientsFive days later, C sends DAI to three different addresses: 500,000 DAI to A at 09:44:11 UTC, 1,500,000 DAI to B at 09:51:11, and 2,869,693.351053390459407100 DAI to D at 09:56:47. These checked token events establish the recipients and quantities. Their further trades and any later pool deposits are not part of this verified subset. O11 transaction; O12 transaction; O13 transaction.Read Figure 2 from S into C, then follow each branch separately. The R branch summarizes the ten 6 August payments; A, B and D are the later 11 August recipients. Each amount is DAI, not dollars. The figure combines separate dates to show address relationships, so its spacing is not a timeline. It draws no DAI-to-ETH conversion.Figure 2. Seven incoming and thirteen outgoing canonical DAI events. Blue-gray identifies the source/collector; sage identifies receiving roles. Solid arrows show token movements. The artwork rounds quantities where marked; Appendix B retains all raw amounts. Fees, small unreviewed incoming events and later asset conversions are omitted.The hub structure makes the central observation readable: one collector sends DAI to four recipients. It does not make those recipients one operator. The next accounting question concerns the difference between checked receipts and checked departures—not an assumption that all counterparties share a key.What remains of the DAI accounting gap?Adding the thirteen checked outgoing logs gives 9870193.351053390459407100 DAI. Subtracting the seven checked incoming logs leaves only 0.010950000000000000 DAI more outgoing than incoming. The formerly unexplained difference of roughly 2.05 million DAI is therefore largely explained by the three earlier receipts. It is not evidence of an additional multi-million-token loss.CalculationDAI / interpretationSeven selected incoming events9870193.340103390459407100Thirteen selected outgoing events9870193.351053390459407100Outgoing minus selected incoming0.010950000000000000; a selection difference, not missing victim funds.That small difference does not settle the balance. The canonical-token listing contains 107 rows across all five pages, including small receipts outside these twenty individually checked events. The listing counts transfer rows, not unique transactions: its 107 rows correspond to 97 hashes. The small rows have not all received a raw-log verification pass, and a fixed-block balance has not been obtained. The explorer’s displayed current token holding is not substituted for one.The review therefore does not claim a zero DAI balance, an exact unexplained deficit or a complete loss ledger. It also does not add the DAI payments to the ETH deposits as separate damage. A conversion could move the same economic value through both asset legs, and its execution remains to be joined.Attribution and the Zcash boundaryThe researcher’s original address disclosure is the basis for investigating C. Triple-A’s statement establishes what the company said about its incident, but it does not attest that C, R or each DAI recipient was a company-controlled wallet. The explorer nametag and the company statement must not be collapsed into an independent ownership finding. Valid transaction execution likewise does not establish human consent.The later public Zcash allegation does not provide a deposit-specific source hash, service order and destination fulfillment for this selected route. No transparent Zcash receipt or post-mixer withdrawal is verified here. Its absence from the checked evidence is not proof that no such movement occurred. The report’s confirmed route ends at the Ethereum pools.Alternative explanations remain for control and purpose: different users can share services, and similar batching does not prove a shared operator. A key compromise, an unauthorized internal action and an authorized movement require different authorization evidence. The examined transfers alone cannot choose among them. The broader October deposit grouping is not imported as a verified 5,220 ETH attribution bound; its complete history, opening balance and joins have not been independently reproduced.The next records are specificQuestionRecord neededDid C’s DAI fund R’s ETH deposits?The actual swap/settlement events and corresponding receipts, with raw per-asset amounts.What is the complete DAI accounting?Raw logs for the remaining listed events, reproducible pagination and a canonical balance at a named block.Which transfers were unauthorized treasury movements?Company-confirmed address ownership and withdrawal/authorization records matched to the hashes.Did any value leave through Zcash?A source deposit, order identifier, destination fulfillment and evidence of the claimed chain boundary.For a focused service or incident review, retain the exact hashes, token contract and receipt-log indices before requesting a broader cluster. No verified custodial-exchange deposit is identified in this selected evidence, so no exchange freeze target or successful cash-out is claimed. No party was contacted, no legal request was sent and no recovery action was executed.The bounded conclusion is now materially firmer. Seven checked DAI receipts explain nearly all of thirteen checked departures, and 28 successful ETH transactions document 2,620 ETH entering two labeled pools through one router. Ownership, the connecting conversion, complete balances and post-pool destinations remain separate questions. The accounting repair supports a clearer report—not a larger loss claim.Appendix A — full Ethereum address rolesRoleFull Ethereum addressS · DAI source0x9d358e54f405e120807D7a07B2895cE77Fe7d53DC · researcher-named collector0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1R · DAI recipient / ETH depositor0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82A · 11 August recipient0xAED30575aefEBdEAed62992084984227Ac77b183B · 11 August recipient0x15Cb70873bB183030617caE04BF32390E402Dc6fD · 11 August recipient0x9e4Bb27b18943FAA7E644B6a841f4D8855996887Canonical DAI contract0x6B175474E89094C44Da98b954EedeAC495271d0FRouter · explorer label0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b100 ETH pool · explorer label0xA160cdAB225685dA1d56aa342Ad8841c3b53f29110 ETH pool · explorer label0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbFEach address link targets Ethereum’s address-detail page. Role names establish neither natural-person identity nor ownership. Pool names are attributed explorer labels; no current legal status is inferred from historical label text.Appendix B — transaction evidence and methodologyAll times below are UTC. Rows are deduplicated by hash within each inventory. An event-level key is transaction hash plus log index, so multiple events in one transaction must not be silently merged. Amounts retain recorded precision; transaction fees are separate ETH costs.Incoming DAII01FieldChecked valueTransaction0xf171fe49976a28c36f964d1536be5e09e0f83d63a16698edc9a3f81693a67630UTC / block2026-07-28T11:24:35Z / 25631002From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount100.000000000000000000 / 100000000000000000000Receipt logCanonical DAI Transfer log 268Status / feeSuccess / 0.000106313478965304 ETHI02FieldChecked valueTransaction0xc961cfc1fac024e6609417b6ba3a11a6debe856ed39d9916842ad4deb2a075a4UTC / block2026-07-28T11:25:59Z / 25631009From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount10000.000000000000000000 / 10000000000000000000000Receipt logCanonical DAI Transfer log 214Status / feeSuccess / 0.0000720321062311 ETHI03FieldChecked valueTransaction0xa9359ce32cd078a59456cfd90f10d1043e8339ef180319dd5466db1a1c553fcaUTC / block2026-07-28T11:26:35Z / 25631012From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount2042954.555997589733765540 / 2042954555997589733765540Receipt logCanonical DAI Transfer log 542Status / feeSuccess / 0.000062507386427022 ETHI04FieldChecked valueTransaction0xaa14868c26d680b1daa7dff3fa329f6a76d623c2e86a409e899bba8f03b9c7d6UTC / block2026-07-28T11:44:59Z / 25631103From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount100 / 100000000000000000000Receipt logCanonical DAI Transfer log 144Status / feeSuccess / 0.000071783836204508 ETHI05FieldChecked valueTransaction0x42c945f322502d29ab01edb65437a3bfe3943e29b29529d33977c8c4c5ab9ab4UTC / block2026-07-28T11:45:47Z / 25631107From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount2798804.533028033525749663 / 2798804533028033525749663Receipt logCanonical DAI Transfer log 482Status / feeSuccess / 0.00006215980593853 ETHI06FieldChecked valueTransaction0x8cecf25dc8f9eb5238aeb792f152796c53488dc36e11b25e4f0ffec351a81e48UTC / block2026-07-28T12:11:59Z / 25631238From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount100 / 100000000000000000000Receipt logCanonical DAI Transfer log 461Status / feeSuccess / 0.000072233346815148 ETHI07FieldChecked valueTransaction0x8cb06a1bf7837a5bfda7fe899b4da13a949b95a289b0130b864a4fd5a1a485c1UTC / block2026-07-28T12:12:35Z / 25631241From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount5018134.251077767199891897 / 5018134251077767199891897Receipt logCanonical DAI Transfer log 445Status / feeSuccess / 0.000062175212448008 ETHOutgoing DAIO01FieldChecked valueTransaction0x22489ca59aea0dfaa1598ca36466b7ac852d054745ef0dc4ccb748fd1becb9d3UTC / block2026-08-06T02:59:11Z / 25693066From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount100.000000000000000000 / 100000000000000000000Receipt logCanonical DAI Transfer log 189Status / feeSuccess / 0.000107748805593598 ETHO02FieldChecked valueTransaction0xe5bdef14f2c0a011dcc515f61f444a6ea5beb0428a985d2425349a8e402b9d11UTC / block2026-08-06T03:01:23Z / 25693077From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount1000000.000000000000000000 / 1000000000000000000000000Receipt logCanonical DAI Transfer log 264Status / feeSuccess / 0.00007303479896477 ETHO03FieldChecked valueTransaction0xe816ea86b0d7f0fad643c991abaf3587a8a3d8cd23de860950d077a494ed0ff4UTC / block2026-08-06T06:26:59Z / 25694104From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount100.000000000000000000 / 100000000000000000000Receipt logCanonical DAI Transfer log 94Status / feeSuccess / 0.000108693429130936 ETHO04FieldChecked valueTransaction0xe3d930642c6767e46f598091167134ee5ca2021edeaeb77369a85c79ac51a1feUTC / block2026-08-06T06:28:11Z / 25694110From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount1000000.000000000000000000 / 1000000000000000000000000Receipt logCanonical DAI Transfer log 463Status / feeSuccess / 0.000072267796722752 ETHO05FieldChecked valueTransaction0x3a55bdc8308fa1b42dc5e1e588389b5ba29d451fe4a006828a9bd61464ed041aUTC / block2026-08-06T06:42:35Z / 25694182From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount100.000000000000000000 / 100000000000000000000Receipt logCanonical DAI Transfer log 164Status / feeSuccess / 0.000072284030130474 ETHO06FieldChecked valueTransaction0x233e427a8c34ace73decc418d4798a714889222a03cbc248f2d66161e44f4948UTC / block2026-08-06T06:43:23Z / 25694186From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount1000000.000000000000000000 / 1000000000000000000000000Receipt logCanonical DAI Transfer log 61Status / feeSuccess / 0.000072255893621734 ETHO07FieldChecked valueTransaction0x83308b9b218fde69c88ac00d5c4c3ceaa93c053cd3607da15c1e5353d340eb2bUTC / block2026-08-06T06:55:59Z / 25694249From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount100.000000000000000000 / 100000000000000000000Receipt logCanonical DAI Transfer log 439Status / feeSuccess / 0.000072435905930964 ETHO08FieldChecked valueTransaction0xca8f6821c4caca1dbd2166bab9f93e057e739d7482b7240cc87de25faec25b57UTC / block2026-08-06T06:57:11Z / 25694255From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount1000000.000000000000000000 / 1000000000000000000000000Receipt logCanonical DAI Transfer log 459Status / feeSuccess / 0.000072583556411982 ETHO09FieldChecked valueTransaction0xc546c9df8f39138ecd0fb815a2d146bd17a8d468735bf1b5d6a01833211c63c4UTC / block2026-08-06T07:22:23Z / 25694381From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount100.000000000000000000 / 100000000000000000000Receipt logCanonical DAI Transfer log 42Status / feeSuccess / 0.000072966037674382 ETHO10FieldChecked valueTransaction0x60afdf1c96d23af558bb78b48ebf95cdb7e0da06931b8f43f02f195897533f59UTC / block2026-08-06T07:24:23Z / 25694391From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount1000000.000000000000000000 / 1000000000000000000000000Receipt logCanonical DAI Transfer log 104Status / feeSuccess / 0.000072469740045402 ETHO11FieldChecked valueTransaction0xcae3448d414fdbfa2730a07f52f6a3f9af49d5f5f29bc84686967d3ab0ddd99cUTC / block2026-08-11T09:44:11Z / 25730941From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0xAED30575aefEBdEAed62992084984227Ac77b183DAI / raw amount500000.000000000000000000 / 500000000000000000000000Receipt logCanonical DAI Transfer log 174Status / feeSuccess / 0.00010739405565436 ETHO12FieldChecked valueTransaction0x2bea3ba5f846c1da06f36feeea386f41b6376981e25ed48c025d7dce3a65d93eUTC / block2026-08-11T09:51:11Z / 25730974From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x15Cb70873bB183030617caE04BF32390E402Dc6fDAI / raw amount1500000.000000000000000000 / 1500000000000000000000000Receipt logCanonical DAI Transfer log 237Status / feeSuccess / 0.00010799303731251 ETHO13FieldChecked valueTransaction0x328b6e17ccd01081edd08bc13c0f6ca202078911a1a5772ac798e9c2f96c4dedUTC / block2026-08-11T09:56:47Z / 25731002From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x9e4Bb27b18943FAA7E644B6a841f4D8855996887DAI / raw amount2869693.351053390459407100 / 2869693351053390459407100Receipt logCanonical DAI Transfer log 73Status / feeSuccess / 0.00009792839039067 ETHSelected ETH deposit inventoryP01–P26 each display 100 ETH to the router and matching forwarding to the 100 ETH pool. P27/P28 each display 10 ETH to the router and matching forwarding to the 10 ETH pool. All have successful status. Decimal ETH shown on the explorer is used here; no raw RPC receipt or execution replay is claimed.Record / UTC / blockETH / fee in ETHFull transaction hashP01 · 2026-08-06T03:20:11Z · 25693171100 / 0.0028345941590194320xd06ac8a5cd2d9a41f594218c675625a799842d157c9399c20a46e14827f098dbP02 · 2026-08-06T06:34:59Z · 25694144100 / 0.0028278653956720080x2488f72a71a5e8442f1b87bafe0ad58e6d836490014f730ff845066158f6bb04P03 · 2026-08-06T06:35:23Z · 25694146100 / 0.0028329863098271960x11d65f8319eca260c00f6a782f58f084596a8e84aefb580ec8413f214ee14a8bP04 · 2026-08-06T06:35:59Z · 25694149100 / 0.0028169394459599240x67b9e573e947c1992f21a6eefd83c369208adacbc6ee1b69852703bb622f3fe5P05 · 2026-08-06T06:36:23Z · 25694151100 / 0.0028564812353832960x7fe7238d53548b215c90a10980e2312d98ee828e89c78b3a9ab11dce9184ee19P06 · 2026-08-06T06:38:11Z · 25694160100 / 0.0028428629041542880x5778c5b4675d80d46c88d17223fb6a1adb9b09f0c2b6a3313908646098b2e6c2P07 · 2026-08-06T06:48:35Z · 25694212100 / 0.00284261646606380xe0a9fb242098c8acb579b69a0779297d80e5ae62d994e90ad8a9c0fd937d3d61P08 · 2026-08-06T06:48:59Z · 25694214100 / 0.0028256541738993960x44c72c80714eb7c5f82fdcacea6451a9c00d191d57c648fb2485fff0e6e1b042P09 · 2026-08-06T06:49:35Z · 25694217100 / 0.002839773788868460xdad27b0211a495eefa4909e64296cb6a5f30eaf880c9543d8cc9fc48ea30d99bP10 · 2026-08-06T06:49:59Z · 25694219100 / 0.002820763997760040x45c3becf5311395b3c68b73b40c0ec95130b989ce2d81ce174d35722fe27b265Record / UTC / blockETH / fee in ETHFull transaction hashP11 · 2026-08-06T06:50:23Z · 25694221100 / 0.002823688478732740x6596f5d99545759d2604099f51d208f77c4d79130f9b7617eb31b3bb8646d4fdP12 · 2026-08-06T07:01:59Z · 25694279100 / 0.002813630242403740xaaf6dc9c9d6b712918f82b79d7be85a3baf3ff0559fcf979ab75419880a741beP13 · 2026-08-06T07:02:23Z · 25694281100 / 0.002910358979203140x19784e32e2984405cdf57d1a082fb5950b90cd308434a13a953c50e74bcc2945P14 · 2026-08-06T07:02:59Z · 25694284100 / 0.002894239085083020x8178941ba9710825e3f5a6b622727a101f9db40adb26b597e831cdd4a98e0471P15 · 2026-08-06T07:03:23Z · 25694286100 / 0.0028992564851133040x31d37b036bcbce7016ae20062b6615538958249e57ac76a42ab8c947567396e8P16 · 2026-08-06T07:03:47Z · 25694288100 / 0.002881404145509160xc87dfd51358cdaf0efec82f9e7f734d64006509acf902115a645479e2902954fP17 · 2026-08-06T07:12:35Z · 25694332100 / 0.0029035856489136840xab1d50d55e45d48f2bf428a1768c7cc2ffb043a7dc13e9249da57c1f3772815bP18 · 2026-08-06T07:13:23Z · 25694336100 / 0.002893078107283980x3c32d3e05dae9ae9050b79e9c265ceac3672abc29075b3a5dc84af08490265b2P19 · 2026-08-06T07:13:47Z · 25694338100 / 0.002889264800232360x2e53bd9383ba1d0e7547526e67f38a5e1286c8609802829851b06f543783e78aP20 · 2026-08-06T07:14:11Z · 25694340100 / 0.00287186312376450x7b1f7e2306b90c8cbd4f3a2926dde47362154f45ab57091700f32bf65ebd803cRecord / UTC / blockETH / fee in ETHFull transaction hashP21 · 2026-08-06T07:29:47Z · 25694418100 / 0.0029077745225918880x2f9fcc6dd34449a8049cc1503fed4bbe7b973def83ac7a7cce31a6976917a09bP22 · 2026-08-06T07:30:23Z · 25694421100 / 0.002888876761759820x8fc3d897f8d09af227a0ac524d6474d11c17dde22d34decb17b72377c8ac5c25P23 · 2026-08-06T07:30:47Z · 25694423100 / 0.002884511906863680xc42983bc911959d79df8aa7e573734e709fb9c39178d0209aa40d99fea1e51efP24 · 2026-08-06T07:31:23Z · 25694426100 / 0.0028683562081445760x3b779b7b65fff36bed55c0a2d2f630744fffa6c2be1704920c2cd98dcada0ba7P25 · 2026-08-06T07:31:47Z · 25694428100 / 0.002890672078726360x9a5cdb5d397f919c9cd37f25624548181da801885b7f9840ed41bc42a6ca5b50P26 · 2026-08-06T07:32:35Z · 25694432100 / 0.0028756618835965760xdc31ee2aa707bf21abd79667abd07c7976ba63e1e64dcdb50c206c86e4768a6cP27 · 2026-08-06T07:36:47Z · 2569445310 / 0.002890824189874460x4b3b076fc7ab134a6b9584b0322acff69625e4c850e8dbee1037a7609c16865bP28 · 2026-08-06T07:37:23Z · 2569445610 / 0.002874360283982880x75d01893d9fa76680b4ea2defc0bfdfd84830b281d9592f172f8fbd247e87798Source and verification boundary: company statement for the company’s incident account; researcher alert for the seed attribution; later allegation for the unresolved Zcash claim; Etherscan transaction details and canonical event logs for the checked records. SentinelTX supplied the original investigation and repair leads; its larger graph totals and unverified attribution bounds are not adopted. Explorer checking is not execution replay, hardware examination, proof of operator identity or a full multi-chain audit.

SentinelTX’s report on the October 8, 2026 X7 Finance / X7Pioneer incident describes a transaction-scoped net outflow of 6.793749214542107991 ETH from the contract publicly attributed to X7Pioneer. Of that amount, the report records 6.780267629238261652 ETH reaching its starting address. The subsequent Ethereum transfers divide into three paths: 3.3 ETH to a Tornado.Cash-labeled address, 1.723 ETH to an unlabeled wallet, and 1.75 ETH to an intermediary used in a reported bridge route.Those quantities answer different questions. The contract’s net outflow, the recipient’s receipt, a repaid principal amount and transfers repeated across multiple hops should remain separate. The report also distinguishes retrieved transfers from the attribution of a mechanism, an operator or a service account.This article follows SentinelTX case CASE-ASYNC643, dated October 19, 2026. The report retrieves individual transfers but leaves several wider conclusions unverified. A retrieved transfer does not, by itself, establish who signed it, whether it was authorised or the nature of a token. One proposed connection cannot represent incident proceeds: the 0.15 ETH payment occurred before the transaction said to fund it. It is therefore excluded from the proceeds trail. The bridge settlement also remains unverified. The source notes below retain the report’s exact warnings and other material discrepancies.The transaction at the center of the reportThe seed transaction is 0xc98056d6ab55ef898189da5fa1fb08b968cb84ca99528d171f8240836b21766d. SentinelTX places it on Ethereum mainnet, chain ID 1, at block 26146922, transaction index 45, on October 8, 2026 at 09:55:59 UTC. The reported status is success, with no revert in the trace.The narrative identifies 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2 as the signing externally owned account, or EOA. It describes a nonce-2 contract-creation transaction that deployed 0x021f832b9ce6685b1135f4a3b55f2b317f95f55c, which in turn deployed the helper contract 0xaa0cad88ac3f76beb9a0f1ba661916d7716d5f4a in the same transaction. The report presents these signer and deployment statements as unverified conclusions.The reported native-ETH value frames show the following sequence:The WETH contract, 0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2, sent 26.963170607692677032 ETH to the helper.The helper sent 26.963170607692677032 ETH to 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7, the contract attributed to X7Pioneer in the report’s public sources.That contract returned 33.756919822234785023 ETH to the helper.The helper sent 26.976652192996523371 ETH back to WETH.The helper sent 6.780267629238261652 ETH to the EOA.SentinelTX calculates the contract’s transaction-scoped net outflow as 6.793749214542107991 ETH. The difference between this figure and the EOA’s receipt is 0.013481585303846339 ETH, which the report identifies as excess ETH re-wrapped into WETH. The helper’s gross inflow and gross outflow are each 60.720090429927462055 ETH; its net native-ETH change in the transaction is zero.The call tree contains 830 frames and reaches depth 8. Its summed frame value, 121.44018085985492411 ETH, counts forwarding hops repeatedly. It is therefore unsuitable as a loss figure. The separate gross-movement total of 130.274148 ETH across 20 transactions also recounts value across hops and is not an incident-loss estimate.What the report says about the mechanismThe reward-accounting explanation comes from third-party search snippets cited by SentinelTX: a SlowMist TI Alert result carried by KuCoin and DeFiHackLabs pull request #1299. The report says these pages were not read. Their snippets attribute an approximately 6.78 ETH loss to a flaw in X7Pioneer’s claimRewards() path; the SlowMist snippet also describes an ETH donation that amplified the accounting delta.SentinelTX describes value movements consistent with that account: the helper’s incoming payment to the attributed X7Pioneer contract, a long sequence of repeated calls, and a larger payment back to the helper. It notes 148 consecutive calls with selector 0x5eac6239 among the 169 displayed frames of the 830-frame trace. The selectors were not ABI-decoded in the evidence, so the report does not establish their function names or the exact accounting formula.The financing explanation is also an assessment. SentinelTX describes a call sequence through 0x87870bca3f3fd6335c3f4ce8392d69350b4fa4e2 and 0x4d5f47fa6a74757f35c14fd3a6ef8e3c9bc514e8, a callback into the helper, WETH unwrapping and subsequent re-wrapping. It interprets that shape as a flash loan with principal of approximately 26.963170607692677032 ETH and an excess repayment of 0.013481585303846339 ETH, roughly 0.05% of principal. The lender was not identified and the selectors were not decoded. The report keeps the flash-loan reading as an inference and excludes the repaid principal from retained proceeds.Three downstream Ethereum pathsThe report records 6.773 ETH in post-incident outflow from the EOA. The earliest listed transfers went to an unlabeled wallet; mixer-labeled transfers followed, then the intermediary associated with the bridge route. All times below are UTC on October 8, 2026.Unlabeled wallet: 0.001 ETH at 10:04:23 and 1.722 ETH at 10:05:23 went to 0x1572cc5a965e6c2f980eca7f6cc63971a9b80eb3, totaling 1.723 ETH. SentinelTX describes the first payment as a test transfer. Its October 19 provider record lists two inflows and no outflows, with in minus out minus gas of 1.723 ETH.Tornado.Cash-labeled recipient: six transfers to 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b totaled 3.3 ETH. Three 0.1 ETH transfers occurred at 10:11:23, 10:12:23 and 10:12:59; three 1.0 ETH transfers followed at 10:13:35, 10:14:11 and 10:15:59.Bridge intermediary: 1.75 ETH went to 0x314b7e4e69fc3ed0b519b5fd835a4adc9abbf335 at 10:23:59. The report assigns no entity label to that address.Figure 1. The report groups nine post-incident transfers from the starting address into three Ethereum branches: 3.3 ETH, 1.723 ETH and 1.75 ETH, totaling 6.773 ETH. The 0.15 ETH sent at 09:11:59 UTC preceded the seed transaction and is excluded. These bars compare transfers; they do not establish a loss or a current balance.Color key: Slate bars show ETH sent by the starting address. A, B and C directly identify recipients; the amounts share a zero baseline.Address/role key: Starting address = 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2. A = 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b, with Tornado.Cash labels recorded in the report; B = 0x1572cc5a965e6c2f980eca7f6cc63971a9b80eb3, unlabeled wallet; C = 0x314b7e4e69fc3ed0b519b5fd835a4adc9abbf335, bridge intermediary.Source: SentinelTX PDF, CASE-ASYNC643, pp. 6–8, Transaction Chronology. Report-level confidence qualifications: pp. 4 and 19.Two different label records appear for the mixer recipient: “Tornado Cash: 10 ETH (Sanctioned)” and “Tornado.Cash, Mixer, Tornado.Cash: Router, Sanctioned.” SentinelTX reproduces both and says the observed deposit sizes are consistent with the Router role. It treats this leg as a privacy boundary and does not trace it further. The methodology says the recipient’s outbound list was not read because it was a high-volume wallet; an absence of outbound edges in the traced set should be read within that collection boundary.The reported bridge route and its receipt qualificationAt 10:24:47 UTC, the intermediary sent 1.75 ETH to 0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae, labeled “LifiDiamond,” in transaction 0xa892aab832796dddd384289179364eaa40f5674a47e77eb9f0347ee0c127f810.The bridge lookup describes a LiFi route using Mayan, also indexed as Socket (Mayan), with the same intermediary address as destination on Arbitrum, chain ID 42161. It reports delivery of 4,475.922884 USDC, with token contract 0xaf88d065e77c8cC2239327C5EDb3A432268e5831. The lookup’s basis is the transaction hash, but the destination-side receipt remains unverified, and the report does not cite the settlement transaction hash.The next reported movement is a transfer of 4,475.922884 USDC at 10:25:31 UTC from the intermediary to 0x2df1c51e09aecf9cacb7bc98cb1742757f163df7, labeled “HyperLiquid, Dex.” Its transaction hash is 0x3d0d18b844f5ebfad3d157702713d48f6233094640b9bf21460d0b89f82e1d6d, at block 512852763. The routing table marks that transfer verified. This separate row does not remove the bridge receipt qualification.Diagram 2. The report describes 1.75 ETH routed via LiFi/Mayan to the same intermediary address on Arbitrum as 4,475.922884 USDC, followed by a transfer to an address labeled “HyperLiquid, Dex”. The bridge settlement remains unverified, and the destination settlement hash is not cited. The onward transfer hash is cited. No custodial cash-out or account ownership is established.Color key: Slate nodes are the intermediary on Ethereum and Arbitrum; the sage node is the HyperLiquid-labeled destination. The dashed arrow denotes the reported, receipt-unverified settlement; the solid arrow denotes the reported onward USDC transfer. Equal-width arrows do not encode amounts.Address/role key: Intermediary on both chains = 0x314b7e4e69fc3ed0b519b5fd835a4adc9abbf335; LiFi router on Ethereum = 0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae; HyperLiquid-labeled destination = 0x2df1c51e09aecf9cacb7bc98cb1742757f163df7. The diagram condenses the bridge service into the first connection.Source: SentinelTX PDF, CASE-ASYNC643, p. 7, Transaction Chronology; pp. 10–11, Transaction Typology; p. 13, Conclusion.SentinelTX identifies the HyperLiquid-labeled address as a DEX endpoint rather than a custodial exchange deposit. Whether the value can be attributed to a particular account at the venue remains an unverified lead. The narrative calls this transfer the third-hop scope boundary; the routing table labels the USDC row hop 1, while the abstract says the cited routing rows reach at most two hops. These are different source presentations, not interchangeable measures of coverage.Funding before the seed transactionThe report places the EOA’s earliest observed value receipt at 09:11:23 UTC, from 0xe7351fd770a37282b91d153ee690b63579d6dd7f, labeled “deBridge Finance, DinDestination, Bridge.” Its narrative gives the amount as 0.160966947216380443 ETH, displayed as 0.160967 ETH, in transaction 0x72d94e8367a25c27d7b381ec899711115489468ffa3eeca2556c17149e3fa56b. The originating chain and depositor are unresolved.At 09:11:59 UTC, the EOA sent 0.15 ETH to 0xb2ecfe4e4d61f8790bbb9de2d1259b9e2410cea5 in transaction 0xda55fd68dce40896726207c74cf9618d8cd727d00d7f822af04d68470b3baeec. The chronology explicitly separates this transfer from incident proceeds because it preceded the seed transaction. It is not included in the three post-incident paths above.A receipt of 15.0 tokens reported as “SEND” at 09:18:23 UTC is recorded but excluded from the value trail. SentinelTX did not classify the token contract or assign a value, and it claims no link to the operator. Three later look-alike-address transfers are similarly recorded but excluded from tracing. The report classifies them as address-poisoning noise without an evidentiary link to the operator.The source limits that matterSentinelTX reports 22 traced movements across 15 addresses. Its two executed query windows each cover 41 days, from September 8 to October 19, 2026 UTC. The 18 retained movements with readable timestamps span October 8 from 09:11:23 to 10:42:47 UTC; four retained rows lack readable timestamps. The methodology says the query interval does not establish complete transaction coverage or enforcement of a requested historical window or block cutoff.The report itself contains several material qualifications and inconsistencies:Verification wording: the executive summary says five claims were downgraded and one finding flagged for review. Its “unverified (auto-downgraded)” heading coexists with a conclusion using “confirms” and a routing table marking transfers verified. This article attributes the analysis to SentinelTX and preserves the abstract’s narrower definition of transfer verification.Pre-incident routing: warning INV-5 identifies a time-inverted path from block 26,146,922 to block 26,146,702. The latter contains the 0.15 ETH payment made before the seed transaction. The report’s chronology already says it cannot be incident proceeds; the warning remains part of the source.Funding quantity: the narrative gives the deBridge receipt as 0.160966947216380443 ETH, while the routing table’s Transfer amount is 0.160966773016380443 ETH. Both are preserved here without choosing a replacement figure.Look-alike transfer quantities: the narrative and Amount column describe three transfers as 0 ETH or 0.0 ETH. The corresponding Transfer amounts are 0.000000172200000000 ETH, 0.000000001000000000 ETH and 0.000000001000000000 ETH. SentinelTX distinguishes recorded Amount from retained-unit Transfer amount and says a difference alone does not establish case attribution.Endpoints and scope: the abstract says terminal endpoints are not recorded in its evidence subset, while the body lists terminal addresses in the traced set. A traced-set terminal denotes a boundary in those records; it does not establish a final beneficiary, an absence of later activity or conversion to cash.The October 19 snapshots also remain separate from traced movements. The report gives the EOA’s snapshot balance as 0.00298 ETH and its provider-list inflow minus outflow minus gas as 0.002980011244414113 ETH. The intermediary’s Ethereum residual is 0.001423268336660466 ETH. Its provider list includes 1.7515 ETH of inflow, with the sender of the additional 0.0015 ETH above the EOA’s 1.75 ETH payment unidentified in this evidence. These figures are dated observations, not current balance claims.The leads SentinelTX leaves openThe report’s conclusion identifies three principal leads: the deBridge funding order, the USDC sent to the HyperLiquid-labeled address, and the unlabeled wallet recorded with 1.723 ETH and no outflows. Its recommended follow-up is specific to those boundaries.For deBridge, SentinelTX recommends obtaining the funding order’s source chain, depositor address and order ID. For LiFi / Mayan, it recommends obtaining the routing record and Arbitrum settlement to corroborate the delivered amount and any integrator metadata. For the HyperLiquid-labeled transfer, it recommends a preservation and information request through the venue’s compliance channel, including any attributable account and subsequent withdrawals.It also recommends monitoring the 1.723 ETH wallet, the intermediary on Ethereum and Arbitrum, and the pre-incident recipient. For the mixer leg, it treats any future withdrawal attribution as a separate lead. Before an evidentiary filing, the report recommends decoding the seed transaction’s selectors against verified ABIs and reading the event logs to move the mechanism beyond its present attributed, code-level-unverified status.Figure 3. The report’s conclusion states a seed-transaction contract net outflow of 6.793749214542107991 ETH and a signer receipt of 6.780267629238261652 ETH; the image rounds these to approximately six decimal places. It attributes the reward-accounting mechanism to SlowMist and DeFiHackLabs without decoded code-level semantics, does not establish operator identity, and identifies no custodial exchange deposit within three hops. Five broader claims remain unverified. A payment made before the incident cannot be proceeds of it, and the bridge settlement is still unverified. These limitations remain part of the conclusion.Color key: Slate headings organize quantities, interpretation and report qualifications. Confidence is stated in words, not encoded by color.Address/role key: Net-outflow contract = 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7, attributed to X7Pioneer by public reports; signer = 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2.Source: SentinelTX PDF, CASE-ASYNC643, pp. 4–5, Executive Summary; pp. 9–10, Transaction Typology; p. 13, Conclusion; p. 19, Automated Integrity Check. Incomplete evidence scope: pp. 1–2 and 17–18.The central finding is a reported contract net outflow of 6.793749214542107991 ETH, a receipt of 6.780267629238261652 ETH by the starting EOA, and the three downstream Ethereum paths described above. The report attributes the incident to X7Pioneer and a reward-accounting flaw through its cited public snippets, while keeping the exact code semantics and operator identity unresolved. The unverified bridge settlement, excluded pre-incident payment and incomplete collection scope limit what these findings establish.

On 9 October 2026, Ledger said it was investigating reported fund losses among Southeast Asian customers who had bought devices from CryptoBilis. Its notice asked the reseller to pause sales and shipments. It did not establish the cause, a total loss figure, or which public addresses belonged to affected buyers. Ledger Support notice, 9 October.This review asks a narrower question: what can the transaction records establish about the addresses supplied as investigation leads? Three checked token transfers from two candidate addresses reach the same Ethereum recipient. Later, one candidate sends ETH to six recipients. One of those recipients makes two separately checked deposits into contracts labeled Tornado Cash. The six departures and the two later deposits are successive movements, not eight losses.The token route is C1 / C2 → D; the selected later ETH branch is C1 → R2 → two labeled pools. R2 is simply the short name for the recipient of the second checked ETH departure. N → C1 is a separate incoming ETH record. Two earlier large ETH leads remain unjoined to these routes. These observations do not establish victim ownership, a total loss, a post-mixer recipient or a Zcash conversion.Ledger later described a hardware implant that reads recovery words—the secret backup material used to restore wallet keys—from the display of a signing device and transmits them over a mobile connection. Ledger’s official statement. That is an attributed vendor finding, not our examination of a device. This article keeps that explanation separate from the transfers it can check. The later section on the official update sets out the scope and limits of that statement.The roles before the numbersETH is Ethereum’s native asset and is used to pay transaction fees. USDT and USDC are separate tokens whose balances are maintained by their own contracts. A transaction can call one of those contracts without attaching ETH, while still instructing it to move a substantial token balance. That distinction matters when reading the three outgoing transactions.C1 and C2 are short labels for the two candidate addresses selected in the existing investigation. “Candidate” is deliberate: the transaction pages establish activity at those addresses, not the identity of their operators or the ownership of the funds. D names their common token recipient, and N names the sender of one checked ETH receipt.A service order is the instruction that asks a provider to exchange or deliver assets, potentially on another chain. The deposit and the payout can be separate blockchain transactions. To join them reliably, the investigator needs a record identifying the input, the requested destination and the actual fulfillment—not just a similar time or a familiar service label. This is the main missing connection tested below.RoleWhat this label meansC1 · candidate addressSends USDT in E04; receives ETH in E03. Incident attribution is not independently established.C2 · candidate addressSends USDC and USDT in E05/E06. The role does not establish common control with C1.D · token recipientReceives E04–E06; explorer label “HiFiSwap: Bridge 7” is provider attribution.N · ETH senderSends E03; explorer label “NEAR Intents” does not identify a source-chain customer.The full, linked Ethereum addresses are preserved in Appendix B. The short names above are used throughout so the narrative can be followed without memorizing address strings.Service labels need the same restraint. Blockscout displays D as “HiFiSwap: Bridge 7” and N as “NEAR Intents.” Those labels help identify a possible service-record request. They do not prove that a particular customer used a bridge, that D’s operator controlled C1 or C2, or that the service participated in a theft. The analysis below relies on the address strings and transfers; the labels remain attributed context.Review measureScope / resultSelected evidenceE01–E06, six later ETH departures L01–L06, and two selected pool deposits M01/M02. Not a complete downstream history.On-chain record window9–11 October 2026 UTC; selected records only, not attack duration.Preparation and scope18 October follow-up; the exact later departures and two deposits directly reread. No complete chain-wide audit or current-balance claim.Token transfers to DThree transfers; two sender addresses; USDT and USDC kept separate.Incident-linked loss totalNot established. No USD valuation or victim count is adopted.The morning records, in time order06:24:23 UTC — C1 sends USDT to DThe first record in this selected sequence is E04 transaction. At Ethereum block 26,153,038, C1 submitted a successful transfer call to the USDT contract. The token-transfer entry names D as the recipient of 124,142.952049 USDT. This proves the token movement between those addresses. It does not identify the original owners of the tokens or the order, if any, that a service processed in return.06:33:35 UTC — an ETH receipt reaches C1Nine minutes and twelve seconds later, E03 transaction records 197.987401974409142087 ETH sent by N to C1, in block 26,153,084. The sender carries the explorer label “NEAR Intents.” The native ETH transfer is directly visible; its source-chain origin and associated customer order are not.The order is important. The ETH receipt follows the USDT departure, which can make the pair look like a conversion. Timing alone does not show that E03 fulfilled E04. There is no verified order identifier, source execution, or destination-fulfillment record joining them in this review. They could belong to one service order, to different orders, or to unrelated activity. The figure therefore shows transfers that touch C1 without drawing a token-to-ETH conversion.06:38:35–06:39:35 UTC — C2 sends two different tokensAt block 26,153,109, C2 sent 100,008.900873 USDC to D in E05 transaction. Exactly sixty seconds later, block 26,153,114 records 49,990.00111 USDT from C2 to the same D in E06 transaction. Both pages show successful transfer calls and zero attached ETH. The two entries concern different token contracts, not one stablecoin balance under two names.Evidence / UTCMovementQuantityE04 · 06:24:23C1 → D124,142.952049 USDTE03 · 06:33:35N → C1197.987401974409142087 ETHE05 · 06:38:35C2 → D100,008.900873 USDCE06 · 06:39:35C2 → D49,990.00111 USDTStart Figure 1 with N and C1 on the left, then read C2 on the right and the shared D below. The solid arrows show the four checked asset movements. Their widths do not measure value, and the layout is not a clock: E04 happened before E03 even though the ETH sender is drawn above C1.Figure 1. Evidence E03–E06. Pastel boxes organize roles and evidence labels; solid arrows represent asset movements, not ownership. The ETH amount is rounded only in the artwork. Full amounts and transaction links are preserved in Appendix A.The common endpoint is the strongest directly observed connection between the two candidates in this subset. It is a connection through a recipient, not proof of common control. The next task is to identify any order fulfilled for each deposit, rather than treating all of D’s activity as the continuation of these three transactions.Why a zero-ETH call still moves tokensAn Ethereum transaction page can display both a transaction target and a token recipient. They answer different questions. The target is the address receiving the instruction. For a token transfer, that is normally the token’s contract. The token recipient is the address whose token balance increases when the instruction is processed.E04 demonstrates the distinction. C1 is the transaction sender. The transaction targets the USDT contract, while the transfer entry names D as the token recipient. “Value: 0 ETH” means the transaction did not attach native ETH to that call. It does not mean zero USDT moved. C1 also paid a separately recorded fee of 0.000011148080355804 ETH. E04 transaction.Read the upper row of Figure 2 as an instruction to token code, and the lower row as the token movement that the explorer reports. The dashed call arrow and solid asset arrow are two views of the same transaction. They must not be counted as two transfers or two losses.Figure 2. Conceptual role diagram anchored to E04. Dashed blue-gray line = contract call; solid sage line = token movement. The rows distinguish address roles; they are not separate transactions or a complete internal-call trace.The distinction prevents two errors: using the token contract as the final receiving wallet, and treating the native-value field as the token amount. It also shows the limit of a successful call. A successful transfer does not explain how signing authority was obtained, whether the owner consented, or whether a hardware device was altered. Those questions need evidence beyond this transfer record.13:32 UTC — the public notice describes reports, not a causeAfter the morning records and before the two afternoon ETH transfers, Ledger Support published the notice used for this article’s incident context. Its request to pause sales and shipments was precautionary. A signer is the device or software used to authorize a transaction; a seed is recovery material from which wallet keys can be derived. Ledger’s recommendation to consider a new signer with a new seed concerns replacing signing authority. It does not establish how any existing authority was compromised. Ledger Support notice, 9 October.The notice is an off-chain statement placed here to distinguish its publication time from the blockchain events. It does not authenticate C1, C2, A or B as victim or attacker addresses. The next two records are therefore read as separate leads, not as a continuation endorsed by that announcement.The separate afternoon ETH leadsLater on 9 October, two other successful transactions moved large amounts of ETH. At 15:04:35 UTC, E01 transferred 393.2698 ETH from A to A′. At 15:31:11 UTC, E02 transferred 438.5549 ETH from B to B′. Neither sender is C1 or C2, and neither recipient is D. E01 transaction; E02 transaction.The block numbers, sender and recipient strings, amounts, success status, fees and gas-used fields were rechecked on the public explorer. Those observations support two direct ETH transfers. They do not establish a path from C1, C2 or D to A or B. The broader investigation contains additional route leads, but a graph’s inclusion of an address is not a substitute for a transaction-by-transaction, time-consistent link.In Figure 3, read the upper token-route box separately from the two ETH pairs below. Whitespace is intentional: no arrow joins the evidence sets because no such link is established here. The two lower solid arrows mean only the individual ETH transfers.Figure 3. Evidence E01 and E02. All solid arrows are directly checked transfers. The separated panels do not imply a hidden bridge or mixer connection. The two-transfer sum excludes fees and is not a loss estimate.The gap changes the conclusion. It would be inaccurate to say these two candidates sent 831.8247 ETH onward, or that their tokens were demonstrably converted into those ETH transfers. It would also be inaccurate to conclude that no relationship can exist. The relationship is unresolved by the reviewed records. Any future connection needs its own source and destination anchors.10–11 October — C1 sends its ETH onwardThe earlier snapshot was not the end of the story. The new review directly checked six later ETH departures from C1. At 09:42:59 UTC on 10 October, L01 transaction sent 468.9 ETH to a new recipient in this review. On 11 October, another five transfers followed. These records supersede any reading of the old snapshot as evidence that C1’s ETH remained unmoved. They do not change what the three earlier token records show.At 09:43:11 UTC on 11 October, C1 sent 199.1 ETH to the address we call R2 in L02 transaction. R2 is a role label, not an identified person. Eight minutes later, M01 transaction records R2 calling deposit on the explorer-labeled 10 ETH Tornado Cash pool with 10 ETH. Thirty-six seconds after that, M02 transaction records a successful deposit of 1 ETH into the separately labeled 1 ETH pool. The sender address in both deposits is the recipient of L02.A mixer is a service designed to make a deposit difficult to link to a later withdrawal. A checked deposit establishes entry into the contract, not the operator’s identity or a later payout. The two individually reread records here total 11 ETH. SentinelTX surfaced a larger pool-deposit set, but this article does not substitute that broader trace result for a fully checked transaction inventory.UTC / recordMovementETH2026-10-10 09:42:59 · L01 transactionC1 → recipient 1468.92026-10-11 09:43:11 · L02 transactionC1 → R2199.12026-10-11 15:43:35 · L03 transactionC1 → recipient 3952026-10-11 19:03:35 · L04 transactionC1 → recipient 4199.12026-10-11 19:07:35 · L05 transactionC1 → recipient 585.082026-10-11 19:08:23 · L06 transactionC1 → recipient 6121.730854381543827The rest of C1’s departures continue the chronology after the selected pool deposits: 95 ETH at 15:43:35, then 199.1 ETH at 19:03:35, 85.08 ETH at 19:07:35 and 121.730854381543827 ETH at 19:08:23 UTC. The last amount retains its full precision. The six unique departure hashes total 1,168.910854381543827 ETH, excluding their transaction fees. This is a departure subtotal from C1, not independently established victim loss.Read Figure 4 from C1 at the top. The left branch follows the selected 199.1 ETH recipient, R2, down to the two individually checked pool deposits. The right panel groups five different direct recipients; it is not a single wallet or an additional transfer. Solid arrows show asset movements, and neither arrow width nor spacing represents quantity or elapsed time.Figure 4. Evidence L01–L06 and M01/M02. The two pool deposits are a selected 11 ETH subset, not a complete mixer total. Grouped recipients on the right are not a shared wallet. No post-mixer route is established.This gives the investigation a concrete continuation from C1, rather than a merely similar-looking route elsewhere in the graph. It still does not join the earlier A/B ETH leads to C1. Nor does the presence of a public pool prove that all ETH R2 received belonged to this incident. Completing R2’s full history and the other five recipients’ routes remains a separate task. The next question is whether a deposit-specific service record establishes any Zcash conversion; none has been established in this review.13–17 October — hardware findings and a different routing claimIn its 13 October statement, Ledger attributed a hardware-implant finding to Donjon and said one affected user’s device had been confirmed on 10 October. Ledger said a separate component observes recovery-word screen data and transmits it through LTE/eSIM without modifying the Secure Element, operating system, transactions or signatures. Recovery words are the secret backup material from which wallet keys can be restored. An unchanged signing chip therefore does not, by itself, establish that words displayed during setup remained confidential. This explains the company’s account; it is not our independent hardware reproduction.Ledger did not confirm a total affected-user count or total loss in that statement. Its Germany follow-up, displayed 15 October KST also needs to be kept within its scope: Ledger said inspected retail and distributor samples showed no tampering, no implant-related fund loss had been reported in Europe, and the devices shown online had not yet been examined. Neither a reported implant nor a negative sample inspection establishes the condition of every device.On 17 October, Specter claimed that CryptoBilis-linked funds had entered Zcash. The original post contains no Ledger or Triple-A transaction hashes; its attached image concerns Bitget and ZachXBT. That image is not supporting transaction evidence for this case. The deposit-to-payout checks in the renewed investigation did not supply a verified Zcash join and suffered provider-read failures. A failed or incomplete lookup is not evidence that a conversion never happened. It leaves the claim unproved here.What the totals do—and do not—measureSeparate questions need separate arithmetic: how much of each token reached D, how much ETH moved in the independent afternoon pair, and what left C1 later. Transactions are deduplicated by their full hash. Token amounts are kept at the precision recorded in the fact ledger; fees are separate ETH costs, not deductions from token quantities.CalculationQuantityMeaningE04 + E06174,132.953159 USDTTwo USDT transfers received by D; not verified victim loss.E05100,008.900873 USDCOne distinct USDC transfer received by D.E01 + E02831.8247 ETHTwo independent ETH transfers; excludes fees; no proved link to C1/C2.E03197.987401974409142087 ETHOne receipt at C1; not a verified conversion of E04.USDT and USDC are both commonly described as dollar-pegged tokens, but that does not make their quantities a verified dollar-loss figure. This review neither applies an incident-time price nor adds ETH to stablecoins. It also does not add E03 to the token departures as new damage: if a conversion were later demonstrated, summing both legs as separate losses would count the same economic value twice.The six later C1 departures total 1,168.910854381543827 ETH. The two selected R2 pool deposits total 11 ETH, but that is later movement from a recipient already present in the departure subtotal: it is not another 11 ETH to add as damage. No balance is inferred from these selected transfers. Establishing what remains requires a balance at a named block and a complete ledger of relevant activity. A service endpoint may process unrelated customers’ funds, so its wider traffic is not assigned to this case. A chart is not included because a loss-sized bar would imply an economic scope that the evidence does not establish.What could connect the evidenceLedger’s notice confirms that the company was investigating reports and had requested a precautionary pause. It also advised recent purchasers who had not configured their devices not to begin setup, and asked those who had configured them to consider a new signer with a new seed. These were the company’s recommendations in that notice, not findings that this review independently established about the cause. Ledger Support notice, 9 October.The same boundary applies to the addresses. To connect a transfer to a reported loss, an investigator needs a reliable record linking the affected account, the withdrawal, and the relevant purchase or setup history. A reseller purchase does not, by itself, prove device tampering. A transfer from a candidate address does not, by itself, establish a stolen private key or an unauthorized approval.QuestionMissing recordWhat a match could establishDid E03 fulfill E04?Service order, source execution and fulfillment identifierA specific deposit-to-payout relationship, not merely time proximity.Where did E04–E06 go after D?Deposit-specific destination chain, recipient and payout transactionAn onward route for each deposit, without importing unrelated service flows.Are E01/E02 connected?A directed, time-consistent sequence or verified service-order joinWhether the separate ETH leads belong to the same fund path.Which transfers are losses?Victim-confirmed account/withdrawal records and authorization historyA bounded loss ledger; distinct from gross transfer volume.What caused the reported losses?Device/setup evidence and applicable signing or authorization recordsA technical explanation that transaction timing alone cannot supply.There are plausible alternative readings. Shared service use could reflect different customers. The ETH receipt and USDT departure could be related or unrelated orders. The afternoon ETH leads could be part of the incident, or simply leads selected for testing. The original six selected records do not discriminate among those possibilities, and the later C1 departures do not close those earlier joins. Naming the missing record is more useful than choosing the most dramatic explanation.The concrete response point is therefore evidence preservation. Retain the three deposit hashes and their exact token contracts, and seek deposit-specific order records through appropriate authorized channels. Preserve buyer purchase and setup records separately from chain observations. No contact, freeze request, recovery action or live monitoring deployment is claimed in this review.ConclusionThree token deposits reach D, where the checked token route remains unresolved. Six later ETH departures extend the record from C1, and two selected deposits establish that R2 sent 11 ETH into explorer-labeled Tornado Cash contracts. The earlier A/B ETH leads remain unjoined, and no Zcash conversion is established. Victim ownership, common control, the full mixer total and an incident-wide loss figure remain outside the independently checked scope. The next investigation must complete recipient histories and seek deposit-specific service fulfillment, rather than drawing a missing connection from a familiar label or a similar amount.Evidence appendixAll times below are UTC, with each date printed explicitly. E01–E06 were previously reread on public Blockscout detail pages; L01–L06 and M01/M02 were directly read in the 18 October follow-up. Local +09:00 explorer timestamps were converted to UTC. Direct checking means checking displayed transaction details, not replaying Ethereum execution, auditing device hardware or identifying the people behind addresses.Appendix A — Transaction anchorsE04 · USDT recordFieldChecked valueFull hash0x0fb0cc83c4647ce0e384840f5e4d3aa9e03c5d9870ad15a3c5e266910e4a5184UTC / block2026-10-09 06:24:23 UTC / 26153038Sender0x83aeaC166f6832aE3500000a24510a95a052A599Recipient0x1481e58411608B2d628Ef305b92B01cF4f83DB70Asset / exact quantityUSDT / 124142.952049Status / feeSuccess / 0.000011148080355804 ETHToken contract0xdAC17F958D2ee523a2206206994597C13D831ec7Call / native valuetransfer / 0 ETHE03 · ETH recordFieldChecked valueFull hash0xb1b7fc7b4911994739652507586eb8d0e4fd06434efe19b17ba041474ee6f55cUTC / block2026-10-09 06:33:35 UTC / 26153084Sender0x2CfF890f0378a11913B6129B2E97417a2c302680Recipient0x83aeaC166f6832aE3500000a24510a95a052A599Asset / exact quantityETH / 197.987401974409142087Status / feeSuccess / 0.000013016071173 ETHE05 · USDC recordFieldChecked valueFull hash0x64f6ad0dccc64ee6657324f809acff6140db12477998ffeacb173d3e2da0e7b5UTC / block2026-10-09 06:38:35 UTC / 26153109Sender0x033636e45d519BeBB7b5c2520Ca6CE56FBDB4F7aRecipient0x1481e58411608B2d628Ef305b92B01cF4f83DB70Asset / exact quantityUSDC / 100008.900873Status / feeSuccess / 0.00001065616800284 ETHToken contract0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48Call / native valuetransfer / 0 ETHE06 · USDT recordFieldChecked valueFull hash0xcfb9cb65511a67b89f044c3df34f16fa8c906375211de58f53d7a09e580c261bUTC / block2026-10-09 06:39:35 UTC / 26153114Sender0x033636e45d519BeBB7b5c2520Ca6CE56FBDB4F7aRecipient0x1481e58411608B2d628Ef305b92B01cF4f83DB70Asset / exact quantityUSDT / 49990.00111Status / feeSuccess / 0.000011126499141282 ETHToken contract0xdAC17F958D2ee523a2206206994597C13D831ec7Call / native valuetransfer / 0 ETHE01 · ETH recordFieldChecked valueFull hash0x266f2dbb1e5f2e5f29242f9f7b8352bd5ca8ebef6edcfb66a69bfa058825000fUTC / block2026-10-09 15:04:35 UTC / 26155632Sender0x131c9Cafa8959A5E7cD7293Df8D5D4B0887dFA6aRecipient0xA27FF374C9aD192728e6EB1e177b5fa11F9d650FAsset / exact quantityETH / 393.2698Status / feeSuccess / 0.000011926562676 ETHE02 · ETH recordFieldChecked valueFull hash0x595c655e9bc3ee94d75b71ac1259eac3e23adaff9a62ef063c2c3e7f72ccedb6UTC / block2026-10-09 15:31:11 UTC / 26155765Sender0xfa4EaBB840A33C156E600311433AE261CBfCb0e2Recipient0x75F88067D274BA59B3C467ab26e6229881480AACAsset / exact quantityETH / 438.5549Status / feeSuccess / 0.000014498392671 ETHL01 · ETH recordFieldChecked valueFull hash0x0edec454766797e722e3b4f73eaf93b97735f98eef2f72b4480295b49b62c302UTC / block2026-10-10 09:42:59 UTC / 26161210Sender0x83aeaC166f6832aE3500000a24510a95a052A599Recipient0xDC651DF8f6368a85297F86f79038986b002CE203Asset / exact quantityETH / 468.9Status / feeSuccess / 0.000004538316468 ETHL02 · ETH recordFieldChecked valueFull hash0x303c3aa4b08d8faea9484edf230479ff05f761792a502cda25aca984ce0ff297UTC / block2026-10-11 09:43:11 UTC / 26168385Sender0x83aeaC166f6832aE3500000a24510a95a052A599Recipient0xAc567666EA5253Adf8E03e84557f29A79D14d9D5Asset / exact quantityETH / 199.1Status / feeSuccess / 0.000004463891565 ETHM01 · ETH recordFieldChecked valueFull hash0x9c947f79a1ce0b8e756f17d9d9353aa9cfd47fd7418dbd701c323dfbfcba7337UTC / block2026-10-11 09:51:11 UTC / 26168425Sender0xAc567666EA5253Adf8E03e84557f29A79D14d9D5Recipient0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbFAsset / exact quantityETH / 10Status / feeSuccess / 0.000119711477203248 ETHM02 · ETH recordFieldChecked valueFull hash0xa5d67098585e895402d0afb444a81032f7653bec3cb2f682ebcf90846cb26bd1UTC / block2026-10-11 09:51:47 UTC / 26168428Sender0xAc567666EA5253Adf8E03e84557f29A79D14d9D5Recipient0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936Asset / exact quantityETH / 1Status / feeSuccess / 0.00010945216451463 ETHL03 · ETH recordFieldChecked valueFull hash0xc11bc87c99eeb2e850beffb9e22e0c5833145078c101e8d20c0c9ed054258539UTC / block2026-10-11 15:43:35 UTC / 26170183Sender0x83aeaC166f6832aE3500000a24510a95a052A599Recipient0xb62aa10E987f5C65A63c0E26F410C75e8C2838C3Asset / exact quantityETH / 95Status / feeSuccess / 0.000006734734587 ETHL04 · ETH recordFieldChecked valueFull hash0x2ae1ba618ad5d71a59a10bb94e2dc755e2faadd7cf0032af230aeea94fc7b39aUTC / block2026-10-11 19:03:35 UTC / 26171180Sender0x83aeaC166f6832aE3500000a24510a95a052A599Recipient0xa82a701887d89ADe05F5682Cf670901f0ccCA9D3Asset / exact quantityETH / 199.1Status / feeSuccess / 0.000005870449809 ETHL05 · ETH recordFieldChecked valueFull hash0x04ae3e77f209a65db3f40b4b3d784ab98f5443cb7c4bbb549b9177fc7023b022UTC / block2026-10-11 19:07:35 UTC / 26171200Sender0x83aeaC166f6832aE3500000a24510a95a052A599Recipient0xd26aB39EBBc7EB38E5bECC94eEB59575ec0b554BAsset / exact quantityETH / 85.08Status / feeSuccess / 0.000005233847073 ETHL06 · ETH recordFieldChecked valueFull hash0x30f4ea623780cc9a99761599e63d8a6111a0a02b143961bd69dabd6bf24723a3UTC / block2026-10-11 19:08:23 UTC / 26171204Sender0x83aeaC166f6832aE3500000a24510a95a052A599Recipient0x422078B0B25F63627dc5D51c264a565d0a7bD255Asset / exact quantityETH / 121.730854381543827Status / feeSuccess / 0.000005227081797 ETHAppendix B — Address-role registerRoleFull Ethereum addressC1 · candidate address0x83aeaC166f6832aE3500000a24510a95a052A599C2 · candidate address0x033636e45d519BeBB7b5c2520Ca6CE56FBDB4F7aD · token recipient0x1481e58411608B2d628Ef305b92B01cF4f83DB70N · ETH sender0x2CfF890f0378a11913B6129B2E97417a2c302680USDT contract0xdAC17F958D2ee523a2206206994597C13D831ec7USDC contract0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48A · E01 sender0x131c9Cafa8959A5E7cD7293Df8D5D4B0887dFA6aA′ · E01 recipient0xA27FF374C9aD192728e6EB1e177b5fa11F9d650FB · E02 sender0xfa4EaBB840A33C156E600311433AE261CBfCb0e2B′ · E02 recipient0x75F88067D274BA59B3C467ab26e6229881480AACL01 · ETH recipient; further route not reviewed0xDC651DF8f6368a85297F86f79038986b002CE203R2 · L02 recipient and M01/M02 sender0xAc567666EA5253Adf8E03e84557f29A79D14d9D5L03 · ETH recipient; further route not reviewed0xb62aa10E987f5C65A63c0E26F410C75e8C2838C3L04 · ETH recipient; further route not reviewed0xa82a701887d89ADe05F5682Cf670901f0ccCA9D3L05 · ETH recipient; further route not reviewed0xd26aB39EBBc7EB38E5bECC94eEB59575ec0b554BL06 · ETH recipient; further route not reviewed0x422078B0B25F63627dc5D51c264a565d0a7bD255M01 · deposit contract; Tornado.Cash: 10 ETH (explorer label)0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbFM02 · deposit contract; Tornado.Cash: 1 ETH (explorer label)0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936Role names describe the reviewed records. They do not establish natural-person identity, common ownership, consent, culpability, or authority to freeze the assets. All address links target Ethereum address-detail pages, not transaction pages.Sources and verification boundaryThe primary incident context is the Ledger Support notice, 9 October, supplemented by the later Ledger and Specter statements linked alongside their discussion. E01–E06 and the eight newly checked L/M records in Appendix A supply the direct movement evidence. The existing SentinelTX investigation supplied candidate identifiers and additional leads; broader balances, service-wide aggregates and unrechecked mixer totals are not adopted as independently established findings in this article.This is a bounded evidence review, not a complete incident census or a current-balance assessment. No full victim-origin ledger, successful deposit-to-payout cross-chain order matching, complete downstream review or hardware reproduction has been completed. Provider failures limit the renewed bridge lookup. The date of reading historical records does not extend the transfer window to the present. No Zcash or post-mixer route is asserted.

18 October 2026The 16–17 October disclosures revisit the NEAR Intents / HOT Bridge incident reported for 29 September–1 October 2026. They add postmortem and recovery context to an earlier exploit. The central questions are how bridge backing and internal credit became separated, what the BNB Chain record supports, and what evidence establishes the reported return.SentinelTX’s 25-page report, CASE-ASYNCE30, distinguishes three transfer-anchored payouts totaling 3,500,000 BSC-USD from two further calls in its narrative. Its routing appendix gives those two calls a different classification. That qualification matters as much as the headline number. This article summarizes the native report; its claims have not been independently re-verified here.What changed in the October follow-upThe report’s chronology attributes the 16–17 October coverage to a deposit-notification bug, “ghost balances,” a reported full recovery, and changes including feature removal and an automatic pause. The feature-removal statement comes from a Defiprime search snippet; the report says that page was not an admissible fetch source. These remain attributed reports, rather than a fresh implementation review.Earlier coverage cited in the PDF places the reported return around 3 October. The later postmortem therefore updates the explanation and safeguards. It does not supply a hash-anchored recovery transaction within this report. [PDF pp. 3, 8, 14–15]Three payouts, two further calls, and a classification gapThe executive summary and conclusion classify these treasury-to-recipient transfers as confirmed:800,000 BSC-USD: 30 September 2026, 23:54:30 UTC; block 125,000,023. Transaction1,200,000 BSC-USD: 1 October 2026, 00:24:02 UTC in the routing appendix; block 125,003,957. Transaction1,500,000 BSC-USD: 1 October 2026, 00:50:42 UTC in the routing appendix; block 125,007,511. TransactionNarrative-confirmed total: 3,500,000 BSC-USD.Two additional recipient-signed treasury calls contain calldata words equal to 330,000 × 10^18 and 35,000 × 10^18. The narrative classifies them as partial: transaction objects were examined, but the cited transfer legs were missing. It attributes the corresponding 330,000 USDT and 35,000 USDT payouts, and the 3,865,000 USDT total, to CertiK.Source qualification: page 16 also lists those same two hashes as “verified” treasury-to-recipient BSC-USD movements, with transfer amounts of 330,000 and 35,000. Page 19 says the routing table lists movements of value. This differs materially from the partial classification on pages 3 and 14. The report does not reconcile the classifications. We retain the narrative’s three-payout total while making the appendix’s additional evidence explicit.Figure 1. The narrative’s three confirmed payouts total 3,500,000 BSC-USD. Its two partial calls correspond to a further 365,000 in CertiK’s reported USDT total; page 16 separately labels both as verified BSC-USD movements. These classifications remain unreconciled. Sources: PDF pp. 3, 14–16, 19.Address keyTreasury role, attributed to CertiK: 0x233c5370CCfb3cD7409d9A3fb98ab94dE94Cb4CdRecipient: 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37BSC-USD token contract in the report: 0x55d398326f99059ff775485246999027b3197955The treasury and recipient returned no attribution-database label in this investigation. Their incident roles derive from CertiK’s public account. BSC-USD quantities are preserved as recorded; public-source USDT and dollar figures are not silently substituted for them. [PDF pp. 3–4, 7]How the reported accounting failure workedThe PDF attributes the NEAR-side explanation to CertiK. A refund calculation was bounded by the receiver’s existing balance but not by the current deposit. An oversized burn event then exceeded the log limit, the resolver failed, HOT returned the deposited backing, and the earlier Intents credit survived. This describes the separation between returned backing and surviving internal credit that underlies the reported “ghost balance” mechanism.The report names intents.near and v2_1.omni.hot.tg, and attributes the first exploit transaction to 29 September 2026 at 16:14:19.280 UTC. Native NEAR tracing was unsupported and refused before querying that chain. These details remain public-source context, not native NEAR findings.One numerical conflict must stay visible: page 3 gives a 16,495-byte event and a 16,384-byte limit, a difference of 111 bytes. Page 11 instead describes an 11-byte overflow. This article does not select a corrected figure.Figure 2. Reported mechanism: resolver failure leaves Intents credit in place while HOT returns backing. This NEAR-side sequence is attributed to CertiK, not natively traced by SentinelTX. The report’s 111-versus-11-byte discrepancy remains unresolved. Sources: PDF pp. 3, 11, 22.On BNB Chain, the examined payout transaction objects show the recipient submitting calls to the treasury. That transaction-sender direction differs from the token-transfer direction: the calls travel toward the treasury, while the payouts travel toward the recipient. The report did not decode the withdrawal selector or establish the signer of the trailing authorization-like blob. [PDF pp. 3, 10]What the movement record showsAt 23:57:38 UTC on 30 September, a recorded swap sends 100,000 BSC-USD through the MetaMask Swap Router and returns 128.865999 BNB. Fourteen seconds later, the narrative records another 128.75691 BNB inflow. Although that narrative citation omits the input leg, page 16 supplies a further 100,000 BSC-USD input for the second transaction. This is additional appendix detail, not evidence that the narrative’s narrower citation was a complete flow account.At 01:25:39 UTC on 1 October, the report records 350 BNB entering CoW Protocol EthFlow. A subsequent WBNB-contract hop is described, but its own transaction hash is not cited. A token-contract destination does not identify a custodial exchange deposit; the eventual order settlement remains unresolved.The narrative also identifies direct relationships with three downstream wallets. Pages 17–18 add direction and amounts for selected movements beyond the narrative’s narrower citations. Those rows do not, by themselves, complete every route or establish a return.Similarly, the KuCoin-labelled leg is partial in the narrative. Page 18 identifies a depositor, 0xcd87c2e1f53b7df97f1db56aec6c63cbd60bb262, and a 99.999959 BNB recorded amount. Its relationship to exploit proceeds still lacks the complete amount-anchored path described as missing in the narrative. The earlier Binance-labelled treasury transfers occurred on 29 August and are excluded from incident attribution. No cross-chain route was established. [PDF pp. 7–11, 16–19]Why reported recovery remains a separate claimSeveral outlets cited by SentinelTX report a full return of approximately $3.8 million. The report does not identify a hash-anchored return from the recipient or downstream wallets to the treasury or a designated HOT/NEAR recovery address.An 18 October token-balance query returned no token holdings for the recipient. That cannot establish where the assets went or prove repayment. Nor should it be read as a comprehensive finding of zero assets across chains.Collection limits matter too. Two executed query windows span 29 August–18 October, but the 3,397 retained movements run only from 29 August to 2 October. The appendix records page caps, unwalked rows and a provider page that did not answer. It also states that enforcement of a requested historical window or block cutoff was not established. A query end date is not proof of complete coverage through that date, and this record cannot establish that no later return occurred. [PDF pp. 4, 20–22]Figure 3. Recovery is reported, with no return transfer hash-anchored in the report. The payout classifications, NEAR-side validation and complete downstream routes still require reconciliation. Sources: PDF pp. 13–16, 20–22.What would close the evidence gapsThe report’s priorities are concrete: obtain return hashes, receiving addresses and per-asset amounts; reconcile the two payout classifications; resolve the CoW order’s settlement; and complete the downstream paths with a NEAR-capable source where needed.The follow-up provides a useful accounting-failure explanation and a detailed BNB Chain record. A defensible conclusion preserves the boundary between reported recovery, transaction evidence and unresolved source differences. That boundary is essential to understanding what this postmortem actually establishes.Source note: SentinelTX, CASE-ASYNCE30, compiled 18 October 2026, 25 pages. Explorer links use exact BNB Chain transaction hashes printed in the PDF and are supplied for reference; they do not represent a separate verification pass. The PDF and detached verification manifest document the compiled artifact’s provenance. They do not resolve the substantive qualifications described above.

Cover: Gamdom wallet trace. Ethereum trace and unresolved endpoints. Published analysis date: 17 October 2026.A SentinelTX report on the reported Gamdom hot-wallet incident documents a clear Ethereum sequence: three source addresses funded one receiving account, which exchanged its recorded USDT, USDC and USD1 intake for DAI through seven CoW Protocol settlements on 13 October 2026. The report identifies no custodial-exchange deposit in those traced routes.The account's controller remains unknown. Its narrative ledger records 949,428.481298 DAI received and no DAI sent, but a separate current-balance query returned an empty token list. That makes the apparent DAI holding unverified. The trace also leaves a small bridge transfer unresolved, so it cannot establish where every asset ultimately ended up.This article summarizes the supplied SentinelTX report. It is an account of that source's findings and qualifications, rather than a new chain investigation.What the report coversThe investigation starts at Ethereum address 0x4b304741599c125a244e498d14562487d7109ab8, referred to here as the receiving account. Its attribution-database entry was unlabeled.The approved scope was Ethereum, 10 October 2026 at 00:00 UTC through 17 October at 11:20 UTC, with two inbound and five outbound hops. The executed query record is broader: 10 September 2026 at 11:23:39.121577 UTC through 17 October at 11:23:39.121577 UTC. The report explicitly warns that the executed records do not establish enforcement of the requested historical window or block cutoff.The retained evidence contains 84 movement rows across seven addresses, with timestamps from 13 October at 16:00:23 to 18:17:47 UTC. Movement rows are not a count of distinct transactions. The abstract's one-hop maximum describes its cited routing rows; it does not define the investigation's authorized tracing depth. Upstream reads were also skipped for high-volume wallets, leaving their own funding sources unestablished.The report gives $6,051,923.89 as the value of movements it could price. This is gross traced movement, with value counted along multiple legs, and cannot be presented as Gamdom's loss or the receiving account's balance.Three source addresses supplied the receiving accountThe narrative groups direct receipts as follows. Quantities retain the units and displayed precision of its sender summary.Source A, 0x0067cc2416f792cf0ec5629f5506324ac508f859: 74.266886 ETH in three transfers; 316,809.689210 USDT in six; 468,830.099059 USDC in seven; and 20,077.942699 USD1 in two. The address had no database label.Source B, 0x580450dff316ae00d0fbef9621a304020a046ce2: 10.994222 ETH in two transfers; 109,231.124988 USDT in three; and 34,171.291810 USDC in one. This address was also unlabeled.Source C, 0xd5fbda4c79f38920159fe5f22df9655fde292d47: 1.695248 ETH and 738.148859 DAI, one transfer each. A search-result snippet displayed the nametag “Gamdom: Hot Wallet,” but the attribution database did not supply that label.The narrative's first DAI receipt is at 16:00:23 UTC, in transaction 0xb2cca150592b3ba9344ff17a6f39888a40a855fc1619e8946b8b87e17217578f. Its first listed ETH receipt follows at 16:10:47 UTC, in transaction 0x178957dc5339430fef6c8e460f54722968b59d06dcc899d1ca1cfdf5bedd19ae. Both came from Source C. These timestamps distinguish the earlier token receipt from the ETH activity cited in the account profile.At 16:16:47, Source A sent 262,237.892832 USDT and Source B sent 92,182.438003 USDT. Source A subsequently supplied 62.204364 ETH at 16:18:35 and large USDC transfers, including 216,144.339953 at 16:22:59 and 175,442.114752 at 16:49:35.These source groups establish observed transfers. They do not establish that all three senders belonged to Gamdom or shared a controller.Seven settlements converted the recorded stablecoin intakeAll seven swaps used 0x9008d19f58aabd9ed0d60971565aa8510560ab41, labeled “CowProtocol, Exchange” in the report. Each transaction sent USDT, USDC or USD1 from the receiving account and returned DAI to that same account.The following entries reproduce the report's six-decimal swap summary. All times are UTC on 13 October 2026; the routing evidence retains greater precision for some token transfers.16:23:35 — Sold 354,420.330835 USDT; received 354,092.632978 DAI. Transaction: 0x00ce1e32059de820e307f65aaac3d790a95fcab2a48b82be768c9f5ab07b2441.16:26:23 — Sold 250,492.462571 USDC; received 250,484.456553 DAI. Transaction: 0x2b2a4ce1aa3f910d44b1425718429c8c7d1c5440729acf046fd26586b72356bb.16:38:59 — Sold 56,130.912559 USDT; received 56,078.550875 DAI. Transaction: 0xf00e7510ce52f85fbde1066922dc9f18fadb5710892d972bf62532c21792d52e.16:39:47 — Sold 20,077.942699 USD1; received 20,061.011520 DAI. Transaction: 0xf13d17c1b8a167aa087ed6402e1788de0244772dd39b78b9d377e38232bd7af9.17:17:11 — Sold 246,251.441288 USDC; received 246,243.742960 DAI. Transaction: 0x3ea5d430d9966ecc19a58ff3433129eaea619cd4f95038e9e34b6ad403bc8000.17:57:11 — Sold 15,489.570804 USDT; received 15,472.826473 DAI. Transaction: 0xc9a9ae19e7ec220ac5e310a986cd819542a5259406a2f307600e7b8ea4c4b842.18:00:11 — Sold 6,257.487010 USDC; received 6,257.111080 DAI. Transaction: 0xced9badc65a23f72a9462d427ae8350c87710bf3d4b32b8763738ba6375d1367.The report reconciles these sales to the narrative intake: 426,040.814198 USDT, 503,001.390869 USDC and 20,077.942699 USD1. It records 948,690.332439 DAI returned by the settlements. For the largest swap, the underlying transfer amount is 354,092.632977884068510689 DAI; the list above uses the rounded narrative figure.Seven swap transactions returned DAI to the receiving account. A protocol's “Exchange” label does not establish a deposit into a custodial trading account.The automated trace marked 15 “cash-out legs” complete. The narrative explains that these counted both sides of each of the seven swaps, plus one bridge leg. After deduplication, there are seven settlements and one bridge interaction, rather than 15 separate exits.Figure 1. Seven settlements returned 948,690.332439 DAI to the receiving account on 13 October 2026. Labels use the six-decimal summary in SentinelTX CASE-ASYNCE53, page 6; quantities are DAI, not dollar losses.ETH accounting and the DAI balance gapThe report's completed provider ETH list records six inbound transfers totaling 86.956356111770671236 ETH, two outbound transfers totaling 0.014 ETH, and gas fees of 0.000498820354746462 ETH. Subtracting the recorded outflows and fees gives 86.941857291415924774 ETH.The methodology calls this arithmetic over the provider's returned history, rather than a direct balance measurement. That distinction also matters for DAI. The narrative adds 948,690.332439 DAI from swaps to 738.148859 DAI from Source C, giving 949,428.481298 DAI received with no recorded DAI outflow. Its separate balance query returned no tokens, and the report explicitly says the holding needs a direct recheck.The broader generated movement summary also includes a 3,012.335110 DAI row in its traced-origin grouping. That section explicitly describes evidence-set activity without establishing incident connection, and the report does not reconcile the row with its receiving-account narrative. It is not added here to the seed ledger or to a loss total.Two small ETH transfers and an unresolved bridgeAt 17:42:23 UTC, the receiving account sent 0.01 ETH back to Source C in transaction 0x90d15c162609522d1229818adfe352d48270db57050e7179a0c0d779a6c1fc0e. This is the address carrying the snippet-only Gamdom nametag.At 18:16:11 UTC, it sent 0.004 ETH to 0x0439e60f02a8900a951603950d8d4527f400c3f1, labeled “Metamask Bridge, Exchange,” in transaction 0xc6365a438054089c9f796643f4ec99ee4bb3ef57a02a39728e511d7638cf8507, at block 26185303.The destination chain and destination address were not resolved. Eight protocol-explorer checks failed to respond. The report suggests the small amount could represent a gas top-up, but labels that interpretation as an assessment. The incomplete lookup cannot establish that all funds remained on Ethereum.The report also records a connection with Relay.link, 0xf70da97812cb96acdf810712aa562db8dfa3dbef. Its narrative describes a direct edge and a shared CoW counterparty, while saying no separate value transfer appears in the seed's transfer ledger. That interaction remains unresolved. The full retained dataset extends to 18:17:47 UTC, later than the narrative's final own-account action at 18:16:11.Figure 2. Three source addresses funded the receiving account. Seven CoW settlements returned DAI; 0.01 ETH went back to Source C and 0.004 ETH reached MetaMask Bridge. The destination chain and address remain unresolved. Source: report pages 5–8. Full addresses appear in the address key.What the evidence says about control and intentThe receiving address had contract code. The report describes a programmable smart account and raises possible EIP-7702 delegation, based on self-calls with selector 0xe9ae5c53. Its code prefix was not read, so delegation is unestablished. A successful call or verified transfer does not identify the signer, authorization or motive.The report's expert assessment considers a hot-wallet compromise followed by rapid conversion into DAI plausible. It also says an operator-initiated emergency sweep cannot be ruled out. The return of 0.01 ETH to the Gamdom-nametagged address and the unidentified receiving-account controller preserve that ambiguity. Shared counterparties among source wallets do not resolve it.Incident-wide loss claims in the report range from more than $2.3 million moving out of hot wallets to a founder statement of “just over $3m” and independent reporting near $4.2 million. Those claims came from search-result snippets, rather than full-page verification. The Gamdom and Romer X posts were not read. Claims that user funds were safe were also unverified.Reported activity on Solana, BNB Chain, Tron and the XRP Ledger falls outside this Ethereum review. Neither those loss claims nor the report's $6.05 million gross-movement figure can be substituted for a verified loss calculation.The defensible conclusionThe strongest finding is the seven-transaction conversion of the narrative's recorded USDT, USDC and USD1 receipts into DAI, with proceeds returned to one identified Ethereum account. The reviewed routes show no identified custodial-exchange deposit. Ownership, current DAI holdings and the bridge's destination remain open questions.The report's priorities follow directly from those limits: recheck the DAI holding, establish whether Gamdom controls the relevant addresses, inspect the account's delegation code, resolve the bridge destination and monitor any later custodial-exchange deposit. Further work on the other reported chains would require a separate scope. Until those questions are answered, the trace supports a documented conversion sequence, not a definitive attribution of theft, a final loss total or proof of recovery.Figure 3. The report documents the conversion sequence but leaves the controller, current DAI holding and bridge destination unresolved. The narrative ledger is not a verified current balance. Source: report pages 7–9; broader generated movement totals are discussed separately in the text.Address keyReceiving account: 0x4b304741599c125a244e498d14562487d7109ab8 Source A: 0x0067cc2416f792cf0ec5629f5506324ac508f859 Source B: 0x580450dff316ae00d0fbef9621a304020a046ce2 Source C, snippet-only Gamdom nametag: 0xd5fbda4c79f38920159fe5f22df9655fde292d47 CoW settlement: 0x9008d19f58aabd9ed0d60971565aa8510560ab41 MetaMask Bridge: 0x0439e60f02a8900a951603950d8d4527f400c3f1 Relay.link: 0xf70da97812cb96acdf810712aa562db8dfa3dbefSource notePrepared from SentinelTX case CASE-ASYNCE53, report generated 17 October 2026 at 11:27:49 UTC. The source narrative and sender/swap summaries are on pages 4–9; transaction-routing evidence on pages 10–16; generated movement totals on pages 17–19; and collection limits and executed query bounds on pages 20–21. Token symbols are as reported and do not independently verify token identities. No additional external verification was performed for this article.

A UNCX vesting-pool transaction on Ethereum moved five tokens into an execution route on 14 October 2026. Four were converted into ETH that afternoon. The fifth, ZC, remained in the executor until the following morning, when a withdrawal and a separate sale completed the selected route.Three roles make that sequence easier to follow. The shared vesting pool held tokens for scheduled releases. The initiating wallet submitted the transaction. The executor was a contract created during that execution, which received tokens and later forwarded them for conversion. These role names describe addresses in the records, not identified people.The confirmed path is shared vesting pool → executor contract → token conversions → the initiating wallet. The two conversion sessions paid that wallet 21.155286011908665958 ETH in total. A separate 0.29 ETH return from the executor was not another token sale. Understanding that distinction matters more here than attaching one large dollar estimate to every transfer.This is a bounded Ethereum investigation, not a reconstruction of every UNCX-related drain. The account below separates transaction records, arithmetic and external reporting, then follows the transitions in time order.ScopeBoundarySelected incidentEthereum seed transaction on 14 October; five subsequent token salesObservation cutoffBlock 26,210,180 · 17 October 2026, 05:27:59 UTCConfirmed sale receipts21.155286011908665958 ETH; before gas and execution costsCounting ruleCount each final ETH receipt once. Keep capital returns, token movements and balances separate.Follow-upInitiating wallet and funding address; bounded native-ETH tracing up to two outward hops, not continuous coverageBefore the numbers: who does what?Vesting is a schedule for releasing tokens over time. A shared vesting contract can hold tokens for many positions. Here, “pool” means the address whose token balances changed in the selected transaction; it does not mean that every position holder has been identified. A net outflow means recorded outgoing tokens minus incoming tokens within that transaction—not the sum of all transfers displayed by an explorer.The initiating wallet submitted the seed transaction. It called an entry contract, which created an executor: a contract that carried out further interactions and received tokens. The executor is a distinct address, not a second name for the wallet. A funding address supplied ETH beforehand. These are roles in the records, not names for people or proof that one operator controlled all of them.Role on EthereumFull addressInitiating wallet0x78c9b11853e4f183a34c63ffd1924d2319a2f5b3Entry contract0x6cebdf095172b355121b93962017975c4601f26cExecutor0xf6d072254eb8a9b06e0ba21221b498332c1bc35eShared vesting pool0xa98f06312b7614523d0f5e725e15fd20fb1b99f5Funding address0x6d2afff4fc6ff46564467762c4aa35812680d606Three findings guide the investigation. The pool’s five token net outflows reconcile to the executor and other net recipients. The fifth conversion happened on the following day, so stopping on 14 October misses a material receipt. Finally, the sale receipts, returned execution capital and later wallet balance answer different questions. The chronology below explains why.Start Figure 1 at the pool and follow the top arrow to the executor, then down to the initiating wallet receiving tokens for conversion. Read the lower boxes as the two conversion sessions: their arrows point back toward the wallet because it received the final ETH. They are not additional recipients to add to the wallet.Figure 1. Solid arrows indicate asset direction or grouped conversion paths, not transaction calls, ownership, quantity scale or elapsed time. All amounts shown are rounded to six decimals. The public receipts and exact tables govern the quantities.The overview shows a route with a pause, rather than a single immediate cash-out. It also stops at the receiving wallet: a sale on a decentralized route does not itself establish a deposit with an exchange. The first chronological question is how the initiating wallet was funded.14 October, 14:47–15:15 UTC: funding arrives before executionThe funding address sent 0.1, 0.9 and 2.5 ETH to the initiating wallet at 14:47:35, 14:56:59 and 15:15:35 UTC, respectively. Together these transfers supplied 3.5 ETH before the seed transaction. ETH is Ethereum’s native asset; it can pay transaction fees as well as contract payments. First funding; second funding; third funding.15:49:59 UTC: five token balances fall in one seed transactionThe successful seed transaction sits in block 26,191,745. Its receipt contains 136 logs, including 64 ERC-20 Transfer events. An ERC-20 token keeps its own ownership ledger; a Transfer event records a movement in that ledger. Several movements can occur inside one transaction, including borrowed tokens going in and back out. Seed transaction and receipt.To avoid counting borrowed principal twice, this review summed the raw integer amounts in the transfer events by token and address. Token decimals translate those integers into readable units: 18 decimal places for four tokens, and nine for PAAL. For every token, the pool’s net outflow equals the sum of the positive net receipts at the executor and the other recipients.TokenPool net outflow (rounded)Executor net receipt (rounded)EDGEN57,344,850.92155,601,598.708ZC9,131,678.0459,055,847.638pepeCoin42,200.53340,155.284LO0P65,826.00065,372.217PAAL115,945.630113,657.767The difference between the two columns is not an unexplained second theft. The receipt records net amounts at a fee recipient and, for three tokens, other counterparties in the execution. Those quantities are preserved separately in the appendix. Do not add the executor’s receipt to the pool’s outflow: they are two views of the same movement.This reconciliation establishes token movements. It does not reconstruct every vesting position or prove the vulnerability’s cause. The incident-time implementation and storage were not replayed here, so the exact accounting defect remains unconfirmed by this analysis. The evidence supports the selected outflow route more directly than it supports a complete root-cause claim.16:41–17:01 UTC: returned capital and four salesAt 16:41:11, the executor returned exactly 0.29 ETH to the initiating wallet. The seed had supplied 0.8 ETH; ten 0.05 ETH payments and one 0.01 ETH payment account for 0.51 ETH, leaving 0.29 ETH. The exact conservation and later return support reading it as unused execution capital. The complete executor history and code semantics were not independently replayed, so this interpretation remains narrower than a full contract audit. Capital return.Three minutes later, the first selected token sale paid ETH to the wallet. Four conversions followed in order: pepeCoin at 16:44:35, EDGEN at 16:56:47, LO0P at 16:58:59 and PAAL at 17:01:11. A swap route can wrap ETH into WETH and unwrap it again. WETH is a token representation of ETH; counting each internal hand-off would inflate the sale receipt. Here only the final ETH receipt at the initiating wallet is counted.14 October UTC / saleETH received16:44:35 · pepeCoin2.19369786395594791616:56:47 · EDGEN8.56791624420310002516:58:59 · LO0P3.46310648888943786317:01:11 · PAAL0.411886429218097850The four receipts sum to 14.636607026266583654 ETH, before costs. The LO0P sale was submitted by a different address, even though ETH reached the initiating wallet. A third-party transaction submitter can execute an order for a recipient. That fact does not identify a co-attacker, and the third party’s transaction fee must not be subtracted from the initiating wallet’s funds without checking who paid it. LO0P receipt.At 17:09:35, after these four sales, 3.5 ETH went back to the funding address. That return connects the two addresses financially, but does not establish a real-world identity, common control or an ultimate cash-out destination. It also does not mean that the sale receipts disappear from the ledger: it is a later movement of ETH, not a negative token sale. Return transaction.15 October, 07:28–07:35 UTC: ZC completes the selected conversion routeAt 07:28:35 the executor sent 9,055,847.637887682268154756 ZC to the initiating wallet. This was a token withdrawal, not yet a sale. At 07:35:11—six minutes and 36 seconds later—a separate successful transaction converted that amount and paid 6.518678985642082304 ETH to the same wallet. ZC withdrawal; ZC sale.The sale used LI.FI routing. A router is a contract that forwards a swap through trading venues and other contracts. It is an intermediary, not necessarily the buyer or the final recipient. The sale included a token fee of 4,527.923818943841134077 ZC. The remaining 9,051,319.714068738427020679 ZC moved onward to the router. The route ultimately unwrapped WETH and delivered ETH through routing contracts to the wallet. These intermediary transfers explain how the conversion completed; they are not extra sale proceeds.A call trace breaks one transaction into the contract calls made while it runs. Each call appears as a frame, so several frames can describe successive steps involving the same funds. The trace displayed 150 of 204 call frames. Original explorer transfer records therefore supplement the quantity check, but this is not a complete execution replay: the transaction was not independently rerun to verify every internal step.Stopping the account on 14 October would therefore omit more than 6.5 ETH of selected sale receipts. Conversely, adding the 0.29 ETH capital return would overstate those receipts. Figure 2 separates the two accounting categories before showing the later balance snapshot.Figure 2. Read the green sale box and amber capital box separately. The connecting arrows identify receipt categories reaching one wallet; they do not instruct the reader to add them as profit. The lower gray panel is a later balance observation. Amounts are rounded to six decimals.The five sale receipts total exactly 21.155286011908665958 ETH. This is a gross conversion receipt, not net profit, a dollar loss or the wallet’s entire balance. Gas, execution payments, starting funds and other transfers need their own accounting. One unsolicited incoming wei and a successful zero-EDGEN transfer are excluded from sale proceeds. The remaining question is where the observed ETH stood at a defined cutoff.17 October: a fixed-block snapshot, not a final destinationAt block 26,210,180, timestamped 05:27:59 UTC, the initiating wallet held 20.237222755363802454 ETH and the funding address held 7.459202396392388 ETH. These were read at the same historical block through Ethereum JSON-RPC, not inferred by subtracting a selection of transfers. The block hash is preserved in the appendix. Cutoff block; RPC endpoint documentation.A balance belongs to an address, not to one incident. The funding address’s balance in particular is not an additional UNCX loss. Within the bounded native-ETH follow-up, no custodial-exchange deposit, bridge exit or mixer deposit was identified from these two addresses. Provider coverage and labels are incomplete; this is not proof that no outside-scope movement exists or that the funds can be recovered.One account detail also deserves care. The initiating wallet’s code at the cutoff is an EIP-7702 delegation marker pointing to a separate implementation. EIP-7702 lets an account authorize delegated code execution. A nonce is an account’s sequential counter; it helps distinguish an authorization or transaction from an earlier one. The ZC sale’s authorization used nonce 25, while its outer transaction used nonce 24; an authorization can increment the authority’s nonce inside that transaction. It is not evidence of a separate later transaction, a compromised key or a specific operator. Sale authorization; EIP-7702 specification.What connects the route—and what remains openThe strongest connections are direct: the executor was created inside the seed execution, token events reconcile its receipts, the next-day ZC withdrawal names the same sender and recipient roles, and the five sale receipts pay the initiating wallet. These are transaction-level links. The funding relationship is a different level of evidence: it establishes value moving between two addresses, not common ownership. Similar patterns or shared service labels cannot fill that gap.Blockaid’s broader alert reported approximately $1.49 million across four chains and 11 drains including copycats and MEV activity—automated attempts to extract value from transaction execution or ordering. That is external incident context, not this report’s verified net loss. This review does not independently aggregate BNB Chain, Base or Robinhood activity, price every token at the incident time, or assign every affected vesting position to a victim. Blockaid update; published transaction list.The transfer-event arithmetic was independently reconstructed from Etherscan receipts. SentinelTX supplied call traces and bounded address follow-up; fixed-block balance and code reads were checked separately through Ethereum RPC. These are complementary evidence sources, not interchangeable confirmations. The selected record is reproducible, but neither the root cause nor a complete multichain victim ledger has been established by this analysis.Response points specific to this caseThe first response question is which vesting positions were affected. Investigators need the incident-time position state and decoded deposit/withdrawal events, not only the shared pool’s balance change. That would connect the reconciled token outflows to individual claims and avoid confusing fee or lending-counterparty receipts with executor gains.The second is why those movements were accepted. Investigators would need to rerun the seed using the contract code and stored state from block 26,191,745. This would test whether an accounting rule was violated. Such a rule is called an invariant: a condition that should remain true as the contract runs. This review has not identified and reproduced a specific invariant failure. A current implementation page or a matching exploit pattern is not an adequate substitute.The third is whether the receiving wallet later crosses into a service with a verifiable destination record. Any new exchange, bridge or mixer label needs the actual transaction, chain, asset and time attached. A historical funding source is not an onward route for proceeds created later. Until such a record is linked, the report should stop at the observed wallets rather than draw a speculative cash-out arrow.The defensible conclusion is therefore specific: five tokens left the shared pool in the selected Ethereum transaction, and five later conversions paid 21.155286011908665958 ETH to the initiating wallet across two days. The 0.29 ETH executor return is separate capital, and the 17 October balance is a snapshot. Those distinctions preserve what the evidence explains without turning unanswered questions into findings.Evidence appendix: exact quantities and identifiersAll addresses below are on Ethereum. Wallet and contract links open address-detail pages; transaction links open transaction-detail pages. Values are unrounded unless explicitly labeled otherwise. Raw token quantities were summed as integers, using each token’s recorded decimal precision.EDGEN: seed-receipt reconciliationRecordExact token amountPool incoming475444753.754326574116796226Pool outgoing532789604.674988572932369396Pool net outflow57344850.920661998815573170Executor net receipt55601598.708417972560603048Fee-recipient net receipt425556.138682232937672685Counterparty net receipt1317696.073561793317297437RoleEthereum addressToken contract0xaa9806c938836627ed1a41ae871c7e1889ae02caFee recipient0xd45dd91df475bfd944335160f538c1a14888dc1cCounterparty0x4b2c930f88a87d1bffac291b6a7e01c9f13dd03eZC: seed-receipt reconciliationRecordExact token amountPool incoming93872336.744096272206179873Pool outgoing103004014.788650621140667962Pool net outflow9131678.044554348934488089Executor net receipt9055847.637887682268154756Fee-recipient net receipt75830.406666666666333333RoleEthereum addressToken contract0x4e67db19044549ff420860834c91b45bad298722Fee recipient0xd45dd91df475bfd944335160f538c1a14888dc1cpepeCoin: seed-receipt reconciliationRecordExact token amountPool incoming658778.146282755355639233Pool outgoing700978.678959483212162252Pool net outflow42200.532676727856523019Executor net receipt40155.284285661160205717Fee-recipient net receipt446.139542453412314759Counterparty net receipt1599.108848613284002543RoleEthereum addressToken contract0xa9e8acf069c58aec8825542845fd754e41a9489aFee recipient0xd45dd91df475bfd944335160f538c1a14888dc1cCounterparty0xddd23787a6b80a794d952f5fb036d0b31a8e6affLO0P: seed-receipt reconciliationRecordExact token amountPool incoming560996.296306472266672982Pool outgoing626822.296306472260110494Pool net outflow65825.999999999993437512Executor net receipt65372.217059159993437512Fee-recipient net receipt453.782940840000000000RoleEthereum addressToken contract0x00000000000050806673b532d7486ac114c1de3fFee recipient0xd45dd91df475bfd944335160f538c1a14888dc1cPAAL: seed-receipt reconciliationRecordExact token amountPool incoming988136.434511398Pool outgoing1104082.064395937Pool net outflow115945.629884539Executor net receipt113657.766933968Fee-recipient net receipt799.291296850Counterparty net receipt1488.571653721RoleEthereum addressToken contract0x14fee680690900ba0cccfc76ad70fd1b95d10e16Fee recipient0xd45dd91df475bfd944335160f538c1a14888dc1cCounterparty0x2a6c340bcbb0a79d3deecd3bc5cbc2605ea9259fExecution and routing addressesRoleEthereum addressSeed fee recipient0xd45dd91df475bfd944335160f538c1a14888dc1cSeed builder-payment recipient0x396343362be2a4da1ce0c1c210945346fb82aa49LO0P transaction submitter0x8d10551fbb0da1eadf34b25210fe75f278fa9321LO0P relay0x52b335fd4d229c4b4ffa6190526e4b5fb8e3fb09UniswapX reactor0x00000011f84b9aa48e5f8aa8b9897600006289beLI.FI route0x1231deb6f5749ef6ce6943a275a1d3e7486f4eaeZC router0x22ec88b9ff78c6f2458ab1a7aa8bb99d84bd4b86ZC ETH routing intermediary0x28bf6006d87de7f44445905aa4f5cb8c0d8cba02Uniswap v4 Pool Manager0x000000000004444c5dc75cb358380d2e3de08a90EIP-7702 delegate0x63c0c19a282a1b52b07dd5a65b58948a07dae32bChronological transaction register (UTC, 2026)Time and evidence roleFull transaction hash14 Oct 14:47:35 · 0.1 ETH funding0x52fe1a5aa857a3e6f6f0c12f559019da382c294238601b967a74b03c01c5b93b14 Oct 14:56:59 · 0.9 ETH funding0x351b5d9728c51ffbefd951b3536ab9c61e6e0de9dfa738830d560eb82fb6992e14 Oct 15:15:35 · 2.5 ETH funding0x56db74daaa13475dbb3360c86bf150ad2430556500cd803e47590f3b32b75e8b14 Oct 15:49:59 · seed · block 261917450x352065378c4a41b77e5b6a1e5b5616cd2886c3e1a2c87ed3db8e5ddddc23823d14 Oct 16:41:11 · 0.29 ETH return0x1527757f77288fafc68ab8f2d20e7061ee9941fe8214e188d6810882661fbc3210-14 16:44:35 · pepeCoin sale · block 261920180xf758582096ed80fbd4b80bc3dbd44e3edabdfd116b15ad9d16af459e38b09be510-14 16:56:47 · EDGEN sale · block 261920790x60becfc7e652d79182402bc3a8ce43ad433b06b5c401d239a4b10b97bb4a722110-14 16:58:59 · LO0P sale · block 261920900x35672ee02483b580acc443657ec6f5326e0fcea35912d6042335ed8f70010d0410-14 17:01:11 · PAAL sale · block 261921010x4ac0a349988c0e87a7d4d8f5fe94ae4886b165b56e931b6f485c57e2db8bcb4c14 Oct 17:09:35 · 3.5 ETH to funder0xa32b5eefca3e3dc8891f9e07fcd585c5ce1762f5d67035fc3e61acaa818f92bd15 Oct 06:40:47 · unsolicited 1 wei0x3d08bda0a282249b2cd05685962c2d7bc21ec2a23a4da4d2191c7d48123b96ac15 Oct 07:27:11 · zero EDGEN · block 261964140xe806726d883cef3dac91fe782ea1bfe8f451f08c40d3990fee8b4a42443c371115 Oct 07:28:35 · ZC withdrawal · block 261964210x8eab147f6e0f34e807c584d69873b2a2f7b4791b691f9a60c9d1ffd347eafcb015 Oct 07:35:11 · ZC sale · block 261964540x13a26824dd3f1135b35852333922f4573e0a8c2542a3d6884655471283a490fcCutoff and counting notesObservationExact valueFive sale receipts21.155286011908665958 ETHZC sale receipt6.518678985642082304 ETHReturned executor capital; excluded from sales0.290000000000000000 ETHInitiating-wallet native balance20.237222755363802454 ETHFunding-address native balance7.459202396392388 ETHBlock / UTC26210180 / 2026-10-17 05:27:59Block hash0x98c78f93c1b3d7de09694f161d922b2c219b68205f87626f224d70301fa672deThe five-sale total excludes the 0.29 ETH capital return, the unsolicited wei, repeated internal route legs and gas. No net-profit or dollar-loss total is asserted. The selected pool-net figures do not establish per-position losses. Findings reflect the stated cutoff and scope, not a live assurance about later funds.

On 15 October 2026, a single Ethereum transaction moved 2.309861111111111114 ETH out of KolanHook and ultimately paid 1.279914429958618589 ETH to its initiating address, according to the body of SentinelTX report CASE-ASYNC95E. Those figures describe different things. The first is the hook's gross native-ETH outflow; the second is the surplus paid after borrowed principal was returned.That distinction is the starting point for understanding this case. The transaction also involved a 6.7 WETH flash loan and a larger Pool Manager payout. Treating every transfer as a separate loss, or calling the entire payout profit, would misrepresent the reported flows.This article adapts the report's findings for the ChainBounty community. It preserves the distinction between recorded movements and the report's interpretation of the mechanism. It also explains the source's scope and evidentiary limits.The incident ledger: follow the amounts separatelyThe report's body places the successful transaction at 11:06:11 UTC on 15 October 2026, in Ethereum block 26197504. It reports 78 call frames and a maximum call depth of eight. The seed transaction and relevant full addresses appear in the reference key below. [1]The seed-transaction ledger is:Borrowed principal: 6.7 WETH, unwrapped into 6.7 ETH.Principal returned: 6.7 ETH re-wrapped into WETH and repaid within the same transaction.First hook payment to the Pool Manager: 2.050000000000000001 ETH.Second hook payment to the Pool Manager: 0.259861111111111113 ETH.Combined hook native outflow: 2.309861111111111114 ETH.Pool Manager payout to the helper: 7.979914429958618589 ETH.Gross surplus paid by the helper to the initiator: 1.279914429958618589 ETH.Maximum transaction-fee estimate: 0.000487737331891920 ETH.Gas-adjusted proceeds: at least 1.279426692626726669 ETH.The payout reconciles exactly as reported: 7.979914429958618589 ETH minus 6.7 ETH equals 1.279914429958618589 ETH. The hook outflow is larger than that surplus. The report attributes the difference to netting against swap legs inside the Pool Manager; these categories should remain separate.The gas-adjusted amount is a lower bound, not an exact net-profit figure. The report multiplies the gas limit of 3,105,267 by the gas price of 157,067,760 wei to obtain a fee ceiling. It does not provide the seed transaction's gasUsed in the cited evidence. [2]Figure 1. Zero-baseline comparison of hook native outflow and initiator gross surplus. The repaid 6.7 WETH principal is a separate annotation. The two bars measure different things and are not additive; the exact ledger above governs any shortened chart labels.How the transaction unfoldedThe report describes Kolan as a fixed-supply KLN token whose supply sits in a native-ETH/KLN Uniswap v4 pool. In the published design summarized by SentinelTX, the hook is the sole liquidity provider. Buyers pay a premium for a cancellation “window,” during which a purchase can be cancelled and ETH refunded. This design context comes from the report, rather than a separate review of the protocol's code. [3]The reported execution sequence has five useful stages:Deployment. The initiating address created an operation contract, which created a helper contract. The helper carried out the interactions.Funding. The helper borrowed 6.7 WETH from the address labelled Balancer, then unwrapped it into ETH.Initial pool interaction. The helper entered the Uniswap v4 Pool Manager and paid it 6.7 ETH. The Pool Manager invoked KolanHook callbacks.Repeated hook calls. The helper called the hook twice using selector 0x19b05f49. The first call triggered four Pool Manager calls with selector 0x5a6bcfda; the second triggered seven. The hook made the two ETH payments listed above during these hook-driven frames.Exit and repayment. The helper interacted with the Pool Manager again, received 7.979914429958618589 ETH, re-wrapped and returned the 6.7 ETH principal, then paid the remaining 1.279914429958618589 ETH to the initiator. [2]SentinelTX assesses this pattern as consistent with flash-loan-funded price-and-liquidity manipulation of the hook's internal accounting. Its interpretation is that the initial swap displaced the pool price, the hook interactions changed liquidity placement or withdrawal around that price, and the reverse swap captured a difference.That is an assessment, not a fully decoded root-cause demonstration. The report says selectors were not ABI-decoded. It cannot establish whether 0x19b05f49 represents buy, cancel or accept, or whether 0x42966c68 is a burn. The broader classification as a logic/accounting exploit rather than a key compromise is also the report's assessment. A decoded trace and relevant hook events remain important missing evidence. [3]Figure 2. Five-stage incident sequence, from deployment and funding through pool and hook interactions to repayment and surplus. The sequence is reported evidence; the proposed accounting mechanism remains an assessment. Pre-incident transfers do not belong in this flow.Where the traced value stoppedSection 7 names the initiating address as the endpoint in the traced set: one inbound movement and no outbound movement in that set. The body also says the initiator's transaction list was read to its end and no later outbound value transfer was identified as of the analysis. No exchange-deposit leg was identified. These are bounded findings, not a guarantee about future activity. [4]A later contract-creation transaction at 16:48:59 UTC on 15 October is described separately. It involved other contracts and no KolanHook value-bearing frame. Its proceeds are excluded from this incident ledger.The initiator's displayed native balance was 1.539598 ETH at analysis time. Appendix A gives the full address-level reconciliation as 1.539598271282627379 ETH. That balance combines unrelated activity; it is not an isolated balance of Kolan proceeds. Similarly, the report's 0.0 ETH native-balance reading for the hook does not establish its total assets or liabilities, because KLN and Pool Manager claim balances were not read. [4]Earlier transfers are context, not the exit routeThe report records three 1 ETH transfers to an address labelled Tornado.Cash Router and DAI/PAXG transfers to an address labelled Relay.link on 12 October. They happened three days before the seed transaction. They cannot be an onward route for proceeds generated on 15 October.Some source figures combine incident flows with earlier or unrelated activity. Visual proximity and connecting arrows should not override chronology. This article does not adopt the report's sanctions tag as a statement of current legal status, and does not infer a real-world identity or insider involvement from the address history. [5]Important limits inside the sourceThe abstract limits its statements to the evidence available to that summary: it does not supply a transaction date or record terminal endpoints, and its definition of “verified” does not establish the signer. The body separately gives the incident date, block and reported tx.from address (§§1 and 3), and lists the initiator as an endpoint within the traced set (§7). These are different levels of scope and detail, not competing dates or proof of a final cash-out destination. This article attributes the specific transaction details to the body and preserves the source's limits on identity, ownership and onward tracing.The abstract also defines “verified” narrowly: the transaction was retrieved and names the addresses. It explicitly says that this does not establish authorization, ownership or even that a reported asset symbol identifies the intended asset. That label should not be read as independent confirmation of every narrative claim.Appendix A records an executed query from 15 September 2026 at 11:43:17.968656 UTC to 16 October 2026 at 11:43:17.968656 UTC. Of 51 retained movement rows, 44 lack readable timestamps. The seven timestamped rows span 22 September to 12 October; separately, the body supplies the incident timestamp. Query bounds are not proof of continuous transaction coverage or enforcement of a requested historical cutoff. The report also leaves KLN quantities and the impact on individual window holders unquantified. [6]The community takeawayThe useful conclusion is specific: SentinelTX reports a repaid 6.7 WETH loan, two hook payments totaling 2.309861111111111114 ETH, and a 1.279914429958618589 ETH surplus payment to the initiator in one transaction. The proposed manipulation mechanism needs decoding; the traced endpoint does not establish a later cash-out route.For community reporting, retain those boundaries. A stronger explanation would require the decoded hook calls and WindowOpened, WindowClosed and Taxed events identified by the report. Until then, the exact ETH ledger is more informative than a single dramatic “loss” number, and the unanswered questions belong alongside the findings.Figure 3. Reported movements, assessed mechanism, unresolved impact. No later cash-out route or real-world identity is established by this adaptation.Reference key and source notesSeed transaction: 0x7b131926e6f06491ae1aead3e419b208c8aa70ed7898e8c5a33d9f52e40915a9Initiator / reported tx.from: 0x8df735014eab81905e76b87ef0c069bd8e0ae382KolanHook: 0x0136fecf49e0217bfd2d9551e8e7b05f174ba8ecHelper: 0x4d6a41f2b80fe75facf27f9d0b3dc8bd0ebc835fOperation contract: 0xebea460c6496e1a2565aab488eb005473bde5f79Uniswap v4 Pool Manager: 0x000000000004444c5dc75cb358380d2e3de08a90Balancer-labelled lender: 0xba12222222228d8ba445958a75a0704d566bf2c8WETH: 0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2Adapted from SentinelTX report CASE-ASYNC95E, generated 16 Oct 2026; findings and limitations as of that report.Source sections: [1] §1 and §3B; [2] §3B and §3D; [3] §1 and §5; [4] §1, §3C, §7 and Appendix A; [5] §3A and source-figure captions; [6] Abstract, §3D and Appendix A.Explorer links are reader-navigation links constructed from the report's exact identifiers. Explorer content was not used as an additional factual source. This adaptation does not claim independent verification of the report's evidence signature.