Gamdom Ethereum fund trace shows seven DAI swaps and unresolved ownership

Cover: Gamdom wallet trace. Ethereum trace and unresolved endpoints. Published analysis date: 17 October 2026.

A SentinelTX report on the reported Gamdom hot-wallet incident documents a clear Ethereum sequence: three source addresses funded one receiving account, which exchanged its recorded USDT, USDC and USD1 intake for DAI through seven CoW Protocol settlements on 13 October 2026. The report identifies no custodial-exchange deposit in those traced routes.

The account's controller remains unknown. Its narrative ledger records 949,428.481298 DAI received and no DAI sent, but a separate current-balance query returned an empty token list. That makes the apparent DAI holding unverified. The trace also leaves a small bridge transfer unresolved, so it cannot establish where every asset ultimately ended up.

This article summarizes the supplied SentinelTX report. It is an account of that source's findings and qualifications, rather than a new chain investigation.

What the report covers

The investigation starts at Ethereum address 0x4b304741599c125a244e498d14562487d7109ab8, referred to here as the receiving account. Its attribution-database entry was unlabeled.

The approved scope was Ethereum, 10 October 2026 at 00:00 UTC through 17 October at 11:20 UTC, with two inbound and five outbound hops. The executed query record is broader: 10 September 2026 at 11:23:39.121577 UTC through 17 October at 11:23:39.121577 UTC. The report explicitly warns that the executed records do not establish enforcement of the requested historical window or block cutoff.

The retained evidence contains 84 movement rows across seven addresses, with timestamps from 13 October at 16:00:23 to 18:17:47 UTC. Movement rows are not a count of distinct transactions. The abstract's one-hop maximum describes its cited routing rows; it does not define the investigation's authorized tracing depth. Upstream reads were also skipped for high-volume wallets, leaving their own funding sources unestablished.

The report gives $6,051,923.89 as the value of movements it could price. This is gross traced movement, with value counted along multiple legs, and cannot be presented as Gamdom's loss or the receiving account's balance.

Three source addresses supplied the receiving account

The narrative groups direct receipts as follows. Quantities retain the units and displayed precision of its sender summary.

• Source A, 0x0067cc2416f792cf0ec5629f5506324ac508f859: 74.266886 ETH in three transfers; 316,809.689210 USDT in six; 468,830.099059 USDC in seven; and 20,077.942699 USD1 in two. The address had no database label.
• Source B, 0x580450dff316ae00d0fbef9621a304020a046ce2: 10.994222 ETH in two transfers; 109,231.124988 USDT in three; and 34,171.291810 USDC in one. This address was also unlabeled.
• Source C, 0xd5fbda4c79f38920159fe5f22df9655fde292d47: 1.695248 ETH and 738.148859 DAI, one transfer each. A search-result snippet displayed the nametag “Gamdom: Hot Wallet,” but the attribution database did not supply that label.

The narrative's first DAI receipt is at 16:00:23 UTC, in transaction 0xb2cca150592b3ba9344ff17a6f39888a40a855fc1619e8946b8b87e17217578f. Its first listed ETH receipt follows at 16:10:47 UTC, in transaction 0x178957dc5339430fef6c8e460f54722968b59d06dcc899d1ca1cfdf5bedd19ae. Both came from Source C. These timestamps distinguish the earlier token receipt from the ETH activity cited in the account profile.

At 16:16:47, Source A sent 262,237.892832 USDT and Source B sent 92,182.438003 USDT. Source A subsequently supplied 62.204364 ETH at 16:18:35 and large USDC transfers, including 216,144.339953 at 16:22:59 and 175,442.114752 at 16:49:35.

These source groups establish observed transfers. They do not establish that all three senders belonged to Gamdom or shared a controller.

Seven settlements converted the recorded stablecoin intake

All seven swaps used 0x9008d19f58aabd9ed0d60971565aa8510560ab41, labeled “CowProtocol, Exchange” in the report. Each transaction sent USDT, USDC or USD1 from the receiving account and returned DAI to that same account.

The following entries reproduce the report's six-decimal swap summary. All times are UTC on 13 October 2026; the routing evidence retains greater precision for some token transfers.

1. 16:23:35 — Sold 354,420.330835 USDT; received 354,092.632978 DAI. Transaction: 0x00ce1e32059de820e307f65aaac3d790a95fcab2a48b82be768c9f5ab07b2441.
2. 16:26:23 — Sold 250,492.462571 USDC; received 250,484.456553 DAI. Transaction: 0x2b2a4ce1aa3f910d44b1425718429c8c7d1c5440729acf046fd26586b72356bb.
3. 16:38:59 — Sold 56,130.912559 USDT; received 56,078.550875 DAI. Transaction: 0xf00e7510ce52f85fbde1066922dc9f18fadb5710892d972bf62532c21792d52e.
4. 16:39:47 — Sold 20,077.942699 USD1; received 20,061.011520 DAI. Transaction: 0xf13d17c1b8a167aa087ed6402e1788de0244772dd39b78b9d377e38232bd7af9.
5. 17:17:11 — Sold 246,251.441288 USDC; received 246,243.742960 DAI. Transaction: 0x3ea5d430d9966ecc19a58ff3433129eaea619cd4f95038e9e34b6ad403bc8000.
6. 17:57:11 — Sold 15,489.570804 USDT; received 15,472.826473 DAI. Transaction: 0xc9a9ae19e7ec220ac5e310a986cd819542a5259406a2f307600e7b8ea4c4b842.
7. 18:00:11 — Sold 6,257.487010 USDC; received 6,257.111080 DAI. Transaction: 0xced9badc65a23f72a9462d427ae8350c87710bf3d4b32b8763738ba6375d1367.

The report reconciles these sales to the narrative intake: 426,040.814198 USDT, 503,001.390869 USDC and 20,077.942699 USD1. It records 948,690.332439 DAI returned by the settlements. For the largest swap, the underlying transfer amount is 354,092.632977884068510689 DAI; the list above uses the rounded narrative figure.

Seven swap transactions returned DAI to the receiving account. A protocol's “Exchange” label does not establish a deposit into a custodial trading account.

The automated trace marked 15 “cash-out legs” complete. The narrative explains that these counted both sides of each of the seven swaps, plus one bridge leg. After deduplication, there are seven settlements and one bridge interaction, rather than 15 separate exits.

Figure 1. Seven settlements returned 948,690.332439 DAI to the receiving account on 13 October 2026. Labels use the six-decimal summary in SentinelTX CASE-ASYNCE53, page 6; quantities are DAI, not dollar losses.

ETH accounting and the DAI balance gap

The report's completed provider ETH list records six inbound transfers totaling 86.956356111770671236 ETH, two outbound transfers totaling 0.014 ETH, and gas fees of 0.000498820354746462 ETH. Subtracting the recorded outflows and fees gives 86.941857291415924774 ETH.

The methodology calls this arithmetic over the provider's returned history, rather than a direct balance measurement. That distinction also matters for DAI. The narrative adds 948,690.332439 DAI from swaps to 738.148859 DAI from Source C, giving 949,428.481298 DAI received with no recorded DAI outflow. Its separate balance query returned no tokens, and the report explicitly says the holding needs a direct recheck.

The broader generated movement summary also includes a 3,012.335110 DAI row in its traced-origin grouping. That section explicitly describes evidence-set activity without establishing incident connection, and the report does not reconcile the row with its receiving-account narrative. It is not added here to the seed ledger or to a loss total.

Two small ETH transfers and an unresolved bridge

At 17:42:23 UTC, the receiving account sent 0.01 ETH back to Source C in transaction 0x90d15c162609522d1229818adfe352d48270db57050e7179a0c0d779a6c1fc0e. This is the address carrying the snippet-only Gamdom nametag.

At 18:16:11 UTC, it sent 0.004 ETH to 0x0439e60f02a8900a951603950d8d4527f400c3f1, labeled “Metamask Bridge, Exchange,” in transaction 0xc6365a438054089c9f796643f4ec99ee4bb3ef57a02a39728e511d7638cf8507, at block 26185303.

The destination chain and destination address were not resolved. Eight protocol-explorer checks failed to respond. The report suggests the small amount could represent a gas top-up, but labels that interpretation as an assessment. The incomplete lookup cannot establish that all funds remained on Ethereum.

The report also records a connection with Relay.link, 0xf70da97812cb96acdf810712aa562db8dfa3dbef. Its narrative describes a direct edge and a shared CoW counterparty, while saying no separate value transfer appears in the seed's transfer ledger. That interaction remains unresolved. The full retained dataset extends to 18:17:47 UTC, later than the narrative's final own-account action at 18:16:11.

Figure 2. Three source addresses funded the receiving account. Seven CoW settlements returned DAI; 0.01 ETH went back to Source C and 0.004 ETH reached MetaMask Bridge. The destination chain and address remain unresolved. Source: report pages 5–8. Full addresses appear in the address key.

What the evidence says about control and intent

The receiving address had contract code. The report describes a programmable smart account and raises possible EIP-7702 delegation, based on self-calls with selector 0xe9ae5c53. Its code prefix was not read, so delegation is unestablished. A successful call or verified transfer does not identify the signer, authorization or motive.

The report's expert assessment considers a hot-wallet compromise followed by rapid conversion into DAI plausible. It also says an operator-initiated emergency sweep cannot be ruled out. The return of 0.01 ETH to the Gamdom-nametagged address and the unidentified receiving-account controller preserve that ambiguity. Shared counterparties among source wallets do not resolve it.

Incident-wide loss claims in the report range from more than $2.3 million moving out of hot wallets to a founder statement of “just over $3m” and independent reporting near $4.2 million. Those claims came from search-result snippets, rather than full-page verification. The Gamdom and Romer X posts were not read. Claims that user funds were safe were also unverified.

Reported activity on Solana, BNB Chain, Tron and the XRP Ledger falls outside this Ethereum review. Neither those loss claims nor the report's $6.05 million gross-movement figure can be substituted for a verified loss calculation.

The defensible conclusion

The strongest finding is the seven-transaction conversion of the narrative's recorded USDT, USDC and USD1 receipts into DAI, with proceeds returned to one identified Ethereum account. The reviewed routes show no identified custodial-exchange deposit. Ownership, current DAI holdings and the bridge's destination remain open questions.

The report's priorities follow directly from those limits: recheck the DAI holding, establish whether Gamdom controls the relevant addresses, inspect the account's delegation code, resolve the bridge destination and monitor any later custodial-exchange deposit. Further work on the other reported chains would require a separate scope. Until those questions are answered, the trace supports a documented conversion sequence, not a definitive attribution of theft, a final loss total or proof of recovery.

Figure 3. The report documents the conversion sequence but leaves the controller, current DAI holding and bridge destination unresolved. The narrative ledger is not a verified current balance. Source: report pages 7–9; broader generated movement totals are discussed separately in the text.

Address key

Receiving account: 0x4b304741599c125a244e498d14562487d7109ab8

Source A: 0x0067cc2416f792cf0ec5629f5506324ac508f859

Source B: 0x580450dff316ae00d0fbef9621a304020a046ce2

Source C, snippet-only Gamdom nametag: 0xd5fbda4c79f38920159fe5f22df9655fde292d47

CoW settlement: 0x9008d19f58aabd9ed0d60971565aa8510560ab41

MetaMask Bridge: 0x0439e60f02a8900a951603950d8d4527f400c3f1

Relay.link: 0xf70da97812cb96acdf810712aa562db8dfa3dbef

Source note

Prepared from SentinelTX case CASE-ASYNCE53, report generated 17 October 2026 at 11:27:49 UTC. The source narrative and sender/swap summaries are on pages 4–9; transaction-routing evidence on pages 10–16; generated movement totals on pages 17–19; and collection limits and executed query bounds on pages 20–21. Token symbols are as reported and do not independently verify token identities. No additional external verification was performed for this article.