X7Pioneer fund flows and the limits of the evidence

SentinelTX’s report on the October 8, 2026 X7 Finance / X7Pioneer incident describes a transaction-scoped net outflow of 6.793749214542107991 ETH from the contract publicly attributed to X7Pioneer. Of that amount, the report records 6.780267629238261652 ETH reaching its starting address. The subsequent Ethereum transfers divide into three paths: 3.3 ETH to a Tornado.Cash-labeled address, 1.723 ETH to an unlabeled wallet, and 1.75 ETH to an intermediary used in a reported bridge route.

Those quantities answer different questions. The contract’s net outflow, the recipient’s receipt, a repaid principal amount and transfers repeated across multiple hops should remain separate. The report also distinguishes retrieved transfers from the attribution of a mechanism, an operator or a service account.

This article follows SentinelTX case CASE-ASYNC643, dated October 19, 2026. The report retrieves individual transfers but leaves several wider conclusions unverified. A retrieved transfer does not, by itself, establish who signed it, whether it was authorised or the nature of a token. One proposed connection cannot represent incident proceeds: the 0.15 ETH payment occurred before the transaction said to fund it. It is therefore excluded from the proceeds trail. The bridge settlement also remains unverified. The source notes below retain the report’s exact warnings and other material discrepancies.

The transaction at the center of the report

The seed transaction is 0xc98056d6ab55ef898189da5fa1fb08b968cb84ca99528d171f8240836b21766d. SentinelTX places it on Ethereum mainnet, chain ID 1, at block 26146922, transaction index 45, on October 8, 2026 at 09:55:59 UTC. The reported status is success, with no revert in the trace.

The narrative identifies 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2 as the signing externally owned account, or EOA. It describes a nonce-2 contract-creation transaction that deployed 0x021f832b9ce6685b1135f4a3b55f2b317f95f55c, which in turn deployed the helper contract 0xaa0cad88ac3f76beb9a0f1ba661916d7716d5f4a in the same transaction. The report presents these signer and deployment statements as unverified conclusions.

The reported native-ETH value frames show the following sequence:

• The WETH contract, 0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2, sent 26.963170607692677032 ETH to the helper.
• The helper sent 26.963170607692677032 ETH to 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7, the contract attributed to X7Pioneer in the report’s public sources.
• That contract returned 33.756919822234785023 ETH to the helper.
• The helper sent 26.976652192996523371 ETH back to WETH.
• The helper sent 6.780267629238261652 ETH to the EOA.

SentinelTX calculates the contract’s transaction-scoped net outflow as 6.793749214542107991 ETH. The difference between this figure and the EOA’s receipt is 0.013481585303846339 ETH, which the report identifies as excess ETH re-wrapped into WETH. The helper’s gross inflow and gross outflow are each 60.720090429927462055 ETH; its net native-ETH change in the transaction is zero.

The call tree contains 830 frames and reaches depth 8. Its summed frame value, 121.44018085985492411 ETH, counts forwarding hops repeatedly. It is therefore unsuitable as a loss figure. The separate gross-movement total of 130.274148 ETH across 20 transactions also recounts value across hops and is not an incident-loss estimate.

What the report says about the mechanism

The reward-accounting explanation comes from third-party search snippets cited by SentinelTX: a SlowMist TI Alert result carried by KuCoin and DeFiHackLabs pull request #1299. The report says these pages were not read. Their snippets attribute an approximately 6.78 ETH loss to a flaw in X7Pioneer’s claimRewards() path; the SlowMist snippet also describes an ETH donation that amplified the accounting delta.

SentinelTX describes value movements consistent with that account: the helper’s incoming payment to the attributed X7Pioneer contract, a long sequence of repeated calls, and a larger payment back to the helper. It notes 148 consecutive calls with selector 0x5eac6239 among the 169 displayed frames of the 830-frame trace. The selectors were not ABI-decoded in the evidence, so the report does not establish their function names or the exact accounting formula.

The financing explanation is also an assessment. SentinelTX describes a call sequence through 0x87870bca3f3fd6335c3f4ce8392d69350b4fa4e2 and 0x4d5f47fa6a74757f35c14fd3a6ef8e3c9bc514e8, a callback into the helper, WETH unwrapping and subsequent re-wrapping. It interprets that shape as a flash loan with principal of approximately 26.963170607692677032 ETH and an excess repayment of 0.013481585303846339 ETH, roughly 0.05% of principal. The lender was not identified and the selectors were not decoded. The report keeps the flash-loan reading as an inference and excludes the repaid principal from retained proceeds.

Three downstream Ethereum paths

The report records 6.773 ETH in post-incident outflow from the EOA. The earliest listed transfers went to an unlabeled wallet; mixer-labeled transfers followed, then the intermediary associated with the bridge route. All times below are UTC on October 8, 2026.

• Unlabeled wallet: 0.001 ETH at 10:04:23 and 1.722 ETH at 10:05:23 went to 0x1572cc5a965e6c2f980eca7f6cc63971a9b80eb3, totaling 1.723 ETH. SentinelTX describes the first payment as a test transfer. Its October 19 provider record lists two inflows and no outflows, with in minus out minus gas of 1.723 ETH.
• Tornado.Cash-labeled recipient: six transfers to 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b totaled 3.3 ETH. Three 0.1 ETH transfers occurred at 10:11:23, 10:12:23 and 10:12:59; three 1.0 ETH transfers followed at 10:13:35, 10:14:11 and 10:15:59.
• Bridge intermediary: 1.75 ETH went to 0x314b7e4e69fc3ed0b519b5fd835a4adc9abbf335 at 10:23:59. The report assigns no entity label to that address.

Figure 1. The report groups nine post-incident transfers from the starting address into three Ethereum branches: 3.3 ETH, 1.723 ETH and 1.75 ETH, totaling 6.773 ETH. The 0.15 ETH sent at 09:11:59 UTC preceded the seed transaction and is excluded. These bars compare transfers; they do not establish a loss or a current balance.

Color key: Slate bars show ETH sent by the starting address. A, B and C directly identify recipients; the amounts share a zero baseline.

Address/role key: Starting address = 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2. A = 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b, with Tornado.Cash labels recorded in the report; B = 0x1572cc5a965e6c2f980eca7f6cc63971a9b80eb3, unlabeled wallet; C = 0x314b7e4e69fc3ed0b519b5fd835a4adc9abbf335, bridge intermediary.

Source: SentinelTX PDF, CASE-ASYNC643, pp. 6–8, Transaction Chronology. Report-level confidence qualifications: pp. 4 and 19.

Two different label records appear for the mixer recipient: “Tornado Cash: 10 ETH (Sanctioned)” and “Tornado.Cash, Mixer, Tornado.Cash: Router, Sanctioned.” SentinelTX reproduces both and says the observed deposit sizes are consistent with the Router role. It treats this leg as a privacy boundary and does not trace it further. The methodology says the recipient’s outbound list was not read because it was a high-volume wallet; an absence of outbound edges in the traced set should be read within that collection boundary.

The reported bridge route and its receipt qualification

At 10:24:47 UTC, the intermediary sent 1.75 ETH to 0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae, labeled “LifiDiamond,” in transaction 0xa892aab832796dddd384289179364eaa40f5674a47e77eb9f0347ee0c127f810.

The bridge lookup describes a LiFi route using Mayan, also indexed as Socket (Mayan), with the same intermediary address as destination on Arbitrum, chain ID 42161. It reports delivery of 4,475.922884 USDC, with token contract 0xaf88d065e77c8cC2239327C5EDb3A432268e5831. The lookup’s basis is the transaction hash, but the destination-side receipt remains unverified, and the report does not cite the settlement transaction hash.

The next reported movement is a transfer of 4,475.922884 USDC at 10:25:31 UTC from the intermediary to 0x2df1c51e09aecf9cacb7bc98cb1742757f163df7, labeled “HyperLiquid, Dex.” Its transaction hash is 0x3d0d18b844f5ebfad3d157702713d48f6233094640b9bf21460d0b89f82e1d6d, at block 512852763. The routing table marks that transfer verified. This separate row does not remove the bridge receipt qualification.

Diagram 2. The report describes 1.75 ETH routed via LiFi/Mayan to the same intermediary address on Arbitrum as 4,475.922884 USDC, followed by a transfer to an address labeled “HyperLiquid, Dex”. The bridge settlement remains unverified, and the destination settlement hash is not cited. The onward transfer hash is cited. No custodial cash-out or account ownership is established.

Color key: Slate nodes are the intermediary on Ethereum and Arbitrum; the sage node is the HyperLiquid-labeled destination. The dashed arrow denotes the reported, receipt-unverified settlement; the solid arrow denotes the reported onward USDC transfer. Equal-width arrows do not encode amounts.

Address/role key: Intermediary on both chains = 0x314b7e4e69fc3ed0b519b5fd835a4adc9abbf335; LiFi router on Ethereum = 0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae; HyperLiquid-labeled destination = 0x2df1c51e09aecf9cacb7bc98cb1742757f163df7. The diagram condenses the bridge service into the first connection.

Source: SentinelTX PDF, CASE-ASYNC643, p. 7, Transaction Chronology; pp. 10–11, Transaction Typology; p. 13, Conclusion.

SentinelTX identifies the HyperLiquid-labeled address as a DEX endpoint rather than a custodial exchange deposit. Whether the value can be attributed to a particular account at the venue remains an unverified lead. The narrative calls this transfer the third-hop scope boundary; the routing table labels the USDC row hop 1, while the abstract says the cited routing rows reach at most two hops. These are different source presentations, not interchangeable measures of coverage.

Funding before the seed transaction

The report places the EOA’s earliest observed value receipt at 09:11:23 UTC, from 0xe7351fd770a37282b91d153ee690b63579d6dd7f, labeled “deBridge Finance, DinDestination, Bridge.” Its narrative gives the amount as 0.160966947216380443 ETH, displayed as 0.160967 ETH, in transaction 0x72d94e8367a25c27d7b381ec899711115489468ffa3eeca2556c17149e3fa56b. The originating chain and depositor are unresolved.

At 09:11:59 UTC, the EOA sent 0.15 ETH to 0xb2ecfe4e4d61f8790bbb9de2d1259b9e2410cea5 in transaction 0xda55fd68dce40896726207c74cf9618d8cd727d00d7f822af04d68470b3baeec. The chronology explicitly separates this transfer from incident proceeds because it preceded the seed transaction. It is not included in the three post-incident paths above.

A receipt of 15.0 tokens reported as “SEND” at 09:18:23 UTC is recorded but excluded from the value trail. SentinelTX did not classify the token contract or assign a value, and it claims no link to the operator. Three later look-alike-address transfers are similarly recorded but excluded from tracing. The report classifies them as address-poisoning noise without an evidentiary link to the operator.

The source limits that matter

SentinelTX reports 22 traced movements across 15 addresses. Its two executed query windows each cover 41 days, from September 8 to October 19, 2026 UTC. The 18 retained movements with readable timestamps span October 8 from 09:11:23 to 10:42:47 UTC; four retained rows lack readable timestamps. The methodology says the query interval does not establish complete transaction coverage or enforcement of a requested historical window or block cutoff.

The report itself contains several material qualifications and inconsistencies:

• Verification wording: the executive summary says five claims were downgraded and one finding flagged for review. Its “unverified (auto-downgraded)” heading coexists with a conclusion using “confirms” and a routing table marking transfers verified. This article attributes the analysis to SentinelTX and preserves the abstract’s narrower definition of transfer verification.
• Pre-incident routing: warning INV-5 identifies a time-inverted path from block 26,146,922 to block 26,146,702. The latter contains the 0.15 ETH payment made before the seed transaction. The report’s chronology already says it cannot be incident proceeds; the warning remains part of the source.
• Funding quantity: the narrative gives the deBridge receipt as 0.160966947216380443 ETH, while the routing table’s Transfer amount is 0.160966773016380443 ETH. Both are preserved here without choosing a replacement figure.
• Look-alike transfer quantities: the narrative and Amount column describe three transfers as 0 ETH or 0.0 ETH. The corresponding Transfer amounts are 0.000000172200000000 ETH, 0.000000001000000000 ETH and 0.000000001000000000 ETH. SentinelTX distinguishes recorded Amount from retained-unit Transfer amount and says a difference alone does not establish case attribution.
• Endpoints and scope: the abstract says terminal endpoints are not recorded in its evidence subset, while the body lists terminal addresses in the traced set. A traced-set terminal denotes a boundary in those records; it does not establish a final beneficiary, an absence of later activity or conversion to cash.

The October 19 snapshots also remain separate from traced movements. The report gives the EOA’s snapshot balance as 0.00298 ETH and its provider-list inflow minus outflow minus gas as 0.002980011244414113 ETH. The intermediary’s Ethereum residual is 0.001423268336660466 ETH. Its provider list includes 1.7515 ETH of inflow, with the sender of the additional 0.0015 ETH above the EOA’s 1.75 ETH payment unidentified in this evidence. These figures are dated observations, not current balance claims.

The leads SentinelTX leaves open

The report’s conclusion identifies three principal leads: the deBridge funding order, the USDC sent to the HyperLiquid-labeled address, and the unlabeled wallet recorded with 1.723 ETH and no outflows. Its recommended follow-up is specific to those boundaries.

For deBridge, SentinelTX recommends obtaining the funding order’s source chain, depositor address and order ID. For LiFi / Mayan, it recommends obtaining the routing record and Arbitrum settlement to corroborate the delivered amount and any integrator metadata. For the HyperLiquid-labeled transfer, it recommends a preservation and information request through the venue’s compliance channel, including any attributable account and subsequent withdrawals.

It also recommends monitoring the 1.723 ETH wallet, the intermediary on Ethereum and Arbitrum, and the pre-incident recipient. For the mixer leg, it treats any future withdrawal attribution as a separate lead. Before an evidentiary filing, the report recommends decoding the seed transaction’s selectors against verified ABIs and reading the event logs to move the mechanism beyond its present attributed, code-level-unverified status.

Figure 3. The report’s conclusion states a seed-transaction contract net outflow of 6.793749214542107991 ETH and a signer receipt of 6.780267629238261652 ETH; the image rounds these to approximately six decimal places. It attributes the reward-accounting mechanism to SlowMist and DeFiHackLabs without decoded code-level semantics, does not establish operator identity, and identifies no custodial exchange deposit within three hops. Five broader claims remain unverified. A payment made before the incident cannot be proceeds of it, and the bridge settlement is still unverified. These limitations remain part of the conclusion.

Color key: Slate headings organize quantities, interpretation and report qualifications. Confidence is stated in words, not encoded by color.

Address/role key: Net-outflow contract = 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7, attributed to X7Pioneer by public reports; signer = 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2.

Source: SentinelTX PDF, CASE-ASYNC643, pp. 4–5, Executive Summary; pp. 9–10, Transaction Typology; p. 13, Conclusion; p. 19, Automated Integrity Check. Incomplete evidence scope: pp. 1–2 and 17–18.

The central finding is a reported contract net outflow of 6.793749214542107991 ETH, a receipt of 6.780267629238261652 ETH by the starting EOA, and the three downstream Ethereum paths described above. The report attributes the incident to X7Pioneer and a reward-accounting flaw through its cited public snippets, while keeping the exact code semantics and operator identity unresolved. The unverified bridge settlement, excluded pre-incident payment and incomplete collection scope limit what these findings establish.