Smart-wallet incident: Repeated calls and commingled ETH

ChainBounty · Report analysis · CASE-01D70140

Ethereum mainnet · Recorded activity: October 19–20, 2026 · Based on the SentinelTX report issued October 20, 2026

A SentinelTX investigation records a 50,655.918487 USDC receipt by a candidate externally owned account, followed by conversion to approximately 20.597338 ETH and onward transfers through a wallet with mixed-source funding. Its call-tree analysis assesses that two transactions made legacy smart-wallet contracts execute repeatedly against a MARK/WETH pool. The report calls the contracts “Argent-style”; it does not establish that they are the official Argent product.

The distinction between recorded transfers and interpretation matters here. The source flags two routes that run backward in time and therefore cannot trace proceeds. Its separate October 20 transfer sequence reaches a Tornado.Cash Router address, but commingling prevents an exact allocation to this incident. No exchange deposit or corresponding mixer withdrawal is established.

Key findings

• The candidate EOA received 50,655.918487 USDC on October 19 and converted it in a later transaction. The PDF’s exact ETH transfer amount is 20.597337757434388495; its narrative rounds that to 20.597338 ETH.
• The two seed call trees show 19 and nine inner executions. The signed-call replay mechanism is an assessment, while a recovery-deadline overflow, an owner change, and official product identity remain unestablished.
• On October 20, the EOA sent 20.68 ETH to a consolidation wallet. That wallet also had other inflows, then sent 5.05 ETH onward. Five 1.0 ETH transfers subsequently reached the Router; those overlapping stages are not separate losses.

Report scope and limits

This article adapts Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, a 46-page SentinelTX PDF issued on October 20, 2026. It follows the report’s records, assessments, and qualifications rather than presenting an independent on-chain investigation. “Candidate EOA,” “consolidation wallet,” and “staging wallet” describe transaction roles; they do not identify people or establish common ownership.

The narrative specifies an incident window of October 18, 2026, 00:00 UTC, to October 20, 2026, 13:15 UTC. The executed queries were broader: two 32-day windows from September 18 to October 20. The 145 retained movement rows with readable timestamps span October 19 at 09:31:23 UTC to October 20 at 11:46:35 UTC; another 57 retained rows have no readable timestamp. A query interval is not the evidenced transaction span, and gaps between queries are not coverage. The PDF expressly says these records do not establish that the requested historical window or block cutoff was enforced. The three-hop maximum and latest block 26,233,589 describe cited routing rows, not complete investigation coverage.

The source’s two time-order warnings concern routes joining the conversion at block 26,225,830 to seed activity at earlier blocks 26,225,798 and 26,225,803. A later receipt cannot fund an earlier transfer. Those joins are excluded from this article’s proceeds claims and diagrams. This does not erase the separately listed transactions, but it prevents treating the backward joins as a valid continuous money trail. The exact warnings appear in the source note.

From funding to the USDC receipt

At 09:31:23 UTC on October 19, the candidate EOA, 0xc10609…872b02, received 0.09761 ETH from an address the report labels as the Tornado.Cash 0.1 ETH pool. SentinelTX assesses that the amount is consistent with a withdrawal net of a relayer fee. This is pre-incident funding provenance, not a destination of the incident’s proceeds, and it does not identify the original funder.

The report’s control-transaction record then lists six successful submissions, with nonces zero through five:

1. 09:35:35 UTC, block 26,225,763: creation of 0x3c5884…3fb310. Contract code was observed; creation alone does not establish ownership or control.
2. 09:42:35 UTC, block 26,225,798: Seed 1 called the created contract with selector 0xc59705f3. It was not reverted; the trace contained 742 frames and reached depth 11.
3. 09:43:35 UTC, block 26,225,803: Seed 2 called the same contract with selector 0x522bffbe. It was not reverted; the trace contained 458 frames and reached depth 12.
4. 09:44:35 UTC, block 26,225,808: the created contract sent 50,655.918487 USDC to the candidate EOA.
5. 09:48:47 UTC, block 26,225,829: the EOA submitted a USDC approval call.
6. 09:48:59 UTC, block 26,225,830: the EOA sent 50,655.918487 USDC into the Uniswap V2 route and received 20.597337757434388495 ETH, approximately 20.597338 ETH.

The USDC receipt and conversion are two stages involving the same token amount, not two amounts to add. The ETH output is a different asset and is not added to the USDC quantity. SlowMist’s approximately US$59,800 estimate appears only as a source-reported figure from its public incident-index snippet. SentinelTX does not reconcile that estimate with the retained USDC proceeds, and this article does not treat it as a recomputed loss.

At 10:07:35 UTC, the EOA also received an unsolicited 1,000,000 PVC. The report records the transfer but sets it aside as non-economic because it was unvalued and no onward movement was observed. It is not included in the proceeds narrative.

What the two call trees show

In Seed 1, the created contract made wallet-control-shaped calls through proxy-style contracts and shared implementations. It also called a counterparty labeled Balancer, which called back and transferred WETH. The report reads that call/callback structure as a flash-loan pattern; the selectors were interpreted structurally rather than fully ABI-decoded.

Within the callback, MARK moved in large round trips between the created contract and the MARK/WETH pair. The narrative’s largest rounded legs were 412.07 million, 405.52 million, and 398.90 million MARK in each direction. These are gross trading movements, not retained proceeds. The evidence-set total of 13,474,585,249.833702 MARK likewise recounts movement and does not measure loss or prove that every included movement belongs to the incident.

One entry with selector 0xaacaaf88 into 0x4e50ad…227394 produced 19 self-call iterations in Seed 1. In each iteration, wallet contract 0xe545b9…ee8f66 made two ETH payments:

• 1.061908909163406246 ETH to the Uniswap V2 router for the ETH-to-MARK route. The report’s total across 19 iterations is 20.176269274104718674 ETH.
• 0.025621353654900691 ETH to 0xd33814…4452e7. The report’s total is 0.486805719443113129 ETH. That recipient’s role is unverified.

The trace’s 40.839344267652550477 ETH of total internal value includes the router’s WETH-wrapping forward and therefore double-counts that leg. It is not an incident loss. After the repeated buys, the report describes the created contract selling MARK back into the pair and taking WETH-side output.

Seed 2 had the same reported flash-loan and churn structure, without the wallet-control-shaped frames. One entry into 0x4e50ad…227394 produced nine iterations through 0x5a79e5…a85440. Each contained a USDC approval, a Uniswap V2 swap through the USDC/WETH and MARK/WETH pairs, and a USDC transfer. No native-ETH internal value moved in that seed.

SentinelTX assesses that one signed call was executed repeatedly: each entry carried a 65-byte field consistent with an ECDSA signature, then fanned out into repeated inner execution. It interprets the associated trading as induced buy pressure in a low-liquidity pool. That remains a mechanism assessment. The recovery-control-shaped sequence does not supply a decoded wrapping deadline or a decoded owner-change event, so neither the reported recovery-deadline overflow nor an owner change is established. No verified-source comparison to the official Argent product was made.

Figure 1. The two October 19 seed call trees contain one entry followed by 19 and nine inner executions, respectively. Arrows show process sequence, not amounts or new transfers. Repeated execution of a signed call is the report's assessment; recovery-deadline overflow and an owner change are not established.

Color key: Slate identifies Seed 1; sage identifies Seed 2. Color does not establish identity or responsibility.

Address/role key: Both seeds called 0x3c5884…3fb310. The repeated entry was into 0x4e50ad…227394; the spending wallet was 0xe545b9…ee8f66 in Seed 1 and 0x5a79e5…a85440 in Seed 2. Official Argent product identity is unverified.

Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026, pp. 7, 9–10.

The downstream route mixes funding sources

On October 20, the candidate EOA sent 1.0 ETH at 08:56:23 UTC and 19.68 ETH at 09:03:11 UTC to 0xfba873…81364a, the consolidation wallet. The combined 20.68 ETH is an observed outward amount, not a fresh loss estimate and not a direct substitute for the swap output: the EOA’s listed inflows also include the earlier 0.09761 ETH funding and small other receipts.

The consolidation wallet’s provider-listed inflows totaled 27.528000001 ETH across five transfers. Of that, 20.68 ETH came from the candidate EOA and 6.848000001 ETH from other senders whose sources were not established. At 11:17:23 UTC it sent 5.05 ETH to the staging wallet, 0x0d9ed4…f12f40. The presence of other inbound funding means the exact incident share of that onward transfer cannot be determined from flow data.

The PDF gives a pro-rata assessment of about 75%, calculated there as 20.68 / 27.528, or roughly 3.79 ETH of the 5.05 ETH transfer. This is an allocation assumption, not identification of which ETH moved. It cannot justify describing all 5.05 ETH, or all five later Router transfers, as exclusively this incident’s funds.

The staging wallet made five separate transfers of 1.0 ETH to 0xd90e2f…24f31b, labeled Tornado.Cash Router, on October 20:

• 11:19:11 UTC: 1.0 ETH.
• 11:32:47 UTC: 1.0 ETH.
• 11:37:11 UTC: 1.0 ETH.
• 11:42:47 UTC: 1.0 ETH.
• 11:46:35 UTC: 1.0 ETH.

These transfers total 5.0 ETH at the Router. The report stops there at a privacy boundary and establishes no corresponding withdrawals. It identifies no exchange-deposit leg. The Uniswap interactions are DEX swaps, not custodial cash-out events, and a service label does not identify the person behind a transfer.

Figure 2. On October 20, the candidate EOA sent 1.0 ETH and 19.68 ETH to the consolidation wallet, which also had 6.848000001 ETH from other senders in its provider-listed inflows. It forwarded 5.05 ETH to the staging wallet, which sent five 1.0 ETH transfers to the Tornado.Cash Router. These are overlapping stages, not additive losses. Commingling prevents an exact case allocation; no corresponding mixer withdrawal is established. The dates of the other senders’ listed inflows are not asserted here.

Color key: Slate identifies the candidate-EOA contribution; sage identifies other provider-listed inflows. Onward route arrows are charcoal. Equal-width arrows show direction, not amount.

Address/role key: Candidate EOA 0xc10609…872b02; consolidation wallet 0xfba873…81364a; staging wallet 0x0d9ed4…f12f40; Tornado.Cash Router 0xd90e2f…24f31b. These are transaction roles and the report’s service label, not verified common ownership.

Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026, pp. 5–6, 8, 13, 41–42.

Residual movement is not a balance

SentinelTX separates provider-list arithmetic from a balance query. The figures below are inflows minus outflows minus listed gas fees over the provider-returned ETH rows, including rows at any date. They are not proof of currently held funds, incident-attributable holdings, or recoverable amounts:

• Candidate EOA: 12 inflows totaling 20.694952258434388495 ETH; two outflows totaling 20.68 ETH; gas fees of 0.009768389421759711 ETH; net listed movement of 0.005183869012628784 ETH. Separately, the narrative says the address record showed 0.005184 ETH on October 20.
• Consolidation wallet: five inflows totaling 27.528000001 ETH; one outflow of 5.05 ETH; gas fees of 0.000043631071701 ETH; net listed movement of 22.477956369928299 ETH, approximately 22.48 ETH.
• Staging wallet: three inflows totaling 5.0500000515 ETH; five outflows totaling 5 ETH; gas fees of 0.014022238141291632 ETH; net listed movement of 0.035977813358708368 ETH.

The report’s expert-opinion section discusses the approximately 22.48 ETH figure as a possible recovery opportunity if funds later reach a custodial venue. That assessment does not turn the flow-derived residual into a balance or establish how much belongs to this incident. Onward movement beyond the listed 5.05 ETH leg is not established.

Conclusion

The report’s most concrete result is the sequence of recorded token receipt, conversion, and later ETH transfers. Its call-tree interpretation connects repeated wallet execution with MARK-pool trading, but the exact defect and official product identity remain unresolved. Downstream, the consolidation wallet’s other funding prevents a precise incident allocation, and the Router marks the end of the established route rather than a confirmed cash-out.

SentinelTX identifies the other consolidation-wallet senders, the unknown Seed 1 ETH recipient, and decoded module calls as useful next leads. Those are recommendations in the source, not completed findings. The two reverse-time joins cannot support a proceeds trail; neither the gross trading totals nor the approximately 22.48 ETH residual establishes a loss or a recoverable balance.

Figure 3. The report records the USDC receipt, ETH conversion, and subsequent transfers, while treating the repeated-execution mechanism as an assessment. Official product identity, recovery overflow, owner change, and exact downstream case allocation remain unestablished. Its two impossible backward-time paths cannot support proceeds tracing, and no exchange deposit or corresponding mixer withdrawal is identified. The figure’s approximate 20.597338 ETH is 20.597337757434388495 ETH in the Path Routing Evidence (p. 14).

Color key: Slate marks section headings only; the written labels distinguish records, assessments, and limits.

Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026, pp. 10, 12–14, 42–43.

Source and limitations note

Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026. Main references: executive summary and value distinctions, pp. 4–6; chronology, pp. 7–8; call-tree interpretation and attribution tiers, pp. 9–11; conclusion and limitations, pp. 12–13; exact transfer amounts, pp. 14–38; aggregate movement definitions, pp. 38–40; collection boundaries, pp. 41–42; native warnings, pp. 42–43. The PDF’s public lead is attributed to the SlowMist incident-index snippet at the SlowMist incident index, not to an independently reviewed full incident notice.

The original dossier is marked confidential. This article adapts its findings and qualifications; it does not reproduce the complete source dossier.

Exact native warning count: the p. 4 banner says, “INTEGRITY GATE — the integrity gate flagged 2 findings for review. See the appendix at the end of this document for the full list.” The two findings appear in “Automated Integrity Check — Warnings (Report Integrity Gate),” pp. 42–43. They are reproduced verbatim below:

[INV-5] (report-wide) — Hop 1 (block 26,225,830) → Hop 2 (block 26,225,798) is time-inverted — the later hop (funds out) settles in an EARLIER block than the hop that feeds it (funds in) → a causally impossible path (the cash-out tx precedes the deposit tx). Likely a destination's commingled total deposits counted as traced taint.

[INV-5] (report-wide) — Hop 1 (block 26,225,830) → Hop 2 (block 26,225,803) is time-inverted — the later hop (funds out) settles in an EARLIER block than the hop that feeds it (funds in) → a causally impossible path (the cash-out tx precedes the deposit tx). Likely a destination's commingled total deposits counted as traced taint.

Plain-language consequence: both flagged paths would require the October 19 conversion to fund seed activity that had already happened. They are causally impossible, not merely unconfirmed. Neither is used as a proceeds route in this article or its figures. The warning’s suggestion about commingled deposits is the source’s explanation, not a separately established repair.

The source retains several different scopes and levels of certainty. Its abstract says transfer verification does not record who signed or authorized a transfer, while the seed and control sections identify the candidate EOA as the submitter/signer. This article uses the transaction role without treating it as a verified personal identity or proof of authority. Service labels are provider attributions reproduced from the report, not new determinations of ownership or current legal status. The executive summary calls 09:35:35 UTC the EOA’s “first recorded activity,” while also recording the earlier 09:31:23 UTC inbound funding; both events are retained here without redefining that source label. The abstract does not identify terminal endpoints or exchange attributions in its cited inputs, while later sections supply the Router service label; neither establishes a mixer withdrawal or a cash-out.

The prose also describes the staging transfer as “exactly 5.05 ETH,” while the full provider-list arithmetic gives 5.0500000515 ETH across three inflows. The former is the single consolidation-to-staging transfer; the latter is a broader list total. The PDF’s flow-derived residuals are not balance queries. Its requested incident window, executed query windows, and retained transaction span remain distinct. Provider page limits and high-volume exclusions mean the collected and followed rows are not every address’s whole history.

The PDF’s aggregate movement totals expressly do not determine loss or establish incident connection. Where its “Amount” and “Transfer amount” columns differ, that difference alone does not establish case attribution. Some USD cells use transaction-date prices, spot fallbacks, or recovered session valuations; the record does not attribute each figure to an individual price source. This article therefore keeps the reported SlowMist estimate separate from native quantities and does not introduce a new USD valuation.

Other stated limits include unknown sources and role for 0x11bf2e…067e26, whose provider-listed inflow is 0.06078317119380398 ETH; an unestablished identity for the MARK/WETH pair; and an unverified role for 0xd33814…4452e7. Claims of a signed-call replay or pool manipulation remain assessments despite the stronger language in the report’s expert-opinion section. The PDF describes a signed manifest and report fingerprint; this adaptation does not claim independent cryptographic verification or clean substantive findings.

Reference addresses and transactions

Full identifiers below reproduce the source for the movements and roles discussed above. Short forms in the article use the first six and last six hexadecimal characters.

• Candidate EOA: 0xc10609ce5c032db92e562e463b1234aab0872b02.
• Created contract and USDC sender: 0x3c5884377cca79ff221936aea4a5df43293fb310.
• Repeated-entry contract: 0x4e50adfc953551286bbd7fee2b2b846d1d227394.
• Seed 1 spending wallet: 0xe545b9a69bff1bf0ed2e922551dda4afc8ee8f66; Seed 2 spending wallet: 0x5a79e5772493cf4329682d202aa2d28f85a85440.
• Other wallet-control-shaped contract: 0xf490557d67d934440677a4f16793d5ef319b8ef5.
• MARK token: 0x67c597624b17b16fb77959217360b7cd18284253; MARK/WETH pair: 0x6f23d2fedb4ff4f1e9f8c521f66e5f2a1451b6f3.
• Seed 1 unknown ETH recipient: 0xd33814c56fdacdc7f084a5443d600ee5464452e7.
• Consolidation wallet: 0xfba873b1e5d0256301b87ce74f79a30d6781364a; staging wallet: 0x0d9ed4bbb6efeda5471cae1aa5f4bbe0e8f12f40.
• Pre-incident funding pool: 0x12d66f87a04a9e220743712ce6d9bb1b5616b8fc; downstream Router: 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b. These are distinct roles.
• Uniswap V2 router: 0x7a250d5630b4cf539739df2c5dacb4c659f2488d; USDC/WETH pair: 0xb4e16d0168e52d35cacd2c6185b44281ec28c9dc; Balancer-labeled counterparty: 0xba12222222228d8ba445958a75a0704d566bf2c8.
• Other provenance address with unestablished role: 0x11bf2e0d39d8589c96171a4102ea39c834067e26.

Transaction references, as printed in the PDF:

• Pre-incident 0.09761 ETH funding: 0x6871f0e18429be8a40b5cc4d358b140ca987bee61ab00d6f652ccb59df631f63.
• Contract creation: 0xaadeff6c257a9339cc82c53ee44870d399b4e81de085f2c7f22464421060d4d2.
• Seed 1: 0xbfed8d33561ed5f9cbd0f4e62a5bbd20187a64f3e22180148dcb58ed6ebaa795.
• Seed 2: 0xa0ee8f914205a948c79eca039b7d8265537eb220472c9be1455d3321f1bd571b.
• USDC receipt: 0xc041e86d96df91df94bb585506865139fe17bebd8473d840cff2e7c4808a2756.
• USDC approval: 0x5e41d5d735133bbf715c55349aa5626e46c9deab986c56c57718330aa576939a.
• USDC-to-ETH conversion: 0xc220bb3c307f7317f4fa12e67220c77bc767db64a61587ebdebdbb442e00f0ce.
• Unsolicited PVC receipt: 0x5dfecdfd733721cc4679e376c0f455019b1512128f61e4b5beb2bc91decd52a4.
• 1.0 ETH to consolidation: 0x5b0ee213efea42fa4fbfdb1d6049c715643d63c54357ba6980d34dec30077e7c.
• 19.68 ETH to consolidation: 0xce8fb63bd9145b205f172243a485e535de627f0810a274d1ff6d3c0a7cc6946a.
• 5.05 ETH to staging: 0x1d7d1d4e7fd61938f1a908292888bd4d2b4ba570cc8713de95633ed00ab7bdc1.
• Router transfer at 11:19:11 UTC: 0x1ba62ed4886fd6b8feae723f66597b4f3940af914b1168bc93ef43de026bdb1b.
• Router transfer at 11:32:47 UTC: 0x124eadf281340cfbb707b4f88d117808af4ab628c1ea2736450a15d29caa887d.
• Router transfer at 11:37:11 UTC: 0x6655185342c5cf5863b4dd0b1d1af67fb9a9ad886e480182d1d8d39824ee5dc2.
• Router transfer at 11:42:47 UTC: 0x5ff8fa2b97db68b116485c187b34caefabe439054f74423a63549d10716fb214.
• Router transfer at 11:46:35 UTC: 0x36deeddccc9d47ab702f8857c5cdf2f0f2de018720341345eae6d56b5089f5ba.

Article version 1.0 · October 20, 2026 · Based on the native SentinelTX PDF.