WAX bridge: following the Ethereum trail

Four token payouts, a sequence of conversions and one short relay define the Ethereum trail associated with the reported WAX Multi-Chain Bridge incident of 22 October 2026. SentinelTX’s case report follows that trail to an address labelled “HitBTC, Exchange”. The destination is an investigative lead, not proof of a completed cash-out or the identity of the person controlling the funds.

This analysis focuses on the Ethereum transfers documented in SentinelTX report CASE-ASYNC3FA, compiled on 24 October 2026 UTC. It distinguishes recorded movements from venue labels and incident-level assessments. Amounts remain in their native asset units; no incident-wide dollar loss is calculated here.

Four payouts in less than a minute

The report records four transfers from the same Ethereum contract to the same recipient between 10:05:35 and 10:06:11 UTC on 22 October. The assets and quantities were:

• 21,558.252354 USDT at 10:05:35 UTC.
• 840.2750339 DAI at 10:05:47 UTC.
• 2.54669928 WETH at 10:05:59 UTC.
• 0.10993227 WBTC at 10:06:11 UTC.

Address key: payout contract 0x24b22b031ae1b5a6b09f9a0fd33613a40e0d70e6; recipient 0x01664e199991b2f3fe412c2de5b9b7a0dcdc5070. Token symbols follow the report’s trace labels and are not a separate token-identity verification.

Figure 1. Four Ethereum payout quantities, shown separately because the units differ. Source: SentinelTX CASE-ASYNC3FA, pp. 4–5 and 17. These are transfer amounts, not a total loss calculation.

The contract’s role as the bridge’s release side is an assessment in the report, not a returned address label. Similarly, the recipient’s alleged attacker-side role depends on the broader incident interpretation. A transaction trail establishes movements between addresses; by itself it does not establish the identity or authority of the signer.

From token balances to an ETH relay

The report’s chronology describes token-conversion activity after the payouts. It records two unsuccessful USDT swap attempts before a successful KyberSwap route at 10:16:11 UTC. The WBTC movement followed at 10:18:35, then WETH at 10:20:23 and DAI at 10:22:23. The WETH and DAI routes are attributed to Velora; the WBTC interaction is with an unlabelled contract.

These swap venues should not be confused with the eventual exchange-labelled destination. They are intermediate interactions in the account’s conversion sequence, not evidence that the exchange received each original token.

At 10:24:23 UTC, the recipient transferred 15.58 ETH to 0x62907e044ffe22a24aa8794ff2a6ea20598227bb. At 10:43:47 UTC, that relay sent 15.5799958 ETH to 0x80787af194c33b74a811f5e5c549316269d7ee1a, which the report labels “HitBTC, Exchange”. The report displays the second amount rounded to 15.579996 ETH in its chronology and summary.

Figure 2. The Ethereum sequence described in the report: token payouts, conversion activity, an ETH relay and an exchange-labelled destination. The 15.579996 ETH endpoint figure is rounded. The report does not itemise each swap’s ETH output, so the full conversion-to-deposit attribution remains a partial path, rather than an exact per-token reconciliation.

Flow address key: A = 0x01664e199991b2f3fe412c2de5b9b7a0dcdc5070; B = 0x62907e044ffe22a24aa8794ff2a6ea20598227bb; C = 0x80787af194c33b74a811f5e5c549316269d7ee1a (HitBTC label as returned).

The distinction matters. The two ETH transfers are recorded movements. The interpretation that the 15.58 ETH combined the four swap proceeds with a small pre-existing gas balance is the report’s assessment. It does not support treating every wei of that transfer as independently reconciled proceeds of the incident.

What the destination does, and does not, establish

The report describes the relay as a single-use pass-through within the inspected ETH record. Its onward transfer gives investigators a concrete transaction to present to the service associated with the destination label. It does not reveal a customer account, establish the wallet type, or demonstrate a fiat withdrawal.

The destination label is therefore a route for further inquiry, not an allegation that HitBTC participated in the incident. The report’s recommended next step is preservation and lawful review of any relevant credited-account, access and onward-withdrawal records. Whether funds remain available, whether the label maps to a particular account and whether recovery is possible require information beyond this public transfer trail.

The reported bridge mechanism remains a separate question

SentinelTX cites third-party reporting of a negative-fee input-validation issue in WAX’s eth.token withdrawal mechanism. In that reported model, a negative max_fee could offset the requested quantity while a full withdrawal was still recorded. The report does not include WAX-chain action records that independently establish the mechanism or map individual source-chain withdrawals to these Ethereum payouts.

Its narrative also describes a Solana USDC branch. That is context for the reported multi-chain incident, not a basis for treating this Ethereum-focused analysis as a complete cross-chain reconstruction. No value transfer linking the Ethereum and Solana recipients is established in the report, and common control is presented as an inference rather than an on-chain connection.

Accordingly, this article does not combine the branches into a loss total, identify an operator, claim that all affected funds have been located, or describe the underlying WAX mechanism as independently confirmed. The report itself leaves onward Solana movement unresolved.

The evidence that would strengthen the case

• Source-chain linkage: WAX withdrawal actions, quantities, fee arguments and transaction identifiers matched to destination-chain payouts.
• Conversion reconciliation: executed ETH outputs for each token swap, kept separate from gas funding and residual balances.
• Destination attribution: confirmation of the exchange-labelled address’s role and any relevant account records obtained through appropriate channels.
• Earlier infrastructure: the origin of the ETH used to fund the recipient’s initial gas, without assuming that funding alone proves common ownership.

Figure 3. The report supports a specific Ethereum transfer trail. Operator identity, source-chain linkage, exact per-swap reconciliation and any completed cash-out remain separate evidentiary questions. Source: SentinelTX CASE-ASYNC3FA, pp. 8–16 and 17–18.

Conclusion: a useful endpoint, not the end of the investigation

The clearest result is narrow and actionable: four recorded Ethereum token payouts were followed by conversion activity, a 15.58 ETH relay transfer and an onward transfer displayed as 15.579996 ETH to a HitBTC-labelled address. The amounts, timing and transaction anchors make that trail more useful than a headline loss estimate.

The remaining work is to connect that trail to the source-chain actions and, where legally available, the account-level records behind the labelled destination. Keeping those questions separate preserves the difference between following funds and identifying who controlled them.

Transaction anchors

USDT payout: 0x7c6e4bf4efff995981b8b0f7fa1434cc85063e95c0f7460c71277e0a3f9c14d0

DAI payout: 0x58960a7afccf78725e8bcfcf7c1f38cac9e08f2a556da81ec7ee1c5023fc79c6

WETH payout: 0x9a55cd6c9e9067ac2bf8d33dff233a3e3dd3739c56206444b8a5e79daabb4ff5

WBTC payout: 0x6e1553e7d932d8019f59ea6a3bd09c3071b41d538975686cf3f7e785f9e67160

15.58 ETH to the relay: 0xd3f4c1c672eb8c3cdbc00216b0215fc72a16bc659a2e48b8a90241b4f165fe80

Relay to the HitBTC-labelled address: 0x64c65d0296fbe983c365646eb5bbb788d6cdd21b2bc54c365e296aef26c885ac

Source note: Adapted from the SentinelTX platform-generated report “Investigation report CASE-ASYNC3FA”, compiled 24 October 2026 UTC. This article is an attributed analysis of that report, not an independently reproduced investigation. Explorer links use transaction hashes cited in the report; they are not proof of address ownership or the broader incident interpretation.