Arkadiko / StackSwap: the Ethereum trail to mixer entry

Nine ETH deposits are the clearest endpoint in SentinelTX’s report on the reported Arkadiko / StackSwap incident. Between 04:05:59 and 04:11:23 UTC on 23 October 2026, the report records 213.3 ETH moving from one address into a Tornado.Cash Router-labelled address. That is a specific Ethereum transfer sequence—not a complete reconstruction of the Stacks attack, proof of an operator’s identity, or a measure of the incident’s total loss.

The distinction matters because the report also leaves cross-chain links unresolved and marks several earlier amounts as unverified. This analysis follows its recorded sequence while keeping those limits attached to the claims they affect. Its source is the 37-page SentinelTX report CASE-ASYNCF7B, generated on 26 October 2026 UTC.

The reported governance attack and the Ethereum investigation are different layers

SentinelTX recounts a reported governance-capture mechanism on Stacks. A proposal presented as a routine vault update was followed by a large DIKO purchase shortly before voting. The reported sequence is precise: a 3.39 million DIKO purchase at 15:03 UTC on 22 October; a vote of 4,573,197 DIKO at 15:06; voting closed at 16:04; and movements of sBTC and stSTX followed at 16:06 and 16:09. The account says the newly enabled contract’s fund-moving functions did not check the caller. Arkadiko reportedly switched the contract off at 18:08.

The same account describes an earlier StackSwap takeover through proposal 4 on 20 October and the draining of 49 pools. These are reported incident details in the PDF, not findings independently established by its Ethereum trace. The report does not anchor the Stacks proposal, vote, drain or USDCx burn transactions. It also does not establish the identity of the controller behind either incident.

Diagram 1. The governance mechanism is reported context: buy voting power, pass the proposal and enable code, followed by reported asset movements and USDA minting. It is not a verified Stacks reconstruction. Source: SentinelTX CASE-ASYNCF7B, pp. 4 and 15.

Reported losses are presented as $1.16 million overall, including $1.09 million for Arkadiko and $70.5 thousand for StackSwap. The PDF explicitly does not reconcile those valuations to its on-chain quantities. They should not be added to, or substituted for, the ETH and USDC movements below.

Stablecoins move through conversion venues

On Ethereum, the report describes a main seed address with older activity and a separate staging address first active on 22 October. The staging address routed two USDC quantities through the MetaSwap router, with the token legs delivered to a shared contract:

• 21:09:23 UTC, 22 October: 28,521.796245 USDC.
• 22:04:35 UTC, 22 October: 32,204.864217 USDC.

Address key: staging address = 0x425679fa1ab564815df9cbd91be68fc27c644073; main seed = 0x9a868f1db69d609a8efe14d979c53ebddd2a3875; MetaSwap router = 0x881d40237659c251811cec9c364ef91dc08d300c; shared recipient contract = 0x74de5d4fcbf63e00296fd95d33236b9794016631. Labels and token symbols follow the report and do not establish ownership or independently verified token identities. Source: pp. 5–7 and 10.

The main seed’s conversion activity includes transfers to an address labelled “Rizzolver, Unknown” and interactions with the MetaSwap router. Those roles are distinct from a custodial exchange account. The report leaves onward movements from the Rizzolver-labelled address and the shared recipient contract unresolved.

The PDF cites 244,594.20828 USDC arriving at the main seed through zero-address credits, but expressly downgrades that amount as unverified because the retained evidence does not supply a readable quantity that bounds it. A mint-style credit alone also does not establish which Stacks burn, if any, produced it. The source-chain burns and corresponding attestations remain missing links.

Consolidation is described, but its exact amounts carry qualifications

The report describes an ETH transfer from the staging address to the main seed, followed by two transfers from the main seed to a dedicated onward address. It characterises the latter sequence as a small probe followed by a sweep. Its quoted figures are 36.389030808813688987 ETH for the staging transfer, then 0.1 ETH and 213.262264545555095065 ETH for the two onward transfers. Each of these amounts is explicitly marked unverified in the compiled report; they are reproduced here as qualified source figures, not confirmed proceeds totals.

There is a second limitation: the staging wallet’s native-ETH record contains its onward transfer, but that transfer is not among the four top-level calls the report lists for the wallet. The signing path is therefore not established. The interpretation that its ETH credits came from the two USDC swaps is an inference, rather than an itemised conversion reconciliation.

These qualifications prevent the earlier stages from being treated as a fully reconciled, end-to-end value chain. They do not turn the separate nine-deposit sequence into an incident-wide loss estimate, nor establish what happened after mixer entry.

Nine deposits, four denominations

The report records the onward address sending nine transfers to the Tornado.Cash Router-labelled address on 23 October. The sequence uses four denominations:

• Two deposits of 100 ETH: 200 ETH combined.
• One deposit of 10 ETH: 10 ETH.
• Three deposits of 1 ETH: 3 ETH combined.
• Three deposits of 0.1 ETH: 0.3 ETH combined.

Together, those nine deposits total the report’s 213.3 ETH. The first occurs at 04:05:59 UTC and the last at 04:11:23 UTC. This is the composition of that deposit sequence only; it is not a breakdown of all stolen assets, all Ethereum receipts or all cross-chain exits.

Figure 2. Nine deposits into the router-labelled address, grouped by denomination. Values are ETH; group values are deposit count × denomination. Source: SentinelTX CASE-ASYNCF7B, pp. 10–11 and 15. Total: 213.3 ETH. No incident-wide loss denominator is implied.

Address key: onward sender = 0xe8cbdc3bb8e7af91f0b7aa91696c5624b4d05006; recipient = 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b. “Tornado.Cash, Mixer, Tornado.Cash: Router, Sanctioned” is the report’s returned label. The report calls for checking current sanctions status before relying on that label in a filing; this article makes no current sanctions determination.

Mixer entry is an endpoint in the traced record, not evidence of a completed cash-out or a recovered balance. The report describes any matching withdrawal pattern as a lead only and says deposit-to-withdrawal matching is probabilistic. It does not identify a person controlling the sender or recipient.

Earlier service activity is not automatically incident proceeds

The trace also reaches service-labelled activity outside the immediate deposit sequence. SentinelTX lists 11 legs to “Metamask Bridge, Exchange” and one to a Binance hot-wallet-labelled address. Its own interpretation is important: the former is a bridge/swap routing service despite the “Exchange” tag, and its destination networks remain unresolved.

Ten of the 11 routing-service legs precede the reported drain. They cannot carry proceeds from that later event. The one post-drain leg is dated 25 October, but its sender is not cited in the report, so its relationship to the main seed is not established. The listed Binance deposit also predates the drain. The PDF consequently states that no custodial exchange deposit of drain-period proceeds is anchored in this report.

The report separately excludes suspected address-poisoning and spam transfers. Look-alike addresses and tokens imitating the “ETH” symbol are not evidence of common ownership. Its ETH narrative uses native-ETH records rather than indiscriminately adding every token carrying an ETH-like symbol. Likewise, gross movement totals recount value at successive hops and are not loss figures.

What the conclusion supports—and what it does not

There is a material tension within the source. Its conclusion calls the Ethereum sequence a “complete proceeds path”, while its own limitations leave the Stacks linkage partial, parts of the conversion chain unresolved and several amounts unverified. Those statements are not equivalent. We retain the narrower distinction: the PDF describes a specific Ethereum sequence culminating in nine mixer deposits, but it does not establish a complete, reconciled route from the reported Stacks drain to every destination.

The report’s practical next steps follow those boundaries: obtain issuer mint and attestation records to connect source-chain burns to Ethereum credits; seek relevant routing-service or solver settlement records through appropriate channels; and examine the reported Bitcoin branch separately. The reported 4.86 BTC exit is not established by this Ethereum investigation, and no link between the cited Bitcoin address and the Ethereum seeds is proved here.

Figure 3. Conclusion: 213.3 ETH in nine recorded mixer deposits; the Stacks linkage remains partial, the Bitcoin leg and controller identity are not established, and several upstream amounts remain qualified. Source: SentinelTX CASE-ASYNCF7B, pp. 15–16, 20–21 and 33–34.

The useful result is therefore a bounded transfer trail, with transaction anchors and clear questions still open. Keeping reported mechanism, recorded movement, amount verification and ownership separate makes that result more useful—not less—than presenting a single headline total as the whole investigation.

Selected transaction anchors

First staging USDC leg: https://etherscan.io/tx/0x0f3d50a9551fbcbac726f54067d880bc7b80353b189fc6b9d62fea54eeab353b

Second staging USDC leg: https://etherscan.io/tx/0xbeaa599afdea60457e240160325843d0b69e5b2938840da7495669a0295dbb87

First mixer deposit, 100 ETH: https://etherscan.io/tx/0x0fade4caf7576e09a05d73a6706f08529087d7d771dd0645415a03ddf2b5707a

Last mixer deposit, 0.1 ETH: https://etherscan.io/tx/0x0ac46a58ac0704d364ca6bc0a167cfd7b09965019cc3d96c5978c8d30257ebaf

Source and limitations note

Adapted from the actual SentinelTX-generated PDF CASE-ASYNCF7B, 37 pages, generated 26 October 2026 UTC. This is a faithful editorial adaptation, not an independently reproduced investigation. The report’s focus is 22–26 October with earlier funding context; its abstract separately gives an executed query window of 15 September–26 October. Those descriptions are not treated as interchangeable. Explorer links use hashes printed in the PDF and do not establish ownership.

The PDF’s reported-incident source name and domain are missing in the rendered text on p. 4. We have not silently repaired that attribution. Its link to Arkadiko’s statement is reproduced below; the PDF says the statement was not independently reviewed for that report. The reported governance mechanism and loss estimates remain attributed to SentinelTX’s account, rather than presented as separately confirmed facts.

Arkadiko statement cited by the PDF: https://x.com/ArkadikoFinance/status/2113367201722044512

Amount qualification: the PDF flags seven findings under [INV-13] (pp. 33–34), auto-downgrading quantities whose retained transfer record has no readable amount that bounds the claim. Its exact inline warning is: “unverified amount — auto-check: a retained transfer this line names has no readable quantity, so no retained amount bounds this figure”. The affected claims are listed below. A number appearing elsewhere in a table does not remove this qualification.

[INV-13] Case narrative — cash-out / attributed amount: 244,594.20828 USDC — auto-downgraded; unverified in the compiled report.

[INV-13] Case narrative — cited transfer amount: 36.389030808813688987 ETH — auto-downgraded; unverified in the compiled report.

[INV-13] Case narrative — cited transfer amount: 0.1 ETH — auto-downgraded; unverified in the compiled report.

[INV-13] Case narrative — cited transfer amount: 213.262264545555095065 ETH — auto-downgraded; unverified in the compiled report.

[INV-13] Stablecoin arrival and conversion (22–23 October 2026) — cash-out / attributed amount: 35,843.240369 USDC — auto-downgraded; unverified in the compiled report.

[INV-13] Consolidation and mixer entry (23 October 2026) — cited transfer amount: 0.039606555354493989 ETH — auto-downgraded; unverified in the compiled report.

[INV-13] Limitations (evidentiary) — cited transfer amount: 36.399562631044986312 ETH — auto-downgraded; unverified in the compiled report.

The source also describes 213.3 ETH as 127.7 ETH plus 85.2 ETH in its assessment (p. 17). Those components do not sum to 213.3 ETH. We do not invent a missing component or use that passage as a reconciled allocation. The nine-deposit total above follows the separate deposit chronology, not that proposed origin split.