Community Investigation

EU entity theft: tracing partial USDC routes, ETH relays, and unresolved endpoints

dooooo
dooooo

November 07, 2026

ChainBounty. EU Entity Theft. Ethereum routes and attribution limits. 5 November 2026.

ChainBounty · Ethereum mainnet · Activity window: November 1–4, 2026 · SentinelTX report CASE-CBE85A32, November 5, 2026

SentinelTX's report on the publicly reported theft from an EU entity follows three Ethereum addresses through USDC transfers, ETH relays, and ETH-to-USDT swaps. It records a 9,582,349.791029 USDC transfer from the first starting address, four transfers totaling 20,000,000 USDC from the second, and 2,592 ETH dispersed from the third. These are separate observations within the traced activity, not components of a verified total loss.

The distinction that shapes the report is between a recorded transfer and a complete account of where its value came from or ultimately went. A USDC route passes through a wallet with mixed funding. A relay reaches an address publicly described as a Kraken deposit address, but the report does not confirm that attribution. A reported USDT freeze also remains unconfirmed.

1. Three starting addresses, one Ethereum-only scope

The report uses three starting addresses, called seeds. Their public descriptions explain why they were selected; those descriptions are not ownership findings. Ownership of the three addresses is not established.

  • Role / scope: Seed 1: reported exchange-paid wallet — Description in the PDF: 0x730bcb…723992. Its inbound exchange payout was not traced because the investigation ran outbound.
  • Role / scope: Seed 2: reported swap wallet — Description in the PDF: 0x9eca05…015547. The report records USDC transfers to a resolver-labeled address and other downstream activity.
  • Role / scope: Seed 3: reported frozen-USDT wallet — Description in the PDF: 0xa3a985…74ae0d. The report records ETH dispersal and a USDT holding, but does not confirm a freeze.
  • Role / scope: Network and analysis window — Description in the PDF: Ethereum mainnet, chain ID 1. November 1, 2026, 00:00:00 UTC, through November 4, 2026, 12:35:00 UTC.
  • Role / scope: Tracing depth — Description in the PDF: Outbound movements, up to three downstream hops per seed. Coverage of Seeds 1 and 2 is incomplete.
  • Role / scope: Balance snapshot — Description in the PDF: Block 26341513, November 4, 2026, 12:41:11 UTC. These are historical balances, not current holdings.

The report examines one publicly described withdrawal wallet and two additional starting addresses. It does not establish the full extent of the reported theft.

The victim’s identity and the circumstances of the reported theft are not established by these Ethereum transactions. This article uses the broader description “EU entity” without identifying a victim or deriving a loss total.

2. The USDC route passes through mixed funding

Seed 1 sent 9,582,349.791029 USDC to an intermediary at 22:06:11 UTC on November 1. That intermediary sent 5,270,291.000000 USDC to a second intermediary at 22:20:23 UTC. The second intermediary then sent Seed 2 a total of 13,495,000.000000 USDC in three transfers after midnight on November 2. The PDF summarizes this route as approximately 9.58 million → 5.27 million → 13.50 million USDC. [E1–E3]

  • Stage: Seed 1 to the first intermediary — Recorded movement and meaning: 9,582,349.791029 USDC to 0xc80f1c…4a8ce4. E1.
  • Stage: First intermediary to the commingled wallet — Recorded movement and meaning: 5,270,291.000000 USDC to 0xb40435…06d39b. E2.
  • Stage: Commingled wallet to Seed 2 — Recorded movement and meaning: 13,495,000.000000 USDC across three transfers: 5,000,000.000000; 5,000,000.000000; and 3,495,000.000000 USDC. E3a–E3c.
  • Stage: Attribution limit — Recorded movement and meaning: Only the approximately 5.27 million USDC inflow is observed coming from the Seed 1 branch. The report does not attribute the entire approximately 13.50 million USDC receipt to Seed 1.

These amounts describe successive transfers, not separate losses to add together. The larger outgoing total at the second intermediary reflects the report's finding that it pooled funds from at least one other source; the rest of its inflow was not traced.

Seed 2's own activity also has a separate chronology. It sent four transfers of 5,000,000 USDC each to 0x225a38…f2dc17, labeled “Rizzolver, Unknown” in the report, between 23:51:23 UTC on November 1 and 00:15:11 UTC on November 2. The report assesses these as swap inputs, but the corresponding ETH outputs were not itemized. Its public-source description of a UniswapX auction remains an attribution, not a confirmed identification of the resolver as a UniswapX filler. [E4a–E4d]

The evidence does not establish which funds financed each resolver payment. No allocation of Seed 1-derived value to those payments is made here.

Partial USDC route through commingled funds: approximately 9.58 million, 5.27 million and 13.50 million USDC. Individual resolver payments are not allocated to Seed 1.

Figure 1. The report describes Seed 1 → Seed 2 as a partial path through commingled funds. Display values are approximate: the first two transfers were 9,582,349.791029 USDC and 5,270,291.000000 USDC. Wallet B subsequently sent 5,000,000.000000, 5,000,000.000000, and 3,495,000.000000 USDC to Seed 2. Its other inflows were not traced. These movements are not a loss total.
Color key: slate marks the selected USDC route and its displayed amounts. Direct labels identify each address role; color does not establish ownership or attribution. Equal-width arrows are not scaled to value.
Address / role key: Seed 1 = 0x730bcb…723992; Relay A = 0xc80f1c…4a8ce4; Wallet B = 0xb40435…06d39b; Seed 2 = 0x9eca05…015547. Wallet B is the commingled intermediary, not an exchange or pool attribution.
Attribution note: The funding source of each resolver payment is not established.
Source: SentinelTX, Investigation report CASE-CBE85A32, November 5, 2026, pp. 4, 6–7 and 18–20.

A separate transfer sent 7,166,580.962400 USDC from Seed 2 to the unlabeled address 0x52b335…e3fb09 at 00:00:47 UTC on November 2. This is the transaction summarized as approximately 7.17 million USDC in the narrative. The broader flow summary lists two transfers to that address totaling 10,661,580.962400 USDC; the single transaction and the aggregate have different scopes. [E5]

3. Seed 3's ETH movements lead to a relay and a separate swap sequence

Seed 3's ledger records five outbound transfers totaling 2,592 ETH. One branch includes a 395 ETH transfer to 0xd359df…0a0573, followed by 395.999977992739261 ETH to 0xf5968b…014ae1 and 395.999955100039942 ETH to 0xfa6766…159556. The final transfer occurred at 10:11:47 UTC on November 3. The chronology displays those last two amounts as approximately 395.999978 ETH and 395.999955 ETH. [E6–E8]

These three transfers are presented at their recorded amounts. The evidence does not establish that the entire onward amount originated from Seed 3.

The final recipient, 0xfa6766…159556, is described as a Kraken deposit address in the public source cited by the PDF. The report does not independently confirm that attribution. The publicly reported onward sweep was beyond the three-hop depth and was not traced. The observed transfer therefore supports an endpoint lead, not a confirmed Kraken cash-out or an identified account holder.

Three recorded ETH transfers: 395 ETH, approximately 395.999978 ETH and approximately 395.999955 ETH. The full onward amount is not attributed to Seed 3. Kraken remains an unconfirmed attribution.

Figure 2. The resolved relay rows are ordered, not scaled to elapsed time. Seed 3 sent 395.0 ETH to R1. R1’s full-ledger outflow was 395.999977992739261 ETH, and R2’s was 395.999955100039942 ETH; the graphic rounds these to six decimals. The onward transfers are not attributed in full to Seed 3.
Color key: slate marks the selected transfer times and quantities. Direct labels identify the source, relays, and recipient.
Address / role key: Seed 3 = 0xa3a985…74ae0d; Relay R1 = 0xd359df…0a0573; Relay R2 = 0xf5968b…014ae1; Recipient R3 = 0xfa6766…159556. Full identifiers appear in the appendix.
Attribution note: R3 has no confirmed service attribution. Its identification as a Kraken deposit address is an attributed public-source lead. The reported onward sweep was beyond the three-hop trace; the figure stops at R3.
Source: SentinelTX, Investigation report CASE-CBE85A32, November 5, 2026, pp. 8–10 and 17–18.

ETH-to-USDT swaps are a separate branch

At 17:10:23 UTC on November 3, Seed 3 sent 2,000 ETH to 0xb3a21e…f99762. That address subsequently funded 0x2fb89a…df8516, where the report describes two ETH-to-USDT swaps on November 4. This is separate from the relay described above. [E9–E11]

  • Stage: First swap, 07:30:35 UTC — Recorded operation: 87.999 ETH was wrapped and sent out as WETH; 202,156.840322 USDT was received. E10.
  • Stage: Second swap, 07:50:35 UTC — Recorded operation: 43.00091147 WETH was sent out; 98,911.866452 USDT was received. E11.
  • Stage: Combined swaps — Recorded operation: The PDF classifies 130.99991147 ETH of input and 301,068.706774 USDT of output. The wrapping and WETH movements are parts of the swaps, not additional value to count again.
  • Stage: Smaller onward payment, 08:25:23 UTC — Recorded operation: 5.000000 USDT went to 0x70e9b5…352a3c. E12.
  • Stage: Main onward payment, 08:26:47 UTC — Recorded operation: 301,063.706774 USDT went to the unlabeled address 0x7ebce2…133fd4. E13.

The printed rows account for the two USDT outputs through the 5 USDT payment and the 301,063.706774 USDT transfer. They do not establish a destination on another chain. The public-source USDT0/LayerZero description remains unverified, as do the report's other attributed off-Ethereum routes.

4. Service labels and historical balances have narrower meanings

The report lists five transfers to an address labeled “Chainflip, Exchange,” totaling 241.00 ETH, on November 2–3. Its narrative places them in the Seed 2 graph. The retained routing table identifies the sender as 0x05184a…d1b01e. These observations do not supply destination-chain settlement records or prove a completed conversion to cash. [E14a–E14e]

At the balance snapshot, Seed 3 held two assets. The second ETH holding below comes from a ledger residual rather than a block-anchored balance read, a distinction the PDF explicitly preserves.

  • Address / measurement: Seed 3: ETH balance — Quantity and stated limit: 1,858.999296273752596983 ETH at block 26341513.
  • Address / measurement: Seed 3: canonical USDT balance — Quantity and stated limit: 1,142,716.43173 USDT at block 26341513, under Tether USD contract 0xdac17f958d2ee523a2206206994597c13d831ec7.
  • Address / measurement: 0xb3a21e…f99762: ETH ledger residual — Quantity and stated limit: 1,559.999871347187806602 ETH. The PDF identifies this as ledger-derived, not a block-anchored balance read.
  • Address / measurement: Freeze status — Quantity and stated limit: The reported Tether freeze remains unconfirmed. The available evidence does not establish the reason for the unsuccessful USDT transfers and approval calls.

Unsuccessful USDT transfers and approval calls do not, on their own, establish a freeze. The ETH balances are not frozen assets or confirmed recoveries, and none of these snapshot quantities describes the present balance.

5. What the report concludes

The report documents substantial transfers, relay activity and swaps. These movements do not establish how the exchange accounts were accessed, who controlled the addresses, or the victim’s total loss.

The next investigative steps are to corroborate the publicly attributed Kraken endpoint, obtain confirmation of the reported Tether freeze, and seek relevant venue order and destination records. These are investigative leads, not completed actions or recovery assurances.

Recorded movements and material attribution limits. Total incident loss and final cash-out are not established. Next steps are victim and service-record corroboration.

Figure 3. The report separates observed movements from partial links and attributed claims. Seed 3’s five outbound transfers total 2,592 ETH. Its USDT balance was 1,142,716.43173 USDT at block 26341513 (2026-11-04T12:41:11Z), approximately six minutes after the analysis window closed. A balance is not proof of a freeze or a recovery amount, and the asset quantities are not combined into a loss estimate.
Color key: slate marks section headings only. Evidence strength is stated in words, not encoded by color.
Address / role key: Seed 1 = 0x730bcb…723992; Seed 2 = 0x9eca05…015547; Seed 3 = 0xa3a985…74ae0d.
Scope note: Ethereum mainnet only; the outbound trace reached up to three hops. Seed 1 and Seed 2 coverage was incomplete. A direct funding link between Seed 2 and Seed 3 is not established. The report calls for corroborating the Kraken attribution, confirming Tether’s freeze, obtaining service order records, and establishing the remaining funding links.
Source: SentinelTX, Investigation report CASE-CBE85A32, November 5, 2026, pp. 4–5 and 16–18.

6. Selected evidence appendix

These IDs organize records reproduced from the PDF; they do not indicate a new investigation. Etherscan links below are navigation links constructed from the full Ethereum hashes printed in the PDF. The PDF remains the source for the descriptions, quantities, status, and timing. “Verified” is the report's status for a transfer, not proof of ownership, intent, victim linkage, or final destination.

E1–E5: USDC route and Seed 2 transfers

E6–E9: ETH relay and funding of the separate swap branch

E10–E13: swaps and onward USDT payments

E14: service-labeled records

Address and role register

  • Label: Seed 1 — Full address and role in the PDF: 0x730bcb1296758c377149d7409f98f041cf723992. Publicly described as exchange-paid; ownership unconfirmed.
  • Label: First USDC intermediary — Full address and role in the PDF: 0xc80f1cd39dc15a341c4ff083ece7d526964a8ce4. Receives E1 and sends E2.
  • Label: Commingled USDC intermediary — Full address and role in the PDF: 0xb4043516a2e5c20e6227ea074c4112457d06d39b. Sends E3a–E3c.
  • Label: Seed 2 — Full address and role in the PDF: 0x9eca05d78f6751c91ab048858b7d21a67c015547. Publicly described as a swap wallet; ownership unconfirmed.
  • Label: Resolver-labeled recipient — Full address and role in the PDF: 0x225a38bc71102999dd13478bfabd7c4d53f2dc17. “Rizzolver, Unknown.”
  • Label: Other USDC recipient — Full address and role in the PDF: 0x52b335fd4d229c4b4ffa6190526e4b5fb8e3fb09. Unlabeled.
  • Label: Seed 3 — Full address and role in the PDF: 0xa3a98584d410c4e32f9825f6af1168f4e774ae0d. Publicly described as frozen-USDT wallet; ownership unconfirmed; freeze unconfirmed.
  • Label: First ETH relay — Full address and role in the PDF: 0xd359dfac0ec3032939f95839cba50b5ad10a0573. Single-forward relay in the report.
  • Label: Second ETH relay — Full address and role in the PDF: 0xf5968bc4d8cd1c75a7ddb93b158689eff9014ae1. Single-forward relay in the report.
  • Label: ETH relay recipient — Full address and role in the PDF: 0xfa6766b362461a20046451b16277ec5f7d159556. Service attribution unconfirmed; publicly attributed Kraken deposit address.
  • Label: Separate ETH branch — Full address and role in the PDF: 0xb3a21eb35ba99f2d9a2bc11f1f6fa17e00f99762. Receives 2,000 ETH from Seed 3.
  • Label: Swap address — Full address and role in the PDF: 0x2fb89a93a1908b1902da6b5a6e3459df75df8516. Site of E10 and E11.
  • Label: Main onward USDT recipient — Full address and role in the PDF: 0x7ebce287d5db06103152bd5dc114b8d5f2133fd4. Unlabeled; bridge role unconfirmed.
  • Label: Chainflip-labeled recipient — Full address and role in the PDF: 0xf5e10380213880111522dd0efd3dbb45b9f62bcc. “Chainflip, Exchange.”

7. Source and scope

Source: SentinelTX, Investigation report CASE-CBE85A32, 5 November 2026. This article presents selected records and assessments from the report; it is not an independent on-chain validation. The report cites Bitquery’s EU theft investigation for public-source context.

The analysis covers selected Ethereum activity. Some records predate the November 1–4 analysis window and provide background only. Coverage is incomplete; the recorded movements do not establish total incident loss or demonstrate that every listed transfer belongs to the incident. Values moving through successive addresses are not added together, and different assets are not combined into a loss estimate.

The Seed 1 route passes through commingled funds. The evidence does not allocate Seed 1-derived value to individual resolver payments or establish a direct funding link between Seed 2 and Seed 3. Service-labeled transactions alone do not establish a case-linked cash-out, an account holder or settlement on another chain.

The publicly reported Kraken attribution and Tether freeze remain unconfirmed. A historical balance is not a current holding, confirmed frozen amount or recovery. The report does not establish the victim’s identity, account-access mechanism or final destination of the funds. Other-chain routes remain outside the demonstrated scope.

post_like_sub0
post_total_comment_sub0

6 reads

Show Your Support!

You are about to donate to the dooooo. Supporting great contributions helps strengthen our community.

Your current CBP0
Donation Amount
cbpCBP

Donations are final and cannot be refunded. Thank you for supporting the ChainBounty community!

0/500 bytes

Signing in progress...

Please sign your wallet messages to ensure a secure connection.