Initia’s second incident — following ten Ethereum payments

A single Ethereum transaction paid ten addresses 28.4001 ETH each, for 284.001 ETH in total. Six addresses forwarded their funds to a seventh address that had received its own payment. The other three went to separate addresses. This note follows the Ethereum leg and uses “split-derived ETH” for value received from that distribution. The cross-chain link to Initia is attributed to the published BlockintAI investigation. Distribution transaction · Initia statement · BlockintAI investigation.

The hub’s own payment and six forwarded payments converged into 198.8002345104950685 ETH at the hub before further funding arrived. The hub started at zero before the split and its balance matched that total at block 26384984. It then received 207.420879250788913781 ETH from other transfers through block 26385310. Those transfers include a 0.120536500688913781 ETH payment from the original distribution funder and 207.30034275 ETH from a router labeled THORChain. The five outbound transactions total 406.220937038689951781 ETH. The ending balance was 0.0000389762392215 ETH, and transaction receipts account for 0.000137746354809 ETH in gas. On this ledger, 198.800057787901038–198.8002345104950685 ETH of the five sends combined came from the split. The range applies to the five sends together. The timing of the later credits narrows what the last transfer could have contained.

The three independent branches continued to new observed addresses. The third joined another outbound branch from the hub at the same recipient.

How much of the Tornado deposits came from the split?

The wallet 0x5348…4818 started at zero before receiving 178.920233388689951781 ETH from the hub. A later withdrawal transaction credited it with 100 ETH, and it separately sent 0.1 ETH directly to a pool contract. The 34 router sends totaled 278.8 ETH. Receipts account for 0.003815052314608855 ETH in gas and the balance after the last router send was 0.016418336375342926 ETH. These entries reconcile to the wei. At least 178.8 ETH of the router sends came from the hub transfer. Hub payment · Separate 100 ETH credit · Direct pool send.

The earlier hub ledger limits the split-derived share of the 178.920233388689951781 ETH payment to 0–0.020166084670776281 ETH. Before the last payment, the largest possible split-derived balance remaining at the hub was slightly above 0.02 ETH. The earlier sends could also have spent the entire split-derived balance. This range carries through as a conservative bound on the split-derived share of the 278.8 ETH router sends. The bound tracks the direct route through the hub. The 100 ETH withdrawal is a separate credit in this ledger. The deposit that funded that withdrawal remains unverified. The total incident-derived share across both routes therefore remains undetermined.

Follow-up: the 100 ETH deposit candidate. The same wallet deposited 100 ETH into the same pool at block 26,395,578, then received 100 ETH at block 26,395,773. The deposit changed the pool’s Merkle root to the exact root used by the withdrawal proof. This confirms the deposit was included in the set of eligible deposits. The proof does not disclose which deposit it spent. The wallet ledger shows that the candidate deposit was funded by the earlier hub payment. The withdrawal’s actual funding deposit and its Initia attribution remain unverified. The direct-route estimate above is unchanged. Deposit transaction · Withdrawal transaction · Pool verification logic.

Where the other three branches reached

What the downstream checks establish

Each of the three later recipient accounts returned 100 further trace entries, the query limit. One route repeatedly paid the same address, starting with 200 ETH. The other two dispersed value across many addresses. These records establish onward movement. The endpoints and any attributable service credit remain unresolved.