Defend Against Cybercrime with the Power of Community

On 17 October 2026, one Ethereum transaction repeatedly moved USDT into and out of BiFi's USDT market, exchanged most of the resulting surplus for WETH, and paid ETH to the transaction sender and a block fee recipient. This investigation asks two separate questions: how much USDT left the handler on a net basis, and how far the proceeds can be followed without assigning unrelated activity to the incident.The checked route is BiFi USDT handler → execution helper → Uniswap pool → WETH unwrap → ETH payouts. A same-transaction flash loan supplies temporary funding and is fully repaid. The asset path is supported by explorer event records and displayed internal transfers; it stops at the payouts, not at a confirmed exchange deposit or recovery.Who and what appear in the route?The handler is the contract that holds the market's USDT. The execution helper is another contract, called by the wallet that submitted and paid for the transaction. These are different roles: the wallet submits instructions, while the handler is the address whose token balance decreases. The role names below describe recorded activity, not the identity or intent of a person.USDT is a stablecoin token designed to track the US dollar, but the quantities here are tokens, not a historical dollar valuation. WETH is a token form of ETH that can be handled by contracts using the common ERC-20 token interface; unwrapping WETH releases ETH rather than creating a second asset gain. A flash loan is temporary funding that must be returned within the same transaction; otherwise the entire transaction is reversed. Its principal is not the amount lost by BiFi. An exchange pool swaps one token for another; its presence does not establish that the pool or its operator participated in an attack.RoleHow it is used hereBiFi USDT handlerSends and receives USDT during the repeated market interactions.Execution helperBorrows temporarily, interacts with the handler, swaps USDT and distributes ETH.Transaction senderSubmits Anchor A and receives its main ETH payout.Block fee recipientReceives a direct ETH payment inside Anchor A, separate from the transaction gas fee.Earlier deployerCreates a different contract one block before Anchor A; its relationship to the profitable execution remains unproven.Scope and three findingsScope itemBoundaryIncident anchors17 October 2026, 05:42:59 and 05:43:11 UTC; Ethereum mainnet.Accounting scopeAnchor A only: 142 displayed ERC-20 transfer rows; 141 USDT events independently cross-checked against decoded integer values and addresses.Follow-up window17 October 05:43:11–22 October 03:15:00 UTC; incomplete provider coverage, not a complete address history.Verification date22 October 2026; explorer and public-source reads may be later than the follow-up cutoff.Counting conventionToken quantities, no historical USD price estimate. Gas and direct builder payment reported separately.First, the handler's net outflow in Anchor A is 165,575.149730 USDT, not the much larger volume of repeated transfers. Second, the swap, residual USDT and ETH payouts can be reconciled without counting the same value twice. Third, the checked proceeds reach the transaction sender, but the reviewed records do not allocate the incident's ETH to a later cash-out or establish a completed refund.05:42:59 UTC: a deployment, not yet a proven causal linkAnchor B creates a contract from a different wallet in block 26,210,255. Twelve seconds later, Anchor A executes in the next block using a different helper. Both successful statuses, times and addresses were read directly in Etherscan. Deployment record · Execution record.The public DeFiHackLabs reconstruction describes the earlier wallet as the original exploiter and the later sender as a front-runner, meaning a participant that executes an opportunity ahead of someone else. We retain those descriptions as external claims. A twelve-second gap is not proof of copying, shared control or mempool observation. Establishing that relationship would require the relevant bytecode and execution comparison, and evidence of how the later transaction was selected or ordered.UTC / blockObserved event17 October 05:42:59 / 26,210,255Anchor B: 0x15b47e2c0daf723dec64c75b435079d3a1f8a6058b21b9a64dda4844e877a034. Deployer 0x7c78a049fff71609990017b58a959e926e6ec4c6 creates 0x8c0d729d03cb8ecbc79a62a68cdd67ccfa6a7b92.17 October 05:43:11 / 26,210,256Anchor A: 0x756c68055af7a0630aa0b56891ba4de14c56c39cbebe99e47eeb4728f4d6ad14. Sender 0xc0ffeebabe5d496b2dde509f9fa189c25cf29671 calls helper 0xe08d97e151473a848c3d9ca3f323cb720472d015.05:43:11 UTC: temporary funding and repeated market flowsHow much of the transfer volume represents money leaving the market? The helper receives 40,499,999.999997 USDT from the Morpho-labelled contract, then repeatedly sends USDT to and receives USDT from the BiFi handler. The flash-loan event records 40,499,999,999,997 base units; the final repayment returns the same principal. Anchor A events.Within this transaction, 54 transfer events run from the helper to the handler and 83 run back. These counts include zero-value events. The incoming and outgoing sums are large because the same capital is reused. Subtracting one direction from the other answers the narrower question of the handler's token movement. Think of this as reconciling one account: a large amount repeatedly entering and leaving is not the same thing as the final amount that left it. The table counts the recorded token movements, not the market's internal deposit claims.Handler ledger in Anchor AUSDTIncoming: 54 events141,270,327.667580Outgoing: 83 events141,435,902.817310Outgoing minus incoming165,575.149730Start Figure 1 at the temporary loan, move through the two-way market interaction, then read the swap stage. Solid arrows connect ordered accounting stages, not additional losses or equal time intervals.Figure 1. The flash loan nets to zero. The handler net outflow equals swap input plus helper residual. Colors group stages only; line width is not amount. Source: Anchor A decoded Transfer events and FlashLoan event.The net outflow is a transaction-level quantity, not a complete statement of protocol insolvency, affected depositors or unreimbursed user losses. The next step is to account for where that surplus went.The swap changes the asset, not the size of the incidentThe helper sends 165,574.514633 USDT to the Uniswap pool and receives 68.057203111718789216 WETH. The remaining 0.635097 USDT is the helper's net token change within Anchor A, not a current balance query. These two USDT quantities add to the handler's net outflow exactly.ReconciliationQuantityUSDT swap input165,574.514633 USDTHelper USDT net increase0.635097 USDTSum / handler net outflow165,575.149730 USDTSwap output68.057203111718789216 WETHUSDT and WETH are not added together as separate losses. They are different forms of value passing through the same execution. Likewise, the following WETH unwrap is not a new theft of ETH on top of the swap. Full transaction and event record.The ETH payout splits into two branchesWhere does the unwrapped ETH go? The WETH contract sends 68.057203111718789216 ETH to the helper. The helper also receives 145 wei with the submitted transaction. A wei is one quintillionth of an ETH; this tiny input matters when checking the payout to its final digit.Start Figure 2 at the WETH contract, then follow the helper's two payout branches. The gray box below the sender marks an allocation limit and has no onward transfer arrow. Both payout branches belong to the same transaction; their side-by-side placement is not a time axis.Figure 2. Solid arrows are ETH transfers in Anchor A. The dashed gray box is an evidence boundary, not an observed destination. Gas is not a helper payout. Sources: Etherscan internal transfers and the provider call trace.ETH accountingExact amountWETH unwrap into helper68.057203111718789216 ETHTransaction value into helper0.000000000000000145 ETHDirect payment to block fee recipient0.986829445119922310 ETHGross payout to transaction sender67.070373666598867051 ETHTransaction gas fee, paid separately by sender0.000845755321487776 ETHUnwrap plus transaction value equals the two helper payouts exactly. The sender's receipt is a gross payout, not automatically its final profit. Even subtracting transaction value and this gas fee would describe only a transaction-specific ETH change; it would not establish wider trading costs, earlier capital or the operator's incident-wide profit. A direct payment to a block fee recipient also does not establish its knowledge or involvement. Internal transfers and transaction fee.What the code supports—and what it does not yet proveA lending market records interest by updating accounting values over time. The DeFiHackLabs reconstruction proposes that an old interval without market activity was reused while the participant changed utilization—the proportion of deposits currently borrowed. In that explanation, repeatedly crediting interest at changing rates lets the participant withdraw more than it supplied. This is an external reconstruction, not a replay we independently executed. Reconstruction and assertions.Direct source inspection provides a narrower check. In Etherscan's currently published TokenHandler source, _checkFirstAction calculates the current block minus the last updated block, then calls setBlocks and syncActionEXR when the difference is positive. In the published interest-model source, _getInterestAmount reads the stored inactive interval and action accounting rates. _calcInterestAmount reads deposit/borrow totals and calculates rates from them; _getNewGlobalEXR multiplies a rate by the interval. TokenHandler source · Interest-model source.Those code relationships help explain the proposed mechanism. They do not establish the exact historical storage values or independently reproduce the exploit. The provider trace reports that the handler delegated calls to this logic address in Anchor A; delegatecall means code at another address runs using the caller's storage context. The inspected source is a present explorer publication, while the trace is provider-reported incident execution. Neither replaces a complete historical-state replay.The reconstruction also uses distinct block contexts: its comments refer to a 264,059-block interval at the deployment block, while its test rolls to the following execution block and asserts 264,060 blocks. We do not silently merge those values or present either as a historical value independently read by this investigation. The missing evidence is the incident-time storage snapshot, decoded full execution and a reproducible replay at the correct parent state.Why the onward trail stops at the senderThe bounded provider follow-up reviewed activity from 17 October 05:43:11 through 22 October 03:15:00 UTC, with limits of two outward hops and ten material transfers. Its source coverage is incomplete. The sender appears in repeated helper executions, so later balances and payments mix multiple activities. A later outgoing payment cannot simply be labelled the same 67.07 ETH because the address received it earlier.The observation window is a requested time boundary, not proof that every transaction up to that time was retrieved. No incident-specific exchange receipt or directly anchored refund was established in that review. This is not a finding that neither exists: unobserved records and unresolved allocation remain. We exclude surrounding tokens, look-alike addresses and unrelated service labels from the incident route rather than drawing a larger network that the evidence does not support.Response points and next recordsFor the market's maintainers, the concrete technical check is how an idle interval and changing utilization interact across repeated actions in one block. Historical storage, active implementation and the before/after interest accounting should be compared before a patch or root-cause statement is treated as validated. The source relationship suggests a targeted test, not a claim that every other market shares the defect.For fund-flow review, the priority is an anchored return transaction or a defensible allocation method at the mixed sender. A screenshot of its balance, a generic exchange label or an unrelated large payment would not answer that question. Full bytecode and execution records for the earlier deployment are separately needed to assess the claimed front-running relationship.The evidence supports one reconciled path: net USDT leaves the BiFi handler, most is swapped for WETH, WETH becomes ETH, and the helper distributes ETH. The accounting is substantially firmer than the attribution and historical root cause. Those differences are the conclusion of this investigation, not details to smooth away.Evidence appendixFull address registerRoleEthereum addresshandler0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3helper0xe08d97e151473a848c3d9ca3f323cb720472d015sender0xc0ffeebabe5d496b2dde509f9fa189c25cf29671builder0x4838b106fce9647bdf1e7877bf73ce8b0bad5f97deployer0x7c78a049fff71609990017b58a959e926e6ec4c6created0x8c0d729d03cb8ecbc79a62a68cdd67ccfa6a7b92morpho0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcbpool0x4e68ccd3e89f51c3074ca5072bbac773960dfa36usdt0xdac17f958d2ee523a2206206994597c13d831ec7weth0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2logic0x47be3d1def039bd85e7570864bb5148e7491a65fmodel0x29ecabde2c57b6d4183f915ebca1a25804a60db1storage0xfdc7d058bede981ea865fb64d06382a2206a1c42Full transaction anchorsAnchor / scopeTransactionB: deployment; block 26,210,255; 17 October 05:42:59 UTC0x15b47e2c0daf723dec64c75b435079d3a1f8a6058b21b9a64dda4844e877a034A: execution; block 26,210,256; 17 October 05:43:11 UTC0x756c68055af7a0630aa0b56891ba4de14c56c39cbebe99e47eeb4728f4d6ad14Transfer-event inventory for Anchor AThe tables below preserve all 142 explorer-displayed ERC-20 transfer rows in event order. They are not 142 separate transactions. USDT uses six decimal places and WETH eighteen in this inventory; the integer USDT event data were checked against every corresponding displayed amount and address. The separate WETH Withdrawal event records the subsequent unwrap; it is not an additional Transfer row. All these events share Anchor A's block and UTC time above.Event / assetFrom → toAmount12 / USDT0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb→ 0xe08d97e151473a848c3d9ca3f323cb720472d01540,499,999.99999714 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3121,257.48502916 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3484,544.91017918 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,795,238.89221520 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e37,238,802.15538922 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e330,860,156.55718524 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3026 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50028 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50030 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50032 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50034 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50036 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50038 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50040 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50042 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50044 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50046 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500Event / assetFrom → toAmount48 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50050 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50052 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50054 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50056 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50058 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50060 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50062 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50064 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50066 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50068 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00070 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50072 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00074 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50076 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00078 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50080 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00082 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500Event / assetFrom → toAmount84 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00086 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50088 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00090 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50092 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00094 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50096 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00098 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500100 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000102 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500104 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000106 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500108 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000110 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500112 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000114 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500116 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000118 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500Event / assetFrom → toAmount120 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000122 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500124 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000126 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500128 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000130 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500132 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000134 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500136 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000138 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500140 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000142 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500144 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000146 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3165,163.833793148 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d015247,951.408655150 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3121,257.485029152 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3484,544.910179154 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,795,238.892215Event / assetFrom → toAmount156 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e37,238,802.155389158 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e330,860,156.557185160 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e30162 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500164 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500166 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500168 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500170 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500172 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500174 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500176 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500178 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500180 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500182 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500184 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500186 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500188 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500190 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500Event / assetFrom → toAmount192 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500194 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500196 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500198 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500200 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500202 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500204 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000206 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500208 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000210 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500212 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000214 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500216 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000218 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500220 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000222 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500224 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000226 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500Event / assetFrom → toAmount228 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000230 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500232 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000234 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500236 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000238 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500240 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000242 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500244 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000246 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500248 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000250 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500252 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000254 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500256 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000258 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500260 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000262 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500Event / assetFrom → toAmount264 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000266 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500268 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000270 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500272 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000274 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500276 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000278 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500280 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000282 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3165,163.833793284 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d015247,951.408655286 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0150288 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0xe08d97e151473a848c3d9ca3f323cb720472d0150.000068289 / WETH0x4e68ccd3e89f51c3074ca5072bbac773960dfa36→ 0xe08d97e151473a848c3d9ca3f323cb720472d01568.057203111718789216290 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x4e68ccd3e89f51c3074ca5072bbac773960dfa36165,574.514633292 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb40,499,999.999997Evidence classificationClaimBasis / limitationUSDT totals, status and UTC timesDirect explorer overview and decoded event reads; integer calculations reproducible from the preserved inventory. Not an independent node consensus check.ETH payoutsDirect explorer internal-transfer display, corroborated by provider trace.Incident-time delegate targetProvider call-trace report; not independently replayed.Idle-interest exploit mechanism / front-runningExternal reconstruction plus limited direct source inspection; historical state, exact replay and ordering causality unconfirmed.Later cash-out / recoveryNot established; follow-up coverage and allocation incomplete.Sources are linked beside the claims and in the exact records above. Explorer labels are descriptive leads, not proof of human identity or culpability.

During the night of 17–18 October 2026, Qubic reported that weak wallet-seed generation had allowed an attacker to drain wallets. A seed is the secret used to derive a wallet’s signing keys: if its generation is predictable, the resulting address can remain valid while its funds are unsafe. The project reported around 2.94 trillion QU affected across 1,404 wallets. This review asks a narrower, reproducible question: what do the public transfers into one listed recipient establish, and where does the evidence stop? Project disclosure; Project explanation of the cause.The directly checked fund path is source addresses → recipient R1. Explorer exports show 205 receipts from 204 distinct sources into R1. One of these transfers and the two transfers from the repeated source were also opened individually with their transfer-event rows. The path drawn here ends at R1. Later containment code names a separate escrow address, but this review does not join R1 to escrow with a verified execution event or independently establish victim repayments. A later project announcement reports that repayments have begun; that attributed update is distinguished below from the checked transaction subset.The roles before the totalsQU is the native asset counted in the Qubic Explorer; the Explorer labels it QUBIC. This article uses QU consistently. A Qubic identity is the public address, not its secret seed. A tick is the network’s numbered processing step, which lets records be ordered without treating a browser’s clock display as UTC. A transfer event describes a balance movement; it is not interchangeable with a separately signed transaction.RoleMeaning in this reportSourcesAddresses recorded as sending QU into R1; being listed does not prove the owner’s identity or consent.R1One of seven initial recipient identities compiled by Qubicmap. The role describes receipt, not a proved person.EscrowAddress named by the official containment code as the intended destination of frozen balances.Frozen identityAn address included in a pinned code list. That list also covers at-risk funds, not only completed theft.The wallet code, the transfer record and the recovery mechanism answer different questions. Public source code can show what a patch was designed to change. Transfer records show who paid which public address and how much. Neither alone proves the attacker’s exact method, real-world identity or a completed refund.What was checked, and what was notMeasureScope / evidence levelReview checkpoint20 October 2026, 00:15 UTC. Historical observations gathered on 20 October; no common pinned state or continuous monitoring is claimed.Incident window17 October 23:42:01–18 October 01:26:19 UTC according to the community dataset; not independently reconstructed for all victims.Direct export subset205 unique successful-transfer rows, 204 source identities, 568,777,432,013 QU into R1. Quantities are transfer amounts, with no separate fee figure added.Individual detail checksThree transactions and their visible QU_TRANSFER rows: the last sampled receipt and both transfers from the repeated source.Whole-incident contextSeven dataset recipient rows sum to 2,939,606,531,944 QU and 1,404 listed source entries. Arithmetic checked; all source histories not replayed.Outside the verified pathMEXC deposit identity, onward transfers, escrow execution events, owner identity, full historical balances and completed restitution.The three principal findings follow from those boundaries. The receipt inventory reconciles to the community subtotal for R1. One address appears twice, explaining why transaction count and source count differ there. Finally, the later frozen-address list and escrow code establish a containment design, not transaction-level proof of recovery. The sections below explain the records behind each finding.17–18 October — receipts converge on one addressQubicmap’s incident checker lists seven initial recipients. R1 has the largest displayed subtotal: 568,777,432,013 QU attributed to 204 listed source addresses. Instead of adopting that row without checking it, we exported all three pages of the Explorer’s displayed signed-transfer table for R1, at 100 rows per page. The resulting 205 unique records sum to exactly the same amount. Community incident dataset; VNJZRGGRYRTKHANUZHLTHTSBQOFCTCJKUKLCVIWCSBRTZNYOJEVPGYDCDRCM.These exports independently support that one recipient’s displayed inventory. They do not independently establish every row in the community dataset, prove who owned the source keys, or replace a native consensus replay. In particular, the sum of the seven displayed source counts is not an independently deduplicated, cross-recipient victim count.Start Figure 1 with the source group at the top and follow the single solid arrow into R1. It represents the 205 exported QU receipts, not 205 different victims. The sample panel anchors one of those receipts to an individually opened transaction. The broken line underneath is an observation boundary, not a route to an unnamed service.Figure 1. Blue-gray boxes summarize the exported source and recipient roles. The solid arrow means recorded QU receipts; it is not scaled to quantity or time. The pale sage panel is one individual detail check, not an additional inflow. Full records and links are retained in Appendix B.The matching subtotal makes the community lead useful without making every wider allegation verified. The next question is why the Explorer gives 205 receipts while the dataset names 204 source addresses. That difference can be resolved inside the exported records, without guessing an extra victim.One source paid twice — transaction count is not victim countAt tick 85,362,890, the repeated source sends 17,065,760,963 QU into R1. At tick 85,371,060 it sends another 1 QU to the same recipient. Both transaction detail pages show the same full source and destination, and each contains a matching QU_TRANSFER event row. First transfer; Later 1 QU transfer.RecordQU / tick / eventpwjalmhztlijreususcvpefiruyddqtmxgahgozctclvxvwfctdzjjxcfvdl17,065,760,963 QU · tick 85,362,890 · event 19832786rmqdmmstqcugfblgthzbnwtrivdcwdpjdkrxodvcbgiszelbeqapasidnolc1 QU · tick 85,371,060 · event 19996143Counting this source once, rather than once per transfer, yields 204 distinct source identities across 205 receipts. The later 1 QU payment is not evidence of a test, a refund or a different attacker: its intent is not recorded. This local reconciliation also does not resolve a separate public discrepancy between 1,404 and 1,405 affected identities, or between seven initial recipients and eight wallets mentioned in later community commentary.The final sampled receipt provides a second type of cross-check. At tick 85,371,146, the Explorer transaction and event both record 106,444,954 QU from source S into R1. Qubicmap’s lookup for S returns the same hash, quantity and tick, classifying it as drained. That is corroboration of the dataset entry, not independent evidence of consent or ownership. Sample transaction; Sample event.Time requires a separate caution. Qubicmap explicitly labels this sample 18 October 01:26:10 UTC; the Explorer in the reviewed browser displays 10:26:10. The nine-hour difference is consistent with the local browser setting, but the exported CSV has no timezone label and raw UTC was not independently obtained. Appendix B therefore preserves its display time as recorded and orders records by tick. It does not silently relabel those timestamps as UTC.18 October — the patch changes seed generation, not existing keysAfter the reported transfer window, the wallet repository records a change replacing Math.random-based generation in the create-vault and seed-edit flows with a shared secure generator. The v4.26.4 helper reads random bytes through crypto.getRandomValues. It refuses to generate a seed if that capability is absent. Pinned wallet patch; v4.26.4 release.The helper produces 55 lowercase letters. It accepts byte values below 234, then maps each accepted value to one of 26 letters; rejecting the remaining byte values avoids giving some letters more possible inputs than others. This is a direct code observation, not a measurement of how unpredictable the random input on an affected device was (its entropy). We did not reproduce the attacker’s seed search, inspect a victim device, or establish which exact bundle every affected wallet ran.A public proposal opened on 12 February 2026 already discusses secure seed generation. Its existence is relevant history, but it does not by itself establish a decision-maker’s knowledge, intent, or the precise cause of every affected key. Likewise, publishing a patched generator does not replace keys created earlier or prove that every installed wallet has updated. Earlier public proposal, PR 229.19 October — a frozen list and an escrow designThe project’s earlier update reported a network halt at tick 85,371,949. On 19 October, Core PR 1048 was merged for v1.308.2. The pinned frozen-address file contains 2,797 distinct identities and specifies FREEZE_FROM_TICK 85,371,950. All seven dataset recipients and the individually sampled source occur in that exact list. The larger list must not be called 2,797 confirmed victims: the containment change also addresses at-risk funds. Project halt statement; Merged Core change; Pinned frozen-address list.The associated sweep code describes reducing frozen balances, increasing the escrow balance and logging QU transfers, alongside asset handling. A later commit explicitly sets the escrow identity preserved in Appendix A. This is a different type of evidence from an ordinary signed transfer: protocol-generated balance movements may not appear as signed transactions in an Explorer table. Sweep implementation; Escrow identity commit.Read Figure 2 from top to bottom as evidence stages, not a stream of money. The first box is the pinned code configuration. The second is an Explorer account-header observation. The dashed third box outlines the execution and reimbursement records still needed. The bottom panel separately identifies the later project announcement; it is not another directly checked transfer. There are no fund-transfer arrows between these boxes because this review has not verified those joins.Figure 2. Sage marks directly read repository configuration; blue-gray marks a separate aggregate Explorer observation; the dashed neutral panel marks missing execution and repayment evidence. The bottom panel is a later project statement, not an independently verified payment record. Vertical order is a reading guide only. These are not amounts to add together.The escrow account header displayed 2,836,660,961,867 QU and 1,441 incoming transfers during the 20 October review, with its latest incoming tick shown as 85,398,715. Its detailed Transactions and Events panels returned no records at that time. R1’s header likewise showed a later outgoing count, while the signed-transfer export contained only receipts. The Explorer’s Events feature warns that coverage is provisional. These mismatches prevent a transaction-level reconstruction of the sweep; an empty detail table does not prove that no protocol movement occurred. XMGUNWJYLLUUZANFEWJNNIDMXNSDMPOVFAHWOERKDDAWDREZLANHTFJBKMPB.Nor can the escrow header be subtracted from the incident total and called missing funds or recovered funds. The two figures have different populations and observation points. A recovery conclusion requires the actual sweep events, their source identities, quantities and ticks, followed separately by evidence of payments to entitled holders. None of those missing joins is drawn as a confirmed path here.20 October — the project reports restart and first repaymentsAt 18:14:20 UTC on 20 October (21 October in Korea), Qubic announced that the Computor quorum had approved recovery, the network was live again, the reclaim platform was open and the first funds had returned to verified owners. A following post said affected funds had been moved into protected escrow during the halt. These are newly read project statements, not independently matched sweep or repayment transactions. Restart and first-repayment announcement; Project escrow account.This changes the reported operational stage from planned containment to announced recovery in progress. It does not change the 205-receipt inventory or provide a verified recipient-by-recipient refund ledger in this review. The statement does not supply a repayment amount in the text examined; no recovery percentage is calculated. Figure 2 therefore keeps the directly checked code/header evidence separate from the project’s later announcement and draws no payment arrow.The project also states that the claim window runs until 1 May 2027. Readers should navigate from the verified project announcement for current instructions; this report neither submits a claim nor requests a seed. The source’s announcement of first payments must not be rewritten as full restitution. Project claim-window statement.What the wider claims still needThe project’s 18 October statement said 87.1% remained on-network and 12.9% had reached MEXC and been frozen. This is a dated project account. This review has not obtained and verified the complete MEXC deposit identity and transaction chain, an exchange confirmation, or a current freeze-status record. It therefore does not label any of the seven recipients as MEXC or call a payment a completed cash-out. Dated project funds-status statement.Open questionRecord needed / current boundaryWhole-incident tallyReplay and deduplicate every source history across all recipient groups; seven displayed row totals alone are insufficient.Seven recipients / eight later walletsThe additional full identity and its transition records; different stages may explain the counts, but that is not established.MEXC connectionExact deposit identity, native transfer/event records and attributable service confirmation.Sweep / repaymentSource-to-escrow execution events followed by separate holder-payment evidence. Code and header totals alone do not prove either.Root cause / identityAffected build and device-level evidence, attacker-method reproduction or attributable records; transfers alone supply neither.An alternative interpretation of the missing signed outbound records is a system-generated sweep rather than an ordinary signed transaction. The official implementation makes that technically plausible. It remains an interpretation until the relevant execution records are obtained. The same discipline applies to the two small-versus-large payments: a visible sequence is not a recorded motive.Where the next response should focusFor affected holders, the specific concern is the generation of the original secret, not an ERC-20 allowance. A software update can prevent the old generation path from being used again; it cannot make an already exposed secret unpredictable. Any migration or claim should use the project’s verified channels and current containment instructions, without submitting a secret seed to a checker. The public checker reviewed here uses an address, not a seed.For maintainers, the next evidence should join the approved release to its actual network execution: frozen identity, movement event, quantity, escrow destination and tick. For service investigators, the next separate task is the exact MEXC deposit trail and the service’s status record. For this report, the strongest completed result is narrower: one independently summed recipient inventory, a concrete explanation of its extra transfer, and a clearly marked boundary between containment design and demonstrated recovery.Appendix A — full address roles and source boundariesRole / evidenceFull Qubic identityR1 · exported receipt inventoryVNJZRGGRYRTKHANUZHLTHTSBQOFCTCJKUKLCVIWCSBRTZNYOJEVPGYDCDRCMS · individually checked sample sourceZNTRZHEVDZPLQGJFHVKUYYSKWNBAZBZDMGHMWSANCGXKEJOXVIZJXPQDZYLORepeated source · two individually checked receiptsIZOOJMBGEKCGZBMYIFEWRPCMMGUCMFOODFVWGEGZAHWWJLHGWRHVRQKBSSHIEscrow · official code identity, header onlyXMGUNWJYLLUUZANFEWJNNIDMXNSDMPOVFAHWOERKDDAWDREZLANHTFJBKMPBThe next table transcribes the community dataset, not seven independently replayed inventories. Only R1’s 205-row signed-transfer listing was exported and reconciled. “Source entries” follows the site’s grouping; a globally unique victim count has not been independently established.Dataset recipient / full identityListed source entries / QUR1 · VNJZRGGRYRTKHANUZHLTHTSBQOFCTCJKUKLCVIWCSBRTZNYOJEVPGYDCDRCM204 / 568,777,432,013 QUR2 · XVPYBEQNKNBKVCFPVGCFFNBZDEBDGJWVGDCBDBQBCFPRQKJNYXIJJWFDQXDI203 / 453,611,215,145 QUR3 · TFYIRQPKYCPQOEUGRZMKCFQNJKPDMPGGKSWISAYLXAIZKFWKAYRXJMZGYVLE202 / 414,758,635,767 QUR4 · JRDYPWVXWSKBXEIMGTHSVPWPMACDONYHRXPGMCNRJGRFQQDEXBADDGTBDIPO201 / 390,892,863,292 QUR5 · YBFJMLNSECZSQBLQUBUDLKYFJMIDYLZPNXAUGUKLTEBLJRHFHBIEPYSCRHWO199 / 379,522,533,375 QUR6 · VICIUULQUOHBIDLNMZNLPQPGSUDDLXUARWEGVOZIEGGFBELUXLMWHHYADJMN197 / 369,642,443,319 QUR7 · FSLWPFDDKMXCEGBTOJRBYOVMFULCQAQDAGAHJBVSAALWYMTZESNLCDUAVZBA198 / 362,401,409,033 QUThe seven quantities sum to 2,939,606,531,944 QU and their displayed source counts sum to 1,404. Frozen-list membership was checked against the pinned file for all seven recipients and the sample source. Membership describes the code’s target set, not the legal identity or guilt of an address owner.Appendix B — reproducible receipt inventoryThe following 205 records reproduce the three downloaded Explorer pages for R1, sorted by tick and hash. They are exported listing observations, not 205 individual detail-page or signature-replay checks. Every row has the same R1 destination given in Appendix A, input type 0 / Transfer, and the exported status Successful transfer. Full source identities and full transaction hashes are preserved. Amounts are exact QU integers; no USD valuation or additional fee estimate is included. The time column is the CSV’s browser display time on 18 October 2026, with timezone unspecified in the export—not a UTC claim.Receipt records 1–15Full transaction / QU / tick / display timeFull source identitykzmbprybxrynifebbcnhpumfozkgrwooahriezmymfwmdzhversdfhbhsrzn1 QUTick 85,358,7112026-10-18 08:42:01KASNLYSOXMDBLAIORZLAOTMZRIOAQXKMGUXSYVOGJHPAAPCYCZJZPQLFMPUOqccojabeomubqgxualmhaanyvnkffahkgpyaayuddairmpbzdascbahffaua1 QUTick 85,358,8122026-10-18 08:42:51TZDRKWYCSPMPXEBMOGDBOWTAZKUCHJTPCSRZGRWCHHVJLFWXCPRGEKQEEXKCxecinfqhvgpkpbxulphgtgjqrylauzrnczvbjsctkgbaeztwbtbpuifehhzi1 QUTick 85,359,5862026-10-18 08:49:20SPLUVFUYTYYNUCCVNVCGZGCWCDMADAIQDMAWPMURKAZFEIVWHXVIWTGCCQPFrfhjyhwajoicraoacoqnjrcmauraqayaykmvohfkxgjypoxvdgvmqtrbmmwb1 QUTick 85,359,6042026-10-18 08:49:29KYGYRXSQYCYFBHKPRFBJPWQFSGLDQCETADWDAVFHMGIBIAZEFUBYNRMBGBWFagrtlqrxppicodvduldkqljwepfgfalcsvzsonheqfehokghaeqnhneeyasg1 QUTick 85,359,6202026-10-18 08:49:37PLWVYDWFQXOVBFAKGQCPYLKFBKCAXKSKZGGNHZESYDELJQPSFGCUJJXEVTVKoesqvoattvnvtebaftbnumgcmrugezibozfwhvlmackaxfyxrwdycvvefjna1 QUTick 85,359,6372026-10-18 08:49:45IPIWJJMRSDKKZBJJDUGJCRYNHWLCDYZIEELOGTGFADVXUDCSMLXDTSXGFLCOgthgtqytkcuejfkpjtmblnyqoiceqsiqseehikhjsfvdxeiafbfgxigegmja212,742,939,086 QUTick 85,361,8592026-10-18 09:08:23PSIVKNHDUSLWRAEZJQAOQMUKYGCBUYGXQTKKZGIEKHHEHSKCKKYCUAPAFOMFlpspgmkxhmlseasrkyfaibkozkydslmjiaoegyrllcqzrzwhuzuwlwqeccel51,756,401,205 QUTick 85,362,8312026-10-18 09:16:30TYODSNDLGNDJVEFNMPACXEDOJRADMTPQAVJDQBKSZEYGMHNFVIFKRXHGSDLNsytrnjsydbguiaiikyiccznpggnfherhovgoebusmbgfznanlgxwfnifzbpi25,366,718,545 QUTick 85,362,8472026-10-18 09:16:38EDPSUEXTDTGHSFQRLHJHYKAKHBGBPEOMSRJHNMFSNDKMTKAIFMISVENEQJUNsraciimlofqwzafurukymzeopzdhbbfxducrwwjweahiqkmclevfotcbaihl21,118,078,476 QUTick 85,362,8652026-10-18 09:16:48EPKPWOLYQKSWCABARVUDIIBOQOKBCLHMSKCVXYORHGUSKJCVDRZQXOODVRDLpwjalmhztlijreususcvpefiruyddqtmxgahgozctclvxvwfctdzjjxcfvdl17,065,760,963 QUTick 85,362,8902026-10-18 09:17:00IZOOJMBGEKCGZBMYIFEWRPCMMGUCMFOODFVWGEGZAHWWJLHGWRHVRQKBSSHIugmlpkophuaxebvpgdsbqmtmcadcbkxqrgpeaqqlhgqjujrbzggponvbhxam14,378,018,567 QUTick 85,362,9062026-10-18 09:17:08AJONCVKYTRUFVACBOHDVBCYMYTSAZFRCUJWPCBPXAAVMIIJDRYPRYYAFGSAGojmewyvoysxzsfpzterifvogebcbyvppkuserhqpgdohjekvznzaktiaanse12,672,798,403 QUTick 85,362,9232026-10-18 09:17:16BOXZEAOSYPYNKFKNHSDMOJINUJOCZTGXKQXXNRGLXEIJCAZEJHZUPFECVSPBecncmspihotondgduyqdwncofynbpwhybffqftifqftqzivlmrkqzyaeysil11,372,064,965 QUTick 85,362,9462026-10-18 09:17:28YALBTQYLHXCMXCIIYHCWALTQEJMALDQUDCHBBBSMIGHUJDJTGWATTNMBILRKrblfngebzrxyxebuglheufnrwdefiwqjxksixttghbemypigkprkbptexbnm10,819,690,581 QUTick 85,362,9462026-10-18 09:17:28VQBTUXWCJTTCMCAGGUIQDTVMAMSAYAAXNULLHXSFOBOZVVUKEPIZZDCAYJKHReceipt records 16–30Full transaction / QU / tick / display timeFull source identityoqpbqdswaqwqtfdhaybfgrmefafddzddjmtagbhoscuumwgdoywqsfgbezyd9,754,066,043 QUTick 85,362,9642026-10-18 09:17:37VWDVFOFUWEAFEBRBFCPBOUQGEAODOTNLSPNXTJZBUBLCKYGZTXMVMUCGOBKHsijbfgbkhzlfzcpmgynufeeaiwxfvxkgpuackgashgwlobcsjnugrvgaukrb9,000,027,944 QUTick 85,362,9812026-10-18 09:17:45FPMCTILWDFNNGFYHIHFTGTAQDTZCJHFFKNAEWCAGADJZQALQTZLFWDFBVLRGukwdxvtfmjzpcafnpnmpsmxskylbvbxeyrdjttphtgfcorciplqvvoceptig8,337,564,524 QUTick 85,362,9972026-10-18 09:17:54TSWIERUTBTUEWAFAXJWXNXJBYJPCPUOTWTBGWUXXOAETHOZTJUYIQIRGEYLLfaredsjokwudgesazbjyqnqyfpncvistgtxaehwboevxwduobptlysrcybae7,579,688,282 QUTick 85,363,0132026-10-18 09:18:02HSOELKNOZBTNNCZALLXRBAIQPEXCKKVSIWBICQIMLCUXCJMHVKHEMDIAKMTOwdfvnpgsaidmehonilfmhibxuibgesiddiemdvarnbtkzuolajhiclmgtori6,787,011,016 QUTick 85,363,0302026-10-18 09:18:10MUXUVHVSVATKAEYGAPJITRSLOMDDNBSPXDYDFVSMQAZITYTUIXVHWCSFPECNiubcxsoijfrfaehpjjgzgfrwttgelpkfhtwxfwhjqftprorudrcabuwcmiil6,366,030,287 QUTick 85,363,0682026-10-18 09:18:30JYMLQRGJPTPRLEBTSJPIVWPZNFRBVFLCCWMRIVMVHDGWGJLESFMGXIXENFCCalwikiqvdfsrjcvlozwgdcwpsvkfvvtwppbezrydyaibckeqwimodasfxgxn5,714,667,283 QUTick 85,363,0842026-10-18 09:18:38PBFIQXQHCICJKCTOUQPKXXCNRADBZHWIQIPUCTOYHGFBNVOVXFHBGZWBLBJFrpyhvkgqsnewrbnjfyermhbiaiebptlbiwfllomlzgquelxbkorfldoafgjl6,057,884,318 QUTick 85,363,0842026-10-18 09:18:38LGLTZGLQKTOTYEEWSJDASVGCJUGAUTTJZGTSYGOLZGYVMVRRXVVBCHJAWOFAceckxgxkmlbysbnyzcnlgmmlprigqpvozslldzyoadxdgqzqdjevrqdfslti5,201,589,839 QUTick 85,363,1012026-10-18 09:18:46EPUGBZESRCWUOGHUZICXFDWRQLACQZNURGIYZOQGIEOFKPMBROLQIKDHQMZDddpmiragocjgxfcnadnvncxocywabsspduqrsbfnaeuwhpawypsnycucxjpa5,017,128,141 QUTick 85,363,1182026-10-18 09:18:55EIFORJHQTPYQHFTAXTHUEOJHFKMDMMPUIYLZDGLKLGKOBLFEYLQFBFKEYWYKklzgxjlghgyvnexwqovagxeaqpbfagznzehteqbdnfpecsbewgznotibuoel5,000,000,000 QUTick 85,363,1352026-10-18 09:19:03BLWAJAWFXNSWHGRSGOYYYLYYVOTCLBMXGSETMQHIIGZIASPUHTFKVMRBWMQBuwvfehpfcyrnxavksgtrktbyfovgjtfnixvimgngrctdldnergnzvuvbowkc4,697,398,495 QUTick 85,363,1522026-10-18 09:19:12EHZVSFKPQACRACISGYKWAVLJXELBNEPTNTSFATNWXEAMEXYAHMVUUOGGCZMNzcavownlosvgydolrftkjpvtopjglkutkeefmnpguemklkayskwykxkbytti4,414,748,788 QUTick 85,363,1682026-10-18 09:19:20EHSYFDWZHYRAQAIGLJLUJOCOTILBCHKONJBYOKPPUEZQOGAZCCWQMSUEQJLBvpyxsnhqhoxawgkzsnqzexvqrexbomsendzcevjtwamybmfjuvqgcqhavnaj4,074,866,216 QUTick 85,363,1862026-10-18 09:19:29ZCUNMOBFWNYVHGTHBIHWVXRTBJACVFPOHDXMRTZVJBDBCYEGKZWJSBAHKXHIedptxlwkhjheycnkxczreasjalealkrkngqwsfffpfsfjjschebsomobhlkl3,725,843,245 QUTick 85,363,2032026-10-18 09:19:37FXLGZDOFJTWJODZFPALRYPAXGVBDBLTCTWOMZWRXRGNJLMFIXBJNFWGCQDUCReceipt records 31–45Full transaction / QU / tick / display timeFull source identityvxspqporvgqmbafbjkzmaielpqcgaojfvxowlxogrfbkbzqjfvuakxibutbg3,924,612,435 QUTick 85,363,2032026-10-18 09:19:37WFKIYQSOJYWJSDXJFJZGYWRIEZODFSZRYRFIZUGETFPPZFITRLHURPUDNOCMglgkpmkposgbiexefupbndznbszgkhicefvlkyjnaestfjsguncxphtagnya3,555,429,774 QUTick 85,363,2212026-10-18 09:19:46NWDKZDYKXMWEZFJYGTKJVKVXPKRBGSLVNSFXGTNSKHIDVDYZJRQPEGSGMHKNssgxvdcnnyewgaoxdjmbiqgzysbgqqbehfwzedlmidzxfvfkvajpqevbpxik3,424,017,171 QUTick 85,363,2372026-10-18 09:19:54TRIOFGEXRZQREDXGWFZOHOUTXWYAWAJILPZWQMRQEGAOFNVSZHCPZLMAUIMHptoauavntmoyjaeyeptjnqoydldgdydgdimbrvnaofelqvivwnwdgqvgyite3,247,781,824 QUTick 85,363,2532026-10-18 09:20:02CGKLIPVFQOESXFPEMBHTPCNPBEUAZURDUDFRYSOQMDZTSGYQHMLZSWNBQFAAfynymhdjvcufwdhhlmzdikievppflwirlystqlyhaeegqqypxvsioebgyzjh3,197,102,035 QUTick 85,363,2702026-10-18 09:20:11MIRUWADIHXORIGGYNXIQFRFGXOQDYYHFJDTNQXYXUGORIONREWHMBXQCHJNCychusmwkkrkqobrhmjidmtkebocaxifqbfirjnrcbexcegidtrwfrncacurf3,000,000,000 QUTick 85,363,3092026-10-18 09:20:31BPKGWUHGMOZGNALTMWSZHARLPQRDBAQNIBAJHTNNZCFCSKMUULSNWDDHCZILbsajktwoakmtihebcwsenadpqobgpyuedfjjdjgybdjcvptyfxtltfchwipf2,845,360,475 QUTick 85,363,3272026-10-18 09:20:39WRWYHYWZQLOTREIYYXOPHVJLVVDAOYKZBOISVASCRGCKXKCFTIMFVVGHHJQGcxzfwkzlssesjcpzzvufgwardrpctywynvfxwgrksbqfhhdmupxhribgmeyh2,759,658,234 QUTick 85,363,3272026-10-18 09:20:39SAIJJORIJIAXBBOTBCYJWICHXGTBYSMNWGHWEHFXHAKLPDJPLLJCKVJENWJJqjezoconfkjznbjmywrwhdppgfxancraojilmnlecdiigxrpkxzpvuvaekhd2,501,199,943 QUTick 85,363,3642026-10-18 09:20:58SAUMYHMDZUTGXCJHVLPAPAKXNKNAEINSFNSTUNLUGDTZOWMWOZJKMXSFSAUDngvgxkiyomnwlakzdwvhuipirljdcsstylwxpqhyhbywigirhkbduageuryk2,396,783,689 QUTick 85,363,3832026-10-18 09:21:08FQDOSZPXMKQSFDTYZHPEMXBIZGCAPDRJJSGZSDQXMDSQFSMSYAHWGOOETQGHvrxiaxdppqveweisebbarjsmdyhfchawtbpjphvnvezkvghfhhvfzeugyaue2,249,918,358 QUTick 85,363,3992026-10-18 09:21:15PWWQYZJVJAKJCCSNDECPVVBCQRLCGDNGSSYJZOTBWGAGJBNIZLUXCAAGTSAJrwkbptuspwvfscsmetnitzkhutqfozsavshnhlwvudiimvhippcviaadozrm2,172,978,396 QUTick 85,363,4162026-10-18 09:21:24XCDZVYULADWVPCUHOVIBHEPCCCJBQTKOLJVPCEARKDZULBFXAHJSYNJBKOIDcotozmohdpiskffjhaiajbawigjgpbmknlvtieykxbtufctydooidxhcybjb2,129,573,252 QUTick 85,363,4322026-10-18 09:21:32RLZGDRAEGULLLBPUPFHQILAEMGHBBYXGYSFEHEYXBBFTWDEAMONPMEUFOIAEaeslbhoorxwmzaxpwatrwdzqwnjgczgwizgrmfodlgyrosikvlnevqqbbrbm1,999,595,479 QUTick 85,363,4482026-10-18 09:21:40WBBQHJJBHFOYTCWBSGURWBOKBMCDFGCCGSYDBNXXEBMZTXLVVMVWSWTDLFCLgokzcppyuulvqcapzjfyvbaxvsjdzfsqihlaodkufebbpytkpfabvwzacrej2,024,069,020 QUTick 85,363,4482026-10-18 09:21:40TTINTYYLMHYBOFYEVIMXSYRBURCBWQKQPWZMGDTUQEPDINQRTNFEYEICLEPOReceipt records 46–60Full transaction / QU / tick / display timeFull source identityhjtbeffilsbridxrjzjnhijnfrucbfkblhhueygbmetuicygeavghjgenmrl1,910,724,313 QUTick 85,363,4842026-10-18 09:21:58SDORRDIREXSYIBLEBTOTUJNHGGVBUPDAJMACBSRCGAVGJFFVVNULKKAHORLOkjhwxqffmpoodeaqziztybpactngcsdhwxgxgtpgkeuncoktgtjdfwkhdncn1,830,595,569 QUTick 85,363,5002026-10-18 09:22:06AFAUHXJYEPHMBFEHPCFKCNBTEOPALVWSTFGUCZCJQEAQNTOPZNZUSSOAZUABtkvylsrzepfjmcamcevyilwjoepfklnkozsjxwilretagzhvszwwxvlbxyxj1,770,947,401 QUTick 85,363,5172026-10-18 09:22:15FQJJRMWGYTVUZFAHULRJNCQGRSSAUGWDCYHKCFCXIHIMBRSDQZEZDAKACJNFtoroalyboskvdgdslzytnfgegtsakpesuoxslphklfqlfyebdsfqygmaebul1,718,218,570 QUTick 85,363,5342026-10-18 09:22:23PIJRJTIIPBOPGEQRNWTRTVOSFCHDODEZGUHVCCUPTDBQGWABHKJPTPPGLFGNupxwcqggqrgtqeaxjdlqkgkawmvbfygbsgpotcmmbcelcbvagvumeqchcstl1,664,726,712 QUTick 85,363,5512026-10-18 09:22:32MFQJQLETCBGNZEFPXNPXPJUEUDJCAKNJHRVYOEMITFJUJUZEFNOQETRCDWIFavvnzsxlkiqczgkgxmgrrxqiqefgphhsqkxkfstichbvkhynyojxfgfeqczb1,601,017,605 QUTick 85,363,5682026-10-18 09:22:40MONPENGZUYGDNBGRSYAOASVFXOGBOPWFJRUMOCDOHHJPHFOSGWABUHVGFBKGtdaownyayypuzggskuoinikqenefqapzqzakpwcqbakjyznptpiibbbcqfml1,513,044,159 QUTick 85,363,5852026-10-18 09:22:48NNXWEXIOWFDFWBXJHWBFUDEQCLRCNIEFHEFOVTZAHFDJJLXCQGBLJPQAUVQOotfbzsziydpubhtpymxyjegpjeiddaybjpcdkftctffmwtsmyolgwehfvlfk1,434,637,934 QUTick 85,363,6112026-10-18 09:23:01LXMFNXIBNBCCCARVQUOAISIWPIIAYJQCZKLIYBTQGHHPGDEIPKNDMWWCFRWDayvfwvytxrtelcemkkwzuamvxmcbaezogynissmghgstloeqntqfpkuggfzb1,375,135,152 QUTick 85,363,6282026-10-18 09:23:10TFLBOJMMJRCFRALYQPRIMXLVMOPDQBPCYGIQKKEJGEJSPOUNOOEIQPSGMJWExhsurqdhqsscuaqmmntsnfemgkchloxrgdodecllvbskdpzyptdfigkcpktc1,324,472,150 QUTick 85,363,6442026-10-18 09:23:19GDAOAUJCEPSGSGTEIQRLXXMLQKXBDVEBJPBMMKNOEGHPOLAQCJDFBTSEVHVOonwvlrxwhwvoagenbzrxuxfbuzabwfctdhmfnjkhedcsyburhdijpbjegbnm1,260,813,994 QUTick 85,363,6612026-10-18 09:23:27VWNQXIMMAKCGLGTDHFJFAZEUSKDBBRCDULXYKQGJFAQWFYENQIYUYWCFJOTBnalfkczccmchwayxbigtfysdpobbfftnlxgiudzrzdyrgryyznokgatcchej1,225,887,157 QUTick 85,363,6782026-10-18 09:23:36KNIRHZHHUJCBHFRNLUABMMZCCDCBPBEIWWGRZKMOAHNYXJLWTAWNLTFDIUAAumzxwtlorhwmwfyfoejjzlchltgbtxfigcdawvvojhiqtkroapnfmqxcocme1,204,619,018 QUTick 85,363,6942026-10-18 09:23:44QJWBQCJWMTOXEHBJZSJQLVNLRROAIWCAXOTWPKUDMDBKJFTOGZOEYLBAUWONhqibubvvjwnvjgnrrhpwcnovasidxfqbkvjzbhysucoemsydxlvygikewsai1,177,390,335 QUTick 85,363,7572026-10-18 09:24:16VSSECZMTLQHFOGFMPUBDIGXESWCBGRTBGHZXUUFHFAKLRVVZLOUHBJIDAASBppvpesndkamviearsedyfhekquyepyaqcccabofxrdzoguoenvbdwvxgnzfk1,107,254,001 QUTick 85,364,0662026-10-18 09:26:52SILVTLWPELACKHGNEZDSCXCVHMDDBVMVUQNYWUMFOAJUUNNITSHUELLFSTEHReceipt records 61–75Full transaction / QU / tick / display timeFull source identitygmqjlecspmfxvbnphpnuswpikfebdopiqwkvcbtxfevldyxjqgsvealghkai1,084,143,572 QUTick 85,364,0832026-10-18 09:27:00TOWAJBLWQTQAPFNWRHZOVKEHHVJBGJNLEOOBUJZASCYRNQSKNLEJOZRAQRYHmvztamwnmubkjbtdwynxdwhqyiehacifshnozdtwkcprkpyepfhuzltbpzun1,061,863,902 QUTick 85,364,0992026-10-18 09:27:08EKLFOALYHZFYMBPFKGLNDMQJHEABLZFASPIVNGFTTEWPAVOIEOAEBLBCWBVEhqmdvldphwqrlcbadqomeyfpbflgxxhmtsbnwfhowdsoxiptlkjmvgmdlovh1,047,275,320 QUTick 85,364,1162026-10-18 09:27:17FMVRSQIBAOXTMGTEMERVDRGLUZNAOAFQVNJNJFPQPCDJOVEPVAWQKOQENMQKcdlbdezaxnntzamtxuublxdtbrtbxqzltiheqcpvycoskfajpbbnrreaqede1,027,279,561 QUTick 85,364,1322026-10-18 09:27:25FDCIQLNKDXOBOCNKTXOGCWMWVOGBFSLHCWUVEDZQPESZOBXAYRBEHXXCXNCNzkrezdqgdqvjwflxodyvkspsjuchkewhjnbbyqnkhhvddyqmrtyglmvdkcoo1,011,997,337 QUTick 85,364,1492026-10-18 09:27:33SOEHPCYUYEWBOEWTMJTSREMGVFQCACQETHCJHXGBKFSMEPWOETPIANKFAYVJdfdyjwvsxlndwbovfplbttykukabggsiaubmhlmmjbkbdywpxjqxgmdflhkl1,004,249,575 QUTick 85,364,1672026-10-18 09:27:43NGYTBPLJPMQOWDSBNMVUDJUSBOYAZBJMONITXDSDSANWCQNLQLHFNASDANTDmpwicnztrwkqmgimtzxmsegvvbdhurcrdiputneijdjrwbpcwxtcghkgmugb1,000,300,000 QUTick 85,364,1672026-10-18 09:27:43EMSZXXFEZGBBHEHBGUIAERQDQXLCOUWXSBYQDAKJDBRGLTNOYBMGUZNDHCNMrbxgtkjqtlfifdkxekiahmxujokdjoprjtpxmfixidnbddlpyomcxwceatgj1,000,000,000 QUTick 85,364,1852026-10-18 09:27:52CUVHDLQVRUIOKDUEWIWBEJLBEZXASQKRVSLEPVCLEDOMCOPIEJKSUTHHNMYEuddwygqhjipiveoohagpjaynqbyedpzsiwdscuspqeuoghxhabsaqaheybqb976,312,184 QUTick 85,364,2022026-10-18 09:28:00SXMMLLLPICIFXEBZLVEPAPIBNEKCTIDCVLGUSCNUCGHLYBVDGUDKHFVEQJUMcseuzzhyhoudlhjonfeiaqzolzsgekqtbkrzkqraabtpvjokfpisewmajvhn951,293,830 QUTick 85,364,2192026-10-18 09:28:09NAMBSOAPCIQXPDHCUDRYLNEOAUIDRIPZKTEMCUJOBAFGGWJQNYLTIBZGQWLLcunzsjbyxcmvzgggjwyyjbvpokneabhhztnqllnzecsopnjtcrdsddbfokgl898,117,637 QUTick 85,364,2362026-10-18 09:28:17CMJBXIWZPOWORGOMUOZRKPVRWVTABSXXDEHFJKPMTCFAXUZVRSYIGPBBAKFEzwsabygmvomdneoqsdypqwnoagzfwhxeyyemwgtixcriqajvrtwlfpfhifng857,173,848 QUTick 85,364,2522026-10-18 09:28:26ZPOLURHJBSVTAHZAQYGGHGPUPFQCOQFPNCBXJDGWVAXRVJFNFHHQDVZCMPWIyrwfdeagqxbtugbqhslaqlxprwedarwlnbgylmdkaaadqvmhtxbfgebfivak831,920,983 QUTick 85,364,2682026-10-18 09:28:33XOGSCISFRRCVNDRHWWSVHMGMDAMAEZIQTGWTMRUBTGCVGFWURZGLEDIABYYIbaahlqsqiwppxcmkhhphbuptrnabbswbflbctbxjjgpzujrnktxpvqdfkuwm802,721,256 QUTick 85,364,2842026-10-18 09:28:42DGYYLNDHJIUOHASOKCUMDJZEHZRDREWOTJMMHDIFGEOXPYOJXQDLXFDBOLWLrjbziqtzrnhxofexrzqhetnzdzodixagzlqjwwrfrdudzbngzkrnkrdftmwm783,377,055 QUTick 85,364,2842026-10-18 09:28:42HZOUHPJHGAYWNEDOUQTDUOUKJAPCWFIYAPZBMZVPSFQYKBODGQNLFINFPVLFReceipt records 76–90Full transaction / QU / tick / display timeFull source identityxaibjkpnqllzqgemxwryaeioarrgudianttnbnlkugewtalbcmtmtufbobhe759,169,910 QUTick 85,364,3012026-10-18 09:28:50USUEWVENMAXYLASQXYMCAYFLHNCDOMDLUWKBQZWPPCOWVCGNCWEYXDSBDKWKdabwlvzeqltmjdogtkhfxzterzechxtpwxmvzqiozgksrzjyijbqnnehutkg724,377,202 QUTick 85,364,3172026-10-18 09:28:58HGIFDDHEHFZINAYKPLDLBJBXPMDCSWNEWPRXFWKGJECOVQDWOYSZEHQFWVODccquqnzwdvhadgahuqxdtmpzdtqbjuulisjhoeobkgfzknwrfkxahllfwbtn699,800,000 QUTick 85,364,3352026-10-18 09:29:07CUEYMHCCTJJCTDBNWLJISKERKNMAWCICEWZVJAYAYCYGFEBGACQSGKUEYCSIwywloobbaersjbwjyseizibnilfhljaydjjhugpvkejdfflsjxxfiyrefpqj665,810,813 QUTick 85,364,3522026-10-18 09:29:16DXQCIDKGTTZPZGYGJISIINOVGMCBTTYKULRXDOWRZGLPOKRLKZDUZRLDEOAMbvjhykmkqfxwkdbwxwrarfqnmrpaooghkblpqhxwgcirhdtgrbazzzvdoqec643,803,321 QUTick 85,364,3692026-10-18 09:29:25YZNCJJHHKIEVKAXAVITZIWFGJLTCMFUYAATJYVBFCEONBLZBFBXVPUEGATQJmwkxuioegechfhlxmhsvcgxvwdreboporegnyxwumdoogkehkhiijbpbqfpn600,448,003 QUTick 85,364,3852026-10-18 09:29:32ORCHKLNIRJSSMEVJXXTXDJEIVIGDSZQVNXVLBKBSWFSOYSFBCELJSMAEPBLIcjfxznckionmzfkhbextwudavnecsutinsvmmoxrvbfnyextchfaeknejfnc584,131,677 QUTick 85,364,4032026-10-18 09:29:41XRDWLXAFJMVLSEGCUWNRUDSHXSEDTWERLVBECGQRVBKQUKDQQKPYKVOGDCKOxftwhzpizjgzbfrnvtoxgfbsmxlduiresruajvnjkcdojgobyrpagvzbpcng538,706,028 QUTick 85,364,4032026-10-18 09:29:41FBQSFCPBQPLLFDHYLXZNDSLBFDODBNDQIKVKHELHFEPJIEUCFTPZNQHCORUBpcgmcgoccbxzceendascgxptiebasguwpvhxdekgfhcpbabuciipbjndjfpd502,579,362 QUTick 85,364,4202026-10-18 09:29:50ZJTSDJIXCSPURCVUWBZJIHYJKPUCPVPEFZYRANMHGFLBJLRLLZDKUYBFQHENzaaimvfgkulwzaddqqumfspzzgyfrigtbmkqlytypckeweesyenjjdhhlmfc480,436,394 QUTick 85,364,4422026-10-18 09:30:01ALJWNCBMNDAKPEXQHNQTLVEKMMABGKUKYDNPFTSRUAZGGAELCWTASBNENIKFullqjxovgzpwlemomerprwbiesialziachqyrepuuflqeypkollydvxeiuhk466,574,888 QUTick 85,364,4582026-10-18 09:30:09OCHWVUVSDAUKXBZDKFCUQNXULHXAKZCGQBHYBHSFHEYUCCNBCMPWGFLAHHHFahfanxgjtvcozfhtdhyxcsqpdxzgvzrxxxlgfzucxccixqjdginsuijeospi417,017,172 QUTick 85,364,5262026-10-18 09:30:43PNQPJJWVNEGWBDOWHOYNVDORWKGAVPUAFSVONKIAXGYXDSVJAPLXWIKAFBVEbatfijcuwgkeveqgtsobgwfsdcmbecbgctoutzwypbvlrrtwxgwixlffnrjm401,017,588 QUTick 85,364,5432026-10-18 09:30:52CHPHTXEIZIIRBGHKLAVJPPNMJYZCZZMUAOGGZLIGNDRUNPEFESWQQREDQFPLrockaxgdxykpzcthjtvdkufiquwairkqigewmwpsqalqdzvkpsrieaqdzsvo381,265,806 QUTick 85,364,5592026-10-18 09:31:00SUBGPWHGSFPRADXJZJNFXNMIWZSBJBQUSIGQIUJNJANXHGNCTVMEAORESQPMjjisdcwmdehynbtpnbalutjfgyqgzqmcojabfldgfdgdeviamlubhmbdgazc362,021,779 QUTick 85,364,5762026-10-18 09:31:08UEYBMETAHLDPZCIKQDVECVTFISJDOZZCAYGVKDTYPALRSKKHDGXYXNGBIZLHReceipt records 91–105Full transaction / QU / tick / display timeFull source identityophedbifwaaebfamvnstmszsjcjfwdiblyjnoswepgunrdraiemzaqoggsmg334,217,259 QUTick 85,364,5762026-10-18 09:31:08BBJZTFHUDZDWCGRDFTFQNGDWFTVCLFUBMXPVZCSUGHULQUDOLASPYKBDECFCtxdbshpiklpjdhpngklupklqjpsaetdmmolweyodgcafqjjwefjombzfiwri294,013,229 QUTick 85,364,6162026-10-18 09:31:28MHLTZYRBHAUJMGGBZJUCWBCXISLDSKDNLZJDBJPPAFOGVYTILCMIUECGIZBHnrvksrzbsbbiaeqvlerdvtiarmtazulojehwhijbzfzheqnvycklznrgrqvc270,168,956 QUTick 85,364,6322026-10-18 09:31:36YIFUJVWLNDALIAYOCEFYZOWGQZPCEPYEQXYDRYPVFAYGHLZTJXWQLXGGZXYEyqbqskgluacoxeaaycqshemqlweaawpriifuehdngdvrriruhwddkyidfkyk254,468,580 QUTick 85,364,6492026-10-18 09:31:45JILWXDLIHXHHFBDZZSTGDKGRPPBALAFYVAWJNXDNKAFEYKPNGLFITVHGVJLBnqfwxyuxzufucgipwibiwftqbjofpkikrnbhsqxztdcafprmvkfccprawmvo242,718,258 QUTick 85,364,6662026-10-18 09:31:53NIIRZOITCFHANGCYGUEZBRLSQTEDLVODJHDYVWBSUEUQBTGASEIRUYNAULRItihraxtzlvtuierexcdvxmhfeyhbhhvfjibewybcrabymylmsxwccpdakagm224,610,580 QUTick 85,364,6842026-10-18 09:32:02RLLFEFEVJDJOJGCDUDWYEPVZPNCAQPSNNHYPWACZCHNKOEUHTNAUIOPDGPYMeiuvwqofxrewcbwrvjspnxkidbbfqiyzywbjvbohudsadldoeqayltfhvkqk201,016,979 QUTick 85,364,7012026-10-18 09:32:10RKVRLVJZPXDJYGYQSOWSKDHUGTBCOYNLLCBVJDENJEOFIMLYRRYIWDXATDJKqddqnigawbezyavvwqiagokfysycpkbvpqcucqwkyfpyduyrblowhkqfnnnc212,003,557 QUTick 85,364,7012026-10-18 09:32:10XCCCGTRYFXNJZBPCVQMHAAUCOZBAAKQTGMNHOHEJQDSUDKAZSOORULQBUHDEzkbmuwdsfpmxtespgnslynojuyzbtzwwhadmcaaahepyftpmrgloatgcahug189,841,796 QUTick 85,364,7192026-10-18 09:32:19WUMCYFZICPSJCHFSEJGRUXKWQJFAZIBFMSTKTYPMFDMGYUGFHBVXZXIBSIECnvhlvustxhjnzeaiikezmjhlubeftoptevtdkbyiraciaazyqeplyeugecla178,681,008 QUTick 85,364,7442026-10-18 09:32:32KZYJKZAHRNQATFNNYQLWWTDOXIADNMYPVDQFBVNMBCRCBNIXXGPJGSXFLYWMlzwcuvkulxvmmfjmhhicyemtrktgoldwottdfyjgbcztmjdlglgicjbdihke163,230,273 QUTick 85,364,7612026-10-18 09:32:40TNQSLQBUTYXEDBQOEHTWNMKFVIQAFXXMZEUPKZKTOECGLLODANPIYWJDGBQDkknfkitfrbhyobmqvhkqgviopaddhdxxgfttctnerbvoyjxclbvbkhgfvcod157,606,226 QUTick 85,364,7792026-10-18 09:32:50HTQOUABIVWRJXBBQFFXIMPFSIQNDAEIJKNPFIVPDWBGCREKCTEDJQDYGTCSOerttlorkhhyfedjdmbgipsfeeeoblnegugdiqszsheeshloeaigxvjjbtkwe151,657,714 QUTick 85,364,7972026-10-18 09:32:58SRMKTSFGKHELIEYHRAYOSTAQVAZCNJPVVVRTCHAINCUTILJXGFCJRICBIIHHrkxirndayiomtbjpxsacofewjkyctotjsmqkcbjakaursaygdhpdcxjextze142,997,534 QUTick 85,364,8142026-10-18 09:33:07ZWYEKLAOUEHPDANOUUSGNSDIGWMBDJFHZXLGEAEVWEIZEPAXQEQBPKFCVNOMhbzclvqpwztfcftoeculusovttbbvwlxqllxfcjstanykdlmtphlqjigbbel136,892,296 QUTick 85,364,8312026-10-18 09:33:15PQJCXYAUVLEPFCFRGGFEXDPFVGIAJZVCQGDQIKXMQFOLFPCMQGOVKOVCYROJReceipt records 106–120Full transaction / QU / tick / display timeFull source identityayameazbhervifnlieukfsetwtibvbsiicgwsgwihhgwgeqvoqjznvyfscbg125,073,630 QUTick 85,364,8482026-10-18 09:33:24IAPRILKEGTLBCEZEESNCQYEHUETBSCSJKHMOGTVUNASJHLDXGRRXMNXGKYBJqevrgblispmvdhgkspucgsfjitzeqhklxkvbnxzeeaacbfqmmoqbnpzdostk117,317,768 QUTick 85,364,8652026-10-18 09:33:33YUAAMZQVUUWNZDVLAZRFXBXZFSGCLUGCIGRUTHWYIAYAWZXGREICVWSAVXDDzqjxzktwbvmuvemdkdskxrursyfbgqerlthwgecbrbgjlzszvhrhzdjfeqqc110,304,823 QUTick 85,364,8812026-10-18 09:33:41BODIVSKFUYMFDCNZKAHKXCWQCEHDENCGOHDBJGAAKESPWELVZCOSDHPEUBZFfuwaadcrcgnczdbhcssmmlbsmcwbohbsmenagenyrffqwknipllzabcefaxl103,522,211 QUTick 85,366,1342026-10-18 09:44:11ZJASAHNQDGVUDEWLNWJMYVYLFSVCAXERLORDXATHIGRKRGBFAHEVBQVDQRZHxlbjqyxmouhwehoaeekstxcqldabbyoyafnawlducbvftalrwcuajvraztce100,793,971 QUTick 85,366,1502026-10-18 09:44:19TCHXRNOTVOLFAHBQNPARNDVDANXBMBIAOYDDWSICVAIHDMLCJCSHBFNBLKZAbixisldqjtcqkgonkdnzcqzkgpcdeahnmmolwnfacbnamsxdlmdcoueccfde84,008,081 QUTick 85,366,1672026-10-18 09:44:27NAOWLCQWKGDPHCSSVWEUNFXMJAABSMBIXCXQZEMHFARTEEKZPASXIITDXZHKomoowngnamiyjgorsesusudsmylbhfeefupwysswybilnmtrdvgmhvhcigol93,360,188 QUTick 85,366,1672026-10-18 09:44:27ECZCURJWJPYBLGYUUSYEXSWYGHICRUJOSWJJNBLHPBYXLWZKSDLGRZXDAYMBrixjxaedrknuwfzcrghsozpcxvnerlaacqzbfedjzbkdnenvhvjtfkvexzli79,414,521 QUTick 85,366,1842026-10-18 09:44:36YJFQEGRQDBOBDEDENOZDATMKYJLADQOZOZIKHTKYFAMKTBNXXBKFOMBBSTSGjfsicrrdjbxynewjcqhfymccgkbbykqqhkvodefnmahxfjfbezdhsvifgdng69,409,988 QUTick 85,366,2072026-10-18 09:44:47ILNJXVHAUXDGGBTTUOITOQGPAYUCFTNCPXDKOCPUOCDOTPUWXBIGRVQDLIKComzphjeworfpzdpjpbmnrqpcijsfrutxtmopjpefrfqwpcdpybrukamazeji65,412,662 QUTick 85,366,2242026-10-18 09:44:56ILDFBBIXPQDPLFLMDSROOHRSNYBBQOPFNHBXEAOZHFMOLRRUJNEJSUZBHHRHzdyxbcpleovrxcfxntyzatfhoonaizzyvulgsnzodappxsbqkijettsdshaa56,772,914 QUTick 85,366,2412026-10-18 09:45:04RYPLPXDVIMFUMGYSRLEQVLCFKTKCPMTUHBLUQATNUBIXGEMJZJTVFKUCIPSJblyalvgvkhfwfbkdrmthifructjhdkgkutysazjqabfmivxtiwupfabevsyi52,891,882 QUTick 85,366,2582026-10-18 09:45:13ZPQGEPFHEUWTXGNYFFBCZDYBSVKCSTFULEIRNYBSWEMTZTEXVFHAOVMEIMOGeabgfctbjsgitfpejaxkyctfgbnadiqvhtxtqeadtgkjsoatwsapkjbdlvrb51,236,311 QUTick 85,366,3212026-10-18 09:45:45OQIBBYTGEHNXBGSLIZIDASJPJMPCRVAXOPOAWZPNIAWFAZPOVFAEWWFCZHXDfmeekyzckniqedcbzopyuckngeqbdezlemjbxganoazwktzubysyrzwbzskf44,398,777 QUTick 85,366,3472026-10-18 09:45:58XIINNRDAZRMCCCZDGOUPLRBQSGLCAYFSLHFHUKLOWCAIRVEACCQSWKFEEUSIoblckjupfblxebmzoaqurbencbaexsutlejazzmowgmrwiovcntwvkndmfqa48,042,756 QUTick 85,366,3472026-10-18 09:45:58YGKZHXBHUVWPUALMTMUOPKTDXUTAIYFPXYRMKFNNHDBWWXMBWZQUAAFFHAVHReceipt records 121–135Full transaction / QU / tick / display timeFull source identityffxykrqacyetvdltkoofriacwobcdelgfmzqlchmoamvdkeopjksgerajhub41,212,746 QUTick 85,366,3652026-10-18 09:46:07AVPNRFPEDCXULCILZOBMDSZCGWDDCJPKHFOGYORAICSOWZMCEXVNZBFBDPFLggxykimwfdqxjeduddvzkraxzbwdudhxwamoqwsglhhnldukbzdkzwraqjqf39,118,511 QUTick 85,366,3822026-10-18 09:46:15MVESVHAZKRRMUBUKSIHYSCZVXIFCOMUNQTITFANTMDBUEUBTVSUSSIMEPJHKzpcdvpcgxrfdzcmxxpmcyyadpgxcnbqjwtnbxihheevcjkxclmxzgstcqoib35,874,380 QUTick 85,366,3992026-10-18 09:46:23IRFXIUHYYGLEOBGETNDHRRNWBNNCCKZRJIWZFGZPGHPTBUODMWRGIKCFRSFNgjqvcsreimthdhbbzvnkxwzsqongevjfypbrodqpbeoksjfpsgsnkkjeljxm34,010,288 QUTick 85,366,4152026-10-18 09:46:31BPHIODFRIXUPZGWJQCQPJKHSWQCCQDHWOIHNKZDNZBFWZPXDRUAMCNQFEJHCjkcpfxxcksdkzcnjtamalzevbyegoubzucuyahjjifgaqoczluyolzefcdae31,881,620 QUTick 85,366,4322026-10-18 09:46:40SDWEWERYASJCOAERGZWCGNXAOJMANWOMUWRWBLBTJDGUVZHLHBKLMOZDETLKtbkvhiaiehdqxfblnztjqajewdqckacsvwjorlpisdeqodiojyszuuibwvjk30,268,916 QUTick 85,366,4502026-10-18 09:46:49RNPFUDQJYIBJWCXJIZWVGBOFBXNDUQPQOEXJFNPZRBNLCDAJNKWIWZCCVVFOiyhsgqerrwghccztrqahmzbiwxydsedtysshsmfjlcosncewlkwkyzheobpm23,360,548 QUTick 85,366,4662026-10-18 09:46:57LFKDTHEIFCTYJDMLTPOMHTVMXTOCQNTFKYCCJYZMGGIZOVTWBHWKKWDCALMJutnsqwtqxtibdeodwnskfkfsqxgdvkvinidhqdluxecjwhpmwwbuwxvctkdh25,695,514 QUTick 85,366,4662026-10-18 09:46:57UMQAWMNVSARKXGOKDETUAGFZIRKDHVRAXPZHVWEKYELHLCLVFSAMBSTDTMICkzmqrvxqawgqwehtlpidzhiqnfyeidtraxpkfggvverracmdudrcqjkefmhn21,453,036 QUTick 85,366,4822026-10-18 09:47:05IDPFNBKHZQEWVEXAVPFBDYGJECFBKMIGZIZZSFJSCBWMGLBRODKQOSUBMGQNyckjbkjmmxhlcalwfuksacxklvlbxlgqtcmpxfalmfxmkwxqxyxsdxugvujl19,900,227 QUTick 85,366,4992026-10-18 09:47:13PLWXSPPQIWEIEECYIVAZVVJYHIFCKIDAWPXPTKNWSFVDADWGQIHXUTHHEKUJbniodeqexkowfaznsrviaixxpblhebynebpsdtrzxggervdtewsbewmcfdbh18,324,937 QUTick 85,366,5182026-10-18 09:47:23FUBEOCYHUXSTBFVIZTHWEQDXBGDBXBSSEZJWOSWLBEDROVMPEDRVSRUFDUNCxjklkopfzccnvepqyytkaadulojgajapemmgatfldhvfxvxhrqmtbikfhqfe16,279,495 QUTick 85,366,5342026-10-18 09:47:31HDGCQOQVZMKRMGBZPPBBNTEMEKJDHKDMPUXILNWWKFDGWZKPLDBKJNPDDGAFszecyxrambwhbgnkzgtxtehvozgajpfylopplyoyqdohafbxbumqqnrfbilj13,969,716 QUTick 85,366,5502026-10-18 09:47:39RUKGKBHUZMGPWBINNVHVTIGLKKXAFYUNXPVURVBUJGIWXYRYPFQAKQTGYDULdjpbrajbngbwgayjsjxyynxdjoafvdkpxizvszkgwfzxpgazlpdndsqfthig13,322,262 QUTick 85,366,5672026-10-18 09:47:47UNQFHEYKKVICDHMONQHJQSQXKIADXBBNNLOEEJUPDBCVBJXQTSLWDBGDQVDJpkmweaqmziclvffgfnqthgjwfjsgknbslnrhxmujccaadoqujnyxebwdzewa12,030,812 QUTick 85,366,5872026-10-18 09:47:58YTNMXCTQCWURCBDNXPBESDGCEJDDPPXAWWCLKXYTYFCYQLPMXEBCJFVGVFIEReceipt records 136–150Full transaction / QU / tick / display timeFull source identitystlxizcbaridpgrigbagyqhbzdkhdlwwyjeptgmzeepecfmfgbmbcqubhzil11,454,590 QUTick 85,366,5872026-10-18 09:47:58KXFPTSBVUPXZZCUAUETMEFGJFMFCOJWMOAUQPIIZMFOCGWGZVIBUBQDGQHTEqbkhgpbbrqanxfdntszmsqmftvmdtkynucmzmxybcgcqthtxiwrwnmtbtolk10,278,303 QUTick 85,366,6042026-10-18 09:48:06UPVBLTQZJJBWPDIZDOQEEPLTKRKCGLKVQQHSVEVHXEZWOECXQHEHADWALZELwxgbcugjrsglegfrmopssnrbavqahajwkzaezpjcgccpghfgnlnqnsiheygb8,667,969 QUTick 85,366,6382026-10-18 09:48:23JLFWGACVYAVPDASPZABRNJUIQRGAHFGXPUNVXMCSOABECFNZCYNULJSDBYJNzopfxtatfrbmzgrpqwqjzgibvrcbzvxtnlikgkvlleamuvzfolrsmokesfjb8,246,975 QUTick 85,366,6562026-10-18 09:48:32ZIKNIOMQBRLALASQGNWMTJUAYHWCRMBQJCIWHSAGICFCNYYQJBVTFEUFYLWOmhyqukpqqvtgtgzduaoqxtuvlkygxibhqsniuthvjfwkxwgcktaysaxbezql7,091,775 QUTick 85,366,6762026-10-18 09:48:42UYQVDOBRFGHULAYPGFWUXEZJGMPCITXUUNLJGVAJICJHRVFTVEYHFLAHTWFNpyftmsfoevgbjcjyejxywighhdmdchplqkkxtugyjdjidnbsysnrlixbntdh5,520,718 QUTick 85,366,6922026-10-18 09:48:50PWISSLUJZEHKQDADWXNPWWROXAEDPKNCWFBNWSVJYCLSTKOHSGKBWMODBJWEzwpviouyiiblraytiwfmygiegncasvrqyrngkbgznahjelonzndvwifcyghc4,939,497 QUTick 85,366,7132026-10-18 09:49:01FPIMGGHPYGOZXFOQSPBXZJETNWYCYGHPRJOHFBLUGFWMVCDIWSMJXKBBYWOFslwoyfzkawoozcplazahoiajkgmacoimpdyfaauicbktgtjduqnyqzlghygj3,250,536 QUTick 85,366,7292026-10-18 09:49:09YKJOEOPGPIIJGEFSVOZWUSKELLBCXMLNFFUUCJEDCDTKOWVVGMPEJISAICHHdwvxrzocwleiudeefdmjmuvngnydfsjaskgfxxdcrbinldacwvdmpsucyebc2,392,959 QUTick 85,367,9842026-10-18 09:59:41GHQRRTFAMKDDEFXEVDCCSHTAJNIBDYHLKXTTTFSUUEYRGZDXDKYNKUEDHTILlxvtkerkjvojebkgijurmvqgkprchgixkihbvfgitctzbvdsxhvgzfecrtpo2,080,760 QUTick 85,368,0122026-10-18 09:59:54RKRBTKKGANTTMDWRWFUNQZZBKKBBHROYRLUFQWIPQBPQXDFMBCHTUCFBACZEixvshnrycdajqgxhugvsszizmmagfiorzvcdqbwvsdpdfeeeqrbmxhugseik1,887,966 QUTick 85,368,0292026-10-18 10:00:03QYZHONUXOEMLMFHMXDKESAAYUAKBRTPNGYWCFXKGRAIQAOHMFSIVXHKDDLSMwlytdjwzcssafawychqtktrxxldhbdrpqcddutlltafpxjaqdluxbjmabupg1,318,086 QUTick 85,368,0462026-10-18 10:00:11AHSBFJTDBFVZSAAHPASKCZDYYTJCEEUWMNSRASFMTFDHUZSZSQEOPVDCECWFgijlwsjgabvpobxrgxlkqzhkmspaesgkgafhdzrcraibuedhjwgywfxejqvi1,178,945 QUTick 85,368,0772026-10-18 10:00:27TNISXZTZDRYSIGBHSJEABGCOIIYCJEQFZMHBTAGHIHXUEJRIKFTUQGIDYEEEodvvbdnxdcdqdasgizfjvfgfwcwewfqvipzxohdepbhmlnqnslpxrrbelphj1,037,103 QUTick 85,368,0772026-10-18 10:00:27KCIKGMDRYUZRCCNGOWXFTLYBDGCDYOFVQIEYYZLSQAQYEKXXMVFSQMOAIKXBqanlvufopuvlccusbuzbtygjzteclalosxraqryezgyhkqqlgchkpkoavmch962,388 QUTick 85,368,0952026-10-18 10:00:36LQIZAKBEUBPNIAOBJCDBCQLIQQYCQGXOOXQLMMKBFGPFRLJZWJFIKATDABGHReceipt records 151–165Full transaction / QU / tick / display timeFull source identitygebqclvnntvhfggsngqhrgbsbjxgwjofoyckepegygpkcxvyogdgotndbdue755,999 QUTick 85,368,1122026-10-18 10:00:45STTIUIRUMLYXLBXNTZDVFBZYEOOAKUNCFISWPLYMYANDLCAQOXHFPVNGEEGOvjpdeocqhlpcybpkswjpzzalgcqafltplprerqnusaxvwahyjrpknrdhaera590,103 QUTick 85,368,1282026-10-18 10:00:53QCAQFFQARLQTHEMYGYUHGKRANUTAROHWXONUGAFFSGUUVDAQWFAQVRSEWPSLcfnxxzhzoihtkcqitiyzsoqgikicppnenokvtdlqidsbdwpcdfohbgtgvnsd517,635 QUTick 85,368,1452026-10-18 10:01:01NTBUSQJGOINSOCTMMZFVGBCFSAFDKGSERGUUUXPECAOCUXLNIQUMAWCCSGWMmreshyahnjkyxbtxzfapyqsahrlbudgumaovjapgtgvdzxlwkftbvaqgjcse380,855 QUTick 85,368,1622026-10-18 10:01:10GZTVMOVMDKBPTEQHKKBZWGRHZHBBEWUUIWKJFKNBCBJFKSCLITMBFMLCFJOKddxqpkxthfvancbslfyonwffcooerpgxluiipaqmagiojpzxyhwsmfffccmo309,297 QUTick 85,368,1782026-10-18 10:01:18AMPFZXXGSSYOXFEZJLFZCJTSPYOCLQXEFCFQNYZDSGURJJQTOFNGYOWDGNUKnkmtnbjpngdwlcgspwaksimxzfxcpkaorybvkmyiychtchowrrxvruyftqra249,140 QUTick 85,368,1942026-10-18 10:01:26ICLHFVEBONODPFIFEVIKZKRAYUZBTMWGNWKLMHCSXCEOVEYKVFUSSGXECXTCyufrdyimmclazdmledmnjypzxdncyrvezmhlriuhodkgatmorpqtvqbcoszc188,778 QUTick 85,368,1942026-10-18 10:01:26RLATELWZWLLBKCXDRLNIMMIQNJJAQKXEIPPBDBSZJGRHXSKAHHRJFQXAAUXFyglupthikmuxtgxobbyoaqpbswiceeglyindwtupycvaulcbzxwygxacddhj131,999 QUTick 85,368,2112026-10-18 10:01:35PYZLQQKYXOWDKFYEGXIKZZJXDLEALDFXGHBZNBMUXDKJWSNIOKEKPTYARRCGdukqihdvbrjkkcgacajkmknrhoacymioekosykkcacvhsrhvczsxijvdrjlf87,719 QUTick 85,368,2282026-10-18 10:01:43HIWVCCYGMXBZUFPTDWOCNEAYVBICBVZGECKXCPHARFTHRHXDQDHRFSEEACOBsllqkvwznkzvhatfhdbsgweoopfgocofcufredalkgvcrbwskqcfrqvcftgl50,366 QUTick 85,368,2452026-10-18 10:01:51NPIIAHZBRNTXMFCSZJASQGYSCGMAKZQUTLJFDLQMOCDLBZFFJKRHCVEFUWMGqvpyfajapdxkyceykvhpgeyojowacnoetngzfmyuwawxpdkxobsnymxbxmzl30,365 QUTick 85,368,2622026-10-18 10:02:00PIYHICMHIDMLXFENXONQFTECVNXATDOWYMFFXZMXSCMUQOPETNIVZYODJBINjzxftvtczgxifhugvlvbovjwbnjdjaxqcpahffwikcwabluzbovzyoadbhse22,637 QUTick 85,368,2802026-10-18 10:02:09DMYBQUXTPIGQUDJGNLGZJKELFGRDUZGVGJZHLOMTFFXRPOZOTGTCSNGBLVSJnhbzhwvnreajkctcslulfhhzgfkflbeqvjvkwlxtqcbgulvnjxnyzlhanayl19,439 QUTick 85,368,2962026-10-18 10:02:17GKYVGQYNRQIRQCMBJUIZGLWXRHECMETQSXQDXSYJZEGCEQRCQABICSGFVWADgbzgqayzfdjnzamszdjcxcyfzrycejfossoifiushdfjajdpqwfbobddevwd17,688 QUTick 85,368,3122026-10-18 10:02:25THSCFREZBXTUZCJALNCHNGBBIBCDNOOMTLGDUEDFCDHGHVCEMYLJRFYFKPZHobtnlxujhewnaavsxdfqnuyzrpydghamyucvmoklygdrffhginipjxgdsnan18,154 QUTick 85,368,3122026-10-18 10:02:25UEYWWUZQMLUGGBUCUREPOANAQUYCFZYBBPISORLDMFDKPOMWBFCVDHJCHOKKReceipt records 166–180Full transaction / QU / tick / display timeFull source identitynwiyvefdmqpctbaacpulrkqgptddjqolykdhgnndfcxxxxnmoupzohydbiaf17,639 QUTick 85,368,3292026-10-18 10:02:34VYOPKJSJQIOKZCIIPDHIZNHQZZTBTNAFDLZPPZJSYEMNQQIKYGAKSXLDHBYJsxvlzxcdqdmghdyyeivgmwtmldahribwdyitanfdzbmbwnnzeaskfqsbmcih17,639 QUTick 85,368,3462026-10-18 10:02:42PFBDMNGJNDFODDTTYTKJCCOCOEIAEKUAMGZLCCDWSCRALXUVITJYFXAHSPMGmetihighvlfxpgdlnevsxrcghqiddxhynfbeluqvubniawldwikbvldhjpln17,638 QUTick 85,368,3622026-10-18 10:02:50WDUTZQLGJCNLAHEPIQAPEALIEFPBANRICGHFPDTCCANTOZKBANCHALICMKGGcrentprrdnbllbfazxtejpedolgcrmwtgjhotwagcgmsyqglvrmyqrzejeen17,638 QUTick 85,368,4092026-10-18 10:03:14QVDLMZWMJQCZOCFMKXNKCDWTKHRCRFRJDROHIHPEFGWTJZLKGWUOPHYEIAGJmwsufdjvvsufraqlpdxnzohziytbzocxtnfltjsbobuhdpgymuwblrngugen17,622 QUTick 85,368,4262026-10-18 10:03:22HGFVVMYWGZOOVGATEZUYUQUGHHWAANOBUYLQSVSXPBWKUWWCLQARARUGQEFDnolznkhnpyuibbqebxnyhxzknyhatktvwvcigfidvfpjuipdchtpdlcdipjf17,610 QUTick 85,368,4452026-10-18 10:03:32RUHUZVLCTLTSAEHCYPACLYDDCHVCQTNYWPGOTYYASFIBWWNKCTKKJLFFCTZEdblgqaobrvqkpegkwuuhhzfvniigsiqeflukpokcjdoasvsijldzegchmlcf17,610 QUTick 85,368,4622026-10-18 10:03:40NCHUTUPDWACMVDUTGKDTNAUEHUSBJELHTZPABKZFJFHAVCPHGFIYDLGAZUSHvcsfctslpsxuvextbqhvadzwelnfplgtemqfvhyhjdagtxmwcfeonzbezbwn17,610 QUTick 85,368,4622026-10-18 10:03:40YFGJCWFCGPPWMCNOCPGEUTNBROXAAAGLIXGHOOTOPFKXYYVZXLOIPPHHYOBNohbzduqamparzaaodtuorymddwhbhkngzmyevhvpaghcqxoxtkrykkabwcvo17,599 QUTick 85,368,4792026-10-18 10:03:49YYIJPHFELSAEBGRVTANXSPEHVYOAXPCQSAJKJWYVHCZDRITGARRGAJDBLMWJdcvqdouseajvtbcfadqezjzxikndkpgokiqerjpqccbolketrjvciasbglwb17,598 QUTick 85,368,4962026-10-18 10:03:58MXQPAPLKAPRBPBHSRBTWKSEMLJIDSQVEJPYVVDYJEHLFJXSUVTGRWLPDCCQDmcohaxqvkscqsaizmqnvljkjhmceksaekhkahfgmhdloxxvwhtztguzfgirh17,598 QUTick 85,368,5122026-10-18 10:04:06QHYDCDAJWQEVGBXOPSMWLZCCJJACOISPKRMYBHPWFFPRRYEKMHXUKZNGPASLutmkssfwgknimgyjacmyvxixlrsedhmjxvdnslbvaekwsyhpumofuohaiudo17,597 QUTick 85,368,5282026-10-18 10:04:14BAXEZWWIFVSFEFBAOXZXZIZXLRPAAQEFIMVNGZNLUESDVMADABCZWPJCFMAMpdptqehmlgohlgoozndxjupqavqenmvbqqpeqcheidluuksaykklnbpeaccm17,593 QUTick 85,368,5472026-10-18 10:04:23YAVIGJXZUBJIJCTRTJFZDIIHLELCGQEOKJFILMXJICAQFGATWWNVMNQAADFBdtxnsjxoiruykhmsfrjhynlpjryadjojvknsnpummdbjgloruxiflyvcgbze17,590 QUTick 85,368,6082026-10-18 10:04:54MWRIAGDZIXDIBDOQZFRQKOEXTIDCGAGGTWCPICYCLHHUYJATRXIBJYMAMJSMgdavbpyauzicdhmdwnxbzxhpclfdfytiteuduwhqgcnkrhweuymnskldkfwm17,566 QUTick 85,368,6242026-10-18 10:05:02DYVELOLTYYZINGYXAMDNBLZVXCHAJCPKQSRBXYOIICDXIEPWZXZQURLDFEKGReceipt records 181–195Full transaction / QU / tick / display timeFull source identitypknylesyzyugmfdddowfeuewbbxabtnjnxfrcyvafaynczeeyftniojcpnok17,520 QUTick 85,368,6242026-10-18 10:05:02VIDUXUODWWDDCBPLZCTZAOCTPZKBGOFTTKFYYSXBTGZKHFLKNRQYUIAFTBGHopljnckfxbxapapldgyocedzjiygqtdtsvsjkrnfifjdcthgjebinnigprcb17,420 QUTick 85,368,6412026-10-18 10:05:10FFRYCFYJRUEVDDCYCMWQGNUXXZRDOZUJLBZCXXBEAFCQXGVFARFNCIZBAWRMebgelspurrpotamjuheamllxwudcqkizxvjpyxkgdbrrkpzgmfnwzwvclwzb17,258 QUTick 85,368,6712026-10-18 10:05:25HHRIMEMZHFQRABANYUMJIJSLJYRATUQLAJBBTLXAJHFMKKRZKBWNQYGFOUHBabfvkmzauqjysgyzleflaqbedlleiotkjxdkzhzifcnycyqengwyojnfxbvi17,183 QUTick 85,368,6882026-10-18 10:05:34FTTWEXFYVMXOCDUFWGRUTRKMVDEDMMIKTREATUANKERHQFDFXEXXUKWAYDDAbrprfgyzrsnzpbaskxalzwjekgvgbbnkgctkqmxhffwaxryooiisyzfffsjk17,181 QUTick 85,368,7042026-10-18 10:05:42AAQMXMOCGLRXRGWSAZBYKZISGNQDAERTKRCKKIFTVFMMCEIQDHWPDJWCXJTLavusjwvlbnopsgdmwrtlepjqllvckintaevpcnxkraipahxwiztntpdapjng17,178 QUTick 85,368,7222026-10-18 10:05:51RTBMDAOIDPOSDFRUQURVVFUPETABPRXNZXWNSBJZHGJAOISCISMMHVWDLLLNbrdzqltvdijtzfxwbfnoppydcpgfjlgiizkdcdrrndedaibnewqfnxfcnqgg17,173 QUTick 85,368,7392026-10-18 10:05:59BYFIIZWLZOTDOFUMRSQFWOLTXZCBEXEUDGNREQTSKDCWVVBWPEPBCPXGRCIMbbdcuuxrgozlrazxtuvrkqxozjaacseoxegvflamebddomcpjtdnmxcduezk17,173 QUTick 85,368,7552026-10-18 10:06:07VAFTVSYUEFVBHHDXXKVOFYWICHACRCNDYRVUWSBOSGMQLWDGPHSFNKDERXVKdkajrxugidpvwfxhtzuisldncuqblksjsajzfsxeoatmatvngrergtmdxnqh17,172 QUTick 85,368,7552026-10-18 10:06:07BVVTTKBNMGNLUDAUIJFPNWASHZNBQIHGRGCOCVCZICLSJSKTEDQTQRHFZJHCxoavznqmooeqnbisamwasimfnnzenukhvfnknjfzxbwsrdnuvowjvqedqtaf3,221 QUTick 85,368,7722026-10-18 10:06:16WBWECDPBSYUYCEQZYXPCOHRFZOACMFHHKMFURDDMMCAGIHHYGSHBFDOGYSKJdpfrfxqsprwmtcieyldzzjrkhvpbnikanpvvkxwzvfcnzmzzonyudvecljrn554 QUTick 85,368,7892026-10-18 10:06:24NWYWNJMOBSDBKFDAKYLSRSDYEJPCQGZMJGCTIKEBKAFMHBVJUFNDICHBWROJlmuveembvqvjkgkrgmukmtupqzwdpgjsoyggwvhimdqonggdigvrvrhbpmfl84 QUTick 85,368,8062026-10-18 10:06:33GVSTZSKWDLFTPFJYZSVLPZKTRECAYSOSIAJUGHHJVCIKAFBJZVOAJBEFMRBMzvbpwenurmjkbgkjwimyyytqtdkgtnkssezsbihfdhukydqbubwbpepcdega21 QUTick 85,368,8222026-10-18 10:06:41RHOTNFTZOWZBAGXWQFAMGQCLDEIBOURZDTOORGGYJFXXJFNZEUXGXYMFHZXLwmtaswoeuqrxdfetffwrucyhhlngibcaakhbzaojjfclinerkrjprqigepnj4 QUTick 85,368,8382026-10-18 10:06:49ACEYOYFUJRTSAGXMIALPVXTCJKDAKHVUJJXHNSAMHEKDCIWWYDENCYCHHETMitpekbjhwfyerfomhrnuclpdssrassjsiwfaexhrnfrrcyzjqhzbusrexrld1 QUTick 85,368,8542026-10-18 10:06:56PMWURSOSCQTEIGASRYSGKVQWEKSDCTSMLGBAAOZVUBFIDRETPWAZMEADTNJOReceipt records 196–205Full transaction / QU / tick / display timeFull source identityegbvwdhcggwqdbhjulzqwainxdwgjmcblufxnnzraezjxwhwsjodksdeoosl1 QUTick 85,368,8702026-10-18 10:07:05ODACZQSOHSKOQCQYJGQCPPINOKVBEJVDZLLSBLOGNAMFQGUJHFKPOJGGXNTMhzykixcbgprtogsftasacdqihyzcjctotakevafxyakxzsxxxkviomjavjrm1 QUTick 85,368,8702026-10-18 10:07:05PIBSBMVVVPMAZBRDVOHSFHCCGUMCTZUZWOKKWRQUUCAYIDLYEFXXEYHBQYYGrmqdmmstqcugfblgthzbnwtrivdcwdpjdkrxodvcbgiszelbeqapasidnolc1 QUTick 85,371,0602026-10-18 10:25:27IZOOJMBGEKCGZBMYIFEWRPCMMGUCMFOODFVWGEGZAHWWJLHGWRHVRQKBSSHIuaacbbofkzxkmcjicacozqdlokucsajezcxifwqwxbqfngckcyqpbfdgmbeb3,051,318,304 QUTick 85,371,0772026-10-18 10:25:35BLALTWKMUCRZCHTLZDTLGAOPBJLCWWMQJYMFQDPDTECOKTSIUDUJJJJFESUIdgekaoyklmmrwgfoemyjbiaaporbqmhuqfftkdgmmdguoaxiigqzribcamea2,615,329,703 QUTick 85,371,0952026-10-18 10:25:44YWUHJUJKTJVKMABEBASXYWTGTQBDNJNLOIFZJPMWDAUVKYLXPLXVMWIGBRUGqcyrhqtwvtylrcjzxpbkwxyqetwbvydztpprshlepgmgcyokclhhdscbuxbc1,477,595,306 QUTick 85,371,1122026-10-18 10:25:53FEPBMNIXODPSMACXUPIOMUTIMMUBOPTZFBXQHKATGGYVAGFNXGDLTKJECJHEyvnbxozgugdkghehohkixcarkeddmyubywaiolkqugxjaedixgwtlrbhnpbm1,149,608,746 QUTick 85,371,1122026-10-18 10:25:53EUTKBUBOQNGSLCYUJXELJSWALTIDJLTXRSJTTAGIAARNDLZVLIMJVUGDWKWMampejuomsdiirgldoihjellyepkfjnvvdcrevuvjwdpxiazjsqhccxgdandl307,533,611 QUTick 85,371,1292026-10-18 10:26:01KWVBTHOJHMBXXGDUEXISUYOMZNDDJYGASBFIFFJFVALRZZYGPKMIBRSGRTFIqpbsawbdgmtbaariwtbshtqzplfcmqxthjfznwnggcguusalqetfemlbswrn106,444,954 QUTick 85,371,1462026-10-18 10:26:10ZNTRZHEVDZPLQGJFHVKUYYSKWNBAZBZDMGHMWSANCGXKEJOXVIZJXPQDZYLOuozjjtcweklbxdcoikwxyeomtlvgrfqncvagfqduzepatadbxutmmtacefvm128,976,240 QUTick 85,371,1462026-10-18 10:26:10CZICVDINZHUVXESYAKMJPXZRNJRCRFKWADKZNDFBWDYWJPGEJHPXRGMCTOACMethod: the actual Explorer Download Page Data control was used on all three pages with 100 rows per page. Rows were deduplicated by full hash; distinct sources were counted independently. Integer addition gives 568,777,432,013 QU. Three selected transactions were separately opened and matched to their visible event rows. No private key was requested, no recovery action was executed and no address-owner attribution is inferred from these exports.Primary and attributed sourcesSourceUse in this articleincidentProject disclosure, attributed.causeProject root-cause account, attributed.haltDirect public repository or project record; implementation is not execution.snapshotProject’s dated 18 October claim; not a fresh freeze confirmation.mapCommunity compilation and explicit UTC sample, not independent loss proof.patchDirect public repository or project record; implementation is not execution.releaseDirect public repository or project record; implementation is not execution.proposalDirect public repository or project record; implementation is not execution.coreDirect public repository or project record; implementation is not execution.frozenDirect public repository or project record; implementation is not execution.sweepDirect public repository or project record; implementation is not execution.escrowDirect public repository or project record; implementation is not execution.recoveryAttributed project recovery statement; not independently matched payment evidence.escrow_statementAttributed project recovery statement; not independently matched payment evidence.reclaim_windowAttributed project recovery statement; not independently matched payment evidence.

ChainBounty · Report analysis · CASE-01D70140Ethereum mainnet · Recorded activity: October 19–20, 2026 · Based on the SentinelTX report issued October 20, 2026A SentinelTX investigation records a 50,655.918487 USDC receipt by a candidate externally owned account, followed by conversion to approximately 20.597338 ETH and onward transfers through a wallet with mixed-source funding. Its call-tree analysis assesses that two transactions made legacy smart-wallet contracts execute repeatedly against a MARK/WETH pool. The report calls the contracts “Argent-style”; it does not establish that they are the official Argent product.The distinction between recorded transfers and interpretation matters here. The source flags two routes that run backward in time and therefore cannot trace proceeds. Its separate October 20 transfer sequence reaches a Tornado.Cash Router address, but commingling prevents an exact allocation to this incident. No exchange deposit or corresponding mixer withdrawal is established.Key findingsThe candidate EOA received 50,655.918487 USDC on October 19 and converted it in a later transaction. The PDF’s exact ETH transfer amount is 20.597337757434388495; its narrative rounds that to 20.597338 ETH.The two seed call trees show 19 and nine inner executions. The signed-call replay mechanism is an assessment, while a recovery-deadline overflow, an owner change, and official product identity remain unestablished.On October 20, the EOA sent 20.68 ETH to a consolidation wallet. That wallet also had other inflows, then sent 5.05 ETH onward. Five 1.0 ETH transfers subsequently reached the Router; those overlapping stages are not separate losses.Report scope and limitsThis article adapts Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, a 46-page SentinelTX PDF issued on October 20, 2026. It follows the report’s records, assessments, and qualifications rather than presenting an independent on-chain investigation. “Candidate EOA,” “consolidation wallet,” and “staging wallet” describe transaction roles; they do not identify people or establish common ownership.The narrative specifies an incident window of October 18, 2026, 00:00 UTC, to October 20, 2026, 13:15 UTC. The executed queries were broader: two 32-day windows from September 18 to October 20. The 145 retained movement rows with readable timestamps span October 19 at 09:31:23 UTC to October 20 at 11:46:35 UTC; another 57 retained rows have no readable timestamp. A query interval is not the evidenced transaction span, and gaps between queries are not coverage. The PDF expressly says these records do not establish that the requested historical window or block cutoff was enforced. The three-hop maximum and latest block 26,233,589 describe cited routing rows, not complete investigation coverage.The source’s two time-order warnings concern routes joining the conversion at block 26,225,830 to seed activity at earlier blocks 26,225,798 and 26,225,803. A later receipt cannot fund an earlier transfer. Those joins are excluded from this article’s proceeds claims and diagrams. This does not erase the separately listed transactions, but it prevents treating the backward joins as a valid continuous money trail. The exact warnings appear in the source note.From funding to the USDC receiptAt 09:31:23 UTC on October 19, the candidate EOA, 0xc10609…872b02, received 0.09761 ETH from an address the report labels as the Tornado.Cash 0.1 ETH pool. SentinelTX assesses that the amount is consistent with a withdrawal net of a relayer fee. This is pre-incident funding provenance, not a destination of the incident’s proceeds, and it does not identify the original funder.The report’s control-transaction record then lists six successful submissions, with nonces zero through five:09:35:35 UTC, block 26,225,763: creation of 0x3c5884…3fb310. Contract code was observed; creation alone does not establish ownership or control.09:42:35 UTC, block 26,225,798: Seed 1 called the created contract with selector 0xc59705f3. It was not reverted; the trace contained 742 frames and reached depth 11.09:43:35 UTC, block 26,225,803: Seed 2 called the same contract with selector 0x522bffbe. It was not reverted; the trace contained 458 frames and reached depth 12.09:44:35 UTC, block 26,225,808: the created contract sent 50,655.918487 USDC to the candidate EOA.09:48:47 UTC, block 26,225,829: the EOA submitted a USDC approval call.09:48:59 UTC, block 26,225,830: the EOA sent 50,655.918487 USDC into the Uniswap V2 route and received 20.597337757434388495 ETH, approximately 20.597338 ETH.The USDC receipt and conversion are two stages involving the same token amount, not two amounts to add. The ETH output is a different asset and is not added to the USDC quantity. SlowMist’s approximately US$59,800 estimate appears only as a source-reported figure from its public incident-index snippet. SentinelTX does not reconcile that estimate with the retained USDC proceeds, and this article does not treat it as a recomputed loss.At 10:07:35 UTC, the EOA also received an unsolicited 1,000,000 PVC. The report records the transfer but sets it aside as non-economic because it was unvalued and no onward movement was observed. It is not included in the proceeds narrative.What the two call trees showIn Seed 1, the created contract made wallet-control-shaped calls through proxy-style contracts and shared implementations. It also called a counterparty labeled Balancer, which called back and transferred WETH. The report reads that call/callback structure as a flash-loan pattern; the selectors were interpreted structurally rather than fully ABI-decoded.Within the callback, MARK moved in large round trips between the created contract and the MARK/WETH pair. The narrative’s largest rounded legs were 412.07 million, 405.52 million, and 398.90 million MARK in each direction. These are gross trading movements, not retained proceeds. The evidence-set total of 13,474,585,249.833702 MARK likewise recounts movement and does not measure loss or prove that every included movement belongs to the incident.One entry with selector 0xaacaaf88 into 0x4e50ad…227394 produced 19 self-call iterations in Seed 1. In each iteration, wallet contract 0xe545b9…ee8f66 made two ETH payments:1.061908909163406246 ETH to the Uniswap V2 router for the ETH-to-MARK route. The report’s total across 19 iterations is 20.176269274104718674 ETH.0.025621353654900691 ETH to 0xd33814…4452e7. The report’s total is 0.486805719443113129 ETH. That recipient’s role is unverified.The trace’s 40.839344267652550477 ETH of total internal value includes the router’s WETH-wrapping forward and therefore double-counts that leg. It is not an incident loss. After the repeated buys, the report describes the created contract selling MARK back into the pair and taking WETH-side output.Seed 2 had the same reported flash-loan and churn structure, without the wallet-control-shaped frames. One entry into 0x4e50ad…227394 produced nine iterations through 0x5a79e5…a85440. Each contained a USDC approval, a Uniswap V2 swap through the USDC/WETH and MARK/WETH pairs, and a USDC transfer. No native-ETH internal value moved in that seed.SentinelTX assesses that one signed call was executed repeatedly: each entry carried a 65-byte field consistent with an ECDSA signature, then fanned out into repeated inner execution. It interprets the associated trading as induced buy pressure in a low-liquidity pool. That remains a mechanism assessment. The recovery-control-shaped sequence does not supply a decoded wrapping deadline or a decoded owner-change event, so neither the reported recovery-deadline overflow nor an owner change is established. No verified-source comparison to the official Argent product was made.Figure 1. The two October 19 seed call trees contain one entry followed by 19 and nine inner executions, respectively. Arrows show process sequence, not amounts or new transfers. Repeated execution of a signed call is the report's assessment; recovery-deadline overflow and an owner change are not established.Color key: Slate identifies Seed 1; sage identifies Seed 2. Color does not establish identity or responsibility.Address/role key: Both seeds called 0x3c5884…3fb310. The repeated entry was into 0x4e50ad…227394; the spending wallet was 0xe545b9…ee8f66 in Seed 1 and 0x5a79e5…a85440 in Seed 2. Official Argent product identity is unverified.Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026, pp. 7, 9–10.The downstream route mixes funding sourcesOn October 20, the candidate EOA sent 1.0 ETH at 08:56:23 UTC and 19.68 ETH at 09:03:11 UTC to 0xfba873…81364a, the consolidation wallet. The combined 20.68 ETH is an observed outward amount, not a fresh loss estimate and not a direct substitute for the swap output: the EOA’s listed inflows also include the earlier 0.09761 ETH funding and small other receipts.The consolidation wallet’s provider-listed inflows totaled 27.528000001 ETH across five transfers. Of that, 20.68 ETH came from the candidate EOA and 6.848000001 ETH from other senders whose sources were not established. At 11:17:23 UTC it sent 5.05 ETH to the staging wallet, 0x0d9ed4…f12f40. The presence of other inbound funding means the exact incident share of that onward transfer cannot be determined from flow data.The PDF gives a pro-rata assessment of about 75%, calculated there as 20.68 / 27.528, or roughly 3.79 ETH of the 5.05 ETH transfer. This is an allocation assumption, not identification of which ETH moved. It cannot justify describing all 5.05 ETH, or all five later Router transfers, as exclusively this incident’s funds.The staging wallet made five separate transfers of 1.0 ETH to 0xd90e2f…24f31b, labeled Tornado.Cash Router, on October 20:11:19:11 UTC: 1.0 ETH.11:32:47 UTC: 1.0 ETH.11:37:11 UTC: 1.0 ETH.11:42:47 UTC: 1.0 ETH.11:46:35 UTC: 1.0 ETH.These transfers total 5.0 ETH at the Router. The report stops there at a privacy boundary and establishes no corresponding withdrawals. It identifies no exchange-deposit leg. The Uniswap interactions are DEX swaps, not custodial cash-out events, and a service label does not identify the person behind a transfer.Figure 2. On October 20, the candidate EOA sent 1.0 ETH and 19.68 ETH to the consolidation wallet, which also had 6.848000001 ETH from other senders in its provider-listed inflows. It forwarded 5.05 ETH to the staging wallet, which sent five 1.0 ETH transfers to the Tornado.Cash Router. These are overlapping stages, not additive losses. Commingling prevents an exact case allocation; no corresponding mixer withdrawal is established. The dates of the other senders’ listed inflows are not asserted here.Color key: Slate identifies the candidate-EOA contribution; sage identifies other provider-listed inflows. Onward route arrows are charcoal. Equal-width arrows show direction, not amount.Address/role key: Candidate EOA 0xc10609…872b02; consolidation wallet 0xfba873…81364a; staging wallet 0x0d9ed4…f12f40; Tornado.Cash Router 0xd90e2f…24f31b. These are transaction roles and the report’s service label, not verified common ownership.Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026, pp. 5–6, 8, 13, 41–42.Residual movement is not a balanceSentinelTX separates provider-list arithmetic from a balance query. The figures below are inflows minus outflows minus listed gas fees over the provider-returned ETH rows, including rows at any date. They are not proof of currently held funds, incident-attributable holdings, or recoverable amounts:Candidate EOA: 12 inflows totaling 20.694952258434388495 ETH; two outflows totaling 20.68 ETH; gas fees of 0.009768389421759711 ETH; net listed movement of 0.005183869012628784 ETH. Separately, the narrative says the address record showed 0.005184 ETH on October 20.Consolidation wallet: five inflows totaling 27.528000001 ETH; one outflow of 5.05 ETH; gas fees of 0.000043631071701 ETH; net listed movement of 22.477956369928299 ETH, approximately 22.48 ETH.Staging wallet: three inflows totaling 5.0500000515 ETH; five outflows totaling 5 ETH; gas fees of 0.014022238141291632 ETH; net listed movement of 0.035977813358708368 ETH.The report’s expert-opinion section discusses the approximately 22.48 ETH figure as a possible recovery opportunity if funds later reach a custodial venue. That assessment does not turn the flow-derived residual into a balance or establish how much belongs to this incident. Onward movement beyond the listed 5.05 ETH leg is not established.ConclusionThe report’s most concrete result is the sequence of recorded token receipt, conversion, and later ETH transfers. Its call-tree interpretation connects repeated wallet execution with MARK-pool trading, but the exact defect and official product identity remain unresolved. Downstream, the consolidation wallet’s other funding prevents a precise incident allocation, and the Router marks the end of the established route rather than a confirmed cash-out.SentinelTX identifies the other consolidation-wallet senders, the unknown Seed 1 ETH recipient, and decoded module calls as useful next leads. Those are recommendations in the source, not completed findings. The two reverse-time joins cannot support a proceeds trail; neither the gross trading totals nor the approximately 22.48 ETH residual establishes a loss or a recoverable balance.Figure 3. The report records the USDC receipt, ETH conversion, and subsequent transfers, while treating the repeated-execution mechanism as an assessment. Official product identity, recovery overflow, owner change, and exact downstream case allocation remain unestablished. Its two impossible backward-time paths cannot support proceeds tracing, and no exchange deposit or corresponding mixer withdrawal is identified. The figure’s approximate 20.597338 ETH is 20.597337757434388495 ETH in the Path Routing Evidence (p. 14).Color key: Slate marks section headings only; the written labels distinguish records, assessments, and limits.Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026, pp. 10, 12–14, 42–43.Source and limitations noteSource: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026. Main references: executive summary and value distinctions, pp. 4–6; chronology, pp. 7–8; call-tree interpretation and attribution tiers, pp. 9–11; conclusion and limitations, pp. 12–13; exact transfer amounts, pp. 14–38; aggregate movement definitions, pp. 38–40; collection boundaries, pp. 41–42; native warnings, pp. 42–43. The PDF’s public lead is attributed to the SlowMist incident-index snippet at the SlowMist incident index, not to an independently reviewed full incident notice.The original dossier is marked confidential. This article adapts its findings and qualifications; it does not reproduce the complete source dossier.Exact native warning count: the p. 4 banner says, “INTEGRITY GATE — the integrity gate flagged 2 findings for review. See the appendix at the end of this document for the full list.” The two findings appear in “Automated Integrity Check — Warnings (Report Integrity Gate),” pp. 42–43. They are reproduced verbatim below:[INV-5] (report-wide) — Hop 1 (block 26,225,830) → Hop 2 (block 26,225,798) is time-inverted — the later hop (funds out) settles in an EARLIER block than the hop that feeds it (funds in) → a causally impossible path (the cash-out tx precedes the deposit tx). Likely a destination's commingled total deposits counted as traced taint.[INV-5] (report-wide) — Hop 1 (block 26,225,830) → Hop 2 (block 26,225,803) is time-inverted — the later hop (funds out) settles in an EARLIER block than the hop that feeds it (funds in) → a causally impossible path (the cash-out tx precedes the deposit tx). Likely a destination's commingled total deposits counted as traced taint.Plain-language consequence: both flagged paths would require the October 19 conversion to fund seed activity that had already happened. They are causally impossible, not merely unconfirmed. Neither is used as a proceeds route in this article or its figures. The warning’s suggestion about commingled deposits is the source’s explanation, not a separately established repair.The source retains several different scopes and levels of certainty. Its abstract says transfer verification does not record who signed or authorized a transfer, while the seed and control sections identify the candidate EOA as the submitter/signer. This article uses the transaction role without treating it as a verified personal identity or proof of authority. Service labels are provider attributions reproduced from the report, not new determinations of ownership or current legal status. The executive summary calls 09:35:35 UTC the EOA’s “first recorded activity,” while also recording the earlier 09:31:23 UTC inbound funding; both events are retained here without redefining that source label. The abstract does not identify terminal endpoints or exchange attributions in its cited inputs, while later sections supply the Router service label; neither establishes a mixer withdrawal or a cash-out.The prose also describes the staging transfer as “exactly 5.05 ETH,” while the full provider-list arithmetic gives 5.0500000515 ETH across three inflows. The former is the single consolidation-to-staging transfer; the latter is a broader list total. The PDF’s flow-derived residuals are not balance queries. Its requested incident window, executed query windows, and retained transaction span remain distinct. Provider page limits and high-volume exclusions mean the collected and followed rows are not every address’s whole history.The PDF’s aggregate movement totals expressly do not determine loss or establish incident connection. Where its “Amount” and “Transfer amount” columns differ, that difference alone does not establish case attribution. Some USD cells use transaction-date prices, spot fallbacks, or recovered session valuations; the record does not attribute each figure to an individual price source. This article therefore keeps the reported SlowMist estimate separate from native quantities and does not introduce a new USD valuation.Other stated limits include unknown sources and role for 0x11bf2e…067e26, whose provider-listed inflow is 0.06078317119380398 ETH; an unestablished identity for the MARK/WETH pair; and an unverified role for 0xd33814…4452e7. Claims of a signed-call replay or pool manipulation remain assessments despite the stronger language in the report’s expert-opinion section. The PDF describes a signed manifest and report fingerprint; this adaptation does not claim independent cryptographic verification or clean substantive findings.Reference addresses and transactionsFull identifiers below reproduce the source for the movements and roles discussed above. Short forms in the article use the first six and last six hexadecimal characters.Candidate EOA: 0xc10609ce5c032db92e562e463b1234aab0872b02.Created contract and USDC sender: 0x3c5884377cca79ff221936aea4a5df43293fb310.Repeated-entry contract: 0x4e50adfc953551286bbd7fee2b2b846d1d227394.Seed 1 spending wallet: 0xe545b9a69bff1bf0ed2e922551dda4afc8ee8f66; Seed 2 spending wallet: 0x5a79e5772493cf4329682d202aa2d28f85a85440.Other wallet-control-shaped contract: 0xf490557d67d934440677a4f16793d5ef319b8ef5.MARK token: 0x67c597624b17b16fb77959217360b7cd18284253; MARK/WETH pair: 0x6f23d2fedb4ff4f1e9f8c521f66e5f2a1451b6f3.Seed 1 unknown ETH recipient: 0xd33814c56fdacdc7f084a5443d600ee5464452e7.Consolidation wallet: 0xfba873b1e5d0256301b87ce74f79a30d6781364a; staging wallet: 0x0d9ed4bbb6efeda5471cae1aa5f4bbe0e8f12f40.Pre-incident funding pool: 0x12d66f87a04a9e220743712ce6d9bb1b5616b8fc; downstream Router: 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b. These are distinct roles.Uniswap V2 router: 0x7a250d5630b4cf539739df2c5dacb4c659f2488d; USDC/WETH pair: 0xb4e16d0168e52d35cacd2c6185b44281ec28c9dc; Balancer-labeled counterparty: 0xba12222222228d8ba445958a75a0704d566bf2c8.Other provenance address with unestablished role: 0x11bf2e0d39d8589c96171a4102ea39c834067e26.Transaction references, as printed in the PDF:Pre-incident 0.09761 ETH funding: 0x6871f0e18429be8a40b5cc4d358b140ca987bee61ab00d6f652ccb59df631f63.Contract creation: 0xaadeff6c257a9339cc82c53ee44870d399b4e81de085f2c7f22464421060d4d2.Seed 1: 0xbfed8d33561ed5f9cbd0f4e62a5bbd20187a64f3e22180148dcb58ed6ebaa795.Seed 2: 0xa0ee8f914205a948c79eca039b7d8265537eb220472c9be1455d3321f1bd571b.USDC receipt: 0xc041e86d96df91df94bb585506865139fe17bebd8473d840cff2e7c4808a2756.USDC approval: 0x5e41d5d735133bbf715c55349aa5626e46c9deab986c56c57718330aa576939a.USDC-to-ETH conversion: 0xc220bb3c307f7317f4fa12e67220c77bc767db64a61587ebdebdbb442e00f0ce.Unsolicited PVC receipt: 0x5dfecdfd733721cc4679e376c0f455019b1512128f61e4b5beb2bc91decd52a4.1.0 ETH to consolidation: 0x5b0ee213efea42fa4fbfdb1d6049c715643d63c54357ba6980d34dec30077e7c.19.68 ETH to consolidation: 0xce8fb63bd9145b205f172243a485e535de627f0810a274d1ff6d3c0a7cc6946a.5.05 ETH to staging: 0x1d7d1d4e7fd61938f1a908292888bd4d2b4ba570cc8713de95633ed00ab7bdc1.Router transfer at 11:19:11 UTC: 0x1ba62ed4886fd6b8feae723f66597b4f3940af914b1168bc93ef43de026bdb1b.Router transfer at 11:32:47 UTC: 0x124eadf281340cfbb707b4f88d117808af4ab628c1ea2736450a15d29caa887d.Router transfer at 11:37:11 UTC: 0x6655185342c5cf5863b4dd0b1d1af67fb9a9ad886e480182d1d8d39824ee5dc2.Router transfer at 11:42:47 UTC: 0x5ff8fa2b97db68b116485c187b34caefabe439054f74423a63549d10716fb214.Router transfer at 11:46:35 UTC: 0x36deeddccc9d47ab702f8857c5cdf2f0f2de018720341345eae6d56b5089f5ba.Article version 1.0 · October 20, 2026 · Based on the native SentinelTX PDF.