Defend Against Cybercrime with the Power of Community

Many victims have already taken action through ChainBounty. Report now and join the effort to stop online crime

chainbounty
Risk assessment

Quick AI Scam Check

Help protect others by sharing your scam experience

View More

[국제발신]

[Pi Net work]회원님의 지갑보호를위해 계정제한이되었습니다 본인확인바랍니다 https://pg.piminak.help

klip

・28 reads

이오영 면상까고 남들정보 팔아가며 찍은사진

[국제발신] 이오영 면#상#까고#남#들 정#보팔#아가며 #찍#은사진#궁#금한사#람 01079378010 #연#락하#면공#개

klip

・55 reads

[PI MINE]

회원님 자산 보호를위해 KYC검증을 완료해주시길 바랍니다.

klip

・105 reads

코인 주식 리딩방 초대

🏆 HANSUNG INVESTMENT GROUP 📈 국내 주식 & BTC 단기 전략 무료 공개 시장에는 언제나 기회가 있지만, 중요한 것은 언제 진입하고 어떻게 대응하느냐입니다. HANSUNG INVESTMENT GROUP은 국내 주식과 BTC 단기 전략 트레이딩을 기반으로 실시간 시장 분석과 단체 트레이딩을 운영하고 있습니다. 무료 공개를 통해 실제 운영 방식과 전문가의 전략을 직접 확인해 보시기 바랍니다. 🔗 무료 입장 링크 https://t.me/+YzI2zf5yamhmZDJk ━━━━━━━━━━━━━━ 📌 무료 공개 내용 ✅ 국내 주식 실시간 전략 ✅ BTC 단기 전략 ✅ 실시간 시장 브리핑 ✅ 전문가 대응 전략 ✅ 단체 트레이딩 운영 방식 ━━━━━━━━━━━━━━ 🎁 정회원 전용 혜택 ✅ 국내 주식 트레이딩 ✅ BTC 단기 전략 트레이딩 ✅ 실시간 시장 브리핑 ✅ 1:1 맞춤 투자 전략 컨설팅 ✅ 원금보장 프로그램 운영 (적용 대상 별도 안내) ━━━━━━━━━━━━━━ 📅 단체 트레이딩 운영 일정 🕘 09:00 ~ 11:30 │ 오전 국내 주식 트레이딩 ☕️ 11:30 ~ 13:00 │ 휴식 및 시장 모니터링 🕐 13:00 ~ 13:30 │ 오후 국내 주식 트레이딩 ₿ 14:00 ~ 14:30 │ BTC 단체 트레이딩 1부 ₿ 15:00 ~ 15:30 │ BTC 단체 트레이딩 2부 ₿ 16:00 ~ 16:30 │ BTC 단체 트레이딩 3부 ₿ 17:00 ~ 17:30 │ BTC 단체 트레이딩 4부 ₿ 18:00 ~ 18:30 │ BTC 단체 트레이딩 5부 ━━━━━━━━━━━━━━ 💬 운영 방식을 직접 확인하신 후 참여 여부를 결정하셔도 됩니다. 부담 없이 입장하셔서 실시간 리딩을 직접 경험해 보세요.

klip

・94 reads

애플 계정사기

[국제발신] Apple ID로 비정상적인 결제 거래가 발생했습니다. 설정을 확인해 주세요. https://lnk.ink/cSjwV

klip

・90 reads

리딩방초대

8월 3일 세제 개편 발표하였습니다. 세제 개편안 상세본 보시면 [힌트]가 많습니다. 앞으로는 어떻게 대비해야 되는 지, 굉장히 중요한 순간에 서있습니다. 지난 [5번의 정권] 발표된 수많은 규제 속에서 정확한 데이터를 추줄한 그룹이 있습니다. 현시간부터 정확한 데이터 기반을 통해 앞으로 발표될 부동산 [규제] 속에서 대응 하실 분들만 참고하시면 되겠습니다. https://숏.한국/openkaka/

klip

・34 reads

Contribute by sharing insights to strengthen the community

dooooo
dooooo

October 22, 2026

Community Investigation
Slice on Base: the payout, the swap, and the limits of the onward trail

A transaction-level review of October 20-21, 2026. Public explorer records checked October 22, 2026. All times are UTC.At 18:39:51 on October 20, a successful Base transaction paid 19,820.734002 USDC and 8.716935563284127414 ETH from the contract identified as Slice's FundsModule to the transaction sender. A subsequent swap returned 8.052201613921397406 ETH to that sender, which then transferred 16.788 ETH to another address. These are different stages of a route, not amounts to add together as separate losses.The distinction becomes more important across chains. The public records establish five later Base departures and separate Ethereum receipts. They do not, by themselves, establish the bridge request linking each departure to an arrival, or how much of a mixed address's later activity belongs to this incident.SlowMist's incident database describes a FundsModule issue involving release amounts returned by a caller-selected contract and reports an approximately US$41,000 loss. That is attributed incident context, not a loss estimate reproduced by this review. We did not replay the proposed mechanism or verify a patch. SlowMist incident recordWhat the initial transaction establishesThe seed transaction, 0x02b039…8d790a, succeeded in Base block 52,866,122. The USDC Transfer log records 19,820.734002 tokens from FundsModule 0x61bcd1…eacaaf to the sender, 0xc34572…8c892f. The independently retained RPC receipt matches the token contract, recipient, and integer amount. BaseScan's internal-transfer display separately shows an 8.716935563284127414 ETH payment between those addresses. Seed transactionThe transaction's top-level value is 0 ETH. That field measures the value submitted with the outer call, not all ETH moved by contracts during execution. It does not contradict the displayed internal payout. BaseScan also flags a reverted internal execution while marking the overall transaction successful; success should not be read as a claim that every nested call succeeded.“Sender,” “FundsModule,” and “recipient” describe roles in the selected records. They do not identify a person or establish who controlled an address. The selected payouts are also not a complete reconciliation of the module's other transfers, user liabilities, or incident-wide net loss.The swap changes the asset, not the amount of lossAt 18:41:17, the sender submitted 19,820.734002 USDC to the swap route. The token-transfer list also shows 0.000001 USDC returned to it. The resulting net USDC sent in that transaction is therefore 19,820.734001, not the full submitted amount. Swap transactionThe ETH records reconcile as follows:WETH unwrapped and passed into the payout route: 8.123274552931009529 ETH.ETH paid to the transaction sender: 8.052201613921397406 ETH.ETH paid to a separate recipient, 0xe25c63…272e42: 0.071072939009612123 ETH.The two payouts sum exactly to the unwrapped amount. The separate recipient's role is not established here, so its payment is not labeled a gas fee or a proven service fee. The sender's ETH receipt is a payout, not a gas-adjusted profit calculation. Nor should the submitted USDC and the resulting ETH be counted as two losses.Figure 1. The selected Base sequence, with the sender's actual ETH payout distinguished from the larger unwrap. Rounded ETH values carry an approximation sign; exact quantities appear in the text. The swap returned 0.000001 USDC. The later 16.788 ETH transfer came from an address that had also received pre-event funding. Sources: the seed, swap, funding, and onward-transfer records linked in this article.Why 16.788 ETH is not an exact incident allocationAt 18:45:47, the sender transferred 16.788 ETH to 0xfba873…81364a. Before the seed, at 18:26:57, it had already received 0.0195 ETH from a different address. Both transfers are visible in BaseScan. Pre-event funding · Onward transferETH is pooled in an address balance. These records show that the outgoing payment followed the incident receipts, but they do not assign an exact fraction of each prior receipt to it. We therefore report 16.788 ETH as an observed transfer, not as an independently measured amount of incident proceeds, a protocol loss total, or a recoverable balance.Two chains, two levels of evidenceBetween 23:57:03 on October 20 and 00:03:15 on October 21, 0xfba873…81364a sent five Base transactions with values of 0.5, 5, 5, 5, and 1.287 ETH. The explorer shows their route through 0x333573…4a3333 and internal transfers to an address labeled “Relay: Depository.” Their total is 16.787 ETH on the source side.A SentinelTX working record pairs the first four departures with four Ethereum payments to the same hexadecimal recipient address. We independently checked the existence, successful status, amounts, recipients, and timestamps of those public transaction pages. The four source values total 15.5 ETH; the four cited Ethereum receipts total 15.496861123458983361 ETH.The pairing itself remains a separate claim. The reviewed overview pages do not supply a request-level record that independently proves each cross-chain link. Nearby timestamps, similar amounts, and a matching destination address support a lead, but are not substitutes for that record. The fifth 1.287 ETH source transfer is observed; its destination correlation is not included in the four-pair total.Figure 2. Individual source transactions and Ethereum receipts were checked in public explorers. Dashed links show pairings reported by the SentinelTX working record, not independently established request-level links. The fifth Base transfer is separate. Values on opposite chains are not added together as a loss figure.Sources: the four Base and four Ethereum transaction pages linked in the exact-records appendix. Pairing provenance: SentinelTX working record; request-level linkage not independently established.Explorer service labels help describe the displayed route. They do not establish ownership, complicity, or the intent of any service or address. This review does not turn the paired totals into an exact allocation of the earlier Slice payout.Where this review stopsThe firmest result is the transaction-level accounting: a USDC receipt and internal ETH payout, a subsequent swap with a small USDC return, and a later ETH transfer from an address with earlier funding. The cross-chain pages add independently observable records, while the request-level linkage remains qualified.We do not establish an incident-specific exchange cash-out, a recovery, a current balance, or the identity of an operator. This is a selected-record review, not a complete address history. A missing finding is not proof that no further movement occurred.Figure 3. Publicly checked transfers and unresolved attribution are different evidence categories. The initial USDC receipt also has an independent RPC check. A transfer's existence does not establish ownership or an exact share of commingled funds.Sources: public BaseScan and Etherscan records linked in this article; retained RPC receipt for the initial USDC transfer. The diagram distinguishes observed transactions from unresolved attribution.Sources and evidence appendixThis article is a new editorial reconstruction from the linked records, not an adopted or sealed SentinelTX report. Public explorer checks were performed on October 22, 2026. The independent RPC cross-check is limited to the seed receipt; it is not a replay of the full execution or an independent verification of every downstream internal call. Cross-chain pairing provenance is identified above. Automated aggregate totals from the working draft were not used as incident amounts or balances.The article's scope ends at the selected transactions below, rather than at an asserted complete-history cutoff. The exact identifiers are provided so readers can distinguish an observed record from a proposed relationship between records.Address registerTransaction sender, Base: 0xc34572ebb26b9a4c54854aae8d2347108e8c892fFundsModule, Base: 0x61bcd1ed11fc03c958a847a6687b1875f5eacaafUSDC token, Base: 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913Onward recipient, observed on Base and Ethereum: 0xfba873b1e5d0256301b87ce74f79a30d6781364aSeparate swap payout recipient, Base: 0xe25c6353a04f9375e9cbac224fda91a90c272e42Exact cross-chain recordsThe pair numbering follows the working record, not an independently authenticated bridge-request mapping.Reported pair 1: Base 0.5 ETH, 0x6ca60f5873a2290cf7284146b4f87ab673d51183d3ba5503ab606774b17e75bb; Ethereum 0.499890262307287644 ETH, 0x4c02a7aa31c6f05662211d69d1031e5f51b5bfc350d01143aba6bb89022abde0.Reported pair 2: Base 5 ETH, 0xa05f56d4fc8484ab69ebbeb4ac4d28e40de98a8eea7244c2dcf2ed5b20b41c86; Ethereum 4.998990272562388387 ETH, 0x7125d47d1d734c5f1c253170fd1edaa72d1901c61ea3902f46e2604682150609.Reported pair 3: Base 5 ETH, 0x4ab516ee7fdca7b0985a132182412f6a860051bebc6e25f5b06db8cb8d37b4f6; Ethereum 4.998990251886325914 ETH, 0xe7ecbc6d35d72e1ec95ea16ae9491b410bff6dfb5e833b6c8c2baefffd33c212.Reported pair 4: Base 5 ETH, 0x485808ce7f4fb6f087072b179decd40aebc1177397488ababfffc8a4f8cb3d1e; Ethereum 4.998990336702981416 ETH, 0xdca2cb6c3fe5542d0447b5a98f2318b62a5a5b8b5090ebdac071fa20b34c9934.Fifth source only: Base 1.287 ETH, 0xb7ff77b677a67d251052557f8c514daaec0b013d1c31142b8674fece02796050. Destination correlation remains unconfirmed in this review.

Slice on Base: the payout, the swap, and the limits of the onward trail
0 likes・7 reads
Philippark
Philippark

October 22, 2026

Community Investigation
BiFi: 165,575 USDT net outflow and the boundary of the ETH trail

On 17 October 2026, one Ethereum transaction repeatedly moved USDT into and out of BiFi's USDT market, exchanged most of the resulting surplus for WETH, and paid ETH to the transaction sender and a block fee recipient. This investigation asks two separate questions: how much USDT left the handler on a net basis, and how far the proceeds can be followed without assigning unrelated activity to the incident.The checked route is BiFi USDT handler → execution helper → Uniswap pool → WETH unwrap → ETH payouts. A same-transaction flash loan supplies temporary funding and is fully repaid. The asset path is supported by explorer event records and displayed internal transfers; it stops at the payouts, not at a confirmed exchange deposit or recovery.Who and what appear in the route?The handler is the contract that holds the market's USDT. The execution helper is another contract, called by the wallet that submitted and paid for the transaction. These are different roles: the wallet submits instructions, while the handler is the address whose token balance decreases. The role names below describe recorded activity, not the identity or intent of a person.USDT is a stablecoin token designed to track the US dollar, but the quantities here are tokens, not a historical dollar valuation. WETH is a token form of ETH that can be handled by contracts using the common ERC-20 token interface; unwrapping WETH releases ETH rather than creating a second asset gain. A flash loan is temporary funding that must be returned within the same transaction; otherwise the entire transaction is reversed. Its principal is not the amount lost by BiFi. An exchange pool swaps one token for another; its presence does not establish that the pool or its operator participated in an attack.RoleHow it is used hereBiFi USDT handlerSends and receives USDT during the repeated market interactions.Execution helperBorrows temporarily, interacts with the handler, swaps USDT and distributes ETH.Transaction senderSubmits Anchor A and receives its main ETH payout.Block fee recipientReceives a direct ETH payment inside Anchor A, separate from the transaction gas fee.Earlier deployerCreates a different contract one block before Anchor A; its relationship to the profitable execution remains unproven.Scope and three findingsScope itemBoundaryIncident anchors17 October 2026, 05:42:59 and 05:43:11 UTC; Ethereum mainnet.Accounting scopeAnchor A only: 142 displayed ERC-20 transfer rows; 141 USDT events independently cross-checked against decoded integer values and addresses.Follow-up window17 October 05:43:11–22 October 03:15:00 UTC; incomplete provider coverage, not a complete address history.Verification date22 October 2026; explorer and public-source reads may be later than the follow-up cutoff.Counting conventionToken quantities, no historical USD price estimate. Gas and direct builder payment reported separately.First, the handler's net outflow in Anchor A is 165,575.149730 USDT, not the much larger volume of repeated transfers. Second, the swap, residual USDT and ETH payouts can be reconciled without counting the same value twice. Third, the checked proceeds reach the transaction sender, but the reviewed records do not allocate the incident's ETH to a later cash-out or establish a completed refund.05:42:59 UTC: a deployment, not yet a proven causal linkAnchor B creates a contract from a different wallet in block 26,210,255. Twelve seconds later, Anchor A executes in the next block using a different helper. Both successful statuses, times and addresses were read directly in Etherscan. Deployment record · Execution record.The public DeFiHackLabs reconstruction describes the earlier wallet as the original exploiter and the later sender as a front-runner, meaning a participant that executes an opportunity ahead of someone else. We retain those descriptions as external claims. A twelve-second gap is not proof of copying, shared control or mempool observation. Establishing that relationship would require the relevant bytecode and execution comparison, and evidence of how the later transaction was selected or ordered.UTC / blockObserved event17 October 05:42:59 / 26,210,255Anchor B: 0x15b47e2c0daf723dec64c75b435079d3a1f8a6058b21b9a64dda4844e877a034. Deployer 0x7c78a049fff71609990017b58a959e926e6ec4c6 creates 0x8c0d729d03cb8ecbc79a62a68cdd67ccfa6a7b92.17 October 05:43:11 / 26,210,256Anchor A: 0x756c68055af7a0630aa0b56891ba4de14c56c39cbebe99e47eeb4728f4d6ad14. Sender 0xc0ffeebabe5d496b2dde509f9fa189c25cf29671 calls helper 0xe08d97e151473a848c3d9ca3f323cb720472d015.05:43:11 UTC: temporary funding and repeated market flowsHow much of the transfer volume represents money leaving the market? The helper receives 40,499,999.999997 USDT from the Morpho-labelled contract, then repeatedly sends USDT to and receives USDT from the BiFi handler. The flash-loan event records 40,499,999,999,997 base units; the final repayment returns the same principal. Anchor A events.Within this transaction, 54 transfer events run from the helper to the handler and 83 run back. These counts include zero-value events. The incoming and outgoing sums are large because the same capital is reused. Subtracting one direction from the other answers the narrower question of the handler's token movement. Think of this as reconciling one account: a large amount repeatedly entering and leaving is not the same thing as the final amount that left it. The table counts the recorded token movements, not the market's internal deposit claims.Handler ledger in Anchor AUSDTIncoming: 54 events141,270,327.667580Outgoing: 83 events141,435,902.817310Outgoing minus incoming165,575.149730Start Figure 1 at the temporary loan, move through the two-way market interaction, then read the swap stage. Solid arrows connect ordered accounting stages, not additional losses or equal time intervals.Figure 1. The flash loan nets to zero. The handler net outflow equals swap input plus helper residual. Colors group stages only; line width is not amount. Source: Anchor A decoded Transfer events and FlashLoan event.The net outflow is a transaction-level quantity, not a complete statement of protocol insolvency, affected depositors or unreimbursed user losses. The next step is to account for where that surplus went.The swap changes the asset, not the size of the incidentThe helper sends 165,574.514633 USDT to the Uniswap pool and receives 68.057203111718789216 WETH. The remaining 0.635097 USDT is the helper's net token change within Anchor A, not a current balance query. These two USDT quantities add to the handler's net outflow exactly.ReconciliationQuantityUSDT swap input165,574.514633 USDTHelper USDT net increase0.635097 USDTSum / handler net outflow165,575.149730 USDTSwap output68.057203111718789216 WETHUSDT and WETH are not added together as separate losses. They are different forms of value passing through the same execution. Likewise, the following WETH unwrap is not a new theft of ETH on top of the swap. Full transaction and event record.The ETH payout splits into two branchesWhere does the unwrapped ETH go? The WETH contract sends 68.057203111718789216 ETH to the helper. The helper also receives 145 wei with the submitted transaction. A wei is one quintillionth of an ETH; this tiny input matters when checking the payout to its final digit.Start Figure 2 at the WETH contract, then follow the helper's two payout branches. The gray box below the sender marks an allocation limit and has no onward transfer arrow. Both payout branches belong to the same transaction; their side-by-side placement is not a time axis.Figure 2. Solid arrows are ETH transfers in Anchor A. The dashed gray box is an evidence boundary, not an observed destination. Gas is not a helper payout. Sources: Etherscan internal transfers and the provider call trace.ETH accountingExact amountWETH unwrap into helper68.057203111718789216 ETHTransaction value into helper0.000000000000000145 ETHDirect payment to block fee recipient0.986829445119922310 ETHGross payout to transaction sender67.070373666598867051 ETHTransaction gas fee, paid separately by sender0.000845755321487776 ETHUnwrap plus transaction value equals the two helper payouts exactly. The sender's receipt is a gross payout, not automatically its final profit. Even subtracting transaction value and this gas fee would describe only a transaction-specific ETH change; it would not establish wider trading costs, earlier capital or the operator's incident-wide profit. A direct payment to a block fee recipient also does not establish its knowledge or involvement. Internal transfers and transaction fee.What the code supports—and what it does not yet proveA lending market records interest by updating accounting values over time. The DeFiHackLabs reconstruction proposes that an old interval without market activity was reused while the participant changed utilization—the proportion of deposits currently borrowed. In that explanation, repeatedly crediting interest at changing rates lets the participant withdraw more than it supplied. This is an external reconstruction, not a replay we independently executed. Reconstruction and assertions.Direct source inspection provides a narrower check. In Etherscan's currently published TokenHandler source, _checkFirstAction calculates the current block minus the last updated block, then calls setBlocks and syncActionEXR when the difference is positive. In the published interest-model source, _getInterestAmount reads the stored inactive interval and action accounting rates. _calcInterestAmount reads deposit/borrow totals and calculates rates from them; _getNewGlobalEXR multiplies a rate by the interval. TokenHandler source · Interest-model source.Those code relationships help explain the proposed mechanism. They do not establish the exact historical storage values or independently reproduce the exploit. The provider trace reports that the handler delegated calls to this logic address in Anchor A; delegatecall means code at another address runs using the caller's storage context. The inspected source is a present explorer publication, while the trace is provider-reported incident execution. Neither replaces a complete historical-state replay.The reconstruction also uses distinct block contexts: its comments refer to a 264,059-block interval at the deployment block, while its test rolls to the following execution block and asserts 264,060 blocks. We do not silently merge those values or present either as a historical value independently read by this investigation. The missing evidence is the incident-time storage snapshot, decoded full execution and a reproducible replay at the correct parent state.Why the onward trail stops at the senderThe bounded provider follow-up reviewed activity from 17 October 05:43:11 through 22 October 03:15:00 UTC, with limits of two outward hops and ten material transfers. Its source coverage is incomplete. The sender appears in repeated helper executions, so later balances and payments mix multiple activities. A later outgoing payment cannot simply be labelled the same 67.07 ETH because the address received it earlier.The observation window is a requested time boundary, not proof that every transaction up to that time was retrieved. No incident-specific exchange receipt or directly anchored refund was established in that review. This is not a finding that neither exists: unobserved records and unresolved allocation remain. We exclude surrounding tokens, look-alike addresses and unrelated service labels from the incident route rather than drawing a larger network that the evidence does not support.Response points and next recordsFor the market's maintainers, the concrete technical check is how an idle interval and changing utilization interact across repeated actions in one block. Historical storage, active implementation and the before/after interest accounting should be compared before a patch or root-cause statement is treated as validated. The source relationship suggests a targeted test, not a claim that every other market shares the defect.For fund-flow review, the priority is an anchored return transaction or a defensible allocation method at the mixed sender. A screenshot of its balance, a generic exchange label or an unrelated large payment would not answer that question. Full bytecode and execution records for the earlier deployment are separately needed to assess the claimed front-running relationship.The evidence supports one reconciled path: net USDT leaves the BiFi handler, most is swapped for WETH, WETH becomes ETH, and the helper distributes ETH. The accounting is substantially firmer than the attribution and historical root cause. Those differences are the conclusion of this investigation, not details to smooth away.Evidence appendixFull address registerRoleEthereum addresshandler0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3helper0xe08d97e151473a848c3d9ca3f323cb720472d015sender0xc0ffeebabe5d496b2dde509f9fa189c25cf29671builder0x4838b106fce9647bdf1e7877bf73ce8b0bad5f97deployer0x7c78a049fff71609990017b58a959e926e6ec4c6created0x8c0d729d03cb8ecbc79a62a68cdd67ccfa6a7b92morpho0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcbpool0x4e68ccd3e89f51c3074ca5072bbac773960dfa36usdt0xdac17f958d2ee523a2206206994597c13d831ec7weth0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2logic0x47be3d1def039bd85e7570864bb5148e7491a65fmodel0x29ecabde2c57b6d4183f915ebca1a25804a60db1storage0xfdc7d058bede981ea865fb64d06382a2206a1c42Full transaction anchorsAnchor / scopeTransactionB: deployment; block 26,210,255; 17 October 05:42:59 UTC0x15b47e2c0daf723dec64c75b435079d3a1f8a6058b21b9a64dda4844e877a034A: execution; block 26,210,256; 17 October 05:43:11 UTC0x756c68055af7a0630aa0b56891ba4de14c56c39cbebe99e47eeb4728f4d6ad14Transfer-event inventory for Anchor AThe tables below preserve all 142 explorer-displayed ERC-20 transfer rows in event order. They are not 142 separate transactions. USDT uses six decimal places and WETH eighteen in this inventory; the integer USDT event data were checked against every corresponding displayed amount and address. The separate WETH Withdrawal event records the subsequent unwrap; it is not an additional Transfer row. All these events share Anchor A's block and UTC time above.Event / assetFrom → toAmount12 / USDT0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb→ 0xe08d97e151473a848c3d9ca3f323cb720472d01540,499,999.99999714 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3121,257.48502916 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3484,544.91017918 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,795,238.89221520 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e37,238,802.15538922 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e330,860,156.55718524 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3026 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50028 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50030 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50032 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50034 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50036 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50038 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50040 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50042 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50044 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50046 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500Event / assetFrom → toAmount48 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50050 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50052 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50054 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50056 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50058 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50060 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50062 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50064 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,50066 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50068 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00070 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50072 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00074 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50076 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00078 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50080 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00082 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500Event / assetFrom → toAmount84 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00086 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50088 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00090 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50092 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00094 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,50096 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,00098 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500100 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000102 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500104 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000106 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500108 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000110 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500112 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000114 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500116 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000118 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500Event / assetFrom → toAmount120 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000122 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500124 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000126 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500128 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000130 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500132 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000134 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500136 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000138 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500140 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000142 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500144 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000146 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3165,163.833793148 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d015247,951.408655150 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3121,257.485029152 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3484,544.910179154 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,795,238.892215Event / assetFrom → toAmount156 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e37,238,802.155389158 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e330,860,156.557185160 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e30162 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500164 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500166 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500168 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500170 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500172 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500174 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500176 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500178 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500180 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500182 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500184 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500186 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500188 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500190 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500Event / assetFrom → toAmount192 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500194 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500196 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500198 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500200 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0151,498,500202 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500204 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000206 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500208 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000210 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500212 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000214 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500216 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000218 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500220 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000222 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500224 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000226 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500Event / assetFrom → toAmount228 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000230 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500232 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000234 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500236 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000238 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500240 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000242 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500244 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000246 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500248 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000250 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500252 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000254 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500256 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000258 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500260 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000262 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500Event / assetFrom → toAmount264 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000266 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500268 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000270 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500272 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000274 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500276 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000278 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e31,498,500280 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0152,025,000282 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3165,163.833793284 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d015247,951.408655286 / USDT0x808c3ba97268dbf9695b1ec10729e09c7e67a9e3→ 0xe08d97e151473a848c3d9ca3f323cb720472d0150288 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0xe08d97e151473a848c3d9ca3f323cb720472d0150.000068289 / WETH0x4e68ccd3e89f51c3074ca5072bbac773960dfa36→ 0xe08d97e151473a848c3d9ca3f323cb720472d01568.057203111718789216290 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0x4e68ccd3e89f51c3074ca5072bbac773960dfa36165,574.514633292 / USDT0xe08d97e151473a848c3d9ca3f323cb720472d015→ 0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb40,499,999.999997Evidence classificationClaimBasis / limitationUSDT totals, status and UTC timesDirect explorer overview and decoded event reads; integer calculations reproducible from the preserved inventory. Not an independent node consensus check.ETH payoutsDirect explorer internal-transfer display, corroborated by provider trace.Incident-time delegate targetProvider call-trace report; not independently replayed.Idle-interest exploit mechanism / front-runningExternal reconstruction plus limited direct source inspection; historical state, exact replay and ordering causality unconfirmed.Later cash-out / recoveryNot established; follow-up coverage and allocation incomplete.Sources are linked beside the claims and in the exact records above. Explorer labels are descriptive leads, not proof of human identity or culpability.

BiFi: 165,575 USDT net outflow and the boundary of the ETH trail
0 likes・10 reads
Philippark
Philippark

October 20, 2026

Community Investigation
Qubic Wallet Incident: 205 Receipts, 204 Sources, and the Boundary Between Containment and Recovery

During the night of 17–18 October 2026, Qubic reported that weak wallet-seed generation had allowed an attacker to drain wallets. A seed is the secret used to derive a wallet’s signing keys: if its generation is predictable, the resulting address can remain valid while its funds are unsafe. The project reported around 2.94 trillion QU affected across 1,404 wallets. This review asks a narrower, reproducible question: what do the public transfers into one listed recipient establish, and where does the evidence stop? Project disclosure; Project explanation of the cause.The directly checked fund path is source addresses → recipient R1. Explorer exports show 205 receipts from 204 distinct sources into R1. One of these transfers and the two transfers from the repeated source were also opened individually with their transfer-event rows. The path drawn here ends at R1. Later containment code names a separate escrow address, but this review does not join R1 to escrow with a verified execution event or independently establish victim repayments. A later project announcement reports that repayments have begun; that attributed update is distinguished below from the checked transaction subset.The roles before the totalsQU is the native asset counted in the Qubic Explorer; the Explorer labels it QUBIC. This article uses QU consistently. A Qubic identity is the public address, not its secret seed. A tick is the network’s numbered processing step, which lets records be ordered without treating a browser’s clock display as UTC. A transfer event describes a balance movement; it is not interchangeable with a separately signed transaction.RoleMeaning in this reportSourcesAddresses recorded as sending QU into R1; being listed does not prove the owner’s identity or consent.R1One of seven initial recipient identities compiled by Qubicmap. The role describes receipt, not a proved person.EscrowAddress named by the official containment code as the intended destination of frozen balances.Frozen identityAn address included in a pinned code list. That list also covers at-risk funds, not only completed theft.The wallet code, the transfer record and the recovery mechanism answer different questions. Public source code can show what a patch was designed to change. Transfer records show who paid which public address and how much. Neither alone proves the attacker’s exact method, real-world identity or a completed refund.What was checked, and what was notMeasureScope / evidence levelReview checkpoint20 October 2026, 00:15 UTC. Historical observations gathered on 20 October; no common pinned state or continuous monitoring is claimed.Incident window17 October 23:42:01–18 October 01:26:19 UTC according to the community dataset; not independently reconstructed for all victims.Direct export subset205 unique successful-transfer rows, 204 source identities, 568,777,432,013 QU into R1. Quantities are transfer amounts, with no separate fee figure added.Individual detail checksThree transactions and their visible QU_TRANSFER rows: the last sampled receipt and both transfers from the repeated source.Whole-incident contextSeven dataset recipient rows sum to 2,939,606,531,944 QU and 1,404 listed source entries. Arithmetic checked; all source histories not replayed.Outside the verified pathMEXC deposit identity, onward transfers, escrow execution events, owner identity, full historical balances and completed restitution.The three principal findings follow from those boundaries. The receipt inventory reconciles to the community subtotal for R1. One address appears twice, explaining why transaction count and source count differ there. Finally, the later frozen-address list and escrow code establish a containment design, not transaction-level proof of recovery. The sections below explain the records behind each finding.17–18 October — receipts converge on one addressQubicmap’s incident checker lists seven initial recipients. R1 has the largest displayed subtotal: 568,777,432,013 QU attributed to 204 listed source addresses. Instead of adopting that row without checking it, we exported all three pages of the Explorer’s displayed signed-transfer table for R1, at 100 rows per page. The resulting 205 unique records sum to exactly the same amount. Community incident dataset; VNJZRGGRYRTKHANUZHLTHTSBQOFCTCJKUKLCVIWCSBRTZNYOJEVPGYDCDRCM.These exports independently support that one recipient’s displayed inventory. They do not independently establish every row in the community dataset, prove who owned the source keys, or replace a native consensus replay. In particular, the sum of the seven displayed source counts is not an independently deduplicated, cross-recipient victim count.Start Figure 1 with the source group at the top and follow the single solid arrow into R1. It represents the 205 exported QU receipts, not 205 different victims. The sample panel anchors one of those receipts to an individually opened transaction. The broken line underneath is an observation boundary, not a route to an unnamed service.Figure 1. Blue-gray boxes summarize the exported source and recipient roles. The solid arrow means recorded QU receipts; it is not scaled to quantity or time. The pale sage panel is one individual detail check, not an additional inflow. Full records and links are retained in Appendix B.The matching subtotal makes the community lead useful without making every wider allegation verified. The next question is why the Explorer gives 205 receipts while the dataset names 204 source addresses. That difference can be resolved inside the exported records, without guessing an extra victim.One source paid twice — transaction count is not victim countAt tick 85,362,890, the repeated source sends 17,065,760,963 QU into R1. At tick 85,371,060 it sends another 1 QU to the same recipient. Both transaction detail pages show the same full source and destination, and each contains a matching QU_TRANSFER event row. First transfer; Later 1 QU transfer.RecordQU / tick / eventpwjalmhztlijreususcvpefiruyddqtmxgahgozctclvxvwfctdzjjxcfvdl17,065,760,963 QU · tick 85,362,890 · event 19832786rmqdmmstqcugfblgthzbnwtrivdcwdpjdkrxodvcbgiszelbeqapasidnolc1 QU · tick 85,371,060 · event 19996143Counting this source once, rather than once per transfer, yields 204 distinct source identities across 205 receipts. The later 1 QU payment is not evidence of a test, a refund or a different attacker: its intent is not recorded. This local reconciliation also does not resolve a separate public discrepancy between 1,404 and 1,405 affected identities, or between seven initial recipients and eight wallets mentioned in later community commentary.The final sampled receipt provides a second type of cross-check. At tick 85,371,146, the Explorer transaction and event both record 106,444,954 QU from source S into R1. Qubicmap’s lookup for S returns the same hash, quantity and tick, classifying it as drained. That is corroboration of the dataset entry, not independent evidence of consent or ownership. Sample transaction; Sample event.Time requires a separate caution. Qubicmap explicitly labels this sample 18 October 01:26:10 UTC; the Explorer in the reviewed browser displays 10:26:10. The nine-hour difference is consistent with the local browser setting, but the exported CSV has no timezone label and raw UTC was not independently obtained. Appendix B therefore preserves its display time as recorded and orders records by tick. It does not silently relabel those timestamps as UTC.18 October — the patch changes seed generation, not existing keysAfter the reported transfer window, the wallet repository records a change replacing Math.random-based generation in the create-vault and seed-edit flows with a shared secure generator. The v4.26.4 helper reads random bytes through crypto.getRandomValues. It refuses to generate a seed if that capability is absent. Pinned wallet patch; v4.26.4 release.The helper produces 55 lowercase letters. It accepts byte values below 234, then maps each accepted value to one of 26 letters; rejecting the remaining byte values avoids giving some letters more possible inputs than others. This is a direct code observation, not a measurement of how unpredictable the random input on an affected device was (its entropy). We did not reproduce the attacker’s seed search, inspect a victim device, or establish which exact bundle every affected wallet ran.A public proposal opened on 12 February 2026 already discusses secure seed generation. Its existence is relevant history, but it does not by itself establish a decision-maker’s knowledge, intent, or the precise cause of every affected key. Likewise, publishing a patched generator does not replace keys created earlier or prove that every installed wallet has updated. Earlier public proposal, PR 229.19 October — a frozen list and an escrow designThe project’s earlier update reported a network halt at tick 85,371,949. On 19 October, Core PR 1048 was merged for v1.308.2. The pinned frozen-address file contains 2,797 distinct identities and specifies FREEZE_FROM_TICK 85,371,950. All seven dataset recipients and the individually sampled source occur in that exact list. The larger list must not be called 2,797 confirmed victims: the containment change also addresses at-risk funds. Project halt statement; Merged Core change; Pinned frozen-address list.The associated sweep code describes reducing frozen balances, increasing the escrow balance and logging QU transfers, alongside asset handling. A later commit explicitly sets the escrow identity preserved in Appendix A. This is a different type of evidence from an ordinary signed transfer: protocol-generated balance movements may not appear as signed transactions in an Explorer table. Sweep implementation; Escrow identity commit.Read Figure 2 from top to bottom as evidence stages, not a stream of money. The first box is the pinned code configuration. The second is an Explorer account-header observation. The dashed third box outlines the execution and reimbursement records still needed. The bottom panel separately identifies the later project announcement; it is not another directly checked transfer. There are no fund-transfer arrows between these boxes because this review has not verified those joins.Figure 2. Sage marks directly read repository configuration; blue-gray marks a separate aggregate Explorer observation; the dashed neutral panel marks missing execution and repayment evidence. The bottom panel is a later project statement, not an independently verified payment record. Vertical order is a reading guide only. These are not amounts to add together.The escrow account header displayed 2,836,660,961,867 QU and 1,441 incoming transfers during the 20 October review, with its latest incoming tick shown as 85,398,715. Its detailed Transactions and Events panels returned no records at that time. R1’s header likewise showed a later outgoing count, while the signed-transfer export contained only receipts. The Explorer’s Events feature warns that coverage is provisional. These mismatches prevent a transaction-level reconstruction of the sweep; an empty detail table does not prove that no protocol movement occurred. XMGUNWJYLLUUZANFEWJNNIDMXNSDMPOVFAHWOERKDDAWDREZLANHTFJBKMPB.Nor can the escrow header be subtracted from the incident total and called missing funds or recovered funds. The two figures have different populations and observation points. A recovery conclusion requires the actual sweep events, their source identities, quantities and ticks, followed separately by evidence of payments to entitled holders. None of those missing joins is drawn as a confirmed path here.20 October — the project reports restart and first repaymentsAt 18:14:20 UTC on 20 October (21 October in Korea), Qubic announced that the Computor quorum had approved recovery, the network was live again, the reclaim platform was open and the first funds had returned to verified owners. A following post said affected funds had been moved into protected escrow during the halt. These are newly read project statements, not independently matched sweep or repayment transactions. Restart and first-repayment announcement; Project escrow account.This changes the reported operational stage from planned containment to announced recovery in progress. It does not change the 205-receipt inventory or provide a verified recipient-by-recipient refund ledger in this review. The statement does not supply a repayment amount in the text examined; no recovery percentage is calculated. Figure 2 therefore keeps the directly checked code/header evidence separate from the project’s later announcement and draws no payment arrow.The project also states that the claim window runs until 1 May 2027. Readers should navigate from the verified project announcement for current instructions; this report neither submits a claim nor requests a seed. The source’s announcement of first payments must not be rewritten as full restitution. Project claim-window statement.What the wider claims still needThe project’s 18 October statement said 87.1% remained on-network and 12.9% had reached MEXC and been frozen. This is a dated project account. This review has not obtained and verified the complete MEXC deposit identity and transaction chain, an exchange confirmation, or a current freeze-status record. It therefore does not label any of the seven recipients as MEXC or call a payment a completed cash-out. Dated project funds-status statement.Open questionRecord needed / current boundaryWhole-incident tallyReplay and deduplicate every source history across all recipient groups; seven displayed row totals alone are insufficient.Seven recipients / eight later walletsThe additional full identity and its transition records; different stages may explain the counts, but that is not established.MEXC connectionExact deposit identity, native transfer/event records and attributable service confirmation.Sweep / repaymentSource-to-escrow execution events followed by separate holder-payment evidence. Code and header totals alone do not prove either.Root cause / identityAffected build and device-level evidence, attacker-method reproduction or attributable records; transfers alone supply neither.An alternative interpretation of the missing signed outbound records is a system-generated sweep rather than an ordinary signed transaction. The official implementation makes that technically plausible. It remains an interpretation until the relevant execution records are obtained. The same discipline applies to the two small-versus-large payments: a visible sequence is not a recorded motive.Where the next response should focusFor affected holders, the specific concern is the generation of the original secret, not an ERC-20 allowance. A software update can prevent the old generation path from being used again; it cannot make an already exposed secret unpredictable. Any migration or claim should use the project’s verified channels and current containment instructions, without submitting a secret seed to a checker. The public checker reviewed here uses an address, not a seed.For maintainers, the next evidence should join the approved release to its actual network execution: frozen identity, movement event, quantity, escrow destination and tick. For service investigators, the next separate task is the exact MEXC deposit trail and the service’s status record. For this report, the strongest completed result is narrower: one independently summed recipient inventory, a concrete explanation of its extra transfer, and a clearly marked boundary between containment design and demonstrated recovery.Appendix A — full address roles and source boundariesRole / evidenceFull Qubic identityR1 · exported receipt inventoryVNJZRGGRYRTKHANUZHLTHTSBQOFCTCJKUKLCVIWCSBRTZNYOJEVPGYDCDRCMS · individually checked sample sourceZNTRZHEVDZPLQGJFHVKUYYSKWNBAZBZDMGHMWSANCGXKEJOXVIZJXPQDZYLORepeated source · two individually checked receiptsIZOOJMBGEKCGZBMYIFEWRPCMMGUCMFOODFVWGEGZAHWWJLHGWRHVRQKBSSHIEscrow · official code identity, header onlyXMGUNWJYLLUUZANFEWJNNIDMXNSDMPOVFAHWOERKDDAWDREZLANHTFJBKMPBThe next table transcribes the community dataset, not seven independently replayed inventories. Only R1’s 205-row signed-transfer listing was exported and reconciled. “Source entries” follows the site’s grouping; a globally unique victim count has not been independently established.Dataset recipient / full identityListed source entries / QUR1 · VNJZRGGRYRTKHANUZHLTHTSBQOFCTCJKUKLCVIWCSBRTZNYOJEVPGYDCDRCM204 / 568,777,432,013 QUR2 · XVPYBEQNKNBKVCFPVGCFFNBZDEBDGJWVGDCBDBQBCFPRQKJNYXIJJWFDQXDI203 / 453,611,215,145 QUR3 · TFYIRQPKYCPQOEUGRZMKCFQNJKPDMPGGKSWISAYLXAIZKFWKAYRXJMZGYVLE202 / 414,758,635,767 QUR4 · JRDYPWVXWSKBXEIMGTHSVPWPMACDONYHRXPGMCNRJGRFQQDEXBADDGTBDIPO201 / 390,892,863,292 QUR5 · YBFJMLNSECZSQBLQUBUDLKYFJMIDYLZPNXAUGUKLTEBLJRHFHBIEPYSCRHWO199 / 379,522,533,375 QUR6 · VICIUULQUOHBIDLNMZNLPQPGSUDDLXUARWEGVOZIEGGFBELUXLMWHHYADJMN197 / 369,642,443,319 QUR7 · FSLWPFDDKMXCEGBTOJRBYOVMFULCQAQDAGAHJBVSAALWYMTZESNLCDUAVZBA198 / 362,401,409,033 QUThe seven quantities sum to 2,939,606,531,944 QU and their displayed source counts sum to 1,404. Frozen-list membership was checked against the pinned file for all seven recipients and the sample source. Membership describes the code’s target set, not the legal identity or guilt of an address owner.Appendix B — reproducible receipt inventoryThe following 205 records reproduce the three downloaded Explorer pages for R1, sorted by tick and hash. They are exported listing observations, not 205 individual detail-page or signature-replay checks. Every row has the same R1 destination given in Appendix A, input type 0 / Transfer, and the exported status Successful transfer. Full source identities and full transaction hashes are preserved. Amounts are exact QU integers; no USD valuation or additional fee estimate is included. The time column is the CSV’s browser display time on 18 October 2026, with timezone unspecified in the export—not a UTC claim.Receipt records 1–15Full transaction / QU / tick / display timeFull source identitykzmbprybxrynifebbcnhpumfozkgrwooahriezmymfwmdzhversdfhbhsrzn1 QUTick 85,358,7112026-10-18 08:42:01KASNLYSOXMDBLAIORZLAOTMZRIOAQXKMGUXSYVOGJHPAAPCYCZJZPQLFMPUOqccojabeomubqgxualmhaanyvnkffahkgpyaayuddairmpbzdascbahffaua1 QUTick 85,358,8122026-10-18 08:42:51TZDRKWYCSPMPXEBMOGDBOWTAZKUCHJTPCSRZGRWCHHVJLFWXCPRGEKQEEXKCxecinfqhvgpkpbxulphgtgjqrylauzrnczvbjsctkgbaeztwbtbpuifehhzi1 QUTick 85,359,5862026-10-18 08:49:20SPLUVFUYTYYNUCCVNVCGZGCWCDMADAIQDMAWPMURKAZFEIVWHXVIWTGCCQPFrfhjyhwajoicraoacoqnjrcmauraqayaykmvohfkxgjypoxvdgvmqtrbmmwb1 QUTick 85,359,6042026-10-18 08:49:29KYGYRXSQYCYFBHKPRFBJPWQFSGLDQCETADWDAVFHMGIBIAZEFUBYNRMBGBWFagrtlqrxppicodvduldkqljwepfgfalcsvzsonheqfehokghaeqnhneeyasg1 QUTick 85,359,6202026-10-18 08:49:37PLWVYDWFQXOVBFAKGQCPYLKFBKCAXKSKZGGNHZESYDELJQPSFGCUJJXEVTVKoesqvoattvnvtebaftbnumgcmrugezibozfwhvlmackaxfyxrwdycvvefjna1 QUTick 85,359,6372026-10-18 08:49:45IPIWJJMRSDKKZBJJDUGJCRYNHWLCDYZIEELOGTGFADVXUDCSMLXDTSXGFLCOgthgtqytkcuejfkpjtmblnyqoiceqsiqseehikhjsfvdxeiafbfgxigegmja212,742,939,086 QUTick 85,361,8592026-10-18 09:08:23PSIVKNHDUSLWRAEZJQAOQMUKYGCBUYGXQTKKZGIEKHHEHSKCKKYCUAPAFOMFlpspgmkxhmlseasrkyfaibkozkydslmjiaoegyrllcqzrzwhuzuwlwqeccel51,756,401,205 QUTick 85,362,8312026-10-18 09:16:30TYODSNDLGNDJVEFNMPACXEDOJRADMTPQAVJDQBKSZEYGMHNFVIFKRXHGSDLNsytrnjsydbguiaiikyiccznpggnfherhovgoebusmbgfznanlgxwfnifzbpi25,366,718,545 QUTick 85,362,8472026-10-18 09:16:38EDPSUEXTDTGHSFQRLHJHYKAKHBGBPEOMSRJHNMFSNDKMTKAIFMISVENEQJUNsraciimlofqwzafurukymzeopzdhbbfxducrwwjweahiqkmclevfotcbaihl21,118,078,476 QUTick 85,362,8652026-10-18 09:16:48EPKPWOLYQKSWCABARVUDIIBOQOKBCLHMSKCVXYORHGUSKJCVDRZQXOODVRDLpwjalmhztlijreususcvpefiruyddqtmxgahgozctclvxvwfctdzjjxcfvdl17,065,760,963 QUTick 85,362,8902026-10-18 09:17:00IZOOJMBGEKCGZBMYIFEWRPCMMGUCMFOODFVWGEGZAHWWJLHGWRHVRQKBSSHIugmlpkophuaxebvpgdsbqmtmcadcbkxqrgpeaqqlhgqjujrbzggponvbhxam14,378,018,567 QUTick 85,362,9062026-10-18 09:17:08AJONCVKYTRUFVACBOHDVBCYMYTSAZFRCUJWPCBPXAAVMIIJDRYPRYYAFGSAGojmewyvoysxzsfpzterifvogebcbyvppkuserhqpgdohjekvznzaktiaanse12,672,798,403 QUTick 85,362,9232026-10-18 09:17:16BOXZEAOSYPYNKFKNHSDMOJINUJOCZTGXKQXXNRGLXEIJCAZEJHZUPFECVSPBecncmspihotondgduyqdwncofynbpwhybffqftifqftqzivlmrkqzyaeysil11,372,064,965 QUTick 85,362,9462026-10-18 09:17:28YALBTQYLHXCMXCIIYHCWALTQEJMALDQUDCHBBBSMIGHUJDJTGWATTNMBILRKrblfngebzrxyxebuglheufnrwdefiwqjxksixttghbemypigkprkbptexbnm10,819,690,581 QUTick 85,362,9462026-10-18 09:17:28VQBTUXWCJTTCMCAGGUIQDTVMAMSAYAAXNULLHXSFOBOZVVUKEPIZZDCAYJKHReceipt records 16–30Full transaction / QU / tick / display timeFull source identityoqpbqdswaqwqtfdhaybfgrmefafddzddjmtagbhoscuumwgdoywqsfgbezyd9,754,066,043 QUTick 85,362,9642026-10-18 09:17:37VWDVFOFUWEAFEBRBFCPBOUQGEAODOTNLSPNXTJZBUBLCKYGZTXMVMUCGOBKHsijbfgbkhzlfzcpmgynufeeaiwxfvxkgpuackgashgwlobcsjnugrvgaukrb9,000,027,944 QUTick 85,362,9812026-10-18 09:17:45FPMCTILWDFNNGFYHIHFTGTAQDTZCJHFFKNAEWCAGADJZQALQTZLFWDFBVLRGukwdxvtfmjzpcafnpnmpsmxskylbvbxeyrdjttphtgfcorciplqvvoceptig8,337,564,524 QUTick 85,362,9972026-10-18 09:17:54TSWIERUTBTUEWAFAXJWXNXJBYJPCPUOTWTBGWUXXOAETHOZTJUYIQIRGEYLLfaredsjokwudgesazbjyqnqyfpncvistgtxaehwboevxwduobptlysrcybae7,579,688,282 QUTick 85,363,0132026-10-18 09:18:02HSOELKNOZBTNNCZALLXRBAIQPEXCKKVSIWBICQIMLCUXCJMHVKHEMDIAKMTOwdfvnpgsaidmehonilfmhibxuibgesiddiemdvarnbtkzuolajhiclmgtori6,787,011,016 QUTick 85,363,0302026-10-18 09:18:10MUXUVHVSVATKAEYGAPJITRSLOMDDNBSPXDYDFVSMQAZITYTUIXVHWCSFPECNiubcxsoijfrfaehpjjgzgfrwttgelpkfhtwxfwhjqftprorudrcabuwcmiil6,366,030,287 QUTick 85,363,0682026-10-18 09:18:30JYMLQRGJPTPRLEBTSJPIVWPZNFRBVFLCCWMRIVMVHDGWGJLESFMGXIXENFCCalwikiqvdfsrjcvlozwgdcwpsvkfvvtwppbezrydyaibckeqwimodasfxgxn5,714,667,283 QUTick 85,363,0842026-10-18 09:18:38PBFIQXQHCICJKCTOUQPKXXCNRADBZHWIQIPUCTOYHGFBNVOVXFHBGZWBLBJFrpyhvkgqsnewrbnjfyermhbiaiebptlbiwfllomlzgquelxbkorfldoafgjl6,057,884,318 QUTick 85,363,0842026-10-18 09:18:38LGLTZGLQKTOTYEEWSJDASVGCJUGAUTTJZGTSYGOLZGYVMVRRXVVBCHJAWOFAceckxgxkmlbysbnyzcnlgmmlprigqpvozslldzyoadxdgqzqdjevrqdfslti5,201,589,839 QUTick 85,363,1012026-10-18 09:18:46EPUGBZESRCWUOGHUZICXFDWRQLACQZNURGIYZOQGIEOFKPMBROLQIKDHQMZDddpmiragocjgxfcnadnvncxocywabsspduqrsbfnaeuwhpawypsnycucxjpa5,017,128,141 QUTick 85,363,1182026-10-18 09:18:55EIFORJHQTPYQHFTAXTHUEOJHFKMDMMPUIYLZDGLKLGKOBLFEYLQFBFKEYWYKklzgxjlghgyvnexwqovagxeaqpbfagznzehteqbdnfpecsbewgznotibuoel5,000,000,000 QUTick 85,363,1352026-10-18 09:19:03BLWAJAWFXNSWHGRSGOYYYLYYVOTCLBMXGSETMQHIIGZIASPUHTFKVMRBWMQBuwvfehpfcyrnxavksgtrktbyfovgjtfnixvimgngrctdldnergnzvuvbowkc4,697,398,495 QUTick 85,363,1522026-10-18 09:19:12EHZVSFKPQACRACISGYKWAVLJXELBNEPTNTSFATNWXEAMEXYAHMVUUOGGCZMNzcavownlosvgydolrftkjpvtopjglkutkeefmnpguemklkayskwykxkbytti4,414,748,788 QUTick 85,363,1682026-10-18 09:19:20EHSYFDWZHYRAQAIGLJLUJOCOTILBCHKONJBYOKPPUEZQOGAZCCWQMSUEQJLBvpyxsnhqhoxawgkzsnqzexvqrexbomsendzcevjtwamybmfjuvqgcqhavnaj4,074,866,216 QUTick 85,363,1862026-10-18 09:19:29ZCUNMOBFWNYVHGTHBIHWVXRTBJACVFPOHDXMRTZVJBDBCYEGKZWJSBAHKXHIedptxlwkhjheycnkxczreasjalealkrkngqwsfffpfsfjjschebsomobhlkl3,725,843,245 QUTick 85,363,2032026-10-18 09:19:37FXLGZDOFJTWJODZFPALRYPAXGVBDBLTCTWOMZWRXRGNJLMFIXBJNFWGCQDUCReceipt records 31–45Full transaction / QU / tick / display timeFull source identityvxspqporvgqmbafbjkzmaielpqcgaojfvxowlxogrfbkbzqjfvuakxibutbg3,924,612,435 QUTick 85,363,2032026-10-18 09:19:37WFKIYQSOJYWJSDXJFJZGYWRIEZODFSZRYRFIZUGETFPPZFITRLHURPUDNOCMglgkpmkposgbiexefupbndznbszgkhicefvlkyjnaestfjsguncxphtagnya3,555,429,774 QUTick 85,363,2212026-10-18 09:19:46NWDKZDYKXMWEZFJYGTKJVKVXPKRBGSLVNSFXGTNSKHIDVDYZJRQPEGSGMHKNssgxvdcnnyewgaoxdjmbiqgzysbgqqbehfwzedlmidzxfvfkvajpqevbpxik3,424,017,171 QUTick 85,363,2372026-10-18 09:19:54TRIOFGEXRZQREDXGWFZOHOUTXWYAWAJILPZWQMRQEGAOFNVSZHCPZLMAUIMHptoauavntmoyjaeyeptjnqoydldgdydgdimbrvnaofelqvivwnwdgqvgyite3,247,781,824 QUTick 85,363,2532026-10-18 09:20:02CGKLIPVFQOESXFPEMBHTPCNPBEUAZURDUDFRYSOQMDZTSGYQHMLZSWNBQFAAfynymhdjvcufwdhhlmzdikievppflwirlystqlyhaeegqqypxvsioebgyzjh3,197,102,035 QUTick 85,363,2702026-10-18 09:20:11MIRUWADIHXORIGGYNXIQFRFGXOQDYYHFJDTNQXYXUGORIONREWHMBXQCHJNCychusmwkkrkqobrhmjidmtkebocaxifqbfirjnrcbexcegidtrwfrncacurf3,000,000,000 QUTick 85,363,3092026-10-18 09:20:31BPKGWUHGMOZGNALTMWSZHARLPQRDBAQNIBAJHTNNZCFCSKMUULSNWDDHCZILbsajktwoakmtihebcwsenadpqobgpyuedfjjdjgybdjcvptyfxtltfchwipf2,845,360,475 QUTick 85,363,3272026-10-18 09:20:39WRWYHYWZQLOTREIYYXOPHVJLVVDAOYKZBOISVASCRGCKXKCFTIMFVVGHHJQGcxzfwkzlssesjcpzzvufgwardrpctywynvfxwgrksbqfhhdmupxhribgmeyh2,759,658,234 QUTick 85,363,3272026-10-18 09:20:39SAIJJORIJIAXBBOTBCYJWICHXGTBYSMNWGHWEHFXHAKLPDJPLLJCKVJENWJJqjezoconfkjznbjmywrwhdppgfxancraojilmnlecdiigxrpkxzpvuvaekhd2,501,199,943 QUTick 85,363,3642026-10-18 09:20:58SAUMYHMDZUTGXCJHVLPAPAKXNKNAEINSFNSTUNLUGDTZOWMWOZJKMXSFSAUDngvgxkiyomnwlakzdwvhuipirljdcsstylwxpqhyhbywigirhkbduageuryk2,396,783,689 QUTick 85,363,3832026-10-18 09:21:08FQDOSZPXMKQSFDTYZHPEMXBIZGCAPDRJJSGZSDQXMDSQFSMSYAHWGOOETQGHvrxiaxdppqveweisebbarjsmdyhfchawtbpjphvnvezkvghfhhvfzeugyaue2,249,918,358 QUTick 85,363,3992026-10-18 09:21:15PWWQYZJVJAKJCCSNDECPVVBCQRLCGDNGSSYJZOTBWGAGJBNIZLUXCAAGTSAJrwkbptuspwvfscsmetnitzkhutqfozsavshnhlwvudiimvhippcviaadozrm2,172,978,396 QUTick 85,363,4162026-10-18 09:21:24XCDZVYULADWVPCUHOVIBHEPCCCJBQTKOLJVPCEARKDZULBFXAHJSYNJBKOIDcotozmohdpiskffjhaiajbawigjgpbmknlvtieykxbtufctydooidxhcybjb2,129,573,252 QUTick 85,363,4322026-10-18 09:21:32RLZGDRAEGULLLBPUPFHQILAEMGHBBYXGYSFEHEYXBBFTWDEAMONPMEUFOIAEaeslbhoorxwmzaxpwatrwdzqwnjgczgwizgrmfodlgyrosikvlnevqqbbrbm1,999,595,479 QUTick 85,363,4482026-10-18 09:21:40WBBQHJJBHFOYTCWBSGURWBOKBMCDFGCCGSYDBNXXEBMZTXLVVMVWSWTDLFCLgokzcppyuulvqcapzjfyvbaxvsjdzfsqihlaodkufebbpytkpfabvwzacrej2,024,069,020 QUTick 85,363,4482026-10-18 09:21:40TTINTYYLMHYBOFYEVIMXSYRBURCBWQKQPWZMGDTUQEPDINQRTNFEYEICLEPOReceipt records 46–60Full transaction / QU / tick / display timeFull source identityhjtbeffilsbridxrjzjnhijnfrucbfkblhhueygbmetuicygeavghjgenmrl1,910,724,313 QUTick 85,363,4842026-10-18 09:21:58SDORRDIREXSYIBLEBTOTUJNHGGVBUPDAJMACBSRCGAVGJFFVVNULKKAHORLOkjhwxqffmpoodeaqziztybpactngcsdhwxgxgtpgkeuncoktgtjdfwkhdncn1,830,595,569 QUTick 85,363,5002026-10-18 09:22:06AFAUHXJYEPHMBFEHPCFKCNBTEOPALVWSTFGUCZCJQEAQNTOPZNZUSSOAZUABtkvylsrzepfjmcamcevyilwjoepfklnkozsjxwilretagzhvszwwxvlbxyxj1,770,947,401 QUTick 85,363,5172026-10-18 09:22:15FQJJRMWGYTVUZFAHULRJNCQGRSSAUGWDCYHKCFCXIHIMBRSDQZEZDAKACJNFtoroalyboskvdgdslzytnfgegtsakpesuoxslphklfqlfyebdsfqygmaebul1,718,218,570 QUTick 85,363,5342026-10-18 09:22:23PIJRJTIIPBOPGEQRNWTRTVOSFCHDODEZGUHVCCUPTDBQGWABHKJPTPPGLFGNupxwcqggqrgtqeaxjdlqkgkawmvbfygbsgpotcmmbcelcbvagvumeqchcstl1,664,726,712 QUTick 85,363,5512026-10-18 09:22:32MFQJQLETCBGNZEFPXNPXPJUEUDJCAKNJHRVYOEMITFJUJUZEFNOQETRCDWIFavvnzsxlkiqczgkgxmgrrxqiqefgphhsqkxkfstichbvkhynyojxfgfeqczb1,601,017,605 QUTick 85,363,5682026-10-18 09:22:40MONPENGZUYGDNBGRSYAOASVFXOGBOPWFJRUMOCDOHHJPHFOSGWABUHVGFBKGtdaownyayypuzggskuoinikqenefqapzqzakpwcqbakjyznptpiibbbcqfml1,513,044,159 QUTick 85,363,5852026-10-18 09:22:48NNXWEXIOWFDFWBXJHWBFUDEQCLRCNIEFHEFOVTZAHFDJJLXCQGBLJPQAUVQOotfbzsziydpubhtpymxyjegpjeiddaybjpcdkftctffmwtsmyolgwehfvlfk1,434,637,934 QUTick 85,363,6112026-10-18 09:23:01LXMFNXIBNBCCCARVQUOAISIWPIIAYJQCZKLIYBTQGHHPGDEIPKNDMWWCFRWDayvfwvytxrtelcemkkwzuamvxmcbaezogynissmghgstloeqntqfpkuggfzb1,375,135,152 QUTick 85,363,6282026-10-18 09:23:10TFLBOJMMJRCFRALYQPRIMXLVMOPDQBPCYGIQKKEJGEJSPOUNOOEIQPSGMJWExhsurqdhqsscuaqmmntsnfemgkchloxrgdodecllvbskdpzyptdfigkcpktc1,324,472,150 QUTick 85,363,6442026-10-18 09:23:19GDAOAUJCEPSGSGTEIQRLXXMLQKXBDVEBJPBMMKNOEGHPOLAQCJDFBTSEVHVOonwvlrxwhwvoagenbzrxuxfbuzabwfctdhmfnjkhedcsyburhdijpbjegbnm1,260,813,994 QUTick 85,363,6612026-10-18 09:23:27VWNQXIMMAKCGLGTDHFJFAZEUSKDBBRCDULXYKQGJFAQWFYENQIYUYWCFJOTBnalfkczccmchwayxbigtfysdpobbfftnlxgiudzrzdyrgryyznokgatcchej1,225,887,157 QUTick 85,363,6782026-10-18 09:23:36KNIRHZHHUJCBHFRNLUABMMZCCDCBPBEIWWGRZKMOAHNYXJLWTAWNLTFDIUAAumzxwtlorhwmwfyfoejjzlchltgbtxfigcdawvvojhiqtkroapnfmqxcocme1,204,619,018 QUTick 85,363,6942026-10-18 09:23:44QJWBQCJWMTOXEHBJZSJQLVNLRROAIWCAXOTWPKUDMDBKJFTOGZOEYLBAUWONhqibubvvjwnvjgnrrhpwcnovasidxfqbkvjzbhysucoemsydxlvygikewsai1,177,390,335 QUTick 85,363,7572026-10-18 09:24:16VSSECZMTLQHFOGFMPUBDIGXESWCBGRTBGHZXUUFHFAKLRVVZLOUHBJIDAASBppvpesndkamviearsedyfhekquyepyaqcccabofxrdzoguoenvbdwvxgnzfk1,107,254,001 QUTick 85,364,0662026-10-18 09:26:52SILVTLWPELACKHGNEZDSCXCVHMDDBVMVUQNYWUMFOAJUUNNITSHUELLFSTEHReceipt records 61–75Full transaction / QU / tick / display timeFull source identitygmqjlecspmfxvbnphpnuswpikfebdopiqwkvcbtxfevldyxjqgsvealghkai1,084,143,572 QUTick 85,364,0832026-10-18 09:27:00TOWAJBLWQTQAPFNWRHZOVKEHHVJBGJNLEOOBUJZASCYRNQSKNLEJOZRAQRYHmvztamwnmubkjbtdwynxdwhqyiehacifshnozdtwkcprkpyepfhuzltbpzun1,061,863,902 QUTick 85,364,0992026-10-18 09:27:08EKLFOALYHZFYMBPFKGLNDMQJHEABLZFASPIVNGFTTEWPAVOIEOAEBLBCWBVEhqmdvldphwqrlcbadqomeyfpbflgxxhmtsbnwfhowdsoxiptlkjmvgmdlovh1,047,275,320 QUTick 85,364,1162026-10-18 09:27:17FMVRSQIBAOXTMGTEMERVDRGLUZNAOAFQVNJNJFPQPCDJOVEPVAWQKOQENMQKcdlbdezaxnntzamtxuublxdtbrtbxqzltiheqcpvycoskfajpbbnrreaqede1,027,279,561 QUTick 85,364,1322026-10-18 09:27:25FDCIQLNKDXOBOCNKTXOGCWMWVOGBFSLHCWUVEDZQPESZOBXAYRBEHXXCXNCNzkrezdqgdqvjwflxodyvkspsjuchkewhjnbbyqnkhhvddyqmrtyglmvdkcoo1,011,997,337 QUTick 85,364,1492026-10-18 09:27:33SOEHPCYUYEWBOEWTMJTSREMGVFQCACQETHCJHXGBKFSMEPWOETPIANKFAYVJdfdyjwvsxlndwbovfplbttykukabggsiaubmhlmmjbkbdywpxjqxgmdflhkl1,004,249,575 QUTick 85,364,1672026-10-18 09:27:43NGYTBPLJPMQOWDSBNMVUDJUSBOYAZBJMONITXDSDSANWCQNLQLHFNASDANTDmpwicnztrwkqmgimtzxmsegvvbdhurcrdiputneijdjrwbpcwxtcghkgmugb1,000,300,000 QUTick 85,364,1672026-10-18 09:27:43EMSZXXFEZGBBHEHBGUIAERQDQXLCOUWXSBYQDAKJDBRGLTNOYBMGUZNDHCNMrbxgtkjqtlfifdkxekiahmxujokdjoprjtpxmfixidnbddlpyomcxwceatgj1,000,000,000 QUTick 85,364,1852026-10-18 09:27:52CUVHDLQVRUIOKDUEWIWBEJLBEZXASQKRVSLEPVCLEDOMCOPIEJKSUTHHNMYEuddwygqhjipiveoohagpjaynqbyedpzsiwdscuspqeuoghxhabsaqaheybqb976,312,184 QUTick 85,364,2022026-10-18 09:28:00SXMMLLLPICIFXEBZLVEPAPIBNEKCTIDCVLGUSCNUCGHLYBVDGUDKHFVEQJUMcseuzzhyhoudlhjonfeiaqzolzsgekqtbkrzkqraabtpvjokfpisewmajvhn951,293,830 QUTick 85,364,2192026-10-18 09:28:09NAMBSOAPCIQXPDHCUDRYLNEOAUIDRIPZKTEMCUJOBAFGGWJQNYLTIBZGQWLLcunzsjbyxcmvzgggjwyyjbvpokneabhhztnqllnzecsopnjtcrdsddbfokgl898,117,637 QUTick 85,364,2362026-10-18 09:28:17CMJBXIWZPOWORGOMUOZRKPVRWVTABSXXDEHFJKPMTCFAXUZVRSYIGPBBAKFEzwsabygmvomdneoqsdypqwnoagzfwhxeyyemwgtixcriqajvrtwlfpfhifng857,173,848 QUTick 85,364,2522026-10-18 09:28:26ZPOLURHJBSVTAHZAQYGGHGPUPFQCOQFPNCBXJDGWVAXRVJFNFHHQDVZCMPWIyrwfdeagqxbtugbqhslaqlxprwedarwlnbgylmdkaaadqvmhtxbfgebfivak831,920,983 QUTick 85,364,2682026-10-18 09:28:33XOGSCISFRRCVNDRHWWSVHMGMDAMAEZIQTGWTMRUBTGCVGFWURZGLEDIABYYIbaahlqsqiwppxcmkhhphbuptrnabbswbflbctbxjjgpzujrnktxpvqdfkuwm802,721,256 QUTick 85,364,2842026-10-18 09:28:42DGYYLNDHJIUOHASOKCUMDJZEHZRDREWOTJMMHDIFGEOXPYOJXQDLXFDBOLWLrjbziqtzrnhxofexrzqhetnzdzodixagzlqjwwrfrdudzbngzkrnkrdftmwm783,377,055 QUTick 85,364,2842026-10-18 09:28:42HZOUHPJHGAYWNEDOUQTDUOUKJAPCWFIYAPZBMZVPSFQYKBODGQNLFINFPVLFReceipt records 76–90Full transaction / QU / tick / display timeFull source identityxaibjkpnqllzqgemxwryaeioarrgudianttnbnlkugewtalbcmtmtufbobhe759,169,910 QUTick 85,364,3012026-10-18 09:28:50USUEWVENMAXYLASQXYMCAYFLHNCDOMDLUWKBQZWPPCOWVCGNCWEYXDSBDKWKdabwlvzeqltmjdogtkhfxzterzechxtpwxmvzqiozgksrzjyijbqnnehutkg724,377,202 QUTick 85,364,3172026-10-18 09:28:58HGIFDDHEHFZINAYKPLDLBJBXPMDCSWNEWPRXFWKGJECOVQDWOYSZEHQFWVODccquqnzwdvhadgahuqxdtmpzdtqbjuulisjhoeobkgfzknwrfkxahllfwbtn699,800,000 QUTick 85,364,3352026-10-18 09:29:07CUEYMHCCTJJCTDBNWLJISKERKNMAWCICEWZVJAYAYCYGFEBGACQSGKUEYCSIwywloobbaersjbwjyseizibnilfhljaydjjhugpvkejdfflsjxxfiyrefpqj665,810,813 QUTick 85,364,3522026-10-18 09:29:16DXQCIDKGTTZPZGYGJISIINOVGMCBTTYKULRXDOWRZGLPOKRLKZDUZRLDEOAMbvjhykmkqfxwkdbwxwrarfqnmrpaooghkblpqhxwgcirhdtgrbazzzvdoqec643,803,321 QUTick 85,364,3692026-10-18 09:29:25YZNCJJHHKIEVKAXAVITZIWFGJLTCMFUYAATJYVBFCEONBLZBFBXVPUEGATQJmwkxuioegechfhlxmhsvcgxvwdreboporegnyxwumdoogkehkhiijbpbqfpn600,448,003 QUTick 85,364,3852026-10-18 09:29:32ORCHKLNIRJSSMEVJXXTXDJEIVIGDSZQVNXVLBKBSWFSOYSFBCELJSMAEPBLIcjfxznckionmzfkhbextwudavnecsutinsvmmoxrvbfnyextchfaeknejfnc584,131,677 QUTick 85,364,4032026-10-18 09:29:41XRDWLXAFJMVLSEGCUWNRUDSHXSEDTWERLVBECGQRVBKQUKDQQKPYKVOGDCKOxftwhzpizjgzbfrnvtoxgfbsmxlduiresruajvnjkcdojgobyrpagvzbpcng538,706,028 QUTick 85,364,4032026-10-18 09:29:41FBQSFCPBQPLLFDHYLXZNDSLBFDODBNDQIKVKHELHFEPJIEUCFTPZNQHCORUBpcgmcgoccbxzceendascgxptiebasguwpvhxdekgfhcpbabuciipbjndjfpd502,579,362 QUTick 85,364,4202026-10-18 09:29:50ZJTSDJIXCSPURCVUWBZJIHYJKPUCPVPEFZYRANMHGFLBJLRLLZDKUYBFQHENzaaimvfgkulwzaddqqumfspzzgyfrigtbmkqlytypckeweesyenjjdhhlmfc480,436,394 QUTick 85,364,4422026-10-18 09:30:01ALJWNCBMNDAKPEXQHNQTLVEKMMABGKUKYDNPFTSRUAZGGAELCWTASBNENIKFullqjxovgzpwlemomerprwbiesialziachqyrepuuflqeypkollydvxeiuhk466,574,888 QUTick 85,364,4582026-10-18 09:30:09OCHWVUVSDAUKXBZDKFCUQNXULHXAKZCGQBHYBHSFHEYUCCNBCMPWGFLAHHHFahfanxgjtvcozfhtdhyxcsqpdxzgvzrxxxlgfzucxccixqjdginsuijeospi417,017,172 QUTick 85,364,5262026-10-18 09:30:43PNQPJJWVNEGWBDOWHOYNVDORWKGAVPUAFSVONKIAXGYXDSVJAPLXWIKAFBVEbatfijcuwgkeveqgtsobgwfsdcmbecbgctoutzwypbvlrrtwxgwixlffnrjm401,017,588 QUTick 85,364,5432026-10-18 09:30:52CHPHTXEIZIIRBGHKLAVJPPNMJYZCZZMUAOGGZLIGNDRUNPEFESWQQREDQFPLrockaxgdxykpzcthjtvdkufiquwairkqigewmwpsqalqdzvkpsrieaqdzsvo381,265,806 QUTick 85,364,5592026-10-18 09:31:00SUBGPWHGSFPRADXJZJNFXNMIWZSBJBQUSIGQIUJNJANXHGNCTVMEAORESQPMjjisdcwmdehynbtpnbalutjfgyqgzqmcojabfldgfdgdeviamlubhmbdgazc362,021,779 QUTick 85,364,5762026-10-18 09:31:08UEYBMETAHLDPZCIKQDVECVTFISJDOZZCAYGVKDTYPALRSKKHDGXYXNGBIZLHReceipt records 91–105Full transaction / QU / tick / display timeFull source identityophedbifwaaebfamvnstmszsjcjfwdiblyjnoswepgunrdraiemzaqoggsmg334,217,259 QUTick 85,364,5762026-10-18 09:31:08BBJZTFHUDZDWCGRDFTFQNGDWFTVCLFUBMXPVZCSUGHULQUDOLASPYKBDECFCtxdbshpiklpjdhpngklupklqjpsaetdmmolweyodgcafqjjwefjombzfiwri294,013,229 QUTick 85,364,6162026-10-18 09:31:28MHLTZYRBHAUJMGGBZJUCWBCXISLDSKDNLZJDBJPPAFOGVYTILCMIUECGIZBHnrvksrzbsbbiaeqvlerdvtiarmtazulojehwhijbzfzheqnvycklznrgrqvc270,168,956 QUTick 85,364,6322026-10-18 09:31:36YIFUJVWLNDALIAYOCEFYZOWGQZPCEPYEQXYDRYPVFAYGHLZTJXWQLXGGZXYEyqbqskgluacoxeaaycqshemqlweaawpriifuehdngdvrriruhwddkyidfkyk254,468,580 QUTick 85,364,6492026-10-18 09:31:45JILWXDLIHXHHFBDZZSTGDKGRPPBALAFYVAWJNXDNKAFEYKPNGLFITVHGVJLBnqfwxyuxzufucgipwibiwftqbjofpkikrnbhsqxztdcafprmvkfccprawmvo242,718,258 QUTick 85,364,6662026-10-18 09:31:53NIIRZOITCFHANGCYGUEZBRLSQTEDLVODJHDYVWBSUEUQBTGASEIRUYNAULRItihraxtzlvtuierexcdvxmhfeyhbhhvfjibewybcrabymylmsxwccpdakagm224,610,580 QUTick 85,364,6842026-10-18 09:32:02RLLFEFEVJDJOJGCDUDWYEPVZPNCAQPSNNHYPWACZCHNKOEUHTNAUIOPDGPYMeiuvwqofxrewcbwrvjspnxkidbbfqiyzywbjvbohudsadldoeqayltfhvkqk201,016,979 QUTick 85,364,7012026-10-18 09:32:10RKVRLVJZPXDJYGYQSOWSKDHUGTBCOYNLLCBVJDENJEOFIMLYRRYIWDXATDJKqddqnigawbezyavvwqiagokfysycpkbvpqcucqwkyfpyduyrblowhkqfnnnc212,003,557 QUTick 85,364,7012026-10-18 09:32:10XCCCGTRYFXNJZBPCVQMHAAUCOZBAAKQTGMNHOHEJQDSUDKAZSOORULQBUHDEzkbmuwdsfpmxtespgnslynojuyzbtzwwhadmcaaahepyftpmrgloatgcahug189,841,796 QUTick 85,364,7192026-10-18 09:32:19WUMCYFZICPSJCHFSEJGRUXKWQJFAZIBFMSTKTYPMFDMGYUGFHBVXZXIBSIECnvhlvustxhjnzeaiikezmjhlubeftoptevtdkbyiraciaazyqeplyeugecla178,681,008 QUTick 85,364,7442026-10-18 09:32:32KZYJKZAHRNQATFNNYQLWWTDOXIADNMYPVDQFBVNMBCRCBNIXXGPJGSXFLYWMlzwcuvkulxvmmfjmhhicyemtrktgoldwottdfyjgbcztmjdlglgicjbdihke163,230,273 QUTick 85,364,7612026-10-18 09:32:40TNQSLQBUTYXEDBQOEHTWNMKFVIQAFXXMZEUPKZKTOECGLLODANPIYWJDGBQDkknfkitfrbhyobmqvhkqgviopaddhdxxgfttctnerbvoyjxclbvbkhgfvcod157,606,226 QUTick 85,364,7792026-10-18 09:32:50HTQOUABIVWRJXBBQFFXIMPFSIQNDAEIJKNPFIVPDWBGCREKCTEDJQDYGTCSOerttlorkhhyfedjdmbgipsfeeeoblnegugdiqszsheeshloeaigxvjjbtkwe151,657,714 QUTick 85,364,7972026-10-18 09:32:58SRMKTSFGKHELIEYHRAYOSTAQVAZCNJPVVVRTCHAINCUTILJXGFCJRICBIIHHrkxirndayiomtbjpxsacofewjkyctotjsmqkcbjakaursaygdhpdcxjextze142,997,534 QUTick 85,364,8142026-10-18 09:33:07ZWYEKLAOUEHPDANOUUSGNSDIGWMBDJFHZXLGEAEVWEIZEPAXQEQBPKFCVNOMhbzclvqpwztfcftoeculusovttbbvwlxqllxfcjstanykdlmtphlqjigbbel136,892,296 QUTick 85,364,8312026-10-18 09:33:15PQJCXYAUVLEPFCFRGGFEXDPFVGIAJZVCQGDQIKXMQFOLFPCMQGOVKOVCYROJReceipt records 106–120Full transaction / QU / tick / display timeFull source identityayameazbhervifnlieukfsetwtibvbsiicgwsgwihhgwgeqvoqjznvyfscbg125,073,630 QUTick 85,364,8482026-10-18 09:33:24IAPRILKEGTLBCEZEESNCQYEHUETBSCSJKHMOGTVUNASJHLDXGRRXMNXGKYBJqevrgblispmvdhgkspucgsfjitzeqhklxkvbnxzeeaacbfqmmoqbnpzdostk117,317,768 QUTick 85,364,8652026-10-18 09:33:33YUAAMZQVUUWNZDVLAZRFXBXZFSGCLUGCIGRUTHWYIAYAWZXGREICVWSAVXDDzqjxzktwbvmuvemdkdskxrursyfbgqerlthwgecbrbgjlzszvhrhzdjfeqqc110,304,823 QUTick 85,364,8812026-10-18 09:33:41BODIVSKFUYMFDCNZKAHKXCWQCEHDENCGOHDBJGAAKESPWELVZCOSDHPEUBZFfuwaadcrcgnczdbhcssmmlbsmcwbohbsmenagenyrffqwknipllzabcefaxl103,522,211 QUTick 85,366,1342026-10-18 09:44:11ZJASAHNQDGVUDEWLNWJMYVYLFSVCAXERLORDXATHIGRKRGBFAHEVBQVDQRZHxlbjqyxmouhwehoaeekstxcqldabbyoyafnawlducbvftalrwcuajvraztce100,793,971 QUTick 85,366,1502026-10-18 09:44:19TCHXRNOTVOLFAHBQNPARNDVDANXBMBIAOYDDWSICVAIHDMLCJCSHBFNBLKZAbixisldqjtcqkgonkdnzcqzkgpcdeahnmmolwnfacbnamsxdlmdcoueccfde84,008,081 QUTick 85,366,1672026-10-18 09:44:27NAOWLCQWKGDPHCSSVWEUNFXMJAABSMBIXCXQZEMHFARTEEKZPASXIITDXZHKomoowngnamiyjgorsesusudsmylbhfeefupwysswybilnmtrdvgmhvhcigol93,360,188 QUTick 85,366,1672026-10-18 09:44:27ECZCURJWJPYBLGYUUSYEXSWYGHICRUJOSWJJNBLHPBYXLWZKSDLGRZXDAYMBrixjxaedrknuwfzcrghsozpcxvnerlaacqzbfedjzbkdnenvhvjtfkvexzli79,414,521 QUTick 85,366,1842026-10-18 09:44:36YJFQEGRQDBOBDEDENOZDATMKYJLADQOZOZIKHTKYFAMKTBNXXBKFOMBBSTSGjfsicrrdjbxynewjcqhfymccgkbbykqqhkvodefnmahxfjfbezdhsvifgdng69,409,988 QUTick 85,366,2072026-10-18 09:44:47ILNJXVHAUXDGGBTTUOITOQGPAYUCFTNCPXDKOCPUOCDOTPUWXBIGRVQDLIKComzphjeworfpzdpjpbmnrqpcijsfrutxtmopjpefrfqwpcdpybrukamazeji65,412,662 QUTick 85,366,2242026-10-18 09:44:56ILDFBBIXPQDPLFLMDSROOHRSNYBBQOPFNHBXEAOZHFMOLRRUJNEJSUZBHHRHzdyxbcpleovrxcfxntyzatfhoonaizzyvulgsnzodappxsbqkijettsdshaa56,772,914 QUTick 85,366,2412026-10-18 09:45:04RYPLPXDVIMFUMGYSRLEQVLCFKTKCPMTUHBLUQATNUBIXGEMJZJTVFKUCIPSJblyalvgvkhfwfbkdrmthifructjhdkgkutysazjqabfmivxtiwupfabevsyi52,891,882 QUTick 85,366,2582026-10-18 09:45:13ZPQGEPFHEUWTXGNYFFBCZDYBSVKCSTFULEIRNYBSWEMTZTEXVFHAOVMEIMOGeabgfctbjsgitfpejaxkyctfgbnadiqvhtxtqeadtgkjsoatwsapkjbdlvrb51,236,311 QUTick 85,366,3212026-10-18 09:45:45OQIBBYTGEHNXBGSLIZIDASJPJMPCRVAXOPOAWZPNIAWFAZPOVFAEWWFCZHXDfmeekyzckniqedcbzopyuckngeqbdezlemjbxganoazwktzubysyrzwbzskf44,398,777 QUTick 85,366,3472026-10-18 09:45:58XIINNRDAZRMCCCZDGOUPLRBQSGLCAYFSLHFHUKLOWCAIRVEACCQSWKFEEUSIoblckjupfblxebmzoaqurbencbaexsutlejazzmowgmrwiovcntwvkndmfqa48,042,756 QUTick 85,366,3472026-10-18 09:45:58YGKZHXBHUVWPUALMTMUOPKTDXUTAIYFPXYRMKFNNHDBWWXMBWZQUAAFFHAVHReceipt records 121–135Full transaction / QU / tick / display timeFull source identityffxykrqacyetvdltkoofriacwobcdelgfmzqlchmoamvdkeopjksgerajhub41,212,746 QUTick 85,366,3652026-10-18 09:46:07AVPNRFPEDCXULCILZOBMDSZCGWDDCJPKHFOGYORAICSOWZMCEXVNZBFBDPFLggxykimwfdqxjeduddvzkraxzbwdudhxwamoqwsglhhnldukbzdkzwraqjqf39,118,511 QUTick 85,366,3822026-10-18 09:46:15MVESVHAZKRRMUBUKSIHYSCZVXIFCOMUNQTITFANTMDBUEUBTVSUSSIMEPJHKzpcdvpcgxrfdzcmxxpmcyyadpgxcnbqjwtnbxihheevcjkxclmxzgstcqoib35,874,380 QUTick 85,366,3992026-10-18 09:46:23IRFXIUHYYGLEOBGETNDHRRNWBNNCCKZRJIWZFGZPGHPTBUODMWRGIKCFRSFNgjqvcsreimthdhbbzvnkxwzsqongevjfypbrodqpbeoksjfpsgsnkkjeljxm34,010,288 QUTick 85,366,4152026-10-18 09:46:31BPHIODFRIXUPZGWJQCQPJKHSWQCCQDHWOIHNKZDNZBFWZPXDRUAMCNQFEJHCjkcpfxxcksdkzcnjtamalzevbyegoubzucuyahjjifgaqoczluyolzefcdae31,881,620 QUTick 85,366,4322026-10-18 09:46:40SDWEWERYASJCOAERGZWCGNXAOJMANWOMUWRWBLBTJDGUVZHLHBKLMOZDETLKtbkvhiaiehdqxfblnztjqajewdqckacsvwjorlpisdeqodiojyszuuibwvjk30,268,916 QUTick 85,366,4502026-10-18 09:46:49RNPFUDQJYIBJWCXJIZWVGBOFBXNDUQPQOEXJFNPZRBNLCDAJNKWIWZCCVVFOiyhsgqerrwghccztrqahmzbiwxydsedtysshsmfjlcosncewlkwkyzheobpm23,360,548 QUTick 85,366,4662026-10-18 09:46:57LFKDTHEIFCTYJDMLTPOMHTVMXTOCQNTFKYCCJYZMGGIZOVTWBHWKKWDCALMJutnsqwtqxtibdeodwnskfkfsqxgdvkvinidhqdluxecjwhpmwwbuwxvctkdh25,695,514 QUTick 85,366,4662026-10-18 09:46:57UMQAWMNVSARKXGOKDETUAGFZIRKDHVRAXPZHVWEKYELHLCLVFSAMBSTDTMICkzmqrvxqawgqwehtlpidzhiqnfyeidtraxpkfggvverracmdudrcqjkefmhn21,453,036 QUTick 85,366,4822026-10-18 09:47:05IDPFNBKHZQEWVEXAVPFBDYGJECFBKMIGZIZZSFJSCBWMGLBRODKQOSUBMGQNyckjbkjmmxhlcalwfuksacxklvlbxlgqtcmpxfalmfxmkwxqxyxsdxugvujl19,900,227 QUTick 85,366,4992026-10-18 09:47:13PLWXSPPQIWEIEECYIVAZVVJYHIFCKIDAWPXPTKNWSFVDADWGQIHXUTHHEKUJbniodeqexkowfaznsrviaixxpblhebynebpsdtrzxggervdtewsbewmcfdbh18,324,937 QUTick 85,366,5182026-10-18 09:47:23FUBEOCYHUXSTBFVIZTHWEQDXBGDBXBSSEZJWOSWLBEDROVMPEDRVSRUFDUNCxjklkopfzccnvepqyytkaadulojgajapemmgatfldhvfxvxhrqmtbikfhqfe16,279,495 QUTick 85,366,5342026-10-18 09:47:31HDGCQOQVZMKRMGBZPPBBNTEMEKJDHKDMPUXILNWWKFDGWZKPLDBKJNPDDGAFszecyxrambwhbgnkzgtxtehvozgajpfylopplyoyqdohafbxbumqqnrfbilj13,969,716 QUTick 85,366,5502026-10-18 09:47:39RUKGKBHUZMGPWBINNVHVTIGLKKXAFYUNXPVURVBUJGIWXYRYPFQAKQTGYDULdjpbrajbngbwgayjsjxyynxdjoafvdkpxizvszkgwfzxpgazlpdndsqfthig13,322,262 QUTick 85,366,5672026-10-18 09:47:47UNQFHEYKKVICDHMONQHJQSQXKIADXBBNNLOEEJUPDBCVBJXQTSLWDBGDQVDJpkmweaqmziclvffgfnqthgjwfjsgknbslnrhxmujccaadoqujnyxebwdzewa12,030,812 QUTick 85,366,5872026-10-18 09:47:58YTNMXCTQCWURCBDNXPBESDGCEJDDPPXAWWCLKXYTYFCYQLPMXEBCJFVGVFIEReceipt records 136–150Full transaction / QU / tick / display timeFull source identitystlxizcbaridpgrigbagyqhbzdkhdlwwyjeptgmzeepecfmfgbmbcqubhzil11,454,590 QUTick 85,366,5872026-10-18 09:47:58KXFPTSBVUPXZZCUAUETMEFGJFMFCOJWMOAUQPIIZMFOCGWGZVIBUBQDGQHTEqbkhgpbbrqanxfdntszmsqmftvmdtkynucmzmxybcgcqthtxiwrwnmtbtolk10,278,303 QUTick 85,366,6042026-10-18 09:48:06UPVBLTQZJJBWPDIZDOQEEPLTKRKCGLKVQQHSVEVHXEZWOECXQHEHADWALZELwxgbcugjrsglegfrmopssnrbavqahajwkzaezpjcgccpghfgnlnqnsiheygb8,667,969 QUTick 85,366,6382026-10-18 09:48:23JLFWGACVYAVPDASPZABRNJUIQRGAHFGXPUNVXMCSOABECFNZCYNULJSDBYJNzopfxtatfrbmzgrpqwqjzgibvrcbzvxtnlikgkvlleamuvzfolrsmokesfjb8,246,975 QUTick 85,366,6562026-10-18 09:48:32ZIKNIOMQBRLALASQGNWMTJUAYHWCRMBQJCIWHSAGICFCNYYQJBVTFEUFYLWOmhyqukpqqvtgtgzduaoqxtuvlkygxibhqsniuthvjfwkxwgcktaysaxbezql7,091,775 QUTick 85,366,6762026-10-18 09:48:42UYQVDOBRFGHULAYPGFWUXEZJGMPCITXUUNLJGVAJICJHRVFTVEYHFLAHTWFNpyftmsfoevgbjcjyejxywighhdmdchplqkkxtugyjdjidnbsysnrlixbntdh5,520,718 QUTick 85,366,6922026-10-18 09:48:50PWISSLUJZEHKQDADWXNPWWROXAEDPKNCWFBNWSVJYCLSTKOHSGKBWMODBJWEzwpviouyiiblraytiwfmygiegncasvrqyrngkbgznahjelonzndvwifcyghc4,939,497 QUTick 85,366,7132026-10-18 09:49:01FPIMGGHPYGOZXFOQSPBXZJETNWYCYGHPRJOHFBLUGFWMVCDIWSMJXKBBYWOFslwoyfzkawoozcplazahoiajkgmacoimpdyfaauicbktgtjduqnyqzlghygj3,250,536 QUTick 85,366,7292026-10-18 09:49:09YKJOEOPGPIIJGEFSVOZWUSKELLBCXMLNFFUUCJEDCDTKOWVVGMPEJISAICHHdwvxrzocwleiudeefdmjmuvngnydfsjaskgfxxdcrbinldacwvdmpsucyebc2,392,959 QUTick 85,367,9842026-10-18 09:59:41GHQRRTFAMKDDEFXEVDCCSHTAJNIBDYHLKXTTTFSUUEYRGZDXDKYNKUEDHTILlxvtkerkjvojebkgijurmvqgkprchgixkihbvfgitctzbvdsxhvgzfecrtpo2,080,760 QUTick 85,368,0122026-10-18 09:59:54RKRBTKKGANTTMDWRWFUNQZZBKKBBHROYRLUFQWIPQBPQXDFMBCHTUCFBACZEixvshnrycdajqgxhugvsszizmmagfiorzvcdqbwvsdpdfeeeqrbmxhugseik1,887,966 QUTick 85,368,0292026-10-18 10:00:03QYZHONUXOEMLMFHMXDKESAAYUAKBRTPNGYWCFXKGRAIQAOHMFSIVXHKDDLSMwlytdjwzcssafawychqtktrxxldhbdrpqcddutlltafpxjaqdluxbjmabupg1,318,086 QUTick 85,368,0462026-10-18 10:00:11AHSBFJTDBFVZSAAHPASKCZDYYTJCEEUWMNSRASFMTFDHUZSZSQEOPVDCECWFgijlwsjgabvpobxrgxlkqzhkmspaesgkgafhdzrcraibuedhjwgywfxejqvi1,178,945 QUTick 85,368,0772026-10-18 10:00:27TNISXZTZDRYSIGBHSJEABGCOIIYCJEQFZMHBTAGHIHXUEJRIKFTUQGIDYEEEodvvbdnxdcdqdasgizfjvfgfwcwewfqvipzxohdepbhmlnqnslpxrrbelphj1,037,103 QUTick 85,368,0772026-10-18 10:00:27KCIKGMDRYUZRCCNGOWXFTLYBDGCDYOFVQIEYYZLSQAQYEKXXMVFSQMOAIKXBqanlvufopuvlccusbuzbtygjzteclalosxraqryezgyhkqqlgchkpkoavmch962,388 QUTick 85,368,0952026-10-18 10:00:36LQIZAKBEUBPNIAOBJCDBCQLIQQYCQGXOOXQLMMKBFGPFRLJZWJFIKATDABGHReceipt records 151–165Full transaction / QU / tick / display timeFull source identitygebqclvnntvhfggsngqhrgbsbjxgwjofoyckepegygpkcxvyogdgotndbdue755,999 QUTick 85,368,1122026-10-18 10:00:45STTIUIRUMLYXLBXNTZDVFBZYEOOAKUNCFISWPLYMYANDLCAQOXHFPVNGEEGOvjpdeocqhlpcybpkswjpzzalgcqafltplprerqnusaxvwahyjrpknrdhaera590,103 QUTick 85,368,1282026-10-18 10:00:53QCAQFFQARLQTHEMYGYUHGKRANUTAROHWXONUGAFFSGUUVDAQWFAQVRSEWPSLcfnxxzhzoihtkcqitiyzsoqgikicppnenokvtdlqidsbdwpcdfohbgtgvnsd517,635 QUTick 85,368,1452026-10-18 10:01:01NTBUSQJGOINSOCTMMZFVGBCFSAFDKGSERGUUUXPECAOCUXLNIQUMAWCCSGWMmreshyahnjkyxbtxzfapyqsahrlbudgumaovjapgtgvdzxlwkftbvaqgjcse380,855 QUTick 85,368,1622026-10-18 10:01:10GZTVMOVMDKBPTEQHKKBZWGRHZHBBEWUUIWKJFKNBCBJFKSCLITMBFMLCFJOKddxqpkxthfvancbslfyonwffcooerpgxluiipaqmagiojpzxyhwsmfffccmo309,297 QUTick 85,368,1782026-10-18 10:01:18AMPFZXXGSSYOXFEZJLFZCJTSPYOCLQXEFCFQNYZDSGURJJQTOFNGYOWDGNUKnkmtnbjpngdwlcgspwaksimxzfxcpkaorybvkmyiychtchowrrxvruyftqra249,140 QUTick 85,368,1942026-10-18 10:01:26ICLHFVEBONODPFIFEVIKZKRAYUZBTMWGNWKLMHCSXCEOVEYKVFUSSGXECXTCyufrdyimmclazdmledmnjypzxdncyrvezmhlriuhodkgatmorpqtvqbcoszc188,778 QUTick 85,368,1942026-10-18 10:01:26RLATELWZWLLBKCXDRLNIMMIQNJJAQKXEIPPBDBSZJGRHXSKAHHRJFQXAAUXFyglupthikmuxtgxobbyoaqpbswiceeglyindwtupycvaulcbzxwygxacddhj131,999 QUTick 85,368,2112026-10-18 10:01:35PYZLQQKYXOWDKFYEGXIKZZJXDLEALDFXGHBZNBMUXDKJWSNIOKEKPTYARRCGdukqihdvbrjkkcgacajkmknrhoacymioekosykkcacvhsrhvczsxijvdrjlf87,719 QUTick 85,368,2282026-10-18 10:01:43HIWVCCYGMXBZUFPTDWOCNEAYVBICBVZGECKXCPHARFTHRHXDQDHRFSEEACOBsllqkvwznkzvhatfhdbsgweoopfgocofcufredalkgvcrbwskqcfrqvcftgl50,366 QUTick 85,368,2452026-10-18 10:01:51NPIIAHZBRNTXMFCSZJASQGYSCGMAKZQUTLJFDLQMOCDLBZFFJKRHCVEFUWMGqvpyfajapdxkyceykvhpgeyojowacnoetngzfmyuwawxpdkxobsnymxbxmzl30,365 QUTick 85,368,2622026-10-18 10:02:00PIYHICMHIDMLXFENXONQFTECVNXATDOWYMFFXZMXSCMUQOPETNIVZYODJBINjzxftvtczgxifhugvlvbovjwbnjdjaxqcpahffwikcwabluzbovzyoadbhse22,637 QUTick 85,368,2802026-10-18 10:02:09DMYBQUXTPIGQUDJGNLGZJKELFGRDUZGVGJZHLOMTFFXRPOZOTGTCSNGBLVSJnhbzhwvnreajkctcslulfhhzgfkflbeqvjvkwlxtqcbgulvnjxnyzlhanayl19,439 QUTick 85,368,2962026-10-18 10:02:17GKYVGQYNRQIRQCMBJUIZGLWXRHECMETQSXQDXSYJZEGCEQRCQABICSGFVWADgbzgqayzfdjnzamszdjcxcyfzrycejfossoifiushdfjajdpqwfbobddevwd17,688 QUTick 85,368,3122026-10-18 10:02:25THSCFREZBXTUZCJALNCHNGBBIBCDNOOMTLGDUEDFCDHGHVCEMYLJRFYFKPZHobtnlxujhewnaavsxdfqnuyzrpydghamyucvmoklygdrffhginipjxgdsnan18,154 QUTick 85,368,3122026-10-18 10:02:25UEYWWUZQMLUGGBUCUREPOANAQUYCFZYBBPISORLDMFDKPOMWBFCVDHJCHOKKReceipt records 166–180Full transaction / QU / tick / display timeFull source identitynwiyvefdmqpctbaacpulrkqgptddjqolykdhgnndfcxxxxnmoupzohydbiaf17,639 QUTick 85,368,3292026-10-18 10:02:34VYOPKJSJQIOKZCIIPDHIZNHQZZTBTNAFDLZPPZJSYEMNQQIKYGAKSXLDHBYJsxvlzxcdqdmghdyyeivgmwtmldahribwdyitanfdzbmbwnnzeaskfqsbmcih17,639 QUTick 85,368,3462026-10-18 10:02:42PFBDMNGJNDFODDTTYTKJCCOCOEIAEKUAMGZLCCDWSCRALXUVITJYFXAHSPMGmetihighvlfxpgdlnevsxrcghqiddxhynfbeluqvubniawldwikbvldhjpln17,638 QUTick 85,368,3622026-10-18 10:02:50WDUTZQLGJCNLAHEPIQAPEALIEFPBANRICGHFPDTCCANTOZKBANCHALICMKGGcrentprrdnbllbfazxtejpedolgcrmwtgjhotwagcgmsyqglvrmyqrzejeen17,638 QUTick 85,368,4092026-10-18 10:03:14QVDLMZWMJQCZOCFMKXNKCDWTKHRCRFRJDROHIHPEFGWTJZLKGWUOPHYEIAGJmwsufdjvvsufraqlpdxnzohziytbzocxtnfltjsbobuhdpgymuwblrngugen17,622 QUTick 85,368,4262026-10-18 10:03:22HGFVVMYWGZOOVGATEZUYUQUGHHWAANOBUYLQSVSXPBWKUWWCLQARARUGQEFDnolznkhnpyuibbqebxnyhxzknyhatktvwvcigfidvfpjuipdchtpdlcdipjf17,610 QUTick 85,368,4452026-10-18 10:03:32RUHUZVLCTLTSAEHCYPACLYDDCHVCQTNYWPGOTYYASFIBWWNKCTKKJLFFCTZEdblgqaobrvqkpegkwuuhhzfvniigsiqeflukpokcjdoasvsijldzegchmlcf17,610 QUTick 85,368,4622026-10-18 10:03:40NCHUTUPDWACMVDUTGKDTNAUEHUSBJELHTZPABKZFJFHAVCPHGFIYDLGAZUSHvcsfctslpsxuvextbqhvadzwelnfplgtemqfvhyhjdagtxmwcfeonzbezbwn17,610 QUTick 85,368,4622026-10-18 10:03:40YFGJCWFCGPPWMCNOCPGEUTNBROXAAAGLIXGHOOTOPFKXYYVZXLOIPPHHYOBNohbzduqamparzaaodtuorymddwhbhkngzmyevhvpaghcqxoxtkrykkabwcvo17,599 QUTick 85,368,4792026-10-18 10:03:49YYIJPHFELSAEBGRVTANXSPEHVYOAXPCQSAJKJWYVHCZDRITGARRGAJDBLMWJdcvqdouseajvtbcfadqezjzxikndkpgokiqerjpqccbolketrjvciasbglwb17,598 QUTick 85,368,4962026-10-18 10:03:58MXQPAPLKAPRBPBHSRBTWKSEMLJIDSQVEJPYVVDYJEHLFJXSUVTGRWLPDCCQDmcohaxqvkscqsaizmqnvljkjhmceksaekhkahfgmhdloxxvwhtztguzfgirh17,598 QUTick 85,368,5122026-10-18 10:04:06QHYDCDAJWQEVGBXOPSMWLZCCJJACOISPKRMYBHPWFFPRRYEKMHXUKZNGPASLutmkssfwgknimgyjacmyvxixlrsedhmjxvdnslbvaekwsyhpumofuohaiudo17,597 QUTick 85,368,5282026-10-18 10:04:14BAXEZWWIFVSFEFBAOXZXZIZXLRPAAQEFIMVNGZNLUESDVMADABCZWPJCFMAMpdptqehmlgohlgoozndxjupqavqenmvbqqpeqcheidluuksaykklnbpeaccm17,593 QUTick 85,368,5472026-10-18 10:04:23YAVIGJXZUBJIJCTRTJFZDIIHLELCGQEOKJFILMXJICAQFGATWWNVMNQAADFBdtxnsjxoiruykhmsfrjhynlpjryadjojvknsnpummdbjgloruxiflyvcgbze17,590 QUTick 85,368,6082026-10-18 10:04:54MWRIAGDZIXDIBDOQZFRQKOEXTIDCGAGGTWCPICYCLHHUYJATRXIBJYMAMJSMgdavbpyauzicdhmdwnxbzxhpclfdfytiteuduwhqgcnkrhweuymnskldkfwm17,566 QUTick 85,368,6242026-10-18 10:05:02DYVELOLTYYZINGYXAMDNBLZVXCHAJCPKQSRBXYOIICDXIEPWZXZQURLDFEKGReceipt records 181–195Full transaction / QU / tick / display timeFull source identitypknylesyzyugmfdddowfeuewbbxabtnjnxfrcyvafaynczeeyftniojcpnok17,520 QUTick 85,368,6242026-10-18 10:05:02VIDUXUODWWDDCBPLZCTZAOCTPZKBGOFTTKFYYSXBTGZKHFLKNRQYUIAFTBGHopljnckfxbxapapldgyocedzjiygqtdtsvsjkrnfifjdcthgjebinnigprcb17,420 QUTick 85,368,6412026-10-18 10:05:10FFRYCFYJRUEVDDCYCMWQGNUXXZRDOZUJLBZCXXBEAFCQXGVFARFNCIZBAWRMebgelspurrpotamjuheamllxwudcqkizxvjpyxkgdbrrkpzgmfnwzwvclwzb17,258 QUTick 85,368,6712026-10-18 10:05:25HHRIMEMZHFQRABANYUMJIJSLJYRATUQLAJBBTLXAJHFMKKRZKBWNQYGFOUHBabfvkmzauqjysgyzleflaqbedlleiotkjxdkzhzifcnycyqengwyojnfxbvi17,183 QUTick 85,368,6882026-10-18 10:05:34FTTWEXFYVMXOCDUFWGRUTRKMVDEDMMIKTREATUANKERHQFDFXEXXUKWAYDDAbrprfgyzrsnzpbaskxalzwjekgvgbbnkgctkqmxhffwaxryooiisyzfffsjk17,181 QUTick 85,368,7042026-10-18 10:05:42AAQMXMOCGLRXRGWSAZBYKZISGNQDAERTKRCKKIFTVFMMCEIQDHWPDJWCXJTLavusjwvlbnopsgdmwrtlepjqllvckintaevpcnxkraipahxwiztntpdapjng17,178 QUTick 85,368,7222026-10-18 10:05:51RTBMDAOIDPOSDFRUQURVVFUPETABPRXNZXWNSBJZHGJAOISCISMMHVWDLLLNbrdzqltvdijtzfxwbfnoppydcpgfjlgiizkdcdrrndedaibnewqfnxfcnqgg17,173 QUTick 85,368,7392026-10-18 10:05:59BYFIIZWLZOTDOFUMRSQFWOLTXZCBEXEUDGNREQTSKDCWVVBWPEPBCPXGRCIMbbdcuuxrgozlrazxtuvrkqxozjaacseoxegvflamebddomcpjtdnmxcduezk17,173 QUTick 85,368,7552026-10-18 10:06:07VAFTVSYUEFVBHHDXXKVOFYWICHACRCNDYRVUWSBOSGMQLWDGPHSFNKDERXVKdkajrxugidpvwfxhtzuisldncuqblksjsajzfsxeoatmatvngrergtmdxnqh17,172 QUTick 85,368,7552026-10-18 10:06:07BVVTTKBNMGNLUDAUIJFPNWASHZNBQIHGRGCOCVCZICLSJSKTEDQTQRHFZJHCxoavznqmooeqnbisamwasimfnnzenukhvfnknjfzxbwsrdnuvowjvqedqtaf3,221 QUTick 85,368,7722026-10-18 10:06:16WBWECDPBSYUYCEQZYXPCOHRFZOACMFHHKMFURDDMMCAGIHHYGSHBFDOGYSKJdpfrfxqsprwmtcieyldzzjrkhvpbnikanpvvkxwzvfcnzmzzonyudvecljrn554 QUTick 85,368,7892026-10-18 10:06:24NWYWNJMOBSDBKFDAKYLSRSDYEJPCQGZMJGCTIKEBKAFMHBVJUFNDICHBWROJlmuveembvqvjkgkrgmukmtupqzwdpgjsoyggwvhimdqonggdigvrvrhbpmfl84 QUTick 85,368,8062026-10-18 10:06:33GVSTZSKWDLFTPFJYZSVLPZKTRECAYSOSIAJUGHHJVCIKAFBJZVOAJBEFMRBMzvbpwenurmjkbgkjwimyyytqtdkgtnkssezsbihfdhukydqbubwbpepcdega21 QUTick 85,368,8222026-10-18 10:06:41RHOTNFTZOWZBAGXWQFAMGQCLDEIBOURZDTOORGGYJFXXJFNZEUXGXYMFHZXLwmtaswoeuqrxdfetffwrucyhhlngibcaakhbzaojjfclinerkrjprqigepnj4 QUTick 85,368,8382026-10-18 10:06:49ACEYOYFUJRTSAGXMIALPVXTCJKDAKHVUJJXHNSAMHEKDCIWWYDENCYCHHETMitpekbjhwfyerfomhrnuclpdssrassjsiwfaexhrnfrrcyzjqhzbusrexrld1 QUTick 85,368,8542026-10-18 10:06:56PMWURSOSCQTEIGASRYSGKVQWEKSDCTSMLGBAAOZVUBFIDRETPWAZMEADTNJOReceipt records 196–205Full transaction / QU / tick / display timeFull source identityegbvwdhcggwqdbhjulzqwainxdwgjmcblufxnnzraezjxwhwsjodksdeoosl1 QUTick 85,368,8702026-10-18 10:07:05ODACZQSOHSKOQCQYJGQCPPINOKVBEJVDZLLSBLOGNAMFQGUJHFKPOJGGXNTMhzykixcbgprtogsftasacdqihyzcjctotakevafxyakxzsxxxkviomjavjrm1 QUTick 85,368,8702026-10-18 10:07:05PIBSBMVVVPMAZBRDVOHSFHCCGUMCTZUZWOKKWRQUUCAYIDLYEFXXEYHBQYYGrmqdmmstqcugfblgthzbnwtrivdcwdpjdkrxodvcbgiszelbeqapasidnolc1 QUTick 85,371,0602026-10-18 10:25:27IZOOJMBGEKCGZBMYIFEWRPCMMGUCMFOODFVWGEGZAHWWJLHGWRHVRQKBSSHIuaacbbofkzxkmcjicacozqdlokucsajezcxifwqwxbqfngckcyqpbfdgmbeb3,051,318,304 QUTick 85,371,0772026-10-18 10:25:35BLALTWKMUCRZCHTLZDTLGAOPBJLCWWMQJYMFQDPDTECOKTSIUDUJJJJFESUIdgekaoyklmmrwgfoemyjbiaaporbqmhuqfftkdgmmdguoaxiigqzribcamea2,615,329,703 QUTick 85,371,0952026-10-18 10:25:44YWUHJUJKTJVKMABEBASXYWTGTQBDNJNLOIFZJPMWDAUVKYLXPLXVMWIGBRUGqcyrhqtwvtylrcjzxpbkwxyqetwbvydztpprshlepgmgcyokclhhdscbuxbc1,477,595,306 QUTick 85,371,1122026-10-18 10:25:53FEPBMNIXODPSMACXUPIOMUTIMMUBOPTZFBXQHKATGGYVAGFNXGDLTKJECJHEyvnbxozgugdkghehohkixcarkeddmyubywaiolkqugxjaedixgwtlrbhnpbm1,149,608,746 QUTick 85,371,1122026-10-18 10:25:53EUTKBUBOQNGSLCYUJXELJSWALTIDJLTXRSJTTAGIAARNDLZVLIMJVUGDWKWMampejuomsdiirgldoihjellyepkfjnvvdcrevuvjwdpxiazjsqhccxgdandl307,533,611 QUTick 85,371,1292026-10-18 10:26:01KWVBTHOJHMBXXGDUEXISUYOMZNDDJYGASBFIFFJFVALRZZYGPKMIBRSGRTFIqpbsawbdgmtbaariwtbshtqzplfcmqxthjfznwnggcguusalqetfemlbswrn106,444,954 QUTick 85,371,1462026-10-18 10:26:10ZNTRZHEVDZPLQGJFHVKUYYSKWNBAZBZDMGHMWSANCGXKEJOXVIZJXPQDZYLOuozjjtcweklbxdcoikwxyeomtlvgrfqncvagfqduzepatadbxutmmtacefvm128,976,240 QUTick 85,371,1462026-10-18 10:26:10CZICVDINZHUVXESYAKMJPXZRNJRCRFKWADKZNDFBWDYWJPGEJHPXRGMCTOACMethod: the actual Explorer Download Page Data control was used on all three pages with 100 rows per page. Rows were deduplicated by full hash; distinct sources were counted independently. Integer addition gives 568,777,432,013 QU. Three selected transactions were separately opened and matched to their visible event rows. No private key was requested, no recovery action was executed and no address-owner attribution is inferred from these exports.Primary and attributed sourcesSourceUse in this articleincidentProject disclosure, attributed.causeProject root-cause account, attributed.haltDirect public repository or project record; implementation is not execution.snapshotProject’s dated 18 October claim; not a fresh freeze confirmation.mapCommunity compilation and explicit UTC sample, not independent loss proof.patchDirect public repository or project record; implementation is not execution.releaseDirect public repository or project record; implementation is not execution.proposalDirect public repository or project record; implementation is not execution.coreDirect public repository or project record; implementation is not execution.frozenDirect public repository or project record; implementation is not execution.sweepDirect public repository or project record; implementation is not execution.escrowDirect public repository or project record; implementation is not execution.recoveryAttributed project recovery statement; not independently matched payment evidence.escrow_statementAttributed project recovery statement; not independently matched payment evidence.reclaim_windowAttributed project recovery statement; not independently matched payment evidence.

Qubic Wallet Incident: 205 Receipts, 204 Sources, and the Boundary Between Containment and Recovery
0 likes・29 reads

Your journey to defend against cyber crime starts here.

Join us to turn your expertise into a force for a safer digital world.

Blog

Gravity Bridge Exploit: Full Attacker Fund Flow Traced — 113 Transactions Reveal Sophisticated…

Gravity Bridge Exploit: Full Attacker Fund Flow Traced — 113 Transactions Reveal Sophisticated…

Gravity Bridge Exploit: Full Attacker Fund Flow Traced — 113 Transactions Reveal Sophisticated Laundering OperationThe laundering infrastructure behind the recent Gravity Bridge exploit has now been largely uncovered.After tracing 87 confirmed attacker transactions and an additional 26 downstream movements, the overall flow of stolen funds is becoming clear. What initially appeared to be a straightforward bridge exploit has evolved into a highly structured laundering operation involving decentralized exchanges, relay wallets, non-custodial swap services, and centralized exchanges.This report summarizes the complete fund flow observed so far and highlights the remaining recovery opportunities.Executive SummaryTotal tracked transactions: 113Initial stolen assets converted into ETH almost immediatelyApproximately $4.7M converted through KyberSwap and 1inch2,600 ETH consolidated into a secondary aggregation walletFunds dispersed through dozens of one-time relay walletsConfirmed deposits identified at ChangeNOW and KuCoinMultiple staging wallets still hold potentially recoverable fundsSeveral laundering paths remain active and require real-time monitoringPhase 1 — Asset ConversionThe attacker-controlled wallet:0x7B582033061b96cC3F9421e73a749ED7C62da1F9immediately began converting stolen stablecoins into ETH.The swaps were executed primarily through KyberSwap and 1inch, suggesting the attacker wanted to reduce exposure to token freezes while maximizing liquidity.Observed transactions include:$100K USDC → ETH$200K USDC → ETH$500K USDC → ETH$400K USDT → ETHMultiple additional swapsIn total:Approximately $4.3M USDCApproximately $434K USDTwere converted into ETH within a short time window.The rapid conversion indicates pre-planning and suggests the operator anticipated potential blacklisting or asset recovery attempts.Phase 2 — ETH ConsolidationAfter conversion, the attacker consolidated funds into a second wallet:0x4d3ca32e687e871a58b78AcAc73bE59AC37C7A47A total of 2,600 ETH was transferred through multiple transactions:600 ETH500 ETH500 ETH500 ETH500 ETHThis wallet appears to have functioned as the primary distribution hub for the laundering operation.Rather than cashing out directly, the operator implemented a layered relay strategy designed to fragment attribution and complicate tracing efforts.Phase 3 — Distributed Relay LaunderingThe most notable discovery is the laundering architecture itself.Instead of sending large transfers directly to exchanges, the attacker repeatedly split funds into dozens of temporary wallets.The observed pattern resembles:Primary Wallets → One-Time Relay Wallets → Swap Service / Exchange → Cross-Chain ExitIndividual transfers were commonly observed in the 6–10 ETH range.This methodology significantly reduces the visibility of exchange deposits and makes automated clustering more difficult.The pattern appears intentional and operationally mature.Confirmed ChangeNOW ActivityThe largest identified laundering route currently leads to ChangeNOW.Observed destination:0xeba88149813bec1cccccfdb0dacefaaa5de94cb1Estimated deposits:Approximately 114 ETHRoughly $230,000 equivalentBecause ChangeNOW is non-custodial, recovery options are more limited.However, transaction records still exist.The highest priority investigative question is determining what assets these ETH deposits were converted into.Particular attention should be given to:Monero (XMR)Privacy-focused assetsCross-chain bridge destinationsIf conversion into privacy-preserving assets occurred, tracing may become significantly more difficult.Confirmed KuCoin DepositsA second laundering path has been identified through KuCoin.Known deposit address:0x45300136662dd4e58fc0df61e6290dffd992b785Estimated deposits:Approximately 6 ETHAdditional suspected deposit address:0x58edf78281334335effa23101bbe3371b6a36a51Status:Further confirmation requiredUnlike ChangeNOW, KuCoin operates as a custodial exchange and maintains KYC records.This creates a potential recovery and attribution opportunity if law enforcement or affected parties act quickly.Remaining On-Chain FundsSeveral wallets remain active and continue to warrant monitoring.Primary Staging Wallet0xc8c71ae4261e55a66d9967f2ac252be4e669f562Current observations:Received 59 ETHOnly 15 ETH moved onwardApproximately 44 ETH potentially remains under attacker controlThis wallet may represent an operational staging point rather than a final cash-out destination.Additional Unresolved Destinations0xf1ed839d08309e2a52e58d69b06d286d35fc18bc — 15 ETH0xe1e471614305656114c39294637b65adccf665a3 — ~13 ETH0x58432e011aa493c404f80409d997b1eabdfd8e24 — 9 ETH0x79f376453537878eeb79fb7d2cdb2c10bc58f454 — 9 ETH0x98d9022fa2789c0d8e9cd49707599c6848619ed8 — 10 ETHThese wallets currently represent unresolved portions of the laundering network.Immediate Investigative Priorities1. KuCoin Cooperation RequestThis remains the strongest recovery opportunity.Required actions:Identify account owner(s)Preserve account recordsFreeze assets if still presentObtain associated KYC informationTiming is critical.2. ChangeNOW Exit TracingInvestigators should determine:Destination chainDestination assetConversion timingPotential privacy-coin exposureThis path likely contains the most important unanswered questions in the investigation.3. Real-Time Monitoring of Staging WalletsThe wallet:0xc8c71ae4261e55a66d9967f2ac252be4e669f562should be monitored continuously.A significant portion of attacker-controlled funds may still be sitting on-chain.Any future movement could reveal:Additional exchange depositsAdditional swap servicesNew laundering infrastructureFinal cash-out attemptsConclusionThe Gravity Bridge attacker did not rely on a simple exchange cash-out strategy.Instead, the operator employed a structured relay-wallet laundering network designed to fragment attribution, obscure exchange deposits, and delay investigation.While a meaningful portion of the funds has already entered laundering channels, several opportunities remain.The most actionable leads currently include:KuCoin deposit attributionChangeNOW conversion tracingMonitoring of the 59 ETH staging walletThe next movements from these wallets will likely determine whether investigators can continue following the money — or whether the trail disappears into privacy infrastructure permanently.

ChainBounty

ChainBounty

5 months ago
Unmasking a Sophisticated Solana Scam Network: A $SUBY Forensic Investigation

Unmasking a Sophisticated Solana Scam Network: A $SUBY Forensic Investigation

How automated bots and shared infrastructure revealed a 10-month-old organized crime syndicate.The blockchain never forgets, but it can be incredibly complex to navigate. Recently, ChainBounty conducted a deep-dive forensic investigation into a significant asset theft involving $SUBY and other Solana-based tokens. What began as a single incident report evolved into the discovery of a professional, long-standing scam infrastructure that has now led to an active criminal investigation by the Cyber Crime Investigation Division in Seoul, South Korea.1. The Incident: Precision and AutomationOn May 30, 2025, a victim’s wallet was drained of approximately 8.2 million $SUBY tokens, along with $SSE and $DAW. The speed of the transfer was alarming.Our forensic analysis revealed that this wasn’t a manual operation. The assets were moved to an intermediary wallet (46S5bgHq...) and immediately processed through automated scripts. These bots executed swaps into stablecoins and distributed funds across multiple "hop" wallets with 0-second latency, ensuring the trail became as fragmented as possible within minutes.2. Identifying the “Cash Out” InfrastructureBy tracing the flow of stolen assets, we identified two primary exit points: Bitget Exchange and FixedFloat (a mixing service). While some deposits to these platforms occurred shortly before or after the specific $SUBY theft, our “Infrastructure Analysis” proved a definitive link. We discovered a massive, interconnected network:27 Common Fee Payers: A cluster of wallets consistently funded the gas fees for the attack wallets.63 Shared Addresses: These wallets acted as a central hub for multiple thefts over a 10-month period.The Forensic Anomaly: Why tracking the criminal organization is more effective than tracking the tokens aloneThis confirms that the attackers are not “lone wolves” but an organized syndicate operating a “Scam-as-a-Service” model on the Solana network.3. The Evidence: The Smoking GunThe most compelling evidence of organized crime was the Machine-like Transfer Patterns. Our timeline analysis showed batch processing intervals of exactly 15 to 28 seconds. This level of synchronization is only possible through a dedicated command-and-control (C2) botnet designed for money laundering.Through our investigation, we identified over $142,430 USDT funneled through the Bitget deposit addresses associated with this specific group.Inhuman execution: Batch processing and mechanical intervals confirm the use of laundering bots.4. Active Investigation and Next StepsChainBounty has officially submitted this forensic package to the Seoul Metropolitan Police Agency. The investigation is currently focused on:KYC De-anonymization: Working with Bitget to identify the account holders behind the identified deposit addresses.Cross-Chain Tracking: Tracing funds that exited via FixedFloat into Ethereum and Bitcoin.Asset Freezing: Coordinating with exchanges to blacklist and freeze the identified criminal infrastructure.Conclusion: Vigilance in the Web3 EraThis case is a stark reminder that in the world of DeFi, your digital footprint — and that of the hackers — is permanent. At ChainBounty, we are committed to turning the tide against these scam networks.We urge the community to stay vigilant. Do not click on suspicious partnership links or authorize “blind signings” in your wallet. The scammers are professional, but so is our pursuit of justice.Join the Fight. Follow our investigation and report suspicious activities at our community: 🔗 https://community.chainbounty.io 📧 For inquiries: [email protected]#ChainBounty #Solana #Forensics #CyberCrime #Web3Security #OSINT #CryptoInvestigation

ChainBounty

ChainBounty

9 months ago
MemeCore (M) Digital Asset Theft Incident: On-Chain Forensics & OSINT Analysis Report

MemeCore (M) Digital Asset Theft Incident: On-Chain Forensics & OSINT Analysis Report

IntroductionThis report details a real-world case submitted by an applicant to ChainBounty’s Victim Relief Program. The victim approached us after suffering a significant loss due to a targeted social engineering attack. ChainBounty is actively assisting the victim by providing comprehensive on-chain forensics and intelligence analysis to trace the stolen assets and identify the perpetrators for law enforcement purposes.1. Executive SummaryThis report synthesizes the results of on-chain forensic analysis and Open Source Intelligence (OSINT) investigation regarding the digital asset theft incident that occurred between December 7 and 8, 2025.The incident appears to have originated from a social engineering attack targeting an active user of Memex, a major dApp in the MemeCore (M) ecosystem. The attacker impersonated community administrators and creators to lure the victim into a fake Telegram group, then induced them to connect their wallet to a fraudulent bot service using “high-yield staking rewards” as bait.The victim created a new wallet and transferred assets as instructed, but the flow was designed to funnel funds into the attacker’s scam network.On-chain analysis reveals that the stolen funds did not end with a simple transfer. A multi-stage laundering flow was observed, involving MRC-20 token swaps within the MemeCore network, repetitive transactions based on the WM contract, cross-chain bridging via Meson Finance, inflows into Centralized Exchanges (CEX), and dispersed withdrawals across multiple exchanges.Notably, a “direct-to-exchange” flow is clearly visible in the early stages. M tokens were directly transferred from the victim’s wallet to Suspect Bitget Deposit 1 (0x7a5d…), and this fund was collected into the exchange’s hot wallet (0x1ab4…) within a short period. This suggests the attacker operated a direct route to the exchange alongside other methods to accelerate cash-out early on.The damage is calculated based on two criteria:Total M Token Outflow (Direct): 2,151.11 M, approx. $2,881.39 (Combined sum of direct transfers to exchange + EOA/Gathering Wallet).Total M Token Outflow (Including Bridge): 8,280.11 M, approx. $11,150.17 (Direct outflow + Meson bridge outflow included).Furthermore, clues suggesting a connection to specific social accounts and developer community profiles were identified in Gathering Wallet 2 (0x1c00…5f), which was confirmed as a key hub for money laundering. Based on this, grounds to narrow down suspect candidates have been partially secured. However, this is a circumstantial judgment based on the correlation between public information (OSINT) and on-chain data, and is not a legally confirmed conclusion.1.1 Summary StatisticsThe key flows are summarized as follows:1.2 Summary of Key Flows (4 Core Paths)Path 1: Victim → Direct Outflow to Bitget (Attempt at Immediate Cash-out)A total of 2,140.72 M (approx. $2,867) was directly transferred from the Victim Wallet (0xdc54…) to Suspect Bitget Deposit 1 (0x7a5d…).The deposit was collected into the Bitget exchange hot wallet (Bitget 6, 0x1ab4…) within minutes (approx. 3–5 mins).This flow represents the attacker sending “M tokens that are easy to cash out immediately” straight to the exchange.Path 2: Victim → Gathering Wallet 1 → Meson Bridge → Gathering Wallet 2 (Mainstream of Indirect Laundering)After WM contract processing, 5 types of MRC-20 tokens were received by the Victim Wallet and then drained to Gathering Wallet 1 (0x8325…e6).In Gathering Wallet 1, MRC-20s were swapped back to M, and 6,129 M was bridged via Meson Finance (0x25ab…48d3).6,122.87 M arrived at Gathering Wallet 2 (0x1c00…5f) on the BNB Chain.Path 3: Gathering Wallets 1, 2 → Reconsolidation at Bitget Deposit 2 (Possible Mixing with Other Victims’ Funds)900.65 M from Gathering Wallet 1 and 5,007.02 M from Gathering Wallet 2 flowed into Suspect Bitget Deposit 2 (0xb408…).The combined total is 5,907.67 M. As there is a “possibility of other victims’ funds being mixed,” this needs to be interpreted separately from the victim’s sole damage amount.Subsequent collection into Bitget 6 (0x1ab4…) was confirmed.Path 4: Multi-chain Dispersed Withdrawal from Gathering Wallet 2 (Evasion/Smurfing)From Gathering Wallet 2, after swapping M → BNB, there is a record of 37.51 BNB being dispersed and withdrawn in 48 transactions to 5 exchanges: Bybit, Bitget, MEXC, Binance, and Remitano.Activity of the same address was confirmed on Arbitrum and Base as well as BNB, reinforcing the cross-chain laundering pattern.2. Incident Mechanism and Psychological AnalysisThis incident appears to have started from a social engineering scenario targeting human trust rather than technical flaws such as system vulnerabilities. It seems to be a variation of the typical “Pig Butchering (Sha Zhu Pan)” tactic adapted to the MemeCore ecosystem context. There are indications that the attacker analyzed the community atmosphere and the victim’s activity patterns beforehand to approach with a tailored script.2.1 Manipulating the Environment to Build Trust: “The Illusion of the Fake Room” The attack seems to have begun with an approach from an account mimicking an acquaintance active on Memex. In anonymous messenger environments like Telegram, profile pictures and Display Names can be configured similarly, and Usernames (Handles) are hard to distinguish with just a one-character difference. The attacker judged to have secured trust by exploiting these characteristics. The Telegram room the victim was invited to contained multiple accounts impersonating Admins and Creators. They staged the room to look like an “Official Community” by continuing conversations or sharing profit verification screenshots even before the victim joined. In such an environment, it was easy to mistake the room for an extension of the official Memex community, which became the basis for the fraud.2.2 Technical Deception: Fake Bot and Inducing Wallet Connection Once a certain level of trust was established, the attacker guided the victim saying, “You can receive staking rewards if you connect your wallet via the Telegram bot”. The method is close to a typical Phishing or Drainer type. The wallet (0xDC54…69b) the victim newly created and connected was a “clean wallet” with almost no transaction history. The moment the victim trusted the instructions and moved assets, it is likely the attacker secured control through one (or a combination) of the following methods:Possibility that the transaction signed via the bot was actually an Unlimited Token Approval, not staking.Possibility that it was designed to execute an asset Transfer transaction during the signing or connection process.Possibility that keys or permissions were exposed to the attacker during the wallet creation/connection process. The key point is that “Wallet Connection” may have turned into an act of handing over actual asset authority, rather than simple login or authentication.3. Technical Characteristics of MemeCore Ecosystem and Asset StructureTo interpret the fund flow, it is necessary to first understand the background of the MemeCore chain where the victim’s assets existed and the asset structure. This explains why the attacker performed repetitive swaps and why the laundering path developed into a specific pattern.3.1 MemeCore and Proof of Meme (PoM) MemeCore is a Layer 1 chain aimed at connecting the cultural value of Memes with an economic reward structure. It promotes Proof of Meme (PoM) as its consensus structure, which includes elements like community contribution and viral activities in the reward system alongside simple staking. The base asset of this chain is the M token. M is used for core functions such as gas fees, governance, and validator staking, and has relatively high liquidity, which is why the attacker ultimately pooled funds into M for laundering.3.2 MRC-20 Token Standard and Cash-out Constraints Tokens such as NinjaMEX, walxop, LIFT, Bubger, and Abudium identified in the swap path of this incident follow the MemeCore-specific token standard (MRC-20). These appear to be “transit tokens” temporarily passed through during the process of the attacker exchanging stolen assets on the internal DEX, rather than assets originally held by the victim. Technically similar to ERC-20, they are structured for the creation and circulation of meme tokens within MemeCore. The issue is external compatibility. Since it is rare for external chains, centralized exchanges, or bridges to directly support MRC-20, it is difficult for the attacker to move them out externally and cash them out in the MRC-20 state. Eventually, to proceed to the actual cash-out stage, they must go through the flow of: converting back to M on the internal DEX -> moving to an external chain (BNB Chain, etc.) via a bridge -> attempting cash-out via swap/dispersed withdrawal on the external chain. The massive internal swap transactions observed in the report are interpreted as reflecting the constraint of having to convert back to M for external export, along with the possibility of transit swaps intended to confuse tracking in some sections.4. Incident Timeline and Detailed Forensic ReconstructionThis incident is clearly divided into Reconnaissance & Testing on December 7 and the Main Exploit on December 8. The attacker checked the validity of the path the day before, and then stole all available assets and proceeded with rapid laundering the next day.4.1 Phase 1: Reconnaissance and Initial Infiltration (Dec 7) — Traces Left by Destination Choice Immediately after securing access rights, the attacker showed a pattern of verifying two things with small (or relatively small) transfers first, rather than moving the full amount immediately:Whether the wallet is actually usable by the attacker.Whether the exchange deposit is processed normally (no risk of detection/blocking). At 10:18 UTC, 388.717 M was transferred to Bitget Deposit 1 (0x7a5d…), and at 14:08 UTC, an additional 752 M was transferred via the same path. This flow aligns with the typical pattern of a small test followed by additional transfers. The notable point is that the receiving address 0x7a5d…337 is estimated to be a User-Assigned Deposit Address of a Centralized Exchange (Bitget), not a personal wallet. Funds flowing into this address were observed being collected into the Bitget hot wallet (0x1ab4…f23) within minutes. If cooperation with the exchange is established, there is a possibility that tracking can continue on an account basis (KYC-based).4.2 Phase 2: Full-Scale Asset Theft and Laundering (Dec 8) — Forced Conversion to M and Exfiltration The full-scale theft proceeded rapidly on December 8. In this phase, it is observed that repetitive processing of the WM contract and mass liquidation (swap) of MRC-20 tokens were carried out in parallel with simple transfers.4.2.1 WM Repetitive Processing Pattern: Between 06:45 and 06:49 UTC, 8 repetitive transactions occurred against the WM contract, confirming processing (Deposit/Withdraw) of approximately 8,000 M. This repetitive wrapping/unwrapping can be interpreted as (1) a staging to confuse tracking, or (2) a preparatory step to match the asset form required for subsequent swaps/bridging.4.2.2 Organized Outflow of 5 MRC-20 Tokens and Immediate Cash-out: Around 1:24 PM, continuous M→MRC-20 swap transactions via the internal DEX occurred in the victim’s wallet, which appear to have been performed by the attacker. Subsequently, these 5 MRC-20 tokens were transferred to Gathering Wallet 1 (0x8325…eae6), where a process of converting them back to M via the Swap Router was observed. This choice is pragmatic from the attacker’s perspective. The longer low-liquidity meme tokens are held, the greater the price fluctuation and tracking traces may become. It seems the attacker chose to quickly convert MRC-20 to M to increase mobility and cash-out potential.4.3 Phase 3: Cross-Chain Bridging and Final Concealment — Attempt to Evade Tracking via Chain Hopping The secured M tokens did not stay in the MemeCore chain for long and were observed moving to the BNB Chain via the Meson Finance (0x25ab…48d3) cross-chain bridge.Meson Bridge: 6,129 M Deposited.BNB Chain Arrival: 6,122.87 M received at Gathering Wallet 2 (0x1c00…5f) (Approx. 3 mins to arrive). Gathering Wallet 2 subsequently acts as a hub to send funds to exchanges or disperse them to other chains (Base, Arbitrum). It has a strong character of a “Operational Wallet” used repeatedly rather than a simple transit point.5. Fund Flow Structure AnalysisFunds drained from the victim’s wallet moved largely in two directions:Direct Outflow straight to the exchange (Priority: Speed).Indirect Laundering via gathering wallets and bridges (Priority: Evasion).5.1 Key Deposit (Receiving) AddressesSuspect Bitget Deposit 1: 0x7a5d...337 / Received: 2,140.72 M (~$2,867.47) / Note: Exchange Transfer.Gathering Wallet 1 (MemeCore): 0x8325...eae6 / Received: 5 MRC-20s + 10.39 M / Note: MRC-20 → M Swap.Gathering Wallet 2 (Multi-chain Same Address): 0x1c00...285f / Received: 6,122.87 M & Multi-chain activity (BNB/Arbitrum/Base).Suspect Bitget Deposit 2: 0xb408...dd5c / Received: 5,907.67 M (~$7,969) / Note: From Gathering Wallets 1, 2 → Exchange. Caution: Possibility of mixing with other victims' funds..5.2 Characteristics and Implications in Fund Flow First, the laundering strategy is split into two. Part of it prioritized speed by sending it quickly to the exchange (Path 1), while the rest tried to make tracking difficult through bridging and multi-chain dispersion (Paths 2, 4). Second, Bitget appears repeatedly. Both the direct outflow path (0x7a5d…) and the path from the gathering wallet (0xb408…) converge to Bitget deposit addresses. In particular, 0xb408… is a common point receiving funds from both Gathering Wallet 1 and Gathering Wallet 2, making it a candidate for a key cash-out window. However, as other victims’ funds may be mixed in this section, definitive conclusions should be avoided. Third, Gathering Wallet 2 (0x1c00…5f) functions as a central node that receives bridged funds and then performs exchange transfers or dispersion to other chains.5.3 Multi-Exchange Dispersed Withdrawal (Smurfing) Statistics (BNB Only) From Gathering Wallet 2 (BNB Chain) → Exchange Withdrawal Statistics:Bybit: 23.44 BNB / 16 txsBitget: 7.15 BNB / 2 txsMEXC Global: 5.06 BNB / 22 txsRemitano: 1.30 BNB / 4 txsBinance: 0.56 BNB / 4 txsTotal Exchange Withdrawals: 37.51 BNB / 48 txs / 5 Exchanges Note: After swapping M → BNB at Gathering Wallet 2, dispersed withdrawals were made to multiple exchanges. Activity of the same address was confirmed on Arbitrum and Base, reinforcing the cross-chain laundering pattern. Reference: Remitano is known as a platform widely used for P2P trading in Southeast Asia, which can serve as a reference clue for geographic profiling (Note: Do not conclude).6. Relevant Actor Intelligence AnalysisIn this investigation, by cross-examining on-chain flows and off-chain public activity traces, we secured clues to narrow down the relevant Actor (Actor A) and associated account/profile candidates. The central address of the analysis is Gathering Wallet 2 (0x1c00…5f), and OSINT information was organized around this address.6.1 Circumstances Connecting On-Chain Activity and Digital Identity In this case, some clues were observed where 0x1c00…5f, identified as a key gathering address, could be connected to external public activities. If the same address is repeatedly mentioned or exposed in specific social accounts or community profiles, it can serve as important evidence connecting on-chain addresses with off-chain activities. There are circumstances where a specific social account marked as (Redacted) posted the 0x1c00…5f address multiple times in posts related to past airdrops, whitelist registrations, faucet participation, etc. This raises the possibility that the address is associated with the account’s activity to a certain level.6.2 Detailed Identity Profile (Circumstantial) In the OSINT investigation, circumstances were confirmed where the social account/handle marked as (Redacted) is connected to a specific bounty/task platform (e.g., Superteam Earn) account/profile. The following additional information is derived from this:Real Name/Legal Identity: (Redacted)Country/Region of Residence: (Redacted; Partially consistent with Remitano usage patterns, etc.)Professional Identity: (Redacted; Based on self-introduction)Tech Stack Claims: (Redacted)Activity Character: (Redacted)Additional Explanation: Meaning of “Partially Consistent with Remitano Usage Patterns” Here, “Partially consistent with Remitano usage patterns” does not mean concluding residence in a specific country/region (e.g., Vietnam) solely because Remitano appeared. It is intended to be referred to as a supplementary clue that increases probability from the perspective of Geo-profiling. specifically:Regional Character of Remitano: Remitano is known to be relatively widely used for P2P On/Off-ramp (cash-out/settlement) purposes in Southeast Asia (especially Vietnam) rather than being used equally worldwide like global major exchanges. Therefore, if Remitano is naturally included and repeatedly observed in the multi-exchange withdrawal flow, the possibility that the actor’s living sphere/settlement environment touches the Southeast Asian region (including Vietnam) relatively increases.Hints form “Exchange Combination”: In this case, regional P2P channels like Remitano appear alongside general-purpose exchanges like Bybit, Binance, and MEXC. This combination can be interpreted as a form often observed in dispersed withdrawals considering the final cash-out route, rather than simple investor propensity.Therefore, Remitano traces are worth referencing as a “Geographic Clue Candidate”. However, it is a “Supplementary Clue,” not definitive evidence. Final confirmation must be made through cooperation/investigation data such as exchange KYC, login/access logs (IP/Device), and withdrawal methods (Bank/Payment info).7. Conclusion & Our CommitmentComprehensive Conclusion This incident, occurring on December 7–8, 2025, was a social engineering-based asset theft. Funds were laundered through two parallel paths:A direct path flowing straight into the Bitget exchange (Speed).An indirect path exfiltrated to external chains via the Meson bridge after internal swaps on MemeCore (Stealth).Additionally, circumstantial evidence links “Gathering Wallet 2” (0x1c00...5f) to specific social accounts and developer profiles, providing strong identification clues for law enforcement.Response Strategy ChainBounty has advised a phased response:Phase 1: Immediate reporting to law enforcement with key TxIDs and requesting asset freezing at Bitget.Phase 2: International cooperation review for cross-border tracking.Phase 3: Continuous monitoring of suspect addresses and community education on risk factors.Need help tracking stolen funds? Recovering stolen assets starts with professional tracking. If you have been targeted by a similar exploit, do not hesitate to reach out. ChainBounty’s Victim Relief Program provides the forensic evidence needed for law enforcement reporting and exchange cooperation.👉 Apply for Victim Relief Program: https://chainbounty.io/en/event/campaign-victim-support/(Disclaimer: This report is based on on-chain data and public OSINT. Identity-related content is circumstantial estimation. Final legal judgments must be confirmed through lawful procedures by law enforcement agencies.)

ChainBounty

ChainBounty

9 months ago