Defend Against Cybercrime with the Power of Community

Cover: Gamdom wallet trace. Ethereum trace and unresolved endpoints. Published analysis date: 17 October 2026.A SentinelTX report on the reported Gamdom hot-wallet incident documents a clear Ethereum sequence: three source addresses funded one receiving account, which exchanged its recorded USDT, USDC and USD1 intake for DAI through seven CoW Protocol settlements on 13 October 2026. The report identifies no custodial-exchange deposit in those traced routes.The account's controller remains unknown. Its narrative ledger records 949,428.481298 DAI received and no DAI sent, but a separate current-balance query returned an empty token list. That makes the apparent DAI holding unverified. The trace also leaves a small bridge transfer unresolved, so it cannot establish where every asset ultimately ended up.This article summarizes the supplied SentinelTX report. It is an account of that source's findings and qualifications, rather than a new chain investigation.What the report coversThe investigation starts at Ethereum address 0x4b304741599c125a244e498d14562487d7109ab8, referred to here as the receiving account. Its attribution-database entry was unlabeled.The approved scope was Ethereum, 10 October 2026 at 00:00 UTC through 17 October at 11:20 UTC, with two inbound and five outbound hops. The executed query record is broader: 10 September 2026 at 11:23:39.121577 UTC through 17 October at 11:23:39.121577 UTC. The report explicitly warns that the executed records do not establish enforcement of the requested historical window or block cutoff.The retained evidence contains 84 movement rows across seven addresses, with timestamps from 13 October at 16:00:23 to 18:17:47 UTC. Movement rows are not a count of distinct transactions. The abstract's one-hop maximum describes its cited routing rows; it does not define the investigation's authorized tracing depth. Upstream reads were also skipped for high-volume wallets, leaving their own funding sources unestablished.The report gives $6,051,923.89 as the value of movements it could price. This is gross traced movement, with value counted along multiple legs, and cannot be presented as Gamdom's loss or the receiving account's balance.Three source addresses supplied the receiving accountThe narrative groups direct receipts as follows. Quantities retain the units and displayed precision of its sender summary.Source A, 0x0067cc2416f792cf0ec5629f5506324ac508f859: 74.266886 ETH in three transfers; 316,809.689210 USDT in six; 468,830.099059 USDC in seven; and 20,077.942699 USD1 in two. The address had no database label.Source B, 0x580450dff316ae00d0fbef9621a304020a046ce2: 10.994222 ETH in two transfers; 109,231.124988 USDT in three; and 34,171.291810 USDC in one. This address was also unlabeled.Source C, 0xd5fbda4c79f38920159fe5f22df9655fde292d47: 1.695248 ETH and 738.148859 DAI, one transfer each. A search-result snippet displayed the nametag “Gamdom: Hot Wallet,” but the attribution database did not supply that label.The narrative's first DAI receipt is at 16:00:23 UTC, in transaction 0xb2cca150592b3ba9344ff17a6f39888a40a855fc1619e8946b8b87e17217578f. Its first listed ETH receipt follows at 16:10:47 UTC, in transaction 0x178957dc5339430fef6c8e460f54722968b59d06dcc899d1ca1cfdf5bedd19ae. Both came from Source C. These timestamps distinguish the earlier token receipt from the ETH activity cited in the account profile.At 16:16:47, Source A sent 262,237.892832 USDT and Source B sent 92,182.438003 USDT. Source A subsequently supplied 62.204364 ETH at 16:18:35 and large USDC transfers, including 216,144.339953 at 16:22:59 and 175,442.114752 at 16:49:35.These source groups establish observed transfers. They do not establish that all three senders belonged to Gamdom or shared a controller.Seven settlements converted the recorded stablecoin intakeAll seven swaps used 0x9008d19f58aabd9ed0d60971565aa8510560ab41, labeled “CowProtocol, Exchange” in the report. Each transaction sent USDT, USDC or USD1 from the receiving account and returned DAI to that same account.The following entries reproduce the report's six-decimal swap summary. All times are UTC on 13 October 2026; the routing evidence retains greater precision for some token transfers.16:23:35 — Sold 354,420.330835 USDT; received 354,092.632978 DAI. Transaction: 0x00ce1e32059de820e307f65aaac3d790a95fcab2a48b82be768c9f5ab07b2441.16:26:23 — Sold 250,492.462571 USDC; received 250,484.456553 DAI. Transaction: 0x2b2a4ce1aa3f910d44b1425718429c8c7d1c5440729acf046fd26586b72356bb.16:38:59 — Sold 56,130.912559 USDT; received 56,078.550875 DAI. Transaction: 0xf00e7510ce52f85fbde1066922dc9f18fadb5710892d972bf62532c21792d52e.16:39:47 — Sold 20,077.942699 USD1; received 20,061.011520 DAI. Transaction: 0xf13d17c1b8a167aa087ed6402e1788de0244772dd39b78b9d377e38232bd7af9.17:17:11 — Sold 246,251.441288 USDC; received 246,243.742960 DAI. Transaction: 0x3ea5d430d9966ecc19a58ff3433129eaea619cd4f95038e9e34b6ad403bc8000.17:57:11 — Sold 15,489.570804 USDT; received 15,472.826473 DAI. Transaction: 0xc9a9ae19e7ec220ac5e310a986cd819542a5259406a2f307600e7b8ea4c4b842.18:00:11 — Sold 6,257.487010 USDC; received 6,257.111080 DAI. Transaction: 0xced9badc65a23f72a9462d427ae8350c87710bf3d4b32b8763738ba6375d1367.The report reconciles these sales to the narrative intake: 426,040.814198 USDT, 503,001.390869 USDC and 20,077.942699 USD1. It records 948,690.332439 DAI returned by the settlements. For the largest swap, the underlying transfer amount is 354,092.632977884068510689 DAI; the list above uses the rounded narrative figure.Seven swap transactions returned DAI to the receiving account. A protocol's “Exchange” label does not establish a deposit into a custodial trading account.The automated trace marked 15 “cash-out legs” complete. The narrative explains that these counted both sides of each of the seven swaps, plus one bridge leg. After deduplication, there are seven settlements and one bridge interaction, rather than 15 separate exits.Figure 1. Seven settlements returned 948,690.332439 DAI to the receiving account on 13 October 2026. Labels use the six-decimal summary in SentinelTX CASE-ASYNCE53, page 6; quantities are DAI, not dollar losses.ETH accounting and the DAI balance gapThe report's completed provider ETH list records six inbound transfers totaling 86.956356111770671236 ETH, two outbound transfers totaling 0.014 ETH, and gas fees of 0.000498820354746462 ETH. Subtracting the recorded outflows and fees gives 86.941857291415924774 ETH.The methodology calls this arithmetic over the provider's returned history, rather than a direct balance measurement. That distinction also matters for DAI. The narrative adds 948,690.332439 DAI from swaps to 738.148859 DAI from Source C, giving 949,428.481298 DAI received with no recorded DAI outflow. Its separate balance query returned no tokens, and the report explicitly says the holding needs a direct recheck.The broader generated movement summary also includes a 3,012.335110 DAI row in its traced-origin grouping. That section explicitly describes evidence-set activity without establishing incident connection, and the report does not reconcile the row with its receiving-account narrative. It is not added here to the seed ledger or to a loss total.Two small ETH transfers and an unresolved bridgeAt 17:42:23 UTC, the receiving account sent 0.01 ETH back to Source C in transaction 0x90d15c162609522d1229818adfe352d48270db57050e7179a0c0d779a6c1fc0e. This is the address carrying the snippet-only Gamdom nametag.At 18:16:11 UTC, it sent 0.004 ETH to 0x0439e60f02a8900a951603950d8d4527f400c3f1, labeled “Metamask Bridge, Exchange,” in transaction 0xc6365a438054089c9f796643f4ec99ee4bb3ef57a02a39728e511d7638cf8507, at block 26185303.The destination chain and destination address were not resolved. Eight protocol-explorer checks failed to respond. The report suggests the small amount could represent a gas top-up, but labels that interpretation as an assessment. The incomplete lookup cannot establish that all funds remained on Ethereum.The report also records a connection with Relay.link, 0xf70da97812cb96acdf810712aa562db8dfa3dbef. Its narrative describes a direct edge and a shared CoW counterparty, while saying no separate value transfer appears in the seed's transfer ledger. That interaction remains unresolved. The full retained dataset extends to 18:17:47 UTC, later than the narrative's final own-account action at 18:16:11.Figure 2. Three source addresses funded the receiving account. Seven CoW settlements returned DAI; 0.01 ETH went back to Source C and 0.004 ETH reached MetaMask Bridge. The destination chain and address remain unresolved. Source: report pages 5–8. Full addresses appear in the address key.What the evidence says about control and intentThe receiving address had contract code. The report describes a programmable smart account and raises possible EIP-7702 delegation, based on self-calls with selector 0xe9ae5c53. Its code prefix was not read, so delegation is unestablished. A successful call or verified transfer does not identify the signer, authorization or motive.The report's expert assessment considers a hot-wallet compromise followed by rapid conversion into DAI plausible. It also says an operator-initiated emergency sweep cannot be ruled out. The return of 0.01 ETH to the Gamdom-nametagged address and the unidentified receiving-account controller preserve that ambiguity. Shared counterparties among source wallets do not resolve it.Incident-wide loss claims in the report range from more than $2.3 million moving out of hot wallets to a founder statement of “just over $3m” and independent reporting near $4.2 million. Those claims came from search-result snippets, rather than full-page verification. The Gamdom and Romer X posts were not read. Claims that user funds were safe were also unverified.Reported activity on Solana, BNB Chain, Tron and the XRP Ledger falls outside this Ethereum review. Neither those loss claims nor the report's $6.05 million gross-movement figure can be substituted for a verified loss calculation.The defensible conclusionThe strongest finding is the seven-transaction conversion of the narrative's recorded USDT, USDC and USD1 receipts into DAI, with proceeds returned to one identified Ethereum account. The reviewed routes show no identified custodial-exchange deposit. Ownership, current DAI holdings and the bridge's destination remain open questions.The report's priorities follow directly from those limits: recheck the DAI holding, establish whether Gamdom controls the relevant addresses, inspect the account's delegation code, resolve the bridge destination and monitor any later custodial-exchange deposit. Further work on the other reported chains would require a separate scope. Until those questions are answered, the trace supports a documented conversion sequence, not a definitive attribution of theft, a final loss total or proof of recovery.Figure 3. The report documents the conversion sequence but leaves the controller, current DAI holding and bridge destination unresolved. The narrative ledger is not a verified current balance. Source: report pages 7–9; broader generated movement totals are discussed separately in the text.Address keyReceiving account: 0x4b304741599c125a244e498d14562487d7109ab8 Source A: 0x0067cc2416f792cf0ec5629f5506324ac508f859 Source B: 0x580450dff316ae00d0fbef9621a304020a046ce2 Source C, snippet-only Gamdom nametag: 0xd5fbda4c79f38920159fe5f22df9655fde292d47 CoW settlement: 0x9008d19f58aabd9ed0d60971565aa8510560ab41 MetaMask Bridge: 0x0439e60f02a8900a951603950d8d4527f400c3f1 Relay.link: 0xf70da97812cb96acdf810712aa562db8dfa3dbefSource notePrepared from SentinelTX case CASE-ASYNCE53, report generated 17 October 2026 at 11:27:49 UTC. The source narrative and sender/swap summaries are on pages 4–9; transaction-routing evidence on pages 10–16; generated movement totals on pages 17–19; and collection limits and executed query bounds on pages 20–21. Token symbols are as reported and do not independently verify token identities. No additional external verification was performed for this article.

A UNCX vesting-pool transaction on Ethereum moved five tokens into an execution route on 14 October 2026. Four were converted into ETH that afternoon. The fifth, ZC, remained in the executor until the following morning, when a withdrawal and a separate sale completed the selected route.Three roles make that sequence easier to follow. The shared vesting pool held tokens for scheduled releases. The initiating wallet submitted the transaction. The executor was a contract created during that execution, which received tokens and later forwarded them for conversion. These role names describe addresses in the records, not identified people.The confirmed path is shared vesting pool → executor contract → token conversions → the initiating wallet. The two conversion sessions paid that wallet 21.155286011908665958 ETH in total. A separate 0.29 ETH return from the executor was not another token sale. Understanding that distinction matters more here than attaching one large dollar estimate to every transfer.This is a bounded Ethereum investigation, not a reconstruction of every UNCX-related drain. The account below separates transaction records, arithmetic and external reporting, then follows the transitions in time order.ScopeBoundarySelected incidentEthereum seed transaction on 14 October; five subsequent token salesObservation cutoffBlock 26,210,180 · 17 October 2026, 05:27:59 UTCConfirmed sale receipts21.155286011908665958 ETH; before gas and execution costsCounting ruleCount each final ETH receipt once. Keep capital returns, token movements and balances separate.Follow-upInitiating wallet and funding address; bounded native-ETH tracing up to two outward hops, not continuous coverageBefore the numbers: who does what?Vesting is a schedule for releasing tokens over time. A shared vesting contract can hold tokens for many positions. Here, “pool” means the address whose token balances changed in the selected transaction; it does not mean that every position holder has been identified. A net outflow means recorded outgoing tokens minus incoming tokens within that transaction—not the sum of all transfers displayed by an explorer.The initiating wallet submitted the seed transaction. It called an entry contract, which created an executor: a contract that carried out further interactions and received tokens. The executor is a distinct address, not a second name for the wallet. A funding address supplied ETH beforehand. These are roles in the records, not names for people or proof that one operator controlled all of them.Role on EthereumFull addressInitiating wallet0x78c9b11853e4f183a34c63ffd1924d2319a2f5b3Entry contract0x6cebdf095172b355121b93962017975c4601f26cExecutor0xf6d072254eb8a9b06e0ba21221b498332c1bc35eShared vesting pool0xa98f06312b7614523d0f5e725e15fd20fb1b99f5Funding address0x6d2afff4fc6ff46564467762c4aa35812680d606Three findings guide the investigation. The pool’s five token net outflows reconcile to the executor and other net recipients. The fifth conversion happened on the following day, so stopping on 14 October misses a material receipt. Finally, the sale receipts, returned execution capital and later wallet balance answer different questions. The chronology below explains why.Start Figure 1 at the pool and follow the top arrow to the executor, then down to the initiating wallet receiving tokens for conversion. Read the lower boxes as the two conversion sessions: their arrows point back toward the wallet because it received the final ETH. They are not additional recipients to add to the wallet.Figure 1. Solid arrows indicate asset direction or grouped conversion paths, not transaction calls, ownership, quantity scale or elapsed time. All amounts shown are rounded to six decimals. The public receipts and exact tables govern the quantities.The overview shows a route with a pause, rather than a single immediate cash-out. It also stops at the receiving wallet: a sale on a decentralized route does not itself establish a deposit with an exchange. The first chronological question is how the initiating wallet was funded.14 October, 14:47–15:15 UTC: funding arrives before executionThe funding address sent 0.1, 0.9 and 2.5 ETH to the initiating wallet at 14:47:35, 14:56:59 and 15:15:35 UTC, respectively. Together these transfers supplied 3.5 ETH before the seed transaction. ETH is Ethereum’s native asset; it can pay transaction fees as well as contract payments. First funding; second funding; third funding.15:49:59 UTC: five token balances fall in one seed transactionThe successful seed transaction sits in block 26,191,745. Its receipt contains 136 logs, including 64 ERC-20 Transfer events. An ERC-20 token keeps its own ownership ledger; a Transfer event records a movement in that ledger. Several movements can occur inside one transaction, including borrowed tokens going in and back out. Seed transaction and receipt.To avoid counting borrowed principal twice, this review summed the raw integer amounts in the transfer events by token and address. Token decimals translate those integers into readable units: 18 decimal places for four tokens, and nine for PAAL. For every token, the pool’s net outflow equals the sum of the positive net receipts at the executor and the other recipients.TokenPool net outflow (rounded)Executor net receipt (rounded)EDGEN57,344,850.92155,601,598.708ZC9,131,678.0459,055,847.638pepeCoin42,200.53340,155.284LO0P65,826.00065,372.217PAAL115,945.630113,657.767The difference between the two columns is not an unexplained second theft. The receipt records net amounts at a fee recipient and, for three tokens, other counterparties in the execution. Those quantities are preserved separately in the appendix. Do not add the executor’s receipt to the pool’s outflow: they are two views of the same movement.This reconciliation establishes token movements. It does not reconstruct every vesting position or prove the vulnerability’s cause. The incident-time implementation and storage were not replayed here, so the exact accounting defect remains unconfirmed by this analysis. The evidence supports the selected outflow route more directly than it supports a complete root-cause claim.16:41–17:01 UTC: returned capital and four salesAt 16:41:11, the executor returned exactly 0.29 ETH to the initiating wallet. The seed had supplied 0.8 ETH; ten 0.05 ETH payments and one 0.01 ETH payment account for 0.51 ETH, leaving 0.29 ETH. The exact conservation and later return support reading it as unused execution capital. The complete executor history and code semantics were not independently replayed, so this interpretation remains narrower than a full contract audit. Capital return.Three minutes later, the first selected token sale paid ETH to the wallet. Four conversions followed in order: pepeCoin at 16:44:35, EDGEN at 16:56:47, LO0P at 16:58:59 and PAAL at 17:01:11. A swap route can wrap ETH into WETH and unwrap it again. WETH is a token representation of ETH; counting each internal hand-off would inflate the sale receipt. Here only the final ETH receipt at the initiating wallet is counted.14 October UTC / saleETH received16:44:35 · pepeCoin2.19369786395594791616:56:47 · EDGEN8.56791624420310002516:58:59 · LO0P3.46310648888943786317:01:11 · PAAL0.411886429218097850The four receipts sum to 14.636607026266583654 ETH, before costs. The LO0P sale was submitted by a different address, even though ETH reached the initiating wallet. A third-party transaction submitter can execute an order for a recipient. That fact does not identify a co-attacker, and the third party’s transaction fee must not be subtracted from the initiating wallet’s funds without checking who paid it. LO0P receipt.At 17:09:35, after these four sales, 3.5 ETH went back to the funding address. That return connects the two addresses financially, but does not establish a real-world identity, common control or an ultimate cash-out destination. It also does not mean that the sale receipts disappear from the ledger: it is a later movement of ETH, not a negative token sale. Return transaction.15 October, 07:28–07:35 UTC: ZC completes the selected conversion routeAt 07:28:35 the executor sent 9,055,847.637887682268154756 ZC to the initiating wallet. This was a token withdrawal, not yet a sale. At 07:35:11—six minutes and 36 seconds later—a separate successful transaction converted that amount and paid 6.518678985642082304 ETH to the same wallet. ZC withdrawal; ZC sale.The sale used LI.FI routing. A router is a contract that forwards a swap through trading venues and other contracts. It is an intermediary, not necessarily the buyer or the final recipient. The sale included a token fee of 4,527.923818943841134077 ZC. The remaining 9,051,319.714068738427020679 ZC moved onward to the router. The route ultimately unwrapped WETH and delivered ETH through routing contracts to the wallet. These intermediary transfers explain how the conversion completed; they are not extra sale proceeds.A call trace breaks one transaction into the contract calls made while it runs. Each call appears as a frame, so several frames can describe successive steps involving the same funds. The trace displayed 150 of 204 call frames. Original explorer transfer records therefore supplement the quantity check, but this is not a complete execution replay: the transaction was not independently rerun to verify every internal step.Stopping the account on 14 October would therefore omit more than 6.5 ETH of selected sale receipts. Conversely, adding the 0.29 ETH capital return would overstate those receipts. Figure 2 separates the two accounting categories before showing the later balance snapshot.Figure 2. Read the green sale box and amber capital box separately. The connecting arrows identify receipt categories reaching one wallet; they do not instruct the reader to add them as profit. The lower gray panel is a later balance observation. Amounts are rounded to six decimals.The five sale receipts total exactly 21.155286011908665958 ETH. This is a gross conversion receipt, not net profit, a dollar loss or the wallet’s entire balance. Gas, execution payments, starting funds and other transfers need their own accounting. One unsolicited incoming wei and a successful zero-EDGEN transfer are excluded from sale proceeds. The remaining question is where the observed ETH stood at a defined cutoff.17 October: a fixed-block snapshot, not a final destinationAt block 26,210,180, timestamped 05:27:59 UTC, the initiating wallet held 20.237222755363802454 ETH and the funding address held 7.459202396392388 ETH. These were read at the same historical block through Ethereum JSON-RPC, not inferred by subtracting a selection of transfers. The block hash is preserved in the appendix. Cutoff block; RPC endpoint documentation.A balance belongs to an address, not to one incident. The funding address’s balance in particular is not an additional UNCX loss. Within the bounded native-ETH follow-up, no custodial-exchange deposit, bridge exit or mixer deposit was identified from these two addresses. Provider coverage and labels are incomplete; this is not proof that no outside-scope movement exists or that the funds can be recovered.One account detail also deserves care. The initiating wallet’s code at the cutoff is an EIP-7702 delegation marker pointing to a separate implementation. EIP-7702 lets an account authorize delegated code execution. A nonce is an account’s sequential counter; it helps distinguish an authorization or transaction from an earlier one. The ZC sale’s authorization used nonce 25, while its outer transaction used nonce 24; an authorization can increment the authority’s nonce inside that transaction. It is not evidence of a separate later transaction, a compromised key or a specific operator. Sale authorization; EIP-7702 specification.What connects the route—and what remains openThe strongest connections are direct: the executor was created inside the seed execution, token events reconcile its receipts, the next-day ZC withdrawal names the same sender and recipient roles, and the five sale receipts pay the initiating wallet. These are transaction-level links. The funding relationship is a different level of evidence: it establishes value moving between two addresses, not common ownership. Similar patterns or shared service labels cannot fill that gap.Blockaid’s broader alert reported approximately $1.49 million across four chains and 11 drains including copycats and MEV activity—automated attempts to extract value from transaction execution or ordering. That is external incident context, not this report’s verified net loss. This review does not independently aggregate BNB Chain, Base or Robinhood activity, price every token at the incident time, or assign every affected vesting position to a victim. Blockaid update; published transaction list.The transfer-event arithmetic was independently reconstructed from Etherscan receipts. SentinelTX supplied call traces and bounded address follow-up; fixed-block balance and code reads were checked separately through Ethereum RPC. These are complementary evidence sources, not interchangeable confirmations. The selected record is reproducible, but neither the root cause nor a complete multichain victim ledger has been established by this analysis.Response points specific to this caseThe first response question is which vesting positions were affected. Investigators need the incident-time position state and decoded deposit/withdrawal events, not only the shared pool’s balance change. That would connect the reconciled token outflows to individual claims and avoid confusing fee or lending-counterparty receipts with executor gains.The second is why those movements were accepted. Investigators would need to rerun the seed using the contract code and stored state from block 26,191,745. This would test whether an accounting rule was violated. Such a rule is called an invariant: a condition that should remain true as the contract runs. This review has not identified and reproduced a specific invariant failure. A current implementation page or a matching exploit pattern is not an adequate substitute.The third is whether the receiving wallet later crosses into a service with a verifiable destination record. Any new exchange, bridge or mixer label needs the actual transaction, chain, asset and time attached. A historical funding source is not an onward route for proceeds created later. Until such a record is linked, the report should stop at the observed wallets rather than draw a speculative cash-out arrow.The defensible conclusion is therefore specific: five tokens left the shared pool in the selected Ethereum transaction, and five later conversions paid 21.155286011908665958 ETH to the initiating wallet across two days. The 0.29 ETH executor return is separate capital, and the 17 October balance is a snapshot. Those distinctions preserve what the evidence explains without turning unanswered questions into findings.Evidence appendix: exact quantities and identifiersAll addresses below are on Ethereum. Wallet and contract links open address-detail pages; transaction links open transaction-detail pages. Values are unrounded unless explicitly labeled otherwise. Raw token quantities were summed as integers, using each token’s recorded decimal precision.EDGEN: seed-receipt reconciliationRecordExact token amountPool incoming475444753.754326574116796226Pool outgoing532789604.674988572932369396Pool net outflow57344850.920661998815573170Executor net receipt55601598.708417972560603048Fee-recipient net receipt425556.138682232937672685Counterparty net receipt1317696.073561793317297437RoleEthereum addressToken contract0xaa9806c938836627ed1a41ae871c7e1889ae02caFee recipient0xd45dd91df475bfd944335160f538c1a14888dc1cCounterparty0x4b2c930f88a87d1bffac291b6a7e01c9f13dd03eZC: seed-receipt reconciliationRecordExact token amountPool incoming93872336.744096272206179873Pool outgoing103004014.788650621140667962Pool net outflow9131678.044554348934488089Executor net receipt9055847.637887682268154756Fee-recipient net receipt75830.406666666666333333RoleEthereum addressToken contract0x4e67db19044549ff420860834c91b45bad298722Fee recipient0xd45dd91df475bfd944335160f538c1a14888dc1cpepeCoin: seed-receipt reconciliationRecordExact token amountPool incoming658778.146282755355639233Pool outgoing700978.678959483212162252Pool net outflow42200.532676727856523019Executor net receipt40155.284285661160205717Fee-recipient net receipt446.139542453412314759Counterparty net receipt1599.108848613284002543RoleEthereum addressToken contract0xa9e8acf069c58aec8825542845fd754e41a9489aFee recipient0xd45dd91df475bfd944335160f538c1a14888dc1cCounterparty0xddd23787a6b80a794d952f5fb036d0b31a8e6affLO0P: seed-receipt reconciliationRecordExact token amountPool incoming560996.296306472266672982Pool outgoing626822.296306472260110494Pool net outflow65825.999999999993437512Executor net receipt65372.217059159993437512Fee-recipient net receipt453.782940840000000000RoleEthereum addressToken contract0x00000000000050806673b532d7486ac114c1de3fFee recipient0xd45dd91df475bfd944335160f538c1a14888dc1cPAAL: seed-receipt reconciliationRecordExact token amountPool incoming988136.434511398Pool outgoing1104082.064395937Pool net outflow115945.629884539Executor net receipt113657.766933968Fee-recipient net receipt799.291296850Counterparty net receipt1488.571653721RoleEthereum addressToken contract0x14fee680690900ba0cccfc76ad70fd1b95d10e16Fee recipient0xd45dd91df475bfd944335160f538c1a14888dc1cCounterparty0x2a6c340bcbb0a79d3deecd3bc5cbc2605ea9259fExecution and routing addressesRoleEthereum addressSeed fee recipient0xd45dd91df475bfd944335160f538c1a14888dc1cSeed builder-payment recipient0x396343362be2a4da1ce0c1c210945346fb82aa49LO0P transaction submitter0x8d10551fbb0da1eadf34b25210fe75f278fa9321LO0P relay0x52b335fd4d229c4b4ffa6190526e4b5fb8e3fb09UniswapX reactor0x00000011f84b9aa48e5f8aa8b9897600006289beLI.FI route0x1231deb6f5749ef6ce6943a275a1d3e7486f4eaeZC router0x22ec88b9ff78c6f2458ab1a7aa8bb99d84bd4b86ZC ETH routing intermediary0x28bf6006d87de7f44445905aa4f5cb8c0d8cba02Uniswap v4 Pool Manager0x000000000004444c5dc75cb358380d2e3de08a90EIP-7702 delegate0x63c0c19a282a1b52b07dd5a65b58948a07dae32bChronological transaction register (UTC, 2026)Time and evidence roleFull transaction hash14 Oct 14:47:35 · 0.1 ETH funding0x52fe1a5aa857a3e6f6f0c12f559019da382c294238601b967a74b03c01c5b93b14 Oct 14:56:59 · 0.9 ETH funding0x351b5d9728c51ffbefd951b3536ab9c61e6e0de9dfa738830d560eb82fb6992e14 Oct 15:15:35 · 2.5 ETH funding0x56db74daaa13475dbb3360c86bf150ad2430556500cd803e47590f3b32b75e8b14 Oct 15:49:59 · seed · block 261917450x352065378c4a41b77e5b6a1e5b5616cd2886c3e1a2c87ed3db8e5ddddc23823d14 Oct 16:41:11 · 0.29 ETH return0x1527757f77288fafc68ab8f2d20e7061ee9941fe8214e188d6810882661fbc3210-14 16:44:35 · pepeCoin sale · block 261920180xf758582096ed80fbd4b80bc3dbd44e3edabdfd116b15ad9d16af459e38b09be510-14 16:56:47 · EDGEN sale · block 261920790x60becfc7e652d79182402bc3a8ce43ad433b06b5c401d239a4b10b97bb4a722110-14 16:58:59 · LO0P sale · block 261920900x35672ee02483b580acc443657ec6f5326e0fcea35912d6042335ed8f70010d0410-14 17:01:11 · PAAL sale · block 261921010x4ac0a349988c0e87a7d4d8f5fe94ae4886b165b56e931b6f485c57e2db8bcb4c14 Oct 17:09:35 · 3.5 ETH to funder0xa32b5eefca3e3dc8891f9e07fcd585c5ce1762f5d67035fc3e61acaa818f92bd15 Oct 06:40:47 · unsolicited 1 wei0x3d08bda0a282249b2cd05685962c2d7bc21ec2a23a4da4d2191c7d48123b96ac15 Oct 07:27:11 · zero EDGEN · block 261964140xe806726d883cef3dac91fe782ea1bfe8f451f08c40d3990fee8b4a42443c371115 Oct 07:28:35 · ZC withdrawal · block 261964210x8eab147f6e0f34e807c584d69873b2a2f7b4791b691f9a60c9d1ffd347eafcb015 Oct 07:35:11 · ZC sale · block 261964540x13a26824dd3f1135b35852333922f4573e0a8c2542a3d6884655471283a490fcCutoff and counting notesObservationExact valueFive sale receipts21.155286011908665958 ETHZC sale receipt6.518678985642082304 ETHReturned executor capital; excluded from sales0.290000000000000000 ETHInitiating-wallet native balance20.237222755363802454 ETHFunding-address native balance7.459202396392388 ETHBlock / UTC26210180 / 2026-10-17 05:27:59Block hash0x98c78f93c1b3d7de09694f161d922b2c219b68205f87626f224d70301fa672deThe five-sale total excludes the 0.29 ETH capital return, the unsolicited wei, repeated internal route legs and gas. No net-profit or dollar-loss total is asserted. The selected pool-net figures do not establish per-position losses. Findings reflect the stated cutoff and scope, not a live assurance about later funds.

On 15 October 2026, a single Ethereum transaction moved 2.309861111111111114 ETH out of KolanHook and ultimately paid 1.279914429958618589 ETH to its initiating address, according to the body of SentinelTX report CASE-ASYNC95E. Those figures describe different things. The first is the hook's gross native-ETH outflow; the second is the surplus paid after borrowed principal was returned.That distinction is the starting point for understanding this case. The transaction also involved a 6.7 WETH flash loan and a larger Pool Manager payout. Treating every transfer as a separate loss, or calling the entire payout profit, would misrepresent the reported flows.This article adapts the report's findings for the ChainBounty community. It preserves the distinction between recorded movements and the report's interpretation of the mechanism. It also explains the source's scope and evidentiary limits.The incident ledger: follow the amounts separatelyThe report's body places the successful transaction at 11:06:11 UTC on 15 October 2026, in Ethereum block 26197504. It reports 78 call frames and a maximum call depth of eight. The seed transaction and relevant full addresses appear in the reference key below. [1]The seed-transaction ledger is:Borrowed principal: 6.7 WETH, unwrapped into 6.7 ETH.Principal returned: 6.7 ETH re-wrapped into WETH and repaid within the same transaction.First hook payment to the Pool Manager: 2.050000000000000001 ETH.Second hook payment to the Pool Manager: 0.259861111111111113 ETH.Combined hook native outflow: 2.309861111111111114 ETH.Pool Manager payout to the helper: 7.979914429958618589 ETH.Gross surplus paid by the helper to the initiator: 1.279914429958618589 ETH.Maximum transaction-fee estimate: 0.000487737331891920 ETH.Gas-adjusted proceeds: at least 1.279426692626726669 ETH.The payout reconciles exactly as reported: 7.979914429958618589 ETH minus 6.7 ETH equals 1.279914429958618589 ETH. The hook outflow is larger than that surplus. The report attributes the difference to netting against swap legs inside the Pool Manager; these categories should remain separate.The gas-adjusted amount is a lower bound, not an exact net-profit figure. The report multiplies the gas limit of 3,105,267 by the gas price of 157,067,760 wei to obtain a fee ceiling. It does not provide the seed transaction's gasUsed in the cited evidence. [2]Figure 1. Zero-baseline comparison of hook native outflow and initiator gross surplus. The repaid 6.7 WETH principal is a separate annotation. The two bars measure different things and are not additive; the exact ledger above governs any shortened chart labels.How the transaction unfoldedThe report describes Kolan as a fixed-supply KLN token whose supply sits in a native-ETH/KLN Uniswap v4 pool. In the published design summarized by SentinelTX, the hook is the sole liquidity provider. Buyers pay a premium for a cancellation “window,” during which a purchase can be cancelled and ETH refunded. This design context comes from the report, rather than a separate review of the protocol's code. [3]The reported execution sequence has five useful stages:Deployment. The initiating address created an operation contract, which created a helper contract. The helper carried out the interactions.Funding. The helper borrowed 6.7 WETH from the address labelled Balancer, then unwrapped it into ETH.Initial pool interaction. The helper entered the Uniswap v4 Pool Manager and paid it 6.7 ETH. The Pool Manager invoked KolanHook callbacks.Repeated hook calls. The helper called the hook twice using selector 0x19b05f49. The first call triggered four Pool Manager calls with selector 0x5a6bcfda; the second triggered seven. The hook made the two ETH payments listed above during these hook-driven frames.Exit and repayment. The helper interacted with the Pool Manager again, received 7.979914429958618589 ETH, re-wrapped and returned the 6.7 ETH principal, then paid the remaining 1.279914429958618589 ETH to the initiator. [2]SentinelTX assesses this pattern as consistent with flash-loan-funded price-and-liquidity manipulation of the hook's internal accounting. Its interpretation is that the initial swap displaced the pool price, the hook interactions changed liquidity placement or withdrawal around that price, and the reverse swap captured a difference.That is an assessment, not a fully decoded root-cause demonstration. The report says selectors were not ABI-decoded. It cannot establish whether 0x19b05f49 represents buy, cancel or accept, or whether 0x42966c68 is a burn. The broader classification as a logic/accounting exploit rather than a key compromise is also the report's assessment. A decoded trace and relevant hook events remain important missing evidence. [3]Figure 2. Five-stage incident sequence, from deployment and funding through pool and hook interactions to repayment and surplus. The sequence is reported evidence; the proposed accounting mechanism remains an assessment. Pre-incident transfers do not belong in this flow.Where the traced value stoppedSection 7 names the initiating address as the endpoint in the traced set: one inbound movement and no outbound movement in that set. The body also says the initiator's transaction list was read to its end and no later outbound value transfer was identified as of the analysis. No exchange-deposit leg was identified. These are bounded findings, not a guarantee about future activity. [4]A later contract-creation transaction at 16:48:59 UTC on 15 October is described separately. It involved other contracts and no KolanHook value-bearing frame. Its proceeds are excluded from this incident ledger.The initiator's displayed native balance was 1.539598 ETH at analysis time. Appendix A gives the full address-level reconciliation as 1.539598271282627379 ETH. That balance combines unrelated activity; it is not an isolated balance of Kolan proceeds. Similarly, the report's 0.0 ETH native-balance reading for the hook does not establish its total assets or liabilities, because KLN and Pool Manager claim balances were not read. [4]Earlier transfers are context, not the exit routeThe report records three 1 ETH transfers to an address labelled Tornado.Cash Router and DAI/PAXG transfers to an address labelled Relay.link on 12 October. They happened three days before the seed transaction. They cannot be an onward route for proceeds generated on 15 October.Some source figures combine incident flows with earlier or unrelated activity. Visual proximity and connecting arrows should not override chronology. This article does not adopt the report's sanctions tag as a statement of current legal status, and does not infer a real-world identity or insider involvement from the address history. [5]Important limits inside the sourceThe abstract limits its statements to the evidence available to that summary: it does not supply a transaction date or record terminal endpoints, and its definition of “verified” does not establish the signer. The body separately gives the incident date, block and reported tx.from address (§§1 and 3), and lists the initiator as an endpoint within the traced set (§7). These are different levels of scope and detail, not competing dates or proof of a final cash-out destination. This article attributes the specific transaction details to the body and preserves the source's limits on identity, ownership and onward tracing.The abstract also defines “verified” narrowly: the transaction was retrieved and names the addresses. It explicitly says that this does not establish authorization, ownership or even that a reported asset symbol identifies the intended asset. That label should not be read as independent confirmation of every narrative claim.Appendix A records an executed query from 15 September 2026 at 11:43:17.968656 UTC to 16 October 2026 at 11:43:17.968656 UTC. Of 51 retained movement rows, 44 lack readable timestamps. The seven timestamped rows span 22 September to 12 October; separately, the body supplies the incident timestamp. Query bounds are not proof of continuous transaction coverage or enforcement of a requested historical cutoff. The report also leaves KLN quantities and the impact on individual window holders unquantified. [6]The community takeawayThe useful conclusion is specific: SentinelTX reports a repaid 6.7 WETH loan, two hook payments totaling 2.309861111111111114 ETH, and a 1.279914429958618589 ETH surplus payment to the initiator in one transaction. The proposed manipulation mechanism needs decoding; the traced endpoint does not establish a later cash-out route.For community reporting, retain those boundaries. A stronger explanation would require the decoded hook calls and WindowOpened, WindowClosed and Taxed events identified by the report. Until then, the exact ETH ledger is more informative than a single dramatic “loss” number, and the unanswered questions belong alongside the findings.Figure 3. Reported movements, assessed mechanism, unresolved impact. No later cash-out route or real-world identity is established by this adaptation.Reference key and source notesSeed transaction: 0x7b131926e6f06491ae1aead3e419b208c8aa70ed7898e8c5a33d9f52e40915a9Initiator / reported tx.from: 0x8df735014eab81905e76b87ef0c069bd8e0ae382KolanHook: 0x0136fecf49e0217bfd2d9551e8e7b05f174ba8ecHelper: 0x4d6a41f2b80fe75facf27f9d0b3dc8bd0ebc835fOperation contract: 0xebea460c6496e1a2565aab488eb005473bde5f79Uniswap v4 Pool Manager: 0x000000000004444c5dc75cb358380d2e3de08a90Balancer-labelled lender: 0xba12222222228d8ba445958a75a0704d566bf2c8WETH: 0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2Adapted from SentinelTX report CASE-ASYNC95E, generated 16 Oct 2026; findings and limitations as of that report.Source sections: [1] §1 and §3B; [2] §3B and §3D; [3] §1 and §5; [4] §1, §3C, §7 and Appendix A; [5] §3A and source-figure captions; [6] Abstract, §3D and Appendix A.Explorer links are reader-navigation links constructed from the report's exact identifiers. Explorer content was not used as an additional factual source. This adaptation does not claim independent verification of the report's evidence signature.