Defend Against Cybercrime with the Power of Community

Two BNB Smart Chain transactions sit at the center of SentinelTX’s November 4 report on the Predict.fun incident: an 82,000 USDT drain on October 22 and a 5,700 USDT drain on October 27. Both were executed through the accounts’ normal user-operation machinery. Neither decoded transaction called a Predict.fun market or exchange contract.That pattern is consistent with misuse of an authorized signing credential. It does not, by itself, identify the signer or establish how a key was obtained. The report did not decode the signatures or validator modules. Its cross-chain account also has important limits: Ethereum bridge receipts remain unverified, one proposed onward path runs backward in time and is causally impossible, and a sanctions label asserted for a collector is unsupported.This article adapts SentinelTX report CASE-CB9FA6EF, dated November 4, 2026. It separates the transactions described in the report from wider public claims and retains the report’s material warnings. The confidential source PDF is not reproduced here.What the report coversPublic reporting summarized in the PDF describes two waves affecting 29 accounts, with 397,708 USDT taken and 166.8 ETH deposited into Tornado.Cash. SentinelTX used that reporting as a source of leads. The retrieved public article was incomplete, and those incident-wide figures are not the totals established by the two seed transactions examined here.The distinction matters because the report contains several different kinds of numbers: transfers out of smart accounts, later bridge deposits, ETH receipts, mixer deposits, and allocations assigned to particular tracing paths. Adding them together would recount funds or combine unlike assets.Measure: 87,700 USDT — Scope and limitation: The two seed drain quantities: 82,000 USDT and 5,700 USDT. Not a complete incident-loss figure.Measure: 397,708 USDT — Scope and limitation: Incident-wide amount reported by the public source, across 29 accounts.Measure: 42 ETH — Scope and limitation: The report’s itemized mixer-deposit headline: four 10 ETH legs and two 1 ETH legs. Not a validated attribution of all that ETH to the two BSC seeds.Measure: 166.8 ETH — Scope and limitation: Tornado.Cash amount reported by the public source.Measure: One further 1 ETH-pool leg — Scope and limitation: The chronology describes its gross amount as not itemized and displays a path-attributed share. The source’s differing presentations are retained in the limitations note.The investigation retained 36 movement rows, with readable timestamps from October 22 at 15:39:27 UTC through October 27 at 07:25:23 UTC. Its query windows extended from September 22 to November 4. A query window is broader than the transactions actually retained and does not establish complete coverage of every address.Two drains, five days apartFigure 1. The two seed transfers described in the report total 87,700 USDT. The bars compare the same asset and scope; they do not represent all affected accounts. Color key: Slate, October 22 seed; sage, October 27 seed. Address/role key: S1 and S2 identify the two victim smart accounts in the selected appendix. Source: SentinelTX, CASE-CB9FA6EF, pp. 3–6 and 15. The chronology marks the seed descriptions “unverified (auto-downgraded)”; the corresponding Path Routing Evidence rows are marked “verified.” See the source note.October 22: the larger seedAt 15:39:27 UTC, S1 transferred 82,000 USDT to a contract ending in de710. Thirteen seconds later, that contract sent 81,999.97 USDT to the BSC address labeled Relay.link in the report’s attribution database. A separate forwarding fee was also recorded.The Ethereum destination of that bridge leg was not resolved. The bridge explorer returned HTTP 429 on three attempts. The report therefore does not establish a completed Ethereum route for this 82,000 USDT seed, and it cannot be treated as an identified contribution to the later mixer deposits.Diagram 2. The common execution pattern and the report’s Wave-1 route, with its unresolved bridge boundary. The report did not decode the signer or validator. Color key: Slate groups the reported execution and BSC route. The amber-tinted box states the unresolved Ethereum boundary. Solid arrows show the report-described Wave-1 route, not independent verification; the dashed line is an unresolved boundary, not a confirmed transfer. Address/role key: Wave-1 smart account 0xd14ca6d1173a710706149a222b7e20324003a660; pass-through contract 0xeda13cffb9b1bb71b948c2b0132f04cf466de710; Relay.link BSC recipient 0x4cd00e387622c35bddb9b4c962c136462338bc31. ERC-4337 entry point 0x0000000071727de22e5e9d8baf0edac6f37da032. Source: SentinelTX, Investigation report CASE-CB9FA6EF, pp. 3–5 and 9, Executive Summary, Transaction Chronology and Transaction Typology. Wave-1 onward chronology is auto-downgraded; Ethereum destination unresolved after HTTP 429.October 27: a smaller seed and a shared pass-throughAt 06:01:44 UTC, S2 transferred 5,700 USDT to a different contract, ending in 82fba. That recipient made seven Relay deposits between 06:01:27 and 06:06:14 UTC. The executive summary presents their total as about 24,654.90 USDT; the fund-flow section records 24,654.894172 BSC-USD across seven transfers.Those seven deposits are activity of the recipient, not seven onward transfers that can all have been funded by S2. The first deposit, 2,544.97 USDT at 06:01:27, occurred before S2’s 5,700 USDT arrived at 06:01:44. The PDF explicitly flags a route that connects the later inflow to that earlier outflow as causally impossible. This is not an unresolved receipt that might eventually validate that ordering: the earlier transfer cannot be proceeds of the later one.The source identifies two bridge correlations involving this pass-through and collector C3 on Ethereum. It records 5,699.98424088292384761 USDT associated with 2.456393911612693978 ETH, and 4,844.988528623471693008 USDT associated with 2.088280124827178002 ETH. These are transaction-hash correlations, with Ethereum payout transactions not separately retrieved and receipts explicitly unverified. They should not be presented as verified cross-chain settlement.What the account operations showBoth BSC seeds were ERC-4337 bundle executions sent to the same entry point. The victim smart account was the sender of the user operation, and the decoded UserOperationEvent reported success. Each operation followed the same sequence: approve a USDT paymaster, pay its fee, then transfer USDT to the recipient contract.The paymaster fees were 0.185195505742016089 USDT for S1 and 0.174759053954175911 USDT for S2. The report says the approvals left near-unlimited allowances after the fees were taken. The same submitting address sent both bundles, while both pass-through contracts used the same forwarding-fee recipient.These similarities explain why the report favors a credential-misuse interpretation over an exploit of a Predict.fun contract. But tooling overlap is not proof of common control: the report expressly notes that public account-abstraction services can be shared. Its attribution database returned no label for the submitter or paymaster, and it established no value-bearing flow linking the two waves.Public claims about compromised API documentation and exported Privy keys supply a possible explanation for how credentials were obtained. SentinelTX did not verify that explanation. The careful conclusion is that the decoded behavior is consistent with an authorized-signer drain, while the signer’s identity and the route of key compromise remain unconfirmed.Ethereum deposits do not close every BSC linkThe Ethereum records show collectors receiving ETH and making fixed-denomination deposits into addresses labeled Tornado.Cash pools. They do not establish that every receipt came from the two BSC seeds.Collector C1 received three Relay.link payouts and deposited 10 ETH at 05:41:59 UTC on October 27. That mixer deposit preceded the 06:01:44 BSC seed by about 20 minutes. It cannot have been funded by that seed. The chronology says the BSC sources of C1’s funding payouts were not correlated, even though the executive narrative associates them with earlier Wave-2 drains.Collector C2 made two 10 ETH deposits at 05:53:59 and 05:54:35 UTC, then two 1 ETH deposits at 06:26:35 and 06:27:11. C1 also forwarded 0.277599 ETH, as displayed in the chronology, to C2 before those smaller deposits. C3 deposited a further 10 ETH at 06:07:11. Together, those six mixer legs make up the report’s 42 ETH itemized headline.C3’s own “Sanctioned” classification is unsupported: the report says no label lookup for that address was on record. That is distinct from the database labels returned for the 10 ETH and 1 ETH Tornado.Cash pool addresses. A pool’s service label does not identify the person controlling a depositor.No exchange-deposit leg was identified in the traces. The report also did not observe the LI.FI, Across or Railgun routes described by the public source. These are limits of the examined material, not proof that no other movement occurred.The conclusion and the remaining investigative workThe useful finding is specific: the report describes two smart-account drains using normal account-operation execution, followed by deposits to a Relay-labeled BSC address. The decoded seeds contain no Predict.fun contract call. Separately, it itemizes Ethereum mixer deposits, while leaving critical bridges between source funds and destination receipts incomplete.Figure 3. What the report supports, and where its conclusions stop. The USDT seed quantities and ETH mixer deposits have separate scopes and must not be added or treated as a completely attributed route. Source: SentinelTX, CASE-CB9FA6EF, pp. 3–4, 10–14 and 22.The report prioritizes obtaining Relay settlement and request records, preserving bundler and paymaster logs, and preserving key-export, documentation-server and authentication records. It recommends owner-key rotation for exposed accounts and revocation of the residual paymaster allowances. These are the report’s proposed responses, not actions completed in this article.Before freeze or KYC action, the report calls for closing the Wave-1 Ethereum route, itemizing C3’s other inbound transfers, resolving the additional mixer leg’s amount presentation, and examining the publicly claimed routes that were not observed. Its assessment of limited freezing prospects rests on the mixer deposits and absence of an identified custodial off-ramp in the traced set. Neither an operator identity nor a recovery outcome is established.Source and limitations noteThis is an adaptation of the actual SentinelTX-generated PDF, not an independent audit or a re-investigation. The source is classified confidential.The PDF contains the following material warnings, reproduced here with their original wording:Page 3: “INTEGRITY GATE — the integrity gate downgraded 9 claims in the text and flagged 1 finding for review. See the appendix at the end of this document for the full list.”Page 3, Label Evidence Gate: “The label claims below do not match the labels the tools actually returned in this session. The lookup result is the single source of truth and the narrative cannot exceed it. Re-verify before investigative use or external submission.”Page 3: “[unverified] 0x294dc89990f70ddb3067b0a8c917413a3e8d7c13 — narrative claim 'Sanctioned' / labels actually returned: none — the classification was asserted without any label lookup for the address on record — unverified assertion”Page 22: “[INV-5] (report-wide) — Hop 0 (block 130,037,922) → Hop 1 (block 130,037,883) is time-inverted — the later hop (funds out) settles in an EARLIER block than the hop that feeds it (funds in) → a causally impossible path (the cash-out tx precedes the deposit tx). Likely a destination's commingled total deposits counted as traced taint.”In plain terms, the C3 label is not supported, and the flagged Wave-2 route cannot establish that the later seed funded the earlier deposit. These warnings are not removed by successful report generation or the presence of a signed evidence manifest.The PDF also presents differing statuses and amount descriptions that this article does not silently reconcile. The chronology marks the two BSC seeds and the Ethereum seed “unverified (auto-downgraded),” while their corresponding Path Routing Evidence rows on page 15 say “verified.” Two bridge receipts remain unverified in the narrative. For chronology row 26, pages 7 and 11 describe the gross amount as not itemized and distinguish a 0.626278 ETH attributed share; page 19 separately prints a Transfer amount of 1.000000000000000000 ETH. The article retains the report’s 42 ETH headline rather than inventing a revised total.The source’s aggregate movement figures are not incident-loss figures. Its residuals are tracer-record calculations, not verified current balances. Retained transfers, a graph connection, shared service infrastructure or a label alone do not establish common control or incident attribution.Selected transaction and address appendixThe short IDs below are reading aids, not verification grades. The PDF provides full transaction hashes and addresses but no embedded public URLs. No explorer link or public-source URL has been reconstructed.Seed transactionsE1, October 22 BSC seed: 2026-10-22 15:39:27 UTC; block 129155430; 82,000 USDT. Hash: 0xe3ceb8ca8d391e33e6538f51ce8fbc4533ed08d38b07b2a4380bc22f072ecf0a. Source: pp. 3, 5 and 15; status distinction described above.E2, October 27 BSC seed: 2026-10-27 06:01:44 UTC; block 130037922; 5,700 USDT. Hash: 0x1dcc6393610d2158fa20fa436f7fbb6fd8f741b0580d627498d5673aebca9c72. Source: pp. 3, 6 and 15; status distinction described above.E3, Ethereum mixer seed: 2026-10-27 05:41:59 UTC; block 26282017; 10 ETH. Hash: 0x02f860b956253fe802fcd09d7dbb5c6bc55d9210977ee49098c96e3e556aad7b. Source: pp. 3, 5 and 15; status distinction described above.Address rolesS1, October 22 victim smart account: 0xd14ca6d1173a710706149a222b7e20324003a660.S2, October 27 victim smart account: 0xdd2be6e0d6db2212060ee3c691b13ff30777e79b.R1, October 22 recipient contract: 0xeda13cffb9b1bb71b948c2b0132f04cf466de710.R2, October 27 recipient contract: 0x8b001d7378dbc19c1c62e39c0fc9ffad84182fba.B, BSC address labeled Relay.link: 0x4cd00e387622c35bddb9b4c962c136462338bc31.E, ERC-4337 entry point: 0x0000000071727de22e5e9d8baf0edac6f37da032.P, USDT paymaster, no database label: 0x8b1f6cb5d062aa2ce8d581942bbb960420d875ba.Bundle submitter, no database label: 0x3cfdc212769c890907bce93d3d8c2c53de6a7a89.C1, Ethereum seed depositor: 0x3c9f6411cd1fbefaf33397145514ed2bf662eef9.C2, Ethereum collector: 0x85cd3ee47307bcaf9e1ada4230cc7646e603d429.C3, Ethereum collector with unsupported “Sanctioned” claim: 0x294dc89990f70ddb3067b0a8c917413a3e8d7c13.M10, database-labeled Tornado.Cash 10 ETH pool: 0x910cbd523d972eb0a6f4cae4618ad62622b39dbf.M1, database-labeled Tornado.Cash 1 ETH pool: 0x47ce0c6ed5b0ce3d3a51fdb1c52dc66a7c3c2936.Address-role sources: SentinelTX, CASE-CB9FA6EF, pp. 3–4, 9–11 and 25. The pool labels include “Mixer” and “Sanctioned”; these are reported database labels, not an independently updated legal-status assessment.

On 2 November 2026, assets from a source wallet reached an Ethereum address that Mercado Bitcoin later identified in its incident disclosure. Hours later, that recipient began sending ETH to other addresses. This investigation follows the difference between those two stages: assets arriving at an incident-linked address, and the same address distributing value onward. It also checks the exchange-disclosed Bitcoin recipient separately.The verified Ethereum route in this report is source wallet → disclosed recipient → selected subsequent recipients → two later common destinations. Three other candidate senders also paid the disclosed recipient during the afternoon. Their payments are verified; their exchange-deposit roles are not. The Bitcoin credits remain a separate record. No service request or settlement record examined here joins the Ethereum path to Bitcoin, so this report does not draw an Ethereum-to-Bitcoin arrow.Mercado Bitcoin is a cryptocurrency exchange. A hot wallet is an online wallet used in day-to-day operations; a deposit address is where a customer sends assets before the exchange accounts for or collects them. Those operational labels require evidence beyond a transfer. Here, “source wallet” identifies the sender in the reviewed records. Bitquery describes it as a Mercado Bitcoin hot wallet, but this article does not independently audit its ownership or the exchange’s signing systems.Role / chainFull addressSource wallet · Ethereum0x5cc7787778B4d20A947dcc53b41f593cFd27d548Exchange-disclosed recipient · Ethereum0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478Exchange-disclosed recipient · Bitcoin19qGpsHvzh1t6pVi526XNNkh6hW6prDZpThe exchange’s address disclosure provides the incident connection for the recipient addresses. A disclosed address identifies a monitoring target; it does not identify a person. ETH is Ethereum’s native asset. USDT and USDC are separate dollar-linked tokens, each with its own issuer and contract. Token transfers and ETH transfers must be counted in their respective units.ScopeBoundaryIncident date2 November 2026; all transaction times below are UTCSentinelTX requested window1 November 00:00–3 November 06:25 UTC; Ethereum inbound one hop and downstream two hopsActual research coverageSentinelTX source screen: 2 Nov 06:20–06:50 UTC, plus four exact Ethereum transaction reads. Independent review: selected source transfers, seed native outbound listing, two canonical-token logs and seven Bitcoin recipient outputsObservation cutoffSentinelTX chain tip 26332521 at 3 Nov 06:36:47 UTC; listed transactions are historical records, not current balancesNot reconstructedWhole-incident USD loss, all-chain holdings, complete deposit-address population, current recovery or customer account balances4 November follow-up scopeExisting SentinelTX case: requested 2 Nov 00:00–4 Nov 10:02 UTC; three bounded deposit-address candidates and one additional native-ETH hop from selected recipients. Four onward transaction details independently read in Etherscan. Requested endpoint is not a proof of balances or complete history.1. A small payment preceded the main ETH transferWhat arrived first? The source listing records a 0.0001 ETH payment to the disclosed recipient at 06:24:23. Twenty-four seconds later, at 06:24:47, the same source sent 2,852.067435264900027051 ETH. The larger transaction succeeded in block 26325283. Its full value, sender and recipient were checked in the public explorer as well as the indexed listing.The small-then-large order is observable. Calling the first payment a deliberate test would require evidence of intent that these transfers do not contain. Likewise, a successful signed payment establishes that the network accepted the transaction; it does not explain how the ability to authorize it was obtained.UTC · 2 NovNative ETHTransaction06:24:230.00010xe8959bb67a6c0b73730c8fd1df7d754ce122ebd190e63f069c50b9374d20fedb06:24:472852.0674352649000270510xf447ad5114dd01d78847799bf82b34f9b2ac04b97bbc5a81370eb753fa81ff682. The two stablecoin transfers are separate ledger entriesAt 06:26:11, the source called the USDT and USDC contracts. Each transaction had a native ETH value of zero, yet each recorded a token transfer to the disclosed recipient. A token contract maintains its own balances; the transaction’s ETH-value field is not the amount of the token moved.The USDT Transfer event records 2,990,643.178450 USDT. The USDC event records 2,236,100.704728 USDC. Both use six decimal places: the raw integer is divided by one million to obtain token units. The contract addresses, full hashes and log indices are preserved in Appendix A. These are selected incoming assets, not a complete inventory or an independently priced whole-incident loss.Asset / quantityRecorded eventUSDT · 2990643.178450Log 831 · 0x041caa2acecd6c7629d4406b18b4c794846ca9d244db14a9b8886cd477b7db75USDC · 2236100.704728Log 833 · 0x5caca820a2aaafb3e3dfaa8679d4dd2cdc8b3255797afa15ddceaeb15951a3b3The surrounding token history also contains zero-value entries and tokens using names that resemble familiar assets. This review identifies the canonical contracts rather than trusting a symbol such as “ETH” or “USDC.” A token named ETH is not native ether. Those entries are not included in the native-ETH totals below.3. The recipient later distributed native ETHThe next question is where the disclosed Ethereum recipient sent value. Its native outbound listing contains eight positive-value transactions on 2 November in the reviewed window. The first selected payment sent 2,800 ETH at 12:07:35. A later payment of 130 ETH reached the same recipient, giving that address 2,930 ETH across the two records. Other payments reached six additional addresses.Read Figure 1 from the exchange-disclosed recipient at the top. Each arrow represents native ETH leaving that address. The panels group payments by recipient, with three small recipients combined only for readability; Appendix B preserves every full address and hash. Line width and panel spacing do not represent quantity or elapsed time.Figure 1. Selected Ethereum native-asset outflows, 2 November UTC. Recipient A receives two payments; the final panel groups three different addresses. Source: preserved Blockscout outbound listing. This is a partial-flow diagram, not a reconciliation of all incoming assets.The eight payments total 3,652.5 ETH. This outgoing total and the single large source payment discussed earlier have different scopes. The later payments may draw on other inflows or a pre-existing balance; a complete funding reconciliation has not been established. This report has not allocated each later wei to a particular earlier source. Adding the outgoing 3,652.5 ETH to the incoming 2,852.067435264900027051 ETH would count movement at multiple stages as new loss. Neither figure is a current balance.A payment to another address proves a transfer relationship. It does not prove common ownership, a sale, a custodial exchange deposit or a withdrawal to fiat money. The next investigative question is the exact onward transaction or service record for each branch, rather than the shape of the distribution alone.4. Three incoming samples establish payments, not deposit ownershipWhat else supplied ETH to the disclosed recipient that afternoon? A bounded review of three distinct candidate senders found positive native-ETH payments at 13:03:59, 14:45:47 and 15:55:23 on 2 November. This sequence overlaps the distribution period in section 3; it is not a later, separate stage. All three payments reached the same disclosed recipient, and all three full transaction pages were independently checked.The candidates came from the existing SentinelTX follow-up, requested within 12:27–16:56 UTC. This is a deliberately small, non-random sample, not an audit of the reported deposit-address population. The available response does not independently establish that these are the earliest, median and latest addresses in the full population. Zero-value transfers and similarly named tokens do not enter these native-ETH amounts.Sample senderNative ETHUTC / full transactionS10xbd3f6f295801540c7D8Bab00E627a22a2eF1F18d41.01695752107622696Nov-02-2026 01:03:59 PM +UTC0xa1e7ed32ef639cddd89730b335eb9cd2f06a221e70677a0355e98d1baff27f15S20x87a4C87bA99747cE0f35FBF386fcF1426ad8602817.396502930061045792Nov-02-2026 02:45:47 PM +UTC0xe10b80b89b4c691c0d0b8a99cabcfdddc0adeeacabb8ecf3e6faf9fef611679aS30x3f2A78AABb39206605ecbfBf564056aC555EbA7810.588801052593577056Nov-02-2026 03:55:23 PM +UTC0x4219f0419dd1afef5cd1cf90a0823dbf4eabaaa952e43eb7be5460df3567b945Together, the three checked payments total 69.002261503730849808 ETH. They show that the recipient had additional incoming transfers beyond the initial source-wallet payment. They do not reconcile its opening balance, all other assets or every outgoing wei. In particular, this small sample does not explain the entire 800.432564735099972949 ETH arithmetic difference between the earlier large source payment and the eight selected outflows.The preceding transactions change the interpretation. Each candidate received ETH through an internal transfer, meaning a value movement made during contract execution rather than a separate externally signed transaction. Etherscan labels the paying contract for S1 and S2 “Mayan: Fast MCTP,” and the paying contract for S3 “Mayan: Swift v2 Destination.” These are explorer service labels, not proof that the service controlled the recipient addresses or participated in the incident.Service payout → sampleETH / time to forwardingTransaction / UTCMayan: Fast MCTP0xC1062b7C5Dc8E4b1Df9F200fe360cDc0eD6e7741 → 0xbd3f6f295801540c7D8Bab00E627a22a2eF1F18d41.01696241581162496 ETH12 seconds0x3ce56c82d53684ee390da69c89f990a6606989b64034d8001b7902393e7df0912026-11-02 13:03:47 UTCBlock 26327274Mayan: Fast MCTP0xC1062b7C5Dc8E4b1Df9F200fe360cDc0eD6e7741 → 0x87a4C87bA99747cE0f35FBF386fcF1426ad8602817.396514662772259792 ETH24 seconds0xf682389b677e4d3bbf3bce464fb980200d6c0afc29a18e180b5e90c8b607072c2026-11-02 14:45:23 UTCBlock 26327778Mayan: Swift v2 Destination0xD78D199f8C402e7B5Cc2abE278dF0412400a3BAe → 0x3f2A78AABb39206605ecbfBf564056aC555EbA7810.588812003685421056 ETH12 seconds0x83f3133c8f458e96912566303a650a12a4afd6dee341a5bf05e459e642ae94542026-11-02 15:55:11 UTCBlock 26328125S1 received its payout at 13:03:47 and forwarded ETH 12 seconds later; S2 followed after 24 seconds; S3 followed after 12 seconds. The incoming amounts are slightly larger than the outgoing amounts. Those quantities must not be called identical: transaction fees and any residual amount require their own accounting. These are checked Ethereum-side service payouts, not independently traced source-chain deposits. An explorer summary referring to a source chain does not replace the original source transaction or a cross-chain settlement identifier.Read Figure 2 from the service panel through the grouped sample addresses to the disclosed recipient. The first arrow summarizes three contract payouts; the second summarizes three later signed ETH payments. Neither arrow is a transfer between sample senders, and neither proves shared ownership. The displayed sample quantities are the forwarded amounts, not the slightly larger service payouts. The next question is whether a source-chain record can bind each payout to its original deposit.Figure 2. Three Ethereum-side service-payout and forwarding samples, 2 November UTC. Service names follow Etherscan labels. Appendix D preserves full identifiers and exact values. Arrows summarize checked payments, not ownership or a completed cross-chain attribution.The independent outbound listings displayed one outgoing transaction for each candidate: the payment to the disclosed recipient. SentinelTX reported no pre-2-November payment to an independently established exchange hot wallet in its 140-day lookup. This review did not establish such a historical link either; activity outside that lookup remains untested. The samples support a short service-payout-and-forward sequence, while the exchange-deposit role remains unconfirmed. They cannot substantiate a claim that longstanding exchange deposit keys were stolen.5. The large ETH branches later met at two destinationsDid the initial distribution remain separate? Four later transaction details answer part of that question. Recipient A sent 29 ETH and then 2,900 ETH to recipient D late on 2 November. After midnight, recipients C and B sent 199.9999 ETH and 469.999 ETH to a second common destination, E. These are direct native-ETH payments, not evidence of a sale or conversion.RouteNative ETHUTC and transaction0x8419e7824e785C4Ac8D9d94A0093C437AB1FF320 → 0x59A919e8D0582Ce62c8De9431b3Ebc6FA121731e29Nov-02-2026 11:26:47 PM +UTCBlock 263303740x861026562466fd690f0ecc66b42b9221bd685fd7ea8fe990304d7e4ae1e847bd0x8419e7824e785C4Ac8D9d94A0093C437AB1FF320 → 0x59A919e8D0582Ce62c8De9431b3Ebc6FA121731e2900Nov-02-2026 11:28:11 PM +UTCBlock 263303810x4339321627174d1f9b734eb1bc2f4e1da8930dc43a52f0c06a62241cc402bf3d0xCeDFEd1392d75aEC08D630be787399E916791279 → 0x071F8366375fdd21423bb23AE19e4b91f03F9270199.9999Nov-03-2026 12:41:59 AM +UTCBlock 263307500x9e0d0a018329fe6a80a1084494238b83c0dd102631b3bb6a9f290a6b713bc2e20x7d40eE879A3A76384C10185C33D515296519E693 → 0x071F8366375fdd21423bb23AE19e4b91f03F9270469.999Nov-03-2026 12:42:59 AM +UTCBlock 263307550x805666108e19f4a37adb91e489c399e26810e1ccc0a28aa43cd1887d9ae35e53The exact transaction pages matter here: list views round the two smaller payments. The four newly checked legs total 3,598.9989 ETH. Adding the already documented 50 ETH payment from the disclosed recipient to D gives 3,648.9989 ETH across five selected destination credits: 2,979 ETH to D and 669.9989 ETH to E. This is a historical credit sum, not a balance at the research cutoff. It is not added to the earlier outflows as another loss.Read Figure 3 downward, following the arrows from A, B and C to their later recipients. Solid arrows mean the linked transactions were checked; the 50 ETH annotation identifies the earlier direct payment already preserved in Appendix B. The grouped totals describe those selected arrivals only. The next question is what the destinations did afterward, which this one-hop review does not establish.Figure 3. Selected native-ETH regrouping, 2–3 November UTC. Address labels are shortened only in the diagram; the native table above and Appendix E preserve complete addresses and hashes. Arrows show payments, not shared control; totals exclude fees and do not represent current holdings.Two independent branches sharing a destination establishes a common counterparty in those transactions. It does not identify who controls the addresses. No exchange-service attribution, cash-out, Bitcoin conversion or key-compromise mechanism is inferred. The destination set here comes from the checked transactions; an address appearing elsewhere in a third-party registry is not substituted into this route.6. Bitcoin: outputs are the unit of evidenceThe Bitcoin review starts again with the separately disclosed Bitcoin address. A Bitcoin transaction can pay multiple outputs, including change back to the sender. The amount relevant to this recipient is its specific output, identified by a transaction ID and output index, rather than the transaction’s total input value.The public address endpoint returned seven confirmed transactions with an output to the disclosed recipient. Those seven outputs total 10,606,780,001 satoshis, or 106.06780001 BTC. A satoshi is one hundred-millionth of a bitcoin. The largest single recipient output is 104.42787649 BTC at index 0 of transaction ada3bb…c5fcf9, confirmed in block 974223 at 06:41:47 UTC. The full record is preserved in Appendix C.Read Figure 4 as a recipient-output summary, separate from Figure 1. Its panels compare one large output with the remaining six. There is deliberately no connecting arrow from Ethereum: the two addresses were disclosed in the same incident, but that fact alone does not establish a cross-chain conversion between them.Figure 4. Seven returned recipient outputs, confirmed from 05:42:34 to 06:49:19 UTC on 2 November. Source: saved public Bitcoin transaction records. The total is a scoped sum of credits, not a proof of source ownership, current balance or incident-wide loss.Several outputs are small. This review does not assign a purpose to those payments or assume every sender belongs to the exchange. The exact output sum is reproducible; the attribution of every input and any later spending require separate evidence. No Bitcoin downstream trace is claimed here.7. Blocking assets and returning assets answer different questionsIn its latest reviewed numerical update, Mercado Bitcoin said approximately $38 million in assets were involved and $11 million had been blocked with partners. Its companion statement assured customers they would not suffer asset losses. These are the exchange’s statements, read directly in the original public thread; they are not totals reconstructed by this report.An issuer can restrict transfers of certain tokens under its contract rules. Such a restriction is different from sending assets back to the exchange, crediting customer accounts or completing a legal recovery. This report does not independently reproduce the exchange’s $11 million figure or the internal accounting behind its customer assurance. It also does not reconcile differing outside dollar estimates, whose pricing and coverage boundaries may differ.The existing SentinelTX case was reused for this follow-up. Its completed result corroborated the B and C onward transactions with full hashes and raw wei; A’s later payments remained trace-level records in that result. The original source transfer and 2,800 ETH payment were re-anchored there, while some other records remained partial or conflicted with lookalike-address activity. The new public tables use independently read Etherscan details for all four onward payments, all three sample payments and their three preceding service payouts. Unresolved duplicate or fake-token rows are excluded. Independent checks do not retroactively change a platform’s confidence label. Issuer restrictions, cash-out and Ethereum-to-Bitcoin conversion remain unestablished.8. Findings, limits and the records needed nextThree bounded findings emerge. First, three candidate senders received Ethereum-side service payouts and forwarded ETH to the disclosed recipient 12–24 seconds later; their exchange-deposit ownership remains unconfirmed. Second, four later native-ETH payments show selected branches converging on two destinations, with no additional loss inferred from movement through another hop. Third, precise stablecoin logs and the separate Bitcoin recipient outputs remain reproducible without inventing an Ethereum-to-Bitcoin connection.The initial intrusion mechanism remains unknown. Private-key extraction, access to a signing service and other authorization failures can produce signed transactions, but the selected records do not choose between those explanations. No claim is made about an attacker’s identity, shared ownership of downstream addresses, customer reimbursement, cash-out or the full ten-chain loss.The new onward records narrow the Ethereum branches to two shared destinations, but do not complete their later history. The useful next evidence is a destination payment or service request that binds an input to a specific output. Reported issuer restrictions still require a contract event and a status observation at a stated cutoff; customer restoration requires separate exchange accounting. One successful transfer cannot answer all of these questions.Appendix A. Initial Ethereum evidenceAssetValue / unitFull recordETH2852.067435264900027051 ETH source wallet→official disclosed EVM recipient0xf447ad5114dd01d78847799bf82b34f9b2ac04b97bbc5a81370eb753fa81ff68Block 26325283 · 2026-11-02T06:24:47ZUSDT2990643.178450Raw 2990643178450; decimals 60x041caa2acecd6c7629d4406b18b4c794846ca9d244db14a9b8886cd477b7db75Log 831 · 2026-11-02T06:26:11ZToken contract 0xdac17f958d2ee523a2206206994597c13d831ec7USDC2236100.704728Raw 2236100704728; decimals 60x5caca820a2aaafb3e3dfaa8679d4dd2cdc8b3255797afa15ddceaeb15951a3b3Log 833 · 2026-11-02T06:26:11ZToken contract 0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48Appendix B. Selected native ETH outflowsUTC · 2 NovETHRecipient / transaction12:07:35 UTCBlock 263269942800Recipient A0x8419e7824e785C4Ac8D9d94A0093C437AB1FF3200x49713cbd0582544cecbe1229336cee0d85be4dd57750df80d95881300d73dac713:16:11 UTCBlock 263273361Smaller recipient0x3CE76d2D27Cc80e44C7D9532423633C7F940C7790x32c6f3d535395ec061b9a5d614e2c63d2b846329301af1ea37a3b5fb92784f4413:20:11 UTCBlock 26327356200Recipient C0xCeDFEd1392d75aEC08D630be787399E9167912790x1c7d152865a0dc6f784eb5f4580194ff5013e4888144480e904b02294df6184214:42:59 UTCBlock 26327766470Recipient B0x7d40eE879A3A76384C10185C33D515296519E6930x58d655c7710f641b15b98a341341e931cfc4d0a91b6fe2d761920f26da7f467c15:17:59 UTCBlock 263279400.5Smaller recipient0xc19f9F80f26e2849c992f43b7D8F9dCAdf1228C10x765a2831830e2a42d3c1a80b89de28cdcc998afec34e0081168a04344995708c15:28:35 UTCBlock 263279931Smaller recipient0xA1319B092CE56A31b5E0F77F5dF2ABa3B34f33520x7f4d0d10a1eca59cdb900135086bc4d610e55f4a55c6a90de1fcb437bb5e965115:39:47 UTCBlock 26328049130Recipient A0x8419e7824e785C4Ac8D9d94A0093C437AB1FF3200x7c02cbb240066f58db7cb78afb51b7f2c2d9a20db70d12c3f922937d6804a6de23:21:59 UTCBlock 2633035050Recipient D0x59A919e8D0582Ce62c8De9431b3Ebc6FA121731e0xc173147b4dd60f52171377df4cf53ec530e3692ad4a9e18de298a15c74f4bc32Every row has the exchange-disclosed Ethereum recipient as its sender. Quantities exclude transaction fees. Native ETH value is read from the transaction listing; similarly named tokens are excluded. The eight-row sum is 3,652.5 ETH.Appendix C. Bitcoin recipient outputsConfirmed UTCRecipient valueTransaction / output05:42:34 UTCBlock 97421672720 sat0.0007272 BTC85d08d7f5c0165a92caabd7a4c9277b3b971dd9e72740f8223fb235a519b1cb2Output 005:42:34 UTCBlock 97421636861187 sat0.36861187 BTCafda480aa8376a073b173d32e4cdb61ffa60076063ff094c62782a35f6e777a7Output 006:19:20 UTCBlock 97422010000 sat0.0001 BTC643b3ad9b3615932109e2256b9cb2a0d1daa636b0250155aba36fe257340bc75Output 006:19:20 UTCBlock 974220126952011 sat1.26952011 BTCaa9bc710f06286911921acf778e0010ed98b3e5032abe553470b9e09e9e96239Output 006:41:47 UTCBlock 97422310000 sat0.0001 BTC7f65ae37cb4f1e7ddbac62ec85f68b64088fd1f2a340fbcf8e81635e79923eccOutput 006:41:47 UTCBlock 97422310442787649 sat104.42787649 BTCada3bb2304be5de8dd7e67bf9be8c765c5f020a34508bd248f345a1205c5fcf9Output 006:49:19 UTCBlock 97422486434 sat0.00086434 BTC44432ef89446564176204bfac68501ffc68d5f7703278d686da5af847931a722Output 0All seven selected outputs pay 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp. The saved response contains seven returned transaction records; no completeness claim is made about all incident sources or later activity.Appendix D. Incoming sample evidenceEvery selected payment below reaches 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478. Exact wei values are decimal conversions of the independently displayed ETH values, not a separate raw-RPC replay. Sender ownership and historical exchange-deposit roles remain unconfirmed.Sample and senderTransaction / UTC / blockExact native valueS10xbd3f6f295801540c7D8Bab00E627a22a2eF1F18d0xa1e7ed32ef639cddd89730b335eb9cd2f06a221e70677a0355e98d1baff27f15Nov-02-2026 01:03:59 PM +UTCBlock 2632727541.01695752107622696 ETH41016957521076226960 weiS20x87a4C87bA99747cE0f35FBF386fcF1426ad860280xe10b80b89b4c691c0d0b8a99cabcfdddc0adeeacabb8ecf3e6faf9fef611679aNov-02-2026 02:45:47 PM +UTCBlock 2632778017.396502930061045792 ETH17396502930061045792 weiS30x3f2A78AABb39206605ecbfBf564056aC555EbA780x4219f0419dd1afef5cd1cf90a0823dbf4eabaaa952e43eb7be5460df3567b945Nov-02-2026 03:55:23 PM +UTCBlock 2632812610.588801052593577056 ETH10588801052593577056 weiThe preceding payouts are contract-internal ETH movements within the linked transactions. The top-level ETH-value field can be zero while the contract pays ETH internally. Quantities below refer to the specific payment to the sampled address, not all internal movements in the transaction.Payout transactionExact native valueRecipient / block0x3ce56c82d53684ee390da69c89f990a6606989b64034d8001b7902393e7df0912026-11-02 13:03:47 UTC41.01696241581162496 ETH41016962415811624960 wei0xbd3f6f295801540c7D8Bab00E627a22a2eF1F18dBlock 263272740xf682389b677e4d3bbf3bce464fb980200d6c0afc29a18e180b5e90c8b607072c2026-11-02 14:45:23 UTC17.396514662772259792 ETH17396514662772259792 wei0x87a4C87bA99747cE0f35FBF386fcF1426ad86028Block 263277780x83f3133c8f458e96912566303a650a12a4afd6dee341a5bf05e459e642ae94542026-11-02 15:55:11 UTC10.588812003685421056 ETH10588812003685421056 wei0x3f2A78AABb39206605ecbfBf564056aC555EbA78Block 26328125Appendix E. Exact onward ETH evidenceNative ETH has 18 decimal places. The wei figures below are exact decimal conversions of the displayed transaction values, not a separate raw-RPC replay. Each full hash opens the independently read Etherscan detail page; the same hashes and quantities are compared with the existing SentinelTX continuation.TransactionValue and blockUTC0x861026562466fd690f0ecc66b42b9221bd685fd7ea8fe990304d7e4ae1e847bd0x8419e7824e785C4Ac8D9d94A0093C437AB1FF320 → 0x59A919e8D0582Ce62c8De9431b3Ebc6FA121731e29 ETH29000000000000000000 weiBlock 26330374Nov-02-2026 11:26:47 PM +UTC0x4339321627174d1f9b734eb1bc2f4e1da8930dc43a52f0c06a62241cc402bf3d0x8419e7824e785C4Ac8D9d94A0093C437AB1FF320 → 0x59A919e8D0582Ce62c8De9431b3Ebc6FA121731e2900 ETH2900000000000000000000 weiBlock 26330381Nov-02-2026 11:28:11 PM +UTC0x9e0d0a018329fe6a80a1084494238b83c0dd102631b3bb6a9f290a6b713bc2e20xCeDFEd1392d75aEC08D630be787399E916791279 → 0x071F8366375fdd21423bb23AE19e4b91f03F9270199.9999 ETH199999900000000000000 weiBlock 26330750Nov-03-2026 12:41:59 AM +UTC0x805666108e19f4a37adb91e489c399e26810e1ccc0a28aa43cd1887d9ae35e530x7d40eE879A3A76384C10185C33D515296519E693 → 0x071F8366375fdd21423bb23AE19e4b91f03F9270469.999 ETH469999000000000000000 weiBlock 26330755Nov-03-2026 12:42:59 AM +UTCSources and verification boundariesDirect checks use the linked public Ethereum explorer, preserved Blockscout transaction and decoded-log responses, and public Bitcoin transaction responses. The exchange disclosure identifies the recipient addresses. Bitquery’s investigation supplied the source-wallet lead, whose operational attribution remains external. No outside headline total is adopted as a reconstructed loss. SentinelTX’s retained findings and their independent corroboration are distinguished in the body.

A collector contract, one transaction-submitting account and three recurring recipients form the clearest BNB Smart Chain pattern in SentinelTX’s November 2 report on a reported DNS-hijack campaign. Three observed splits followed incoming transfers by five seconds at the recorded block timestamps. Each used the same recipients and approximately the same 55/30/15 proportions.That pattern is narrower than the whole incident. It does not identify the people behind the addresses, establish how the DNS change happened, or prove that all reported losses passed through this collector. Some incoming amounts also carry explicit verification warnings in the source report. This article keeps those qualifications alongside the findings rather than treating a detailed transaction diagram as a complete account of the attack.What this report coversThe source of this article is SentinelTX’s platform-generated report CASE-7766DAE6, dated November 2, 2026. Its analytic focus is BNB Smart Chain, chain ID 56, from October 31 at 00:00 to November 2 at 00:00 UTC. The executed query was broader: October 1, 2026, 00:24:30.552075 UTC through November 2, 2026, 00:24:30.552075 UTC. Those are different boundaries, not interchangeable descriptions of a single 48-hour search.The report’s discovery source, a Bitquery investigation dated October 31, describes 12 DeFi websites registered through Name.com resolving to attacker-run copies containing a wallet drainer. It attributes a Step Drainer connection to Blockaid and reports $202,386 across 32 wallets on six chains, including $2,386 across seven BNB Chain wallets. These are attributed incident-wide claims reproduced in the PDF, not totals independently reconstructed by this BSC investigation. SentinelTX states that only the first 12,000 characters of that discovery page were reviewed.The cause of the DNS change and the registrar’s role are not established by the chain evidence. The report makes no finding of registrar culpability. Likewise, the claimed drainer-family attribution is not an identity finding from the transactions below.Source note: SentinelTX PDF, pages 4, 11–15 and 21. All transaction times in this article are UTC. The BSC subset must not be extrapolated into a six-chain loss estimate.Follow the roles, not presumed identitiesC1 is the Safe-type collector contract. X1 is the externally owned account that submitted every observed split. P1, P2 and P3 are recurring recipient addresses. S1 identifies the sender of the incoming transfer immediately preceding the example split.The report records Safe-style execution calls and an ExecutionSuccess event for the seed transaction. That supports the execution relationship. It does not establish that X1 is a Safe owner: the owner set, signing threshold and modules were not read. All attribution lookups returned no label, which means no label was returned—not that attribution is impossible or that the addresses belong to one operator.Figure 1. The observed BSC roles: S1 sends to C1; C1 distributes to P1, P2 and P3; X1 submits the execution call. The call relationship is distinct from a value-transfer relationship. Source: SentinelTX PDF, pages 7–10. Address ownership and Safe control remain unknown.The five-second splitThe example begins at 01:40:21 on October 31. The PDF records an incoming transfer from S1 to C1 of 0.483268458106 BNB, but explicitly flags that incoming amount as unverified in its narrative and conclusion. At 01:40:26, seed transaction T1 records three outgoing legs:Recipient: P1 — approximately 55% — Recorded outgoing amount: 0.2657976519583 BNBRecipient: P2 — approximately 30% — Recorded outgoing amount: 0.1449805374318 BNBRecipient: P3 — approximately 15% — Recorded outgoing amount: 0.0724902687159 BNBThe three outgoing amounts total 0.483268458106 BNB. Presenting those recorded legs does not remove the source’s separate warning about the incoming transfer. Nor is this one transaction’s total a whole-incident loss figure.Figure 2. Three recorded outgoing legs in seed transaction T1, shown in BNB from a zero baseline. Total: 0.483268458106 BNB; proportions approximately 55/30/15. Source: SentinelTX PDF, pages 5–6, 9–10 and 17. These are transaction amounts, not recipient balances; the preceding incoming amount retains its verification warning.Two other inflow-to-split pairs show the same five-second spacing: 01:00:55 to 01:01:00, and 01:42:38 to 01:42:43. The same X1 account submitted all three splits to the same three recipients. This repeated execution pattern is the basis for the report’s revenue-sharing interpretation. The allocation of specific business roles—such as kit operator, affiliate or infrastructure provider—is an assessment, not an observed identification of three people.The largest reported inflow did not splitThe collector summary lists four incoming transfers totaling 3.09671583071052685 BNB and nine outgoing legs across three split transactions totaling 0.828208994212836824 BNB. Their reported difference is 2.268506836497690026 BNB. These are the PDF’s reconciliation figures; its warnings on underlying incoming amounts still apply.That difference matches the collector balance recorded at block 131144415, on November 2 at 00:24:09 UTC. This balance observation is later than the stated analytic cutoff. It must not be presented as a continuously monitored or current balance.The corresponding 2.268506836497690026 BNB inflow, associated with block 130768877 at 01:26:51 on October 31, is explicitly classified as needing corroboration. It is also the largest reported collector inflow and the one not forwarded in the observed splits. The PDF therefore qualifies the discovery source’s broad claim that almost every drain followed the same split: that description does not capture this largest BSC transfer.The source offers possible explanations, including execution failure, a deliberate hold or an attempted transaction that reverted. It does not choose between them. An earlier zero-value executor call at 01:16:29 was not decoded. The missing explanation remains a lead, not a finding that can be filled in from the later balance match.Receipts are not balancesThe payout-wallet figures cover gross receipts in the 32-day lookback. They include more than the three collector payments and should not be used as a current asset inventory.Recipient: P1 — Gross receipts reported in the lookback: 0.551359380509872312 BNB across 4 receipts; gross sent: 0 BNBRecipient: P2 — Gross receipts reported in the lookback: 0.300741480278112169 BNB across 4 receipts; gross sent: 0 BNBRecipient: P3 — Gross receipts reported in the lookback: 0.170375356553192358 BNB across 6 receipts; gross sent: 0 BNBThe report says that one additional receipt to P1, one to P2 and three to P3 were not itemized. It considers a direct-to-payout route possible, but the missing senders and transaction detail prevent confirmation. P3 also has history from September 23, before the reported incident. Earlier activity cannot simply be relabeled as proceeds of this campaign.There is an important source contradiction here. The PDF’s recovery discussion describes approximately 1.0225 BNB in gross receipts as sitting across the payout wallets, while its limitations explicitly say their current balances were not read. The latter qualification prevents treating that receipt total as an established present balance or recoverable amount. No exchange deposit, bridge or DEX endpoint was identified in the examined evidence; that is a scoped absence of observation, not proof that later or cross-chain exits did not occur.Signed transfers and reported deceptionThe four collector inflows are described as plain native-BNB transfers signed by their sending wallets. The retained BSC rows do not show an approve, permit or transferFrom pull. This distinction matters: the visible movement is not presented as a token allowance being exercised by a third party.A signature establishes the transaction-signing relationship, not whether the person understood the action shown by the interface. The DNS-hijacked-front-end explanation remains a reported allegation in the source. The presence of a valid signature neither establishes nor disproves that deception.The report also excludes suspected unsolicited token distributions from its economic interpretation, including 3.0 units of an unidentified-symbol token and 5.0 TeslaSI. Their units are not BNB and must not be added to BNB totals. Their liquidity was not checked. Shared spam counterparties between addresses are not evidence of common control.Where the evidence stopsThe PDF contains both structured rows labeled verified and narrative warnings that some retained incoming quantities cannot be confirmed. It also gives some blocks, hashes and precise amounts in its chronology or tables while its limitations say those details were not recorded or were available only at displayed precision. These are internal differences in the source, not discrepancies resolved by this article. In particular, a structured “verified” label does not justify silently upgrading an amount the report’s conclusion leaves unverified.The coverage appendix records 19 retained movement rows spanning October 31, 01:00:55 to 01:51:45 UTC. It does not establish enforcement of the requested historical cutoff. The collector’s internal-call history is incomplete, and 12 of 22 transaction-list entries were reviewed. The query interval, retained-row interval and later balance observation therefore answer different questions.The PDF’s optimistic recovery assessment is professional opinion, not a recovery guarantee. With no identified custodial endpoint and payout balances unread, this record does not establish an immediately available freeze target. No recovery, freeze or contact with an exchange is reported as completed.Conclusion: a repeatable pattern, not a complete attributionThe strongest story is a bounded one: a Safe-type collector distributed three observed transfers to the same recipients, using the same submitting account and repeated five-second timing. The largest reported inflow did not follow that path. Address ownership, the DNS change’s cause and subsequent destinations remain unresolved.The report’s priority leads are the Safe’s owner configuration and creation trail, X1’s funding, the unitemized payout receipts and the undecoded executor call. These are proposed investigative steps, not work represented as already performed. The case illustrates why transaction structure, attribution and recoverability must remain separate even when a distribution pattern is visually clear.Figure 3. Conclusion and evidence boundaries. Recorded: three splits, one submitting account and recurring recipients. Not established: address ownership, the DNS change’s cause or final destinations. Some incoming amounts remain unverified, and payout balances were not read. Source: SentinelTX PDF, pages 13–15, 21–22.Reference keysThe following identifiers are transcribed from the source PDF. Role labels are local reading aids, not identity claims.Address key — C1, collector: 0x24497068ca4166ca32a04ae530ce00cf79755bd5. X1, submitting account: 0x33dfc810365193bff54326812d7df34b3e438da3. S1, example sender: 0x4fa1daf1e03759e802452f5543171fa19c0209d7.Recipient key — P1: 0x012f89ff307568f8409bbe379ca92ed41bc4d386. P2: 0x7bf2037264efbff55bd52777772779c1d9e87695. P3: 0x5aff449b63c033df386af0c45384cd20c5918dbf.Transaction key — T1, seed split: 0x39b36904796f53ca801bbd393ba09b1169fe3b87462719a177efde2e30967379. Preceding incoming transfer: 0x911b11cd01af297d62933632d5d59e5adc84e5f88e4b2668ef4d989b8c16c151. Other observed splits: 0xad1e8a632c5ad86b49b571384fb02e529da73e8617112a87907b0cf4271e29b6 and 0x96db9345ea17d232ee659eb55debb75c11e723e0f92dea726e293cef5d7ad86e.Source note: Adapted from the actual SentinelTX platform-generated PDF, CASE-7766DAE6, November 2, 2026, 25 pages. References to external reporting are attributed as they appear in that PDF. No public download URL for the PDF is asserted.