Defend Against Cybercrime with the Power of Community

ChainBounty · Report analysis · CASE-01D70140Ethereum mainnet · Recorded activity: October 19–20, 2026 · Based on the SentinelTX report issued October 20, 2026A SentinelTX investigation records a 50,655.918487 USDC receipt by a candidate externally owned account, followed by conversion to approximately 20.597338 ETH and onward transfers through a wallet with mixed-source funding. Its call-tree analysis assesses that two transactions made legacy smart-wallet contracts execute repeatedly against a MARK/WETH pool. The report calls the contracts “Argent-style”; it does not establish that they are the official Argent product.The distinction between recorded transfers and interpretation matters here. The source flags two routes that run backward in time and therefore cannot trace proceeds. Its separate October 20 transfer sequence reaches a Tornado.Cash Router address, but commingling prevents an exact allocation to this incident. No exchange deposit or corresponding mixer withdrawal is established.Key findingsThe candidate EOA received 50,655.918487 USDC on October 19 and converted it in a later transaction. The PDF’s exact ETH transfer amount is 20.597337757434388495; its narrative rounds that to 20.597338 ETH.The two seed call trees show 19 and nine inner executions. The signed-call replay mechanism is an assessment, while a recovery-deadline overflow, an owner change, and official product identity remain unestablished.On October 20, the EOA sent 20.68 ETH to a consolidation wallet. That wallet also had other inflows, then sent 5.05 ETH onward. Five 1.0 ETH transfers subsequently reached the Router; those overlapping stages are not separate losses.Report scope and limitsThis article adapts Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, a 46-page SentinelTX PDF issued on October 20, 2026. It follows the report’s records, assessments, and qualifications rather than presenting an independent on-chain investigation. “Candidate EOA,” “consolidation wallet,” and “staging wallet” describe transaction roles; they do not identify people or establish common ownership.The narrative specifies an incident window of October 18, 2026, 00:00 UTC, to October 20, 2026, 13:15 UTC. The executed queries were broader: two 32-day windows from September 18 to October 20. The 145 retained movement rows with readable timestamps span October 19 at 09:31:23 UTC to October 20 at 11:46:35 UTC; another 57 retained rows have no readable timestamp. A query interval is not the evidenced transaction span, and gaps between queries are not coverage. The PDF expressly says these records do not establish that the requested historical window or block cutoff was enforced. The three-hop maximum and latest block 26,233,589 describe cited routing rows, not complete investigation coverage.The source’s two time-order warnings concern routes joining the conversion at block 26,225,830 to seed activity at earlier blocks 26,225,798 and 26,225,803. A later receipt cannot fund an earlier transfer. Those joins are excluded from this article’s proceeds claims and diagrams. This does not erase the separately listed transactions, but it prevents treating the backward joins as a valid continuous money trail. The exact warnings appear in the source note.From funding to the USDC receiptAt 09:31:23 UTC on October 19, the candidate EOA, 0xc10609…872b02, received 0.09761 ETH from an address the report labels as the Tornado.Cash 0.1 ETH pool. SentinelTX assesses that the amount is consistent with a withdrawal net of a relayer fee. This is pre-incident funding provenance, not a destination of the incident’s proceeds, and it does not identify the original funder.The report’s control-transaction record then lists six successful submissions, with nonces zero through five:09:35:35 UTC, block 26,225,763: creation of 0x3c5884…3fb310. Contract code was observed; creation alone does not establish ownership or control.09:42:35 UTC, block 26,225,798: Seed 1 called the created contract with selector 0xc59705f3. It was not reverted; the trace contained 742 frames and reached depth 11.09:43:35 UTC, block 26,225,803: Seed 2 called the same contract with selector 0x522bffbe. It was not reverted; the trace contained 458 frames and reached depth 12.09:44:35 UTC, block 26,225,808: the created contract sent 50,655.918487 USDC to the candidate EOA.09:48:47 UTC, block 26,225,829: the EOA submitted a USDC approval call.09:48:59 UTC, block 26,225,830: the EOA sent 50,655.918487 USDC into the Uniswap V2 route and received 20.597337757434388495 ETH, approximately 20.597338 ETH.The USDC receipt and conversion are two stages involving the same token amount, not two amounts to add. The ETH output is a different asset and is not added to the USDC quantity. SlowMist’s approximately US$59,800 estimate appears only as a source-reported figure from its public incident-index snippet. SentinelTX does not reconcile that estimate with the retained USDC proceeds, and this article does not treat it as a recomputed loss.At 10:07:35 UTC, the EOA also received an unsolicited 1,000,000 PVC. The report records the transfer but sets it aside as non-economic because it was unvalued and no onward movement was observed. It is not included in the proceeds narrative.What the two call trees showIn Seed 1, the created contract made wallet-control-shaped calls through proxy-style contracts and shared implementations. It also called a counterparty labeled Balancer, which called back and transferred WETH. The report reads that call/callback structure as a flash-loan pattern; the selectors were interpreted structurally rather than fully ABI-decoded.Within the callback, MARK moved in large round trips between the created contract and the MARK/WETH pair. The narrative’s largest rounded legs were 412.07 million, 405.52 million, and 398.90 million MARK in each direction. These are gross trading movements, not retained proceeds. The evidence-set total of 13,474,585,249.833702 MARK likewise recounts movement and does not measure loss or prove that every included movement belongs to the incident.One entry with selector 0xaacaaf88 into 0x4e50ad…227394 produced 19 self-call iterations in Seed 1. In each iteration, wallet contract 0xe545b9…ee8f66 made two ETH payments:1.061908909163406246 ETH to the Uniswap V2 router for the ETH-to-MARK route. The report’s total across 19 iterations is 20.176269274104718674 ETH.0.025621353654900691 ETH to 0xd33814…4452e7. The report’s total is 0.486805719443113129 ETH. That recipient’s role is unverified.The trace’s 40.839344267652550477 ETH of total internal value includes the router’s WETH-wrapping forward and therefore double-counts that leg. It is not an incident loss. After the repeated buys, the report describes the created contract selling MARK back into the pair and taking WETH-side output.Seed 2 had the same reported flash-loan and churn structure, without the wallet-control-shaped frames. One entry into 0x4e50ad…227394 produced nine iterations through 0x5a79e5…a85440. Each contained a USDC approval, a Uniswap V2 swap through the USDC/WETH and MARK/WETH pairs, and a USDC transfer. No native-ETH internal value moved in that seed.SentinelTX assesses that one signed call was executed repeatedly: each entry carried a 65-byte field consistent with an ECDSA signature, then fanned out into repeated inner execution. It interprets the associated trading as induced buy pressure in a low-liquidity pool. That remains a mechanism assessment. The recovery-control-shaped sequence does not supply a decoded wrapping deadline or a decoded owner-change event, so neither the reported recovery-deadline overflow nor an owner change is established. No verified-source comparison to the official Argent product was made.Figure 1. The two October 19 seed call trees contain one entry followed by 19 and nine inner executions, respectively. Arrows show process sequence, not amounts or new transfers. Repeated execution of a signed call is the report's assessment; recovery-deadline overflow and an owner change are not established.Color key: Slate identifies Seed 1; sage identifies Seed 2. Color does not establish identity or responsibility.Address/role key: Both seeds called 0x3c5884…3fb310. The repeated entry was into 0x4e50ad…227394; the spending wallet was 0xe545b9…ee8f66 in Seed 1 and 0x5a79e5…a85440 in Seed 2. Official Argent product identity is unverified.Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026, pp. 7, 9–10.The downstream route mixes funding sourcesOn October 20, the candidate EOA sent 1.0 ETH at 08:56:23 UTC and 19.68 ETH at 09:03:11 UTC to 0xfba873…81364a, the consolidation wallet. The combined 20.68 ETH is an observed outward amount, not a fresh loss estimate and not a direct substitute for the swap output: the EOA’s listed inflows also include the earlier 0.09761 ETH funding and small other receipts.The consolidation wallet’s provider-listed inflows totaled 27.528000001 ETH across five transfers. Of that, 20.68 ETH came from the candidate EOA and 6.848000001 ETH from other senders whose sources were not established. At 11:17:23 UTC it sent 5.05 ETH to the staging wallet, 0x0d9ed4…f12f40. The presence of other inbound funding means the exact incident share of that onward transfer cannot be determined from flow data.The PDF gives a pro-rata assessment of about 75%, calculated there as 20.68 / 27.528, or roughly 3.79 ETH of the 5.05 ETH transfer. This is an allocation assumption, not identification of which ETH moved. It cannot justify describing all 5.05 ETH, or all five later Router transfers, as exclusively this incident’s funds.The staging wallet made five separate transfers of 1.0 ETH to 0xd90e2f…24f31b, labeled Tornado.Cash Router, on October 20:11:19:11 UTC: 1.0 ETH.11:32:47 UTC: 1.0 ETH.11:37:11 UTC: 1.0 ETH.11:42:47 UTC: 1.0 ETH.11:46:35 UTC: 1.0 ETH.These transfers total 5.0 ETH at the Router. The report stops there at a privacy boundary and establishes no corresponding withdrawals. It identifies no exchange-deposit leg. The Uniswap interactions are DEX swaps, not custodial cash-out events, and a service label does not identify the person behind a transfer.Figure 2. On October 20, the candidate EOA sent 1.0 ETH and 19.68 ETH to the consolidation wallet, which also had 6.848000001 ETH from other senders in its provider-listed inflows. It forwarded 5.05 ETH to the staging wallet, which sent five 1.0 ETH transfers to the Tornado.Cash Router. These are overlapping stages, not additive losses. Commingling prevents an exact case allocation; no corresponding mixer withdrawal is established. The dates of the other senders’ listed inflows are not asserted here.Color key: Slate identifies the candidate-EOA contribution; sage identifies other provider-listed inflows. Onward route arrows are charcoal. Equal-width arrows show direction, not amount.Address/role key: Candidate EOA 0xc10609…872b02; consolidation wallet 0xfba873…81364a; staging wallet 0x0d9ed4…f12f40; Tornado.Cash Router 0xd90e2f…24f31b. These are transaction roles and the report’s service label, not verified common ownership.Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026, pp. 5–6, 8, 13, 41–42.Residual movement is not a balanceSentinelTX separates provider-list arithmetic from a balance query. The figures below are inflows minus outflows minus listed gas fees over the provider-returned ETH rows, including rows at any date. They are not proof of currently held funds, incident-attributable holdings, or recoverable amounts:Candidate EOA: 12 inflows totaling 20.694952258434388495 ETH; two outflows totaling 20.68 ETH; gas fees of 0.009768389421759711 ETH; net listed movement of 0.005183869012628784 ETH. Separately, the narrative says the address record showed 0.005184 ETH on October 20.Consolidation wallet: five inflows totaling 27.528000001 ETH; one outflow of 5.05 ETH; gas fees of 0.000043631071701 ETH; net listed movement of 22.477956369928299 ETH, approximately 22.48 ETH.Staging wallet: three inflows totaling 5.0500000515 ETH; five outflows totaling 5 ETH; gas fees of 0.014022238141291632 ETH; net listed movement of 0.035977813358708368 ETH.The report’s expert-opinion section discusses the approximately 22.48 ETH figure as a possible recovery opportunity if funds later reach a custodial venue. That assessment does not turn the flow-derived residual into a balance or establish how much belongs to this incident. Onward movement beyond the listed 5.05 ETH leg is not established.ConclusionThe report’s most concrete result is the sequence of recorded token receipt, conversion, and later ETH transfers. Its call-tree interpretation connects repeated wallet execution with MARK-pool trading, but the exact defect and official product identity remain unresolved. Downstream, the consolidation wallet’s other funding prevents a precise incident allocation, and the Router marks the end of the established route rather than a confirmed cash-out.SentinelTX identifies the other consolidation-wallet senders, the unknown Seed 1 ETH recipient, and decoded module calls as useful next leads. Those are recommendations in the source, not completed findings. The two reverse-time joins cannot support a proceeds trail; neither the gross trading totals nor the approximately 22.48 ETH residual establishes a loss or a recoverable balance.Figure 3. The report records the USDC receipt, ETH conversion, and subsequent transfers, while treating the repeated-execution mechanism as an assessment. Official product identity, recovery overflow, owner change, and exact downstream case allocation remain unestablished. Its two impossible backward-time paths cannot support proceeds tracing, and no exchange deposit or corresponding mixer withdrawal is identified. The figure’s approximate 20.597338 ETH is 20.597337757434388495 ETH in the Path Routing Evidence (p. 14).Color key: Slate marks section headings only; the written labels distinguish records, assessments, and limits.Source: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026, pp. 10, 12–14, 42–43.Source and limitations noteSource: SentinelTX, Argent-style Smart-Wallet Incident — Ethereum Investigation Report, CASE-01D70140, October 20, 2026. Main references: executive summary and value distinctions, pp. 4–6; chronology, pp. 7–8; call-tree interpretation and attribution tiers, pp. 9–11; conclusion and limitations, pp. 12–13; exact transfer amounts, pp. 14–38; aggregate movement definitions, pp. 38–40; collection boundaries, pp. 41–42; native warnings, pp. 42–43. The PDF’s public lead is attributed to the SlowMist incident-index snippet at the SlowMist incident index, not to an independently reviewed full incident notice.The original dossier is marked confidential. This article adapts its findings and qualifications; it does not reproduce the complete source dossier.Exact native warning count: the p. 4 banner says, “INTEGRITY GATE — the integrity gate flagged 2 findings for review. See the appendix at the end of this document for the full list.” The two findings appear in “Automated Integrity Check — Warnings (Report Integrity Gate),” pp. 42–43. They are reproduced verbatim below:[INV-5] (report-wide) — Hop 1 (block 26,225,830) → Hop 2 (block 26,225,798) is time-inverted — the later hop (funds out) settles in an EARLIER block than the hop that feeds it (funds in) → a causally impossible path (the cash-out tx precedes the deposit tx). Likely a destination's commingled total deposits counted as traced taint.[INV-5] (report-wide) — Hop 1 (block 26,225,830) → Hop 2 (block 26,225,803) is time-inverted — the later hop (funds out) settles in an EARLIER block than the hop that feeds it (funds in) → a causally impossible path (the cash-out tx precedes the deposit tx). Likely a destination's commingled total deposits counted as traced taint.Plain-language consequence: both flagged paths would require the October 19 conversion to fund seed activity that had already happened. They are causally impossible, not merely unconfirmed. Neither is used as a proceeds route in this article or its figures. The warning’s suggestion about commingled deposits is the source’s explanation, not a separately established repair.The source retains several different scopes and levels of certainty. Its abstract says transfer verification does not record who signed or authorized a transfer, while the seed and control sections identify the candidate EOA as the submitter/signer. This article uses the transaction role without treating it as a verified personal identity or proof of authority. Service labels are provider attributions reproduced from the report, not new determinations of ownership or current legal status. The executive summary calls 09:35:35 UTC the EOA’s “first recorded activity,” while also recording the earlier 09:31:23 UTC inbound funding; both events are retained here without redefining that source label. The abstract does not identify terminal endpoints or exchange attributions in its cited inputs, while later sections supply the Router service label; neither establishes a mixer withdrawal or a cash-out.The prose also describes the staging transfer as “exactly 5.05 ETH,” while the full provider-list arithmetic gives 5.0500000515 ETH across three inflows. The former is the single consolidation-to-staging transfer; the latter is a broader list total. The PDF’s flow-derived residuals are not balance queries. Its requested incident window, executed query windows, and retained transaction span remain distinct. Provider page limits and high-volume exclusions mean the collected and followed rows are not every address’s whole history.The PDF’s aggregate movement totals expressly do not determine loss or establish incident connection. Where its “Amount” and “Transfer amount” columns differ, that difference alone does not establish case attribution. Some USD cells use transaction-date prices, spot fallbacks, or recovered session valuations; the record does not attribute each figure to an individual price source. This article therefore keeps the reported SlowMist estimate separate from native quantities and does not introduce a new USD valuation.Other stated limits include unknown sources and role for 0x11bf2e…067e26, whose provider-listed inflow is 0.06078317119380398 ETH; an unestablished identity for the MARK/WETH pair; and an unverified role for 0xd33814…4452e7. Claims of a signed-call replay or pool manipulation remain assessments despite the stronger language in the report’s expert-opinion section. The PDF describes a signed manifest and report fingerprint; this adaptation does not claim independent cryptographic verification or clean substantive findings.Reference addresses and transactionsFull identifiers below reproduce the source for the movements and roles discussed above. Short forms in the article use the first six and last six hexadecimal characters.Candidate EOA: 0xc10609ce5c032db92e562e463b1234aab0872b02.Created contract and USDC sender: 0x3c5884377cca79ff221936aea4a5df43293fb310.Repeated-entry contract: 0x4e50adfc953551286bbd7fee2b2b846d1d227394.Seed 1 spending wallet: 0xe545b9a69bff1bf0ed2e922551dda4afc8ee8f66; Seed 2 spending wallet: 0x5a79e5772493cf4329682d202aa2d28f85a85440.Other wallet-control-shaped contract: 0xf490557d67d934440677a4f16793d5ef319b8ef5.MARK token: 0x67c597624b17b16fb77959217360b7cd18284253; MARK/WETH pair: 0x6f23d2fedb4ff4f1e9f8c521f66e5f2a1451b6f3.Seed 1 unknown ETH recipient: 0xd33814c56fdacdc7f084a5443d600ee5464452e7.Consolidation wallet: 0xfba873b1e5d0256301b87ce74f79a30d6781364a; staging wallet: 0x0d9ed4bbb6efeda5471cae1aa5f4bbe0e8f12f40.Pre-incident funding pool: 0x12d66f87a04a9e220743712ce6d9bb1b5616b8fc; downstream Router: 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b. These are distinct roles.Uniswap V2 router: 0x7a250d5630b4cf539739df2c5dacb4c659f2488d; USDC/WETH pair: 0xb4e16d0168e52d35cacd2c6185b44281ec28c9dc; Balancer-labeled counterparty: 0xba12222222228d8ba445958a75a0704d566bf2c8.Other provenance address with unestablished role: 0x11bf2e0d39d8589c96171a4102ea39c834067e26.Transaction references, as printed in the PDF:Pre-incident 0.09761 ETH funding: 0x6871f0e18429be8a40b5cc4d358b140ca987bee61ab00d6f652ccb59df631f63.Contract creation: 0xaadeff6c257a9339cc82c53ee44870d399b4e81de085f2c7f22464421060d4d2.Seed 1: 0xbfed8d33561ed5f9cbd0f4e62a5bbd20187a64f3e22180148dcb58ed6ebaa795.Seed 2: 0xa0ee8f914205a948c79eca039b7d8265537eb220472c9be1455d3321f1bd571b.USDC receipt: 0xc041e86d96df91df94bb585506865139fe17bebd8473d840cff2e7c4808a2756.USDC approval: 0x5e41d5d735133bbf715c55349aa5626e46c9deab986c56c57718330aa576939a.USDC-to-ETH conversion: 0xc220bb3c307f7317f4fa12e67220c77bc767db64a61587ebdebdbb442e00f0ce.Unsolicited PVC receipt: 0x5dfecdfd733721cc4679e376c0f455019b1512128f61e4b5beb2bc91decd52a4.1.0 ETH to consolidation: 0x5b0ee213efea42fa4fbfdb1d6049c715643d63c54357ba6980d34dec30077e7c.19.68 ETH to consolidation: 0xce8fb63bd9145b205f172243a485e535de627f0810a274d1ff6d3c0a7cc6946a.5.05 ETH to staging: 0x1d7d1d4e7fd61938f1a908292888bd4d2b4ba570cc8713de95633ed00ab7bdc1.Router transfer at 11:19:11 UTC: 0x1ba62ed4886fd6b8feae723f66597b4f3940af914b1168bc93ef43de026bdb1b.Router transfer at 11:32:47 UTC: 0x124eadf281340cfbb707b4f88d117808af4ab628c1ea2736450a15d29caa887d.Router transfer at 11:37:11 UTC: 0x6655185342c5cf5863b4dd0b1d1af67fb9a9ad886e480182d1d8d39824ee5dc2.Router transfer at 11:42:47 UTC: 0x5ff8fa2b97db68b116485c187b34caefabe439054f74423a63549d10716fb214.Router transfer at 11:46:35 UTC: 0x36deeddccc9d47ab702f8857c5cdf2f0f2de018720341345eae6d56b5089f5ba.Article version 1.0 · October 20, 2026 · Based on the native SentinelTX PDF.

On 25 July 2026, a researcher reported wallet-draining activity and named an Ethereum collecting address. Two days later, Triple-A said unauthorized access had affected wallets holding its own treasury assets, while client funds were unaffected. The company did not name the investigated addresses in that statement. This review therefore follows the researcher’s leads without treating every movement as independently proved victim loss. Original researcher alert; Triple-A statement.The checked token route is source S → collector C → four DAI recipients. One recipient, R, also sends ETH through a router into two explorer-labeled Tornado Cash pools. These are connected address roles, but the trade that would connect the DAI and ETH legs has not been reconstructed. The confirmed diagram stops at the Ethereum pools; no withdrawal recipient or Zcash continuation is established.Read the roles before the amountsDAI is a token: its contract maintains a ledger of balances. ETH is Ethereum’s native asset and pays execution fees. A DAI transfer can attach zero ETH to its contract call while still moving tokens. The transaction’s target contract and the recipient named in a token Transfer event answer different questions. A router forwards a call or payment to another contract. A mixer is designed to make a deposit difficult to match with a later withdrawal; observing entry does not identify an exit.Short nameRole in this reviewSSource of the seven checked DAI receipts.CCollecting address named in the researcher’s alert; ownership not independently attested.RReceives ten checked DAI payments from C; submits the 28 checked ETH deposits.A / B / DThree separate recipients of the checked 11 August DAI payments.Router / poolsContract destinations in the checked ETH transactions; names are explorer labels.These short names avoid asking the reader to memorize addresses. They describe movements, not people, common control or criminal intent. Full underlined Ethereum address links appear in Appendix A. The Etherscan nametag for C is corroborating attribution context, not a company ownership record.What was checkedMeasureBounded scopeReading checkpoint19 October 2026 KST. Historical explorer records, not a continuous trace to a pinned cutoff block.DAI recordsSeven incoming and thirteen outgoing canonical DAI Transfer events, each checked with transaction details and raw event amounts.ETH records28 unique successful transactions on 6 August; displayed router-to-pool forwarding checked for every row.DAI list coverageAll five visible token-holder pages read: 107 transfer rows, 97 unique hashes. Small incoming rows were not all independently checked as raw logs.Not measuredVictim-confirmed loss, a historical or current fixed-block balance, DAI-to-ETH execution, post-mixer payout or Zcash delivery.Three findings guide the chronology. First, three earlier DAI receipts materially change the former four-receipt account. Second, thirteen exact DAI departures can now be reproduced without counting an approval as a payment. Third, all 28 listed August pool deposits have transaction-level support, but their 2,620 ETH subtotal is not a verified incident-loss figure.28 July — seven receipts, not just the last fourThe earliest checked receipt is at 11:24:35 UTC: S sends 100 DAI to C. At 11:25:59, it sends 10,000 DAI. Thirty-six seconds later, another receipt carries 2,042,954.555997589733765540 DAI. These three earlier transactions are essential to understanding how much DAI reached C from S. I01 transaction; I02 transaction; I03 transaction.At 11:44:59, a further 100 DAI arrives. The next two large receipts are separated by another small payment: 2,798,804.533028033525749663 DAI at 11:45:47, 100 DAI at 12:11:59, and 5,018,134.251077767199891897 DAI at 12:12:35 UTC. The same canonical token contract, source and collector are named in the checked events. I04 transaction; I05 transaction; I06 transaction; I07 transaction.UTC, 28 July 2026DAI received (6 decimals)Evidence11:24:35100.000000I01 transaction11:25:5910,000.000000I02 transaction11:26:352,042,954.555997I03 transaction11:44:59100.000000I04 transaction11:45:472,798,804.533028I05 transaction12:11:59100.000000I06 transaction12:12:355,018,134.251077I07 transactionThis compact table truncates amounts to six decimals; Appendix B preserves every raw integer and full precision. DAI uses 18 decimal places: each event’s integer amount is divided by 10¹⁸ to express tokens. The seven raw event amounts sum to 9,870,193.340103390459407100 DAI. Selecting only the last four would give 7,817,138.784105800725641560 DAI and omit the earlier 2,053,054.555997589733765540 DAI. The broader receipt selection repairs the accounting comparison; it does not establish the origin of S’s assets or prove treasury ownership.6 August — DAI payments and ETH deposits interleaveAt 02:59:11 UTC, C sends 100 DAI to R. At 03:01:23, it sends 1,000,000 DAI to the same address. The first checked ETH pool deposit follows at 03:20:11. The order is consistent with a later conversion, but does not itself supply the trade, settlement or authorization that would prove one. O01 transaction; O02 transaction; P01 transaction.Four more 100 DAI / 1,000,000 DAI pairs follow at 06:26:59 / 06:28:11, 06:42:35 / 06:43:23, 06:55:59 / 06:57:11 and 07:22:23 / 07:24:23 UTC. Together, the ten payments send 5,000,500 DAI to R. The ETH deposits continue during this sequence, so the diagram must not imply that every DAI payment finished before every ETH deposit began. The full transaction links and log positions are retained in Appendix B.R’s 28 checked deposit transactions span 03:20:11–07:37:23 UTC. Twenty-six send 100 ETH each through the router to the 100 ETH pool; the final two send 10 ETH each to the 10 ETH pool. That gives 26 × 100 + 2 × 10 = 2,620 ETH. The window measures these selected deposits, not the duration of the underlying compromise. Transaction fees are separate and excluded from this subtotal.Deposit groupUTC on 6 AugustChecked amountP0103:20:11100 ETHP02–P2606:34:59–07:32:3525 × 100 = 2,500 ETHP27 / P2807:36:47 / 07:37:232 × 10 = 20 ETHStart Figure 1 at R, then follow the router’s branches to the two pools. Solid arrows show ETH movements; the branch captions state transaction counts and quantities. The two stages carry the same ETH, so adding the router receipt to its forwarding would count it twice. The layout is schematic, not proportional to time or amount.Figure 1. P01–P28. Sage boxes mark the sending and receiving roles; blue-gray marks the forwarding router. Solid arrows mean displayed asset movement, not identity or legal attribution. The 2,620 ETH appears at both stages but is counted once; no post-pool recipient is shown.This is stronger than a list of hashes alone: every selected record now has a success status, block, timestamp, fee and displayed internal forwarding. It is still an explorer-record check, not an independent execution replay. Nor does verifying the deposit inventory prove that all deposited ETH was purchased with C’s DAI or belonged to the reported incident.11 August — three further DAI recipientsFive days later, C sends DAI to three different addresses: 500,000 DAI to A at 09:44:11 UTC, 1,500,000 DAI to B at 09:51:11, and 2,869,693.351053390459407100 DAI to D at 09:56:47. These checked token events establish the recipients and quantities. Their further trades and any later pool deposits are not part of this verified subset. O11 transaction; O12 transaction; O13 transaction.Read Figure 2 from S into C, then follow each branch separately. The R branch summarizes the ten 6 August payments; A, B and D are the later 11 August recipients. Each amount is DAI, not dollars. The figure combines separate dates to show address relationships, so its spacing is not a timeline. It draws no DAI-to-ETH conversion.Figure 2. Seven incoming and thirteen outgoing canonical DAI events. Blue-gray identifies the source/collector; sage identifies receiving roles. Solid arrows show token movements. The artwork rounds quantities where marked; Appendix B retains all raw amounts. Fees, small unreviewed incoming events and later asset conversions are omitted.The hub structure makes the central observation readable: one collector sends DAI to four recipients. It does not make those recipients one operator. The next accounting question concerns the difference between checked receipts and checked departures—not an assumption that all counterparties share a key.What remains of the DAI accounting gap?Adding the thirteen checked outgoing logs gives 9870193.351053390459407100 DAI. Subtracting the seven checked incoming logs leaves only 0.010950000000000000 DAI more outgoing than incoming. The formerly unexplained difference of roughly 2.05 million DAI is therefore largely explained by the three earlier receipts. It is not evidence of an additional multi-million-token loss.CalculationDAI / interpretationSeven selected incoming events9870193.340103390459407100Thirteen selected outgoing events9870193.351053390459407100Outgoing minus selected incoming0.010950000000000000; a selection difference, not missing victim funds.That small difference does not settle the balance. The canonical-token listing contains 107 rows across all five pages, including small receipts outside these twenty individually checked events. The listing counts transfer rows, not unique transactions: its 107 rows correspond to 97 hashes. The small rows have not all received a raw-log verification pass, and a fixed-block balance has not been obtained. The explorer’s displayed current token holding is not substituted for one.The review therefore does not claim a zero DAI balance, an exact unexplained deficit or a complete loss ledger. It also does not add the DAI payments to the ETH deposits as separate damage. A conversion could move the same economic value through both asset legs, and its execution remains to be joined.Attribution and the Zcash boundaryThe researcher’s original address disclosure is the basis for investigating C. Triple-A’s statement establishes what the company said about its incident, but it does not attest that C, R or each DAI recipient was a company-controlled wallet. The explorer nametag and the company statement must not be collapsed into an independent ownership finding. Valid transaction execution likewise does not establish human consent.The later public Zcash allegation does not provide a deposit-specific source hash, service order and destination fulfillment for this selected route. No transparent Zcash receipt or post-mixer withdrawal is verified here. Its absence from the checked evidence is not proof that no such movement occurred. The report’s confirmed route ends at the Ethereum pools.Alternative explanations remain for control and purpose: different users can share services, and similar batching does not prove a shared operator. A key compromise, an unauthorized internal action and an authorized movement require different authorization evidence. The examined transfers alone cannot choose among them. The broader October deposit grouping is not imported as a verified 5,220 ETH attribution bound; its complete history, opening balance and joins have not been independently reproduced.The next records are specificQuestionRecord neededDid C’s DAI fund R’s ETH deposits?The actual swap/settlement events and corresponding receipts, with raw per-asset amounts.What is the complete DAI accounting?Raw logs for the remaining listed events, reproducible pagination and a canonical balance at a named block.Which transfers were unauthorized treasury movements?Company-confirmed address ownership and withdrawal/authorization records matched to the hashes.Did any value leave through Zcash?A source deposit, order identifier, destination fulfillment and evidence of the claimed chain boundary.For a focused service or incident review, retain the exact hashes, token contract and receipt-log indices before requesting a broader cluster. No verified custodial-exchange deposit is identified in this selected evidence, so no exchange freeze target or successful cash-out is claimed. No party was contacted, no legal request was sent and no recovery action was executed.The bounded conclusion is now materially firmer. Seven checked DAI receipts explain nearly all of thirteen checked departures, and 28 successful ETH transactions document 2,620 ETH entering two labeled pools through one router. Ownership, the connecting conversion, complete balances and post-pool destinations remain separate questions. The accounting repair supports a clearer report—not a larger loss claim.Appendix A — full Ethereum address rolesRoleFull Ethereum addressS · DAI source0x9d358e54f405e120807D7a07B2895cE77Fe7d53DC · researcher-named collector0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1R · DAI recipient / ETH depositor0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82A · 11 August recipient0xAED30575aefEBdEAed62992084984227Ac77b183B · 11 August recipient0x15Cb70873bB183030617caE04BF32390E402Dc6fD · 11 August recipient0x9e4Bb27b18943FAA7E644B6a841f4D8855996887Canonical DAI contract0x6B175474E89094C44Da98b954EedeAC495271d0FRouter · explorer label0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b100 ETH pool · explorer label0xA160cdAB225685dA1d56aa342Ad8841c3b53f29110 ETH pool · explorer label0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbFEach address link targets Ethereum’s address-detail page. Role names establish neither natural-person identity nor ownership. Pool names are attributed explorer labels; no current legal status is inferred from historical label text.Appendix B — transaction evidence and methodologyAll times below are UTC. Rows are deduplicated by hash within each inventory. An event-level key is transaction hash plus log index, so multiple events in one transaction must not be silently merged. Amounts retain recorded precision; transaction fees are separate ETH costs.Incoming DAII01FieldChecked valueTransaction0xf171fe49976a28c36f964d1536be5e09e0f83d63a16698edc9a3f81693a67630UTC / block2026-07-28T11:24:35Z / 25631002From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount100.000000000000000000 / 100000000000000000000Receipt logCanonical DAI Transfer log 268Status / feeSuccess / 0.000106313478965304 ETHI02FieldChecked valueTransaction0xc961cfc1fac024e6609417b6ba3a11a6debe856ed39d9916842ad4deb2a075a4UTC / block2026-07-28T11:25:59Z / 25631009From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount10000.000000000000000000 / 10000000000000000000000Receipt logCanonical DAI Transfer log 214Status / feeSuccess / 0.0000720321062311 ETHI03FieldChecked valueTransaction0xa9359ce32cd078a59456cfd90f10d1043e8339ef180319dd5466db1a1c553fcaUTC / block2026-07-28T11:26:35Z / 25631012From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount2042954.555997589733765540 / 2042954555997589733765540Receipt logCanonical DAI Transfer log 542Status / feeSuccess / 0.000062507386427022 ETHI04FieldChecked valueTransaction0xaa14868c26d680b1daa7dff3fa329f6a76d623c2e86a409e899bba8f03b9c7d6UTC / block2026-07-28T11:44:59Z / 25631103From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount100 / 100000000000000000000Receipt logCanonical DAI Transfer log 144Status / feeSuccess / 0.000071783836204508 ETHI05FieldChecked valueTransaction0x42c945f322502d29ab01edb65437a3bfe3943e29b29529d33977c8c4c5ab9ab4UTC / block2026-07-28T11:45:47Z / 25631107From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount2798804.533028033525749663 / 2798804533028033525749663Receipt logCanonical DAI Transfer log 482Status / feeSuccess / 0.00006215980593853 ETHI06FieldChecked valueTransaction0x8cecf25dc8f9eb5238aeb792f152796c53488dc36e11b25e4f0ffec351a81e48UTC / block2026-07-28T12:11:59Z / 25631238From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount100 / 100000000000000000000Receipt logCanonical DAI Transfer log 461Status / feeSuccess / 0.000072233346815148 ETHI07FieldChecked valueTransaction0x8cb06a1bf7837a5bfda7fe899b4da13a949b95a289b0130b864a4fd5a1a485c1UTC / block2026-07-28T12:12:35Z / 25631241From0x9d358e54f405e120807D7a07B2895cE77Fe7d53DRecipient0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1DAI / raw amount5018134.251077767199891897 / 5018134251077767199891897Receipt logCanonical DAI Transfer log 445Status / feeSuccess / 0.000062175212448008 ETHOutgoing DAIO01FieldChecked valueTransaction0x22489ca59aea0dfaa1598ca36466b7ac852d054745ef0dc4ccb748fd1becb9d3UTC / block2026-08-06T02:59:11Z / 25693066From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount100.000000000000000000 / 100000000000000000000Receipt logCanonical DAI Transfer log 189Status / feeSuccess / 0.000107748805593598 ETHO02FieldChecked valueTransaction0xe5bdef14f2c0a011dcc515f61f444a6ea5beb0428a985d2425349a8e402b9d11UTC / block2026-08-06T03:01:23Z / 25693077From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount1000000.000000000000000000 / 1000000000000000000000000Receipt logCanonical DAI Transfer log 264Status / feeSuccess / 0.00007303479896477 ETHO03FieldChecked valueTransaction0xe816ea86b0d7f0fad643c991abaf3587a8a3d8cd23de860950d077a494ed0ff4UTC / block2026-08-06T06:26:59Z / 25694104From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount100.000000000000000000 / 100000000000000000000Receipt logCanonical DAI Transfer log 94Status / feeSuccess / 0.000108693429130936 ETHO04FieldChecked valueTransaction0xe3d930642c6767e46f598091167134ee5ca2021edeaeb77369a85c79ac51a1feUTC / block2026-08-06T06:28:11Z / 25694110From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount1000000.000000000000000000 / 1000000000000000000000000Receipt logCanonical DAI Transfer log 463Status / feeSuccess / 0.000072267796722752 ETHO05FieldChecked valueTransaction0x3a55bdc8308fa1b42dc5e1e588389b5ba29d451fe4a006828a9bd61464ed041aUTC / block2026-08-06T06:42:35Z / 25694182From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount100.000000000000000000 / 100000000000000000000Receipt logCanonical DAI Transfer log 164Status / feeSuccess / 0.000072284030130474 ETHO06FieldChecked valueTransaction0x233e427a8c34ace73decc418d4798a714889222a03cbc248f2d66161e44f4948UTC / block2026-08-06T06:43:23Z / 25694186From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount1000000.000000000000000000 / 1000000000000000000000000Receipt logCanonical DAI Transfer log 61Status / feeSuccess / 0.000072255893621734 ETHO07FieldChecked valueTransaction0x83308b9b218fde69c88ac00d5c4c3ceaa93c053cd3607da15c1e5353d340eb2bUTC / block2026-08-06T06:55:59Z / 25694249From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount100.000000000000000000 / 100000000000000000000Receipt logCanonical DAI Transfer log 439Status / feeSuccess / 0.000072435905930964 ETHO08FieldChecked valueTransaction0xca8f6821c4caca1dbd2166bab9f93e057e739d7482b7240cc87de25faec25b57UTC / block2026-08-06T06:57:11Z / 25694255From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount1000000.000000000000000000 / 1000000000000000000000000Receipt logCanonical DAI Transfer log 459Status / feeSuccess / 0.000072583556411982 ETHO09FieldChecked valueTransaction0xc546c9df8f39138ecd0fb815a2d146bd17a8d468735bf1b5d6a01833211c63c4UTC / block2026-08-06T07:22:23Z / 25694381From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount100.000000000000000000 / 100000000000000000000Receipt logCanonical DAI Transfer log 42Status / feeSuccess / 0.000072966037674382 ETHO10FieldChecked valueTransaction0x60afdf1c96d23af558bb78b48ebf95cdb7e0da06931b8f43f02f195897533f59UTC / block2026-08-06T07:24:23Z / 25694391From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x33DfbC8B52596EcC7D2057F6b1DaD88AF8CbDe82DAI / raw amount1000000.000000000000000000 / 1000000000000000000000000Receipt logCanonical DAI Transfer log 104Status / feeSuccess / 0.000072469740045402 ETHO11FieldChecked valueTransaction0xcae3448d414fdbfa2730a07f52f6a3f9af49d5f5f29bc84686967d3ab0ddd99cUTC / block2026-08-11T09:44:11Z / 25730941From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0xAED30575aefEBdEAed62992084984227Ac77b183DAI / raw amount500000.000000000000000000 / 500000000000000000000000Receipt logCanonical DAI Transfer log 174Status / feeSuccess / 0.00010739405565436 ETHO12FieldChecked valueTransaction0x2bea3ba5f846c1da06f36feeea386f41b6376981e25ed48c025d7dce3a65d93eUTC / block2026-08-11T09:51:11Z / 25730974From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x15Cb70873bB183030617caE04BF32390E402Dc6fDAI / raw amount1500000.000000000000000000 / 1500000000000000000000000Receipt logCanonical DAI Transfer log 237Status / feeSuccess / 0.00010799303731251 ETHO13FieldChecked valueTransaction0x328b6e17ccd01081edd08bc13c0f6ca202078911a1a5772ac798e9c2f96c4dedUTC / block2026-08-11T09:56:47Z / 25731002From0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1Recipient0x9e4Bb27b18943FAA7E644B6a841f4D8855996887DAI / raw amount2869693.351053390459407100 / 2869693351053390459407100Receipt logCanonical DAI Transfer log 73Status / feeSuccess / 0.00009792839039067 ETHSelected ETH deposit inventoryP01–P26 each display 100 ETH to the router and matching forwarding to the 100 ETH pool. P27/P28 each display 10 ETH to the router and matching forwarding to the 10 ETH pool. All have successful status. Decimal ETH shown on the explorer is used here; no raw RPC receipt or execution replay is claimed.Record / UTC / blockETH / fee in ETHFull transaction hashP01 · 2026-08-06T03:20:11Z · 25693171100 / 0.0028345941590194320xd06ac8a5cd2d9a41f594218c675625a799842d157c9399c20a46e14827f098dbP02 · 2026-08-06T06:34:59Z · 25694144100 / 0.0028278653956720080x2488f72a71a5e8442f1b87bafe0ad58e6d836490014f730ff845066158f6bb04P03 · 2026-08-06T06:35:23Z · 25694146100 / 0.0028329863098271960x11d65f8319eca260c00f6a782f58f084596a8e84aefb580ec8413f214ee14a8bP04 · 2026-08-06T06:35:59Z · 25694149100 / 0.0028169394459599240x67b9e573e947c1992f21a6eefd83c369208adacbc6ee1b69852703bb622f3fe5P05 · 2026-08-06T06:36:23Z · 25694151100 / 0.0028564812353832960x7fe7238d53548b215c90a10980e2312d98ee828e89c78b3a9ab11dce9184ee19P06 · 2026-08-06T06:38:11Z · 25694160100 / 0.0028428629041542880x5778c5b4675d80d46c88d17223fb6a1adb9b09f0c2b6a3313908646098b2e6c2P07 · 2026-08-06T06:48:35Z · 25694212100 / 0.00284261646606380xe0a9fb242098c8acb579b69a0779297d80e5ae62d994e90ad8a9c0fd937d3d61P08 · 2026-08-06T06:48:59Z · 25694214100 / 0.0028256541738993960x44c72c80714eb7c5f82fdcacea6451a9c00d191d57c648fb2485fff0e6e1b042P09 · 2026-08-06T06:49:35Z · 25694217100 / 0.002839773788868460xdad27b0211a495eefa4909e64296cb6a5f30eaf880c9543d8cc9fc48ea30d99bP10 · 2026-08-06T06:49:59Z · 25694219100 / 0.002820763997760040x45c3becf5311395b3c68b73b40c0ec95130b989ce2d81ce174d35722fe27b265Record / UTC / blockETH / fee in ETHFull transaction hashP11 · 2026-08-06T06:50:23Z · 25694221100 / 0.002823688478732740x6596f5d99545759d2604099f51d208f77c4d79130f9b7617eb31b3bb8646d4fdP12 · 2026-08-06T07:01:59Z · 25694279100 / 0.002813630242403740xaaf6dc9c9d6b712918f82b79d7be85a3baf3ff0559fcf979ab75419880a741beP13 · 2026-08-06T07:02:23Z · 25694281100 / 0.002910358979203140x19784e32e2984405cdf57d1a082fb5950b90cd308434a13a953c50e74bcc2945P14 · 2026-08-06T07:02:59Z · 25694284100 / 0.002894239085083020x8178941ba9710825e3f5a6b622727a101f9db40adb26b597e831cdd4a98e0471P15 · 2026-08-06T07:03:23Z · 25694286100 / 0.0028992564851133040x31d37b036bcbce7016ae20062b6615538958249e57ac76a42ab8c947567396e8P16 · 2026-08-06T07:03:47Z · 25694288100 / 0.002881404145509160xc87dfd51358cdaf0efec82f9e7f734d64006509acf902115a645479e2902954fP17 · 2026-08-06T07:12:35Z · 25694332100 / 0.0029035856489136840xab1d50d55e45d48f2bf428a1768c7cc2ffb043a7dc13e9249da57c1f3772815bP18 · 2026-08-06T07:13:23Z · 25694336100 / 0.002893078107283980x3c32d3e05dae9ae9050b79e9c265ceac3672abc29075b3a5dc84af08490265b2P19 · 2026-08-06T07:13:47Z · 25694338100 / 0.002889264800232360x2e53bd9383ba1d0e7547526e67f38a5e1286c8609802829851b06f543783e78aP20 · 2026-08-06T07:14:11Z · 25694340100 / 0.00287186312376450x7b1f7e2306b90c8cbd4f3a2926dde47362154f45ab57091700f32bf65ebd803cRecord / UTC / blockETH / fee in ETHFull transaction hashP21 · 2026-08-06T07:29:47Z · 25694418100 / 0.0029077745225918880x2f9fcc6dd34449a8049cc1503fed4bbe7b973def83ac7a7cce31a6976917a09bP22 · 2026-08-06T07:30:23Z · 25694421100 / 0.002888876761759820x8fc3d897f8d09af227a0ac524d6474d11c17dde22d34decb17b72377c8ac5c25P23 · 2026-08-06T07:30:47Z · 25694423100 / 0.002884511906863680xc42983bc911959d79df8aa7e573734e709fb9c39178d0209aa40d99fea1e51efP24 · 2026-08-06T07:31:23Z · 25694426100 / 0.0028683562081445760x3b779b7b65fff36bed55c0a2d2f630744fffa6c2be1704920c2cd98dcada0ba7P25 · 2026-08-06T07:31:47Z · 25694428100 / 0.002890672078726360x9a5cdb5d397f919c9cd37f25624548181da801885b7f9840ed41bc42a6ca5b50P26 · 2026-08-06T07:32:35Z · 25694432100 / 0.0028756618835965760xdc31ee2aa707bf21abd79667abd07c7976ba63e1e64dcdb50c206c86e4768a6cP27 · 2026-08-06T07:36:47Z · 2569445310 / 0.002890824189874460x4b3b076fc7ab134a6b9584b0322acff69625e4c850e8dbee1037a7609c16865bP28 · 2026-08-06T07:37:23Z · 2569445610 / 0.002874360283982880x75d01893d9fa76680b4ea2defc0bfdfd84830b281d9592f172f8fbd247e87798Source and verification boundary: company statement for the company’s incident account; researcher alert for the seed attribution; later allegation for the unresolved Zcash claim; Etherscan transaction details and canonical event logs for the checked records. SentinelTX supplied the original investigation and repair leads; its larger graph totals and unverified attribution bounds are not adopted. Explorer checking is not execution replay, hardware examination, proof of operator identity or a full multi-chain audit.

SentinelTX’s report on the October 8, 2026 X7 Finance / X7Pioneer incident describes a transaction-scoped net outflow of 6.793749214542107991 ETH from the contract publicly attributed to X7Pioneer. Of that amount, the report records 6.780267629238261652 ETH reaching its starting address. The subsequent Ethereum transfers divide into three paths: 3.3 ETH to a Tornado.Cash-labeled address, 1.723 ETH to an unlabeled wallet, and 1.75 ETH to an intermediary used in a reported bridge route.Those quantities answer different questions. The contract’s net outflow, the recipient’s receipt, a repaid principal amount and transfers repeated across multiple hops should remain separate. The report also distinguishes retrieved transfers from the attribution of a mechanism, an operator or a service account.This article follows SentinelTX case CASE-ASYNC643, dated October 19, 2026. The report retrieves individual transfers but leaves several wider conclusions unverified. A retrieved transfer does not, by itself, establish who signed it, whether it was authorised or the nature of a token. One proposed connection cannot represent incident proceeds: the 0.15 ETH payment occurred before the transaction said to fund it. It is therefore excluded from the proceeds trail. The bridge settlement also remains unverified. The source notes below retain the report’s exact warnings and other material discrepancies.The transaction at the center of the reportThe seed transaction is 0xc98056d6ab55ef898189da5fa1fb08b968cb84ca99528d171f8240836b21766d. SentinelTX places it on Ethereum mainnet, chain ID 1, at block 26146922, transaction index 45, on October 8, 2026 at 09:55:59 UTC. The reported status is success, with no revert in the trace.The narrative identifies 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2 as the signing externally owned account, or EOA. It describes a nonce-2 contract-creation transaction that deployed 0x021f832b9ce6685b1135f4a3b55f2b317f95f55c, which in turn deployed the helper contract 0xaa0cad88ac3f76beb9a0f1ba661916d7716d5f4a in the same transaction. The report presents these signer and deployment statements as unverified conclusions.The reported native-ETH value frames show the following sequence:The WETH contract, 0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2, sent 26.963170607692677032 ETH to the helper.The helper sent 26.963170607692677032 ETH to 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7, the contract attributed to X7Pioneer in the report’s public sources.That contract returned 33.756919822234785023 ETH to the helper.The helper sent 26.976652192996523371 ETH back to WETH.The helper sent 6.780267629238261652 ETH to the EOA.SentinelTX calculates the contract’s transaction-scoped net outflow as 6.793749214542107991 ETH. The difference between this figure and the EOA’s receipt is 0.013481585303846339 ETH, which the report identifies as excess ETH re-wrapped into WETH. The helper’s gross inflow and gross outflow are each 60.720090429927462055 ETH; its net native-ETH change in the transaction is zero.The call tree contains 830 frames and reaches depth 8. Its summed frame value, 121.44018085985492411 ETH, counts forwarding hops repeatedly. It is therefore unsuitable as a loss figure. The separate gross-movement total of 130.274148 ETH across 20 transactions also recounts value across hops and is not an incident-loss estimate.What the report says about the mechanismThe reward-accounting explanation comes from third-party search snippets cited by SentinelTX: a SlowMist TI Alert result carried by KuCoin and DeFiHackLabs pull request #1299. The report says these pages were not read. Their snippets attribute an approximately 6.78 ETH loss to a flaw in X7Pioneer’s claimRewards() path; the SlowMist snippet also describes an ETH donation that amplified the accounting delta.SentinelTX describes value movements consistent with that account: the helper’s incoming payment to the attributed X7Pioneer contract, a long sequence of repeated calls, and a larger payment back to the helper. It notes 148 consecutive calls with selector 0x5eac6239 among the 169 displayed frames of the 830-frame trace. The selectors were not ABI-decoded in the evidence, so the report does not establish their function names or the exact accounting formula.The financing explanation is also an assessment. SentinelTX describes a call sequence through 0x87870bca3f3fd6335c3f4ce8392d69350b4fa4e2 and 0x4d5f47fa6a74757f35c14fd3a6ef8e3c9bc514e8, a callback into the helper, WETH unwrapping and subsequent re-wrapping. It interprets that shape as a flash loan with principal of approximately 26.963170607692677032 ETH and an excess repayment of 0.013481585303846339 ETH, roughly 0.05% of principal. The lender was not identified and the selectors were not decoded. The report keeps the flash-loan reading as an inference and excludes the repaid principal from retained proceeds.Three downstream Ethereum pathsThe report records 6.773 ETH in post-incident outflow from the EOA. The earliest listed transfers went to an unlabeled wallet; mixer-labeled transfers followed, then the intermediary associated with the bridge route. All times below are UTC on October 8, 2026.Unlabeled wallet: 0.001 ETH at 10:04:23 and 1.722 ETH at 10:05:23 went to 0x1572cc5a965e6c2f980eca7f6cc63971a9b80eb3, totaling 1.723 ETH. SentinelTX describes the first payment as a test transfer. Its October 19 provider record lists two inflows and no outflows, with in minus out minus gas of 1.723 ETH.Tornado.Cash-labeled recipient: six transfers to 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b totaled 3.3 ETH. Three 0.1 ETH transfers occurred at 10:11:23, 10:12:23 and 10:12:59; three 1.0 ETH transfers followed at 10:13:35, 10:14:11 and 10:15:59.Bridge intermediary: 1.75 ETH went to 0x314b7e4e69fc3ed0b519b5fd835a4adc9abbf335 at 10:23:59. The report assigns no entity label to that address.Figure 1. The report groups nine post-incident transfers from the starting address into three Ethereum branches: 3.3 ETH, 1.723 ETH and 1.75 ETH, totaling 6.773 ETH. The 0.15 ETH sent at 09:11:59 UTC preceded the seed transaction and is excluded. These bars compare transfers; they do not establish a loss or a current balance.Color key: Slate bars show ETH sent by the starting address. A, B and C directly identify recipients; the amounts share a zero baseline.Address/role key: Starting address = 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2. A = 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b, with Tornado.Cash labels recorded in the report; B = 0x1572cc5a965e6c2f980eca7f6cc63971a9b80eb3, unlabeled wallet; C = 0x314b7e4e69fc3ed0b519b5fd835a4adc9abbf335, bridge intermediary.Source: SentinelTX PDF, CASE-ASYNC643, pp. 6–8, Transaction Chronology. Report-level confidence qualifications: pp. 4 and 19.Two different label records appear for the mixer recipient: “Tornado Cash: 10 ETH (Sanctioned)” and “Tornado.Cash, Mixer, Tornado.Cash: Router, Sanctioned.” SentinelTX reproduces both and says the observed deposit sizes are consistent with the Router role. It treats this leg as a privacy boundary and does not trace it further. The methodology says the recipient’s outbound list was not read because it was a high-volume wallet; an absence of outbound edges in the traced set should be read within that collection boundary.The reported bridge route and its receipt qualificationAt 10:24:47 UTC, the intermediary sent 1.75 ETH to 0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae, labeled “LifiDiamond,” in transaction 0xa892aab832796dddd384289179364eaa40f5674a47e77eb9f0347ee0c127f810.The bridge lookup describes a LiFi route using Mayan, also indexed as Socket (Mayan), with the same intermediary address as destination on Arbitrum, chain ID 42161. It reports delivery of 4,475.922884 USDC, with token contract 0xaf88d065e77c8cC2239327C5EDb3A432268e5831. The lookup’s basis is the transaction hash, but the destination-side receipt remains unverified, and the report does not cite the settlement transaction hash.The next reported movement is a transfer of 4,475.922884 USDC at 10:25:31 UTC from the intermediary to 0x2df1c51e09aecf9cacb7bc98cb1742757f163df7, labeled “HyperLiquid, Dex.” Its transaction hash is 0x3d0d18b844f5ebfad3d157702713d48f6233094640b9bf21460d0b89f82e1d6d, at block 512852763. The routing table marks that transfer verified. This separate row does not remove the bridge receipt qualification.Diagram 2. The report describes 1.75 ETH routed via LiFi/Mayan to the same intermediary address on Arbitrum as 4,475.922884 USDC, followed by a transfer to an address labeled “HyperLiquid, Dex”. The bridge settlement remains unverified, and the destination settlement hash is not cited. The onward transfer hash is cited. No custodial cash-out or account ownership is established.Color key: Slate nodes are the intermediary on Ethereum and Arbitrum; the sage node is the HyperLiquid-labeled destination. The dashed arrow denotes the reported, receipt-unverified settlement; the solid arrow denotes the reported onward USDC transfer. Equal-width arrows do not encode amounts.Address/role key: Intermediary on both chains = 0x314b7e4e69fc3ed0b519b5fd835a4adc9abbf335; LiFi router on Ethereum = 0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae; HyperLiquid-labeled destination = 0x2df1c51e09aecf9cacb7bc98cb1742757f163df7. The diagram condenses the bridge service into the first connection.Source: SentinelTX PDF, CASE-ASYNC643, p. 7, Transaction Chronology; pp. 10–11, Transaction Typology; p. 13, Conclusion.SentinelTX identifies the HyperLiquid-labeled address as a DEX endpoint rather than a custodial exchange deposit. Whether the value can be attributed to a particular account at the venue remains an unverified lead. The narrative calls this transfer the third-hop scope boundary; the routing table labels the USDC row hop 1, while the abstract says the cited routing rows reach at most two hops. These are different source presentations, not interchangeable measures of coverage.Funding before the seed transactionThe report places the EOA’s earliest observed value receipt at 09:11:23 UTC, from 0xe7351fd770a37282b91d153ee690b63579d6dd7f, labeled “deBridge Finance, DinDestination, Bridge.” Its narrative gives the amount as 0.160966947216380443 ETH, displayed as 0.160967 ETH, in transaction 0x72d94e8367a25c27d7b381ec899711115489468ffa3eeca2556c17149e3fa56b. The originating chain and depositor are unresolved.At 09:11:59 UTC, the EOA sent 0.15 ETH to 0xb2ecfe4e4d61f8790bbb9de2d1259b9e2410cea5 in transaction 0xda55fd68dce40896726207c74cf9618d8cd727d00d7f822af04d68470b3baeec. The chronology explicitly separates this transfer from incident proceeds because it preceded the seed transaction. It is not included in the three post-incident paths above.A receipt of 15.0 tokens reported as “SEND” at 09:18:23 UTC is recorded but excluded from the value trail. SentinelTX did not classify the token contract or assign a value, and it claims no link to the operator. Three later look-alike-address transfers are similarly recorded but excluded from tracing. The report classifies them as address-poisoning noise without an evidentiary link to the operator.The source limits that matterSentinelTX reports 22 traced movements across 15 addresses. Its two executed query windows each cover 41 days, from September 8 to October 19, 2026 UTC. The 18 retained movements with readable timestamps span October 8 from 09:11:23 to 10:42:47 UTC; four retained rows lack readable timestamps. The methodology says the query interval does not establish complete transaction coverage or enforcement of a requested historical window or block cutoff.The report itself contains several material qualifications and inconsistencies:Verification wording: the executive summary says five claims were downgraded and one finding flagged for review. Its “unverified (auto-downgraded)” heading coexists with a conclusion using “confirms” and a routing table marking transfers verified. This article attributes the analysis to SentinelTX and preserves the abstract’s narrower definition of transfer verification.Pre-incident routing: warning INV-5 identifies a time-inverted path from block 26,146,922 to block 26,146,702. The latter contains the 0.15 ETH payment made before the seed transaction. The report’s chronology already says it cannot be incident proceeds; the warning remains part of the source.Funding quantity: the narrative gives the deBridge receipt as 0.160966947216380443 ETH, while the routing table’s Transfer amount is 0.160966773016380443 ETH. Both are preserved here without choosing a replacement figure.Look-alike transfer quantities: the narrative and Amount column describe three transfers as 0 ETH or 0.0 ETH. The corresponding Transfer amounts are 0.000000172200000000 ETH, 0.000000001000000000 ETH and 0.000000001000000000 ETH. SentinelTX distinguishes recorded Amount from retained-unit Transfer amount and says a difference alone does not establish case attribution.Endpoints and scope: the abstract says terminal endpoints are not recorded in its evidence subset, while the body lists terminal addresses in the traced set. A traced-set terminal denotes a boundary in those records; it does not establish a final beneficiary, an absence of later activity or conversion to cash.The October 19 snapshots also remain separate from traced movements. The report gives the EOA’s snapshot balance as 0.00298 ETH and its provider-list inflow minus outflow minus gas as 0.002980011244414113 ETH. The intermediary’s Ethereum residual is 0.001423268336660466 ETH. Its provider list includes 1.7515 ETH of inflow, with the sender of the additional 0.0015 ETH above the EOA’s 1.75 ETH payment unidentified in this evidence. These figures are dated observations, not current balance claims.The leads SentinelTX leaves openThe report’s conclusion identifies three principal leads: the deBridge funding order, the USDC sent to the HyperLiquid-labeled address, and the unlabeled wallet recorded with 1.723 ETH and no outflows. Its recommended follow-up is specific to those boundaries.For deBridge, SentinelTX recommends obtaining the funding order’s source chain, depositor address and order ID. For LiFi / Mayan, it recommends obtaining the routing record and Arbitrum settlement to corroborate the delivered amount and any integrator metadata. For the HyperLiquid-labeled transfer, it recommends a preservation and information request through the venue’s compliance channel, including any attributable account and subsequent withdrawals.It also recommends monitoring the 1.723 ETH wallet, the intermediary on Ethereum and Arbitrum, and the pre-incident recipient. For the mixer leg, it treats any future withdrawal attribution as a separate lead. Before an evidentiary filing, the report recommends decoding the seed transaction’s selectors against verified ABIs and reading the event logs to move the mechanism beyond its present attributed, code-level-unverified status.Figure 3. The report’s conclusion states a seed-transaction contract net outflow of 6.793749214542107991 ETH and a signer receipt of 6.780267629238261652 ETH; the image rounds these to approximately six decimal places. It attributes the reward-accounting mechanism to SlowMist and DeFiHackLabs without decoded code-level semantics, does not establish operator identity, and identifies no custodial exchange deposit within three hops. Five broader claims remain unverified. A payment made before the incident cannot be proceeds of it, and the bridge settlement is still unverified. These limitations remain part of the conclusion.Color key: Slate headings organize quantities, interpretation and report qualifications. Confidence is stated in words, not encoded by color.Address/role key: Net-outflow contract = 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7, attributed to X7Pioneer by public reports; signer = 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2.Source: SentinelTX PDF, CASE-ASYNC643, pp. 4–5, Executive Summary; pp. 9–10, Transaction Typology; p. 13, Conclusion; p. 19, Automated Integrity Check. Incomplete evidence scope: pp. 1–2 and 17–18.The central finding is a reported contract net outflow of 6.793749214542107991 ETH, a receipt of 6.780267629238261652 ETH by the starting EOA, and the three downstream Ethereum paths described above. The report attributes the incident to X7Pioneer and a reward-accounting flaw through its cited public snippets, while keeping the exact code semantics and operator identity unresolved. The unverified bridge settlement, excluded pre-incident payment and incomplete collection scope limit what these findings establish.