Defend Against Cybercrime with the Power of Community

Four token payouts, a sequence of conversions and one short relay define the Ethereum trail associated with the reported WAX Multi-Chain Bridge incident of 22 October 2026. SentinelTX’s case report follows that trail to an address labelled “HitBTC, Exchange”. The destination is an investigative lead, not proof of a completed cash-out or the identity of the person controlling the funds.This analysis focuses on the Ethereum transfers documented in SentinelTX report CASE-ASYNC3FA, compiled on 24 October 2026 UTC. It distinguishes recorded movements from venue labels and incident-level assessments. Amounts remain in their native asset units; no incident-wide dollar loss is calculated here.Four payouts in less than a minuteThe report records four transfers from the same Ethereum contract to the same recipient between 10:05:35 and 10:06:11 UTC on 22 October. The assets and quantities were:21,558.252354 USDT at 10:05:35 UTC.840.2750339 DAI at 10:05:47 UTC.2.54669928 WETH at 10:05:59 UTC.0.10993227 WBTC at 10:06:11 UTC.Address key: payout contract 0x24b22b031ae1b5a6b09f9a0fd33613a40e0d70e6; recipient 0x01664e199991b2f3fe412c2de5b9b7a0dcdc5070. Token symbols follow the report’s trace labels and are not a separate token-identity verification.Figure 1. Four Ethereum payout quantities, shown separately because the units differ. Source: SentinelTX CASE-ASYNC3FA, pp. 4–5 and 17. These are transfer amounts, not a total loss calculation.The contract’s role as the bridge’s release side is an assessment in the report, not a returned address label. Similarly, the recipient’s alleged attacker-side role depends on the broader incident interpretation. A transaction trail establishes movements between addresses; by itself it does not establish the identity or authority of the signer.From token balances to an ETH relayThe report’s chronology describes token-conversion activity after the payouts. It records two unsuccessful USDT swap attempts before a successful KyberSwap route at 10:16:11 UTC. The WBTC movement followed at 10:18:35, then WETH at 10:20:23 and DAI at 10:22:23. The WETH and DAI routes are attributed to Velora; the WBTC interaction is with an unlabelled contract.These swap venues should not be confused with the eventual exchange-labelled destination. They are intermediate interactions in the account’s conversion sequence, not evidence that the exchange received each original token.At 10:24:23 UTC, the recipient transferred 15.58 ETH to 0x62907e044ffe22a24aa8794ff2a6ea20598227bb. At 10:43:47 UTC, that relay sent 15.5799958 ETH to 0x80787af194c33b74a811f5e5c549316269d7ee1a, which the report labels “HitBTC, Exchange”. The report displays the second amount rounded to 15.579996 ETH in its chronology and summary.Figure 2. The Ethereum sequence described in the report: token payouts, conversion activity, an ETH relay and an exchange-labelled destination. The 15.579996 ETH endpoint figure is rounded. The report does not itemise each swap’s ETH output, so the full conversion-to-deposit attribution remains a partial path, rather than an exact per-token reconciliation.Flow address key: A = 0x01664e199991b2f3fe412c2de5b9b7a0dcdc5070; B = 0x62907e044ffe22a24aa8794ff2a6ea20598227bb; C = 0x80787af194c33b74a811f5e5c549316269d7ee1a (HitBTC label as returned).The distinction matters. The two ETH transfers are recorded movements. The interpretation that the 15.58 ETH combined the four swap proceeds with a small pre-existing gas balance is the report’s assessment. It does not support treating every wei of that transfer as independently reconciled proceeds of the incident.What the destination does, and does not, establishThe report describes the relay as a single-use pass-through within the inspected ETH record. Its onward transfer gives investigators a concrete transaction to present to the service associated with the destination label. It does not reveal a customer account, establish the wallet type, or demonstrate a fiat withdrawal.The destination label is therefore a route for further inquiry, not an allegation that HitBTC participated in the incident. The report’s recommended next step is preservation and lawful review of any relevant credited-account, access and onward-withdrawal records. Whether funds remain available, whether the label maps to a particular account and whether recovery is possible require information beyond this public transfer trail.The reported bridge mechanism remains a separate questionSentinelTX cites third-party reporting of a negative-fee input-validation issue in WAX’s eth.token withdrawal mechanism. In that reported model, a negative max_fee could offset the requested quantity while a full withdrawal was still recorded. The report does not include WAX-chain action records that independently establish the mechanism or map individual source-chain withdrawals to these Ethereum payouts.Its narrative also describes a Solana USDC branch. That is context for the reported multi-chain incident, not a basis for treating this Ethereum-focused analysis as a complete cross-chain reconstruction. No value transfer linking the Ethereum and Solana recipients is established in the report, and common control is presented as an inference rather than an on-chain connection.Accordingly, this article does not combine the branches into a loss total, identify an operator, claim that all affected funds have been located, or describe the underlying WAX mechanism as independently confirmed. The report itself leaves onward Solana movement unresolved.The evidence that would strengthen the caseSource-chain linkage: WAX withdrawal actions, quantities, fee arguments and transaction identifiers matched to destination-chain payouts.Conversion reconciliation: executed ETH outputs for each token swap, kept separate from gas funding and residual balances.Destination attribution: confirmation of the exchange-labelled address’s role and any relevant account records obtained through appropriate channels.Earlier infrastructure: the origin of the ETH used to fund the recipient’s initial gas, without assuming that funding alone proves common ownership.Figure 3. The report supports a specific Ethereum transfer trail. Operator identity, source-chain linkage, exact per-swap reconciliation and any completed cash-out remain separate evidentiary questions. Source: SentinelTX CASE-ASYNC3FA, pp. 8–16 and 17–18.Conclusion: a useful endpoint, not the end of the investigationThe clearest result is narrow and actionable: four recorded Ethereum token payouts were followed by conversion activity, a 15.58 ETH relay transfer and an onward transfer displayed as 15.579996 ETH to a HitBTC-labelled address. The amounts, timing and transaction anchors make that trail more useful than a headline loss estimate.The remaining work is to connect that trail to the source-chain actions and, where legally available, the account-level records behind the labelled destination. Keeping those questions separate preserves the difference between following funds and identifying who controlled them.Transaction anchorsUSDT payout: 0x7c6e4bf4efff995981b8b0f7fa1434cc85063e95c0f7460c71277e0a3f9c14d0DAI payout: 0x58960a7afccf78725e8bcfcf7c1f38cac9e08f2a556da81ec7ee1c5023fc79c6WETH payout: 0x9a55cd6c9e9067ac2bf8d33dff233a3e3dd3739c56206444b8a5e79daabb4ff5WBTC payout: 0x6e1553e7d932d8019f59ea6a3bd09c3071b41d538975686cf3f7e785f9e6716015.58 ETH to the relay: 0xd3f4c1c672eb8c3cdbc00216b0215fc72a16bc659a2e48b8a90241b4f165fe80Relay to the HitBTC-labelled address: 0x64c65d0296fbe983c365646eb5bbb788d6cdd21b2bc54c365e296aef26c885acSource note: Adapted from the SentinelTX platform-generated report “Investigation report CASE-ASYNC3FA”, compiled 24 October 2026 UTC. This article is an attributed analysis of that report, not an independently reproduced investigation. Explorer links use transaction hashes cited in the report; they are not proof of address ownership or the broader incident interpretation.

Source: SentinelTX analysis.SentinelTX’s analysis records 726,307.1011248019 BSC-USD paid to the exploit-signing address, followed by a bridge route and Ethereum settlement activity. The reported loss, mechanism, and final ETH balance require different levels of qualification.This ChainBounty review draws on SentinelTX’s analysis of case CASE-20261024-NEM1. Recorded transfers, reported figures, and analytical assessments are distinguished throughout.The recorded proceeds and reported lossThe investigation concerns a BNB Smart Chain token called NEM, identified in the analysis as token contract 0x9cf0e3ad4efa7ab602d7b5a38c55795cfa777777. The name NemTokenV2 comes from press reporting cited by SentinelTX. The analysis establishes no connection to the separate NEM/Symbol blockchain project.Its central finding is a transaction dated October 21, 2026, at 03:28:50 UTC, in BSC block 128,866,147. The signing address, 0xfd929b0f270dfea6c4827262b4e2bf6ea50fe9b6, called an attack contract, 0x5e6d1f40be466dd2facc94a26818948ecd3b1ca2. SentinelTX classifies the resulting payment of 726,307.1011248019 BSC-USD to the signing address as confirmed. The full transaction hash and address register appear in the appendix.The widely reported loss of approximately US$821,920 is a separate source claim. It is not interchangeable with the recorded payment of 726,307.1011248019 BSC-USD. SentinelTX does not establish a complete reconciliation between the reported loss and the recorded proceeds, so neither figure should be substituted for the other.The analysis distinguishes the October 21 execution date from the October 22 alert and publication date. Its October 24 ETH balance observation is later still. These dates describe different events, not competing dates for one transaction.From preparation to the Ethereum exitAll transaction times below are UTC on October 21, 2026, as stated in the source analysis.01:00:17: The address described as the funder sent the signing address its first recorded gas funding, 0.007 BNB. The analysis flags this amount as unverified and requiring corroboration.01:28:16–03:27:26: Sixteen NEM transfers from the funder supplied approximately 767,818.31 NEM, also an unverified amount. A second gas top-up is recorded as 0.01 BNB. Six helper-creation records span 01:32:22–03:14:31.03:28:30: The signing address transferred 767,811.3061168424 NEM to the attack contract. The transfer is recorded, but its quantity is explicitly unverified.03:28:50: The exploit transaction executed. The analysis reports 1,608 receipt logs and approximately 473 million BSC-USD in transaction-level movement across several counterparties. That gross movement is not presented as the loss or the attacker's proceeds.03:38:38: The recorded 726,307.1011248019 BSC-USD payment was forwarded through a router labeled Socket OpenRouter. SentinelTX correlates a Relay bridge record to this source transaction.03:39:11: A sender labeled Relay.link delivered 725,384.763364 USDT to the same address on Ethereum. The analysis classifies the route as confirmed through the correlated bridge record and destination transfer, while marking the destination amount unverified.03:46:11–03:47:47: Three USDT legs went to a contract labeled CoW Protocol settlement. Their quantities are unverified.The analysis’s later balance read is dated October 24. It records approximately 296.19 ETH remaining at the signing address on Ethereum, with no outbound ETH in the retrieved ledger. This is an unverified historical balance observation, not a claim about the address's live balance when this article is read.The assessed mechanism: a skim-and-burn loopSentinelTX assesses the incident as a token-accounting and liquidity-pool reserve manipulation exploit. Its proposed sequence depends on reporting that transfers into the pair count as sell volume, while a function named flushLpSellRecycle() burns NEM held by the pair. Repeated skim() calls are reported to return the operator's tokens as the pool's NEM holdings shrink, before the retained inventory is sold against the altered pool state.That sequence is an assessment in the analysis. The token's source code and the individual burn, reserve, and skim-related events were not decoded there. The proposed sequence is therefore not an event-by-event proof of the vulnerability.The reported count of 42 cycles has a limited technical anchor: the transaction's calldata ends with 0x2a, or decimal 42. Without ABI decoding, that word does not by itself prove what the parameter controls or how many cycles executed. Likewise, 1,608 logs show extensive transaction activity in the analysis, but an unclassified log count cannot independently establish 42 repetitions of a particular mechanism.Flash-borrowed liquidity is another inference. SentinelTX describes large, same-transaction BSC-USD round trips involving Venus vUSDT, PancakeSwap, and two unlabeled contracts. It did not decode loan origination and repayment events. The analysis assigns the direct loss to the affected pair's liquidity providers, but does not provide a reconciled reserve-loss calculation matching the reported US$821,920.Diagram 1. Read the numbered rows from top to bottom, and each row from left to right. The analysis assesses a skim-and-burn reserve-desynchronization loop: transfers into the LP register pending sell volume, flushLpSellRecycle() burns NEM held by the pair, skim() returns the operator’s tokens, and repeated rounds precede a final inventory sale. This is a reported mechanism, not an event-by-event decoded proof. The reported 42-cycle count is only partially corroborated by the raw calldata word 0x2a, not ABI-decoded; no exact loop count is encoded in this schematic. Equal-width dashed arrows summarize the reported sequence, not token quantities.Slate labels identify the stated actions; arrows indicate the relationships written in each row, not quantities.NEM token: 0x9cf0e3ad4efa7ab602d7b5a38c55795cfa777777. LP/pair: 0x840e19dcca541ee0b55a3c67e900a39d523b12b8; its victim-pool role is a source claim consistent with the analysis’s records. Attack contract: 0x5e6d1f40be466dd2facc94a26818948ecd3b1ca2. Signer/proceeds recipient: 0xfd929b0f270dfea6c4827262b4e2bf6ea50fe9b6; operator identity is not established.Source: SentinelTX analysis. Source location: Transaction Typology → Mechanism: observed, inferred and claimed; Scheme description (assessment).Funding supports a relationship, not an identityThe funder, 0x96cb6bec56e43b2f16c05e1af4776fbc7b9713b5, supplied the initial gas and the NEM inventory later committed to the attack contract. Its first-seen date is October 20 in the analysis. The repeated funding, inventory transfers, and timing support SentinelTX's assessment that the two addresses were operated by the same actor or closely coordinated actors. Common ownership is not proven, and no person or organization is identified as the operator.Six helper contracts reportedly returned their NEM balances short by exactly 1 NEM each. SentinelTX interprets the similar interactions as rehearsal against mainnet conditions, an operational assessment rather than a separate finding of intent. Six listed WBNB recipients are classified as probable helpers; their mapping to the six creation records is not established.The inventory has another upstream lead. An unlabeled contract, 0xaee6b842f94281653dde98da97debd93007de2a1, reportedly sent the funder 780,757.29 NEM across 45 transfers. In itemized examples, NEM arrived with BSC-USD and the same BSC-USD quantity was returned shortly afterward. SentinelTX suggests a reward, staking, or distribution mechanism as a possible explanation, but the contract's function was not decoded.The contract’s ownership and any additional loss remain unproven. Shared first-seen dates with the token and pair do not establish ownership. The analysis also records a post-exploit sale by the funder through a TransitSwapRouterV5-labeled route, but its relationship to any additional loss remains unresolved.Following the exit without overstating the endpointThe analysis traces a BSC stablecoin payment into the router, a correlated Relay delivery on Ethereum, and three transfers to CoW Protocol settlement: 250,000.0 USDT, 250,000.0 USDT, and 225,384.763364 USDT. Each Ethereum quantity carries the source's unverified-amount qualification.SentinelTX attributes the difference between the routed and delivered quantities to bridge fees and spread. That remains an assessment: the amounts are in different token denominations, the destination quantity is unverified, and no itemized fee accounting is provided.The Ethereum native ledger is reported as four inbound transfers totaling 296.192678708450769578 ETH, no outbound ETH, and 0.000205413793461084 ETH used for gas. Its resulting balance is 296.192473294657308494 ETH. All of these ETH figures are unverified. The counterparties and hashes of the four incoming ETH transfers are not itemized in the analysis, so the article cannot supply a complete leg-by-leg conversion reconstruction.The recorded endpoint is an address holding native ETH. It is not evidence of fiat cash-out. The WBNB contract's Binance-related label does not make it a Binance customer deposit address, and the CoW settlement contract is described as a non-custodial venue. No custodial exchange deposit is established by the analysis.The BSC exit also contains an EIP-7702 authorization that delegates execution to another address. SentinelTX records that field but treats its batching interpretation as an assessment. Delegation on Ethereum is not established. These technical roles do not identify a beneficial owner.Diagram 2. Read the numbered rows as the reported route, not three independent totals. The analysis records 726,307.1011248019 BSC-USD from the attack contract to Recipient A and the same quantity forwarded through the Socket router on October 21. A correlated Relay record reports delivery of 725,384.763364 USDT to the same address on Ethereum; that destination quantity is unverified. Three CoW settlement legs follow. The October 24 balance read reports 296.192473 ETH, while the analysis’s ledger calculation gives 296.192473294657308494 ETH; both are unverified. Display values are approximate. The four inbound ETH counterparties are not itemized, so the final arrow summarizes the analysis’s conversion sequence and later balance, not a fully reconstructed transfer leg. Equal-width arrows are schematic; the BSC-USD, USDT and ETH values are not summed or treated as interchangeable loss amounts.Slate: 1 · BSC collection and router exit; Sage: 2 · Relay delivery and CoW swaps; Amber: 3 · Later Ethereum balance read. Equal-width arrows show stated routes, not quantities.Recipient A on both chains: 0xfd929b0f270dfea6c4827262b4e2bf6ea50fe9b6. BSC attack contract: 0x5e6d1f40be466dd2facc94a26818948ecd3b1ca2. Socket router: 0x50cfe7c1938db66a1a6d2e86d36f39fbef3d5c4a; the analysis’s literal attribution includes “Socket OpenRouter (Ethereum)” despite the BSC transaction. Relay-labeled Ethereum sender: 0xb92fe925dc43a0ecde6c8b1a2709c170ec4fff4f. CoW settlement recipient: 0x9008d19f58aabd9ed0d60971565aa8510560ab41. No operator identity or custodial exchange deposit is established.Source: SentinelTX analysis. Source location: Executive Summary → Exit; Transaction Chronology → Fund-flow sequence and Gross versus forwarded amounts; Exchange-deposit and venue legs.Why the look-alike transfers were excludedThe original source distinguishes real funding from records it classifies as suspected address poisoning. At 01:07:18, a look-alike of the funder sent 0.007 units of a token whose symbol imitated BNB using non-Latin characters. Its amount mirrored the real gas funding, but the analysis found no value-bearing onward movement and excluded it.A mirror-image record named a look-alike of the signing address. The two full addresses are distinct, and the mirror-image record’s transaction hash is not provided. Neither poisoning record is used as evidence of common control or an economic connection.The analysis also excludes unsolicited airdrops as spam, including two tokens recorded with a burn-address emitter and other tokens with miscellaneous names. An appearance in a transaction history is not enough, within the source's own methodology, to include a transfer in the traced proceeds.Recovery implications and analytical limitsSentinelTX's practical priority is the last recorded Ethereum holding and any later onward transfer. The analysis describes potential investigative leads in the funder's upstream financing and in request metadata that infrastructure operators might hold. The availability of that metadata and any resulting recovery action are not established.The source rates near-term recovery prospects as moderate, but that is its expert assessment, conditional on an unverified balance observation. It is not a recovery probability, an assurance that funds remain available, or a promise that a service provider can freeze native ETH. The analysis’s legal-process and negotiated-return suggestions require case-specific decisions by the affected parties and their qualified advisers; they are not legal instructions from ChainBounty.Important analytical limits remain: the mechanism has not been decoded cycle by cycle, flash liquidity is inferred, the funder's earlier history is not itemized, two in-transaction counterparties lack an onward trace, and the four ETH receipts lack individual detail. The reported loss remains unreconciled with the recorded proceeds. The analysis does not specify its complete query windows; its conclusions are limited to the records discussed. No personal identity, custodial deposit, or connection to NEM/Symbol is established.Figure 3. The analysis supports a reported route from BSC proceeds through Relay to Ethereum and CoW settlement, subject to its quantity and balance qualifications. Approximately US$821,920 is a publicly reported loss claim; 726,307.1011248019 BSC-USD is the analysis’s recorded proceeds payment. These differently denominated figures are not directly interchangeable, and the source does not reconcile the loss gap. The mechanism is not decoded cycle by cycle; no personal or organizational identity, custodial exchange deposit, fiat cash-out, or connection to the unrelated NEM/Symbol project is established. The October 24 balance observation of 296.192473 ETH remains unverified and is not a statement of a live current balance. Rounded display values are approximate.Slate identifies section headings, not certainty or risk.The balance observation and Recipient A role refer to 0xfd929b0f270dfea6c4827262b4e2bf6ea50fe9b6 on Ethereum, not the separate poisoning look-alike identified in the analysis.Source: SentinelTX analysis. Source location: Key findings and certainty; Transaction Chronology → Coverage against the claim and Cash-out endpoint; Transaction Typology; source limitations.Sources and scopeThe transaction findings, address roles, and analytical assessments in this review are attributed to SentinelTX’s analysis of case CASE-20261024-NEM1. The appendix preserves its full address and transaction references. It should be read as a source register, not as independent verification of the underlying blockchain records.The press context in SentinelTX’s analysis comes from search-result snippets attributed to TokenPost, DEV Community, KuCoin, PANews, TechFlow, and CryptoBriefing. These are attributed reporting references, not claims that the complete pages or underlying SlowMist posts were reviewed for this article.Amounts described as unverified require corroboration. Service labels identify the roles assigned to addresses in the analysis; they do not establish ownership or custody. The mechanism and recovery assessments retain their stated qualifications, and the October 24 balance observation must not be treated as a live balance.Appendix: full identifiersThe following register lists 31 full addresses and 21 full transaction hashes cited in SentinelTX’s analysis. It is not a complete transaction ledger. Address roles and service labels do not establish operator identity.Full addresses1. 0xfd929b0f270dfea6c4827262b4e2bf6ea50fe9b6 Exploit transaction signer and proceeds recipient on BSC; same address receives the reported Ethereum delivery. The analysis records BSC delegated code. Operator identity is not established.2. 0x5e6d1f40be466dd2facc94a26818948ecd3b1ca2 Attack contract on BSC and payer of the recorded 726,307.1011248019 BSC-USD proceeds.3. 0x9cf0e3ad4efa7ab602d7b5a38c55795cfa777777 NEM token contract on BSC. NemTokenV2 is a press-source name, not independently verified here.4. 0x840e19dcca541ee0b55a3c67e900a39d523b12b8 Contract identified by press as the USDT/NEM pair on PancakeSwap. The analysis considers its victim-pool role consistent with the recorded transfers.5. 0x96cb6bec56e43b2f16c05e1af4776fbc7b9713b5 Funder on BSC: recorded source of the signing address’s first gas and NEM inventory. No operator identity established.6. 0xaee6b842f94281653dde98da97debd93007de2a1 Unlabeled BSC contract recorded as the funder’s NEM source. Its function is not decoded; a project-side mechanism is only an assessment.7. 0x63c0c19a282a1b52b07dd5a65b58948a07dae32b EIP-7702 delegate named in the authorization list of the BSC exit transaction. No label; type not classified in the analysis.8. 0x50cfe7c1938db66a1a6d2e86d36f39fbef3d5c4a BSC bridge-exit router identified as Socket OpenRouter in SentinelTX’s analysis. This entry concerns the recorded BSC transaction.9. 0xb92fe925dc43a0ecde6c8b1a2709c170ec4fff4f Sender of the reported Ethereum USDT delivery. Exact source label: “Relay.link.”10. 0x9008d19f58aabd9ed0d60971565aa8510560ab41 Recipient of the three Ethereum USDT legs. Exact label: “CowProtocol, Exchange.” Described by the analysis as a non-custodial settlement contract.11. 0x07964f135f276412b3182a3b2407b8dd45000000 Route used for the funder’s post-exploit NEM sale on BSC. Exact label: “TransitSwapRouterV5.”12. 0xfd5840cd36d94d7229439859c0112a4185bc0255 BSC in-transaction BSC-USD counterparty. Exact label: “Venus USDT, vUSDT, DEX.”13. 0x238a358808379702088667322f80ac48bad5e6c4 BSC in-transaction BSC-USD counterparty. Exact label: “PancakeSwap.”14. 0x92b7807bf19b7dddf89b706143896d05228f3121 Unlabeled in-transaction BSC-USD counterparty on BSC; onward movement not established.15. 0x4f31fa980a675570939b737ebdde0471a4be40eb Unlabeled in-transaction BSC-USD counterparty on BSC; onward movement not established.16. 0x370a7e2d300c14d79d4a7ee07aaca46c4b3012cf Listed with the following address under submitter and target of the Ethereum delivery transaction. The roles and attribution are unverified.17. 0xccc88a9d1b4ed6b0eaba998850414b24f1c315be Listed with the preceding address under submitter and target of the Ethereum delivery transaction. The analysis does not separately verify the mapping or attribution.18. 0xbb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c WBNB contract on BSC. Exact label: “Binance, WBNB Token, Token Contract.” Not a Binance customer deposit address in the analysis’s account.19. 0x2db7fca7a84a4ae69d41aec8d74b96b679c8ac5e First of six listed WBNB recipients on BSC, classified as probable helpers. Their mapping to helper-creation records #1–#6 is unresolved. The reported 0.0001 WBNB quantity is unverified.20. 0xbae2628c3f926971d4fc66c16120b2c7e0dce42a Second listed WBNB recipient on BSC; probable helper, with creation-record mapping unresolved.21. 0x0c3dac1d3b6f870b5bca16b7926631b525216865 Third listed WBNB recipient on BSC; probable helper, with creation-record mapping unresolved.22. 0xe1a9d2ecfb453be4608c126ef95ee71faec7f9cc Fourth listed WBNB recipient on BSC; probable helper, with creation-record mapping unresolved.23. 0x07d792806989300cd3b5d05329fea154a32ad96b Fifth listed WBNB recipient on BSC; probable helper, with creation-record mapping unresolved.24. 0xa16f9a316a2b9ef97994cd47991b72ecbebfd7db Sixth listed WBNB recipient on BSC; probable helper, with creation-record mapping unresolved.25. 0x50c4e75a512f2a14a7b304787adf79c4531a5909 Unlabeled code-bearing recipient of the residual BNB route at 03:40:52 UTC on BSC. The source does not provide that transaction’s hash.26. 0x97caca78ac2a94c67643d07843f85afaa44a3ea5 Unlabeled BSC-USD source to the funder and address appearing in residual-route calldata. The source explicitly treats a swap-route executor role as an unverified lead, not established funding attribution.27. 0x96cb0a81cd849f21e512f5d6eda78bdf1c0713b5 Look-alike of the funder, excluded as suspected address poisoning. Distinct from the real gas-funding address.28. 0xfd92b74d57b02814ea2591bd963d1fae390fe9b6 Look-alike of the exploit signer/proceeds recipient, excluded as suspected poisoning. It is distinct from the address receiving the recorded proceeds.29. 0x058941553ea64444077522d6b5edc2e09655ef66 Token contract used by the suspected poisoning record; symbol imitates BNB using non-Latin characters. Not native BNB.30. 0x5c718fc9c1bc1ca6d55b3c9c564153d98faff2d0 Unsolicited token identified among excluded spam records with a burn-address emitter.31. 0x1303753839659cd4ca526a9c2e7091cc68be26ab Second unsolicited token identified among excluded spam records with a burn-address emitter.Full transaction hashesTimes below refer to October 21, 2026, UTC. Transaction references and classifications are attributed to SentinelTX.1. 0x57b1847f6f2cf3d1676f6ba38064c0756d1fbec9b502c5dc662e35a2307fb0dd BSC. First gas funding, October 21 at 01:00:17 UTC; 0.007 BNB, unverified amount.2. 0xe9827bcce1262daf9a6026afdce9a4d51bf7e28dcd7d3ba767c9684fc8523468 BSC. Second gas top-up, stated as 0.01 BNB. The analysis places it in the preparation interval but does not give an exact time.3. 0xcbcdc77b393a30bf3212f80a8afdc334af642dc9615d47582cc5302f739da924 BSC. Anchor cited for NEM inventory funding. The analysis does not itemize all sixteen NEM transfer hashes.4. 0x54842ae0334a6b4bd2b24fbbe0251ea2c302f2ab253f87f2340b7462a7d8a4cb BSC. NEM transfer into the attack contract at 03:28:30 UTC; 767,811.3061168424 NEM, unverified amount.5. 0xfb093c96c0094cbcca10801f97ed2e5ed3d96550ce64b544df5a349545723f91 BSC. Exploit transaction, block 128,866,147, 03:28:50 UTC. SentinelTX classifies the payment of 726,307.1011248019 BSC-USD to the signer as confirmed.6. 0x4da49613a58f3d872c5991c0b7fc1a3d4ebb6b2b3c55fab768c490e57b104a68 BSC. Router exit, block 128,867,454, 03:38:38 UTC; source hash used to correlate the Relay bridge record. SentinelTX records EIP-7702 type-4 execution.7. 0xc4acd18a0e8f4b4f24b47ce6e57a7c936b148108327236125daac250d07bc8bb Ethereum. Reported bridge delivery, block 26,238,334, 03:39:11 UTC; 725,384.763364 USDT, unverified amount.8. 0xfc7fc1af22358f55ea4f3847efb7a70514e81b4d0d8c5da392c7874609ab2533 Ethereum. First CoW settlement leg, 03:46:11 UTC; 250,000.0 USDT, unverified amount.9. 0x0757d2285bd862798c3b52181e919e8853d6037e8096e4fdf7456a7e3269ab0d Ethereum. Second CoW settlement leg, 03:47:11 UTC; 250,000.0 USDT, unverified amount.10. 0xbcef08a442ca7bba882c43ebf61fbc6fc285a70d7d207238bbea797b17817cfb Ethereum. Third CoW settlement leg, 03:47:47 UTC; 225,384.763364 USDT, unverified amount.11. 0xf66fa8c86299c9de6798556d42966fb9fa8c6b47b0d1eb8080344685af3668fa BSC. Funder’s post-exploit NEM sale, 03:37:01 UTC, through the TransitSwapRouterV5-labeled route.12. 0x38739784a8b13de37666e5770de7d2603a92ee50f233789b97ddd7c468300ed2 BSC. Example inbound cycle to the funder, 03:26:19 UTC, including 12,571.42 BSC-USD and NEM, as stated in the analysis.13. 0x57a6519c13ad203c479d3166fea6ddefc46ad994d14e665c939778ab12f97d57 BSC. Example corresponding BSC-USD return, 03:26:45 UTC.14. 0xce77892c0e98a893f0b109d0f905c9423337addec5142edaf75be07eb3a73f53 BSC. WBNB transfer to probable helper 0x2db7fca7a84a4ae69d41aec8d74b96b679c8ac5e.15. 0x645edaec509f12f493ca15a42e793fc731dfc0610da85b7a1ee59dd7c609f0d7 BSC. WBNB transfer to probable helper 0xbae2628c3f926971d4fc66c16120b2c7e0dce42a.16. 0x0e714d980478f9f636eae18d81ec5399e66eeee6926c113e886b243818e553df BSC. WBNB transfer to probable helper 0x0c3dac1d3b6f870b5bca16b7926631b525216865.17. 0xec0de15f90e82015087eae522d2771de1ee8ac192cd91b8a851fa802079d34c6 BSC. WBNB transfer to probable helper 0xe1a9d2ecfb453be4608c126ef95ee71faec7f9cc.18. 0xa3b2e00ade40364427fbcc08803fe9fa3c7de8aac45dcd92986e140890150ea9 BSC. WBNB transfer to probable helper 0x07d792806989300cd3b5d05329fea154a32ad96b.19. 0xfb5384ed31469f13842a77a05ca0511402b7bad0d8af5f858de5acb9155e7124 BSC. WBNB transfer to probable helper 0xa16f9a316a2b9ef97994cd47991b72ecbebfd7db.20. 0xcf4469e6214a085023251542c924fc468be8856a144075ddaf47360fcc8792e3 BSC. WBNB transfer to attack contract 0x5e6d1f40be466dd2facc94a26818948ecd3b1ca2.21. 0x2b407b29b19baf491bfbcdd2a2e9c67f939e17bae22ffff6bd8f6287646326f8 BSC. Suspected address-poisoning record at 01:07:18 UTC. Excluded from economic tracing and attribution.Other explicit identifiersCase reference: CASE-20261024-NEM1.Chains: BNB Smart Chain, chain ID 56; Ethereum, chain ID 1.Exploit calldata selector: 0x05d546ef. Final raw word: 0x2a, decimal 42. No ABI-decoded meaning is established.BSC exit observed byte pattern: 0x095ea7b3, described in the source as an approve pattern; inner router call not ABI-decoded.Control-call selector: 0xe9ae5c53. Ethereum delegated-code status is not established.BSC authorization nonce: 0x32. BSC transaction nonce: 0x31.Reported route text: "Source":"BUNGEE_AUTO", "AmountInUSD":"6.781519". This describes the residual BNB route, not an added valuation of the main proceeds.Helper-creation record identifiers: #1–#6; source block range 128,850,621–128,864,238. Full creation hashes are absent from the original narrative.Ethereum first control-transaction block: 26,238,366; nonce 0. Its hash is not supplied.Residual BNB transaction block: 128,867,751, at 03:40:52 UTC. Its hash is not supplied.Coverage of the identifier registerThe full set of sixteen inventory-funding transaction hashes is not enumerated.The full set of 45 inbound NEM transfer hashes for the upstream contract is not enumerated.The four inbound ETH receipt hashes and counterparties are not itemized.The helper creation transaction hashes are not itemized.The WBNB wrap transaction hash at 01:31:59 UTC is not provided.The mirror-image poisoning transaction hash, burn-emitter address, and remaining spam-token identifiers are not supplied in full.The full residual BNB route transaction hash and all control-transaction hashes are not provided.These omissions limit reconstruction of the individual movements and the helper-creation mapping. The register does not infer missing identifiers.

A large USDT transfer drew attention to CoinDCX-linked deposit addresses in October 2026. CoinDCX later described a failure in the process used to collect deposits from retired addresses. The chain can help test the transfer sequence. It cannot show the exchange’s internal customer credits or diagnose its collection software.This review follows one large-source address into a receiving address, then its six first-hop recipients and three selected onward transfers. Before following those departures, it reads a small deposit-and-collection sequence from the same day. Address names below describe observed roles, not proven people or organizations.The verified route is large-source address → receiving address → six first-hop recipients, with only three onward transfers examined in detail. The operational question is separate: a sampled deposit address still made a collection transfer on 21 October. This does not identify when another address, or the wider system, stopped collecting deposits.What the address names meanUSDT is a token intended to track the US dollar. This review follows the canonical TRON USDT contract, rather than trusting a token’s ticker alone. TRX is TRON’s native coin, used to pay transaction costs. A sweep is a transfer that collects deposits into another address. A transfer can fit that pattern without proving which software or person submitted it.A Transfer event is a record emitted by the token contract when tokens move. A solidified receipt is the network record of an executed transaction after it has become final. Matching these records checks the asset movement; it does not identify the person behind an address.Role used hereFull TRON addressLarge sourceTQKJQrWok6fsBqZi3mkLkL6qX4YEgjqWUyReceiving address / collectorTAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTSampled deposit addressTMRgWCMJ5CL82GypJMDrGemUs5r1zh51k1Fee-source addressTFLxNHunhEizmeEdiMyA3r2XGLSKaEznGdCollection-pattern destinationTU7BbAsb8t371eMijQeiGXsiLvY1vZbsFsBranch ATMJMTCvtPgMRQmLBYUTmdwfEozoveccUjqBranch BTFaHkHcMGWLnnBCaGVpHBHufb1DNNHbadhBranch CTUNxeav4BWVoFGGaE97ygHkKYdKLJTHkbUCoinDCX’s 22 October follow-up names the TQKJQ wallet and says deprecated, previously compromised deposit addresses remained exposed to user deposits. It attributes operational losses to a sweep failure and says affected users were credited. These remain company statements, not findings from customer-account records.Scope before the numbersMeasureCoverageIncident records21–22 October 2026; earlier source history used only as contextEvidence cutoff23 October 2026 06:30:00 UTC; not a live balance assessmentDirect execution checks27 USDT Transfer logs in solidified receipts, plus 2 native TRX transactionsIndexed contextSix address/time-bounded canonical-USDT histories, plus one sampled deposit-day history. History rows are not all separately receipt-verified.DepthSix first-hop recipients; three selected second-hop transfers. No complete downstream reconstruction.Before the incident: collection was observable, but a failure interval is not4 May: a large-source deposit moved onward in 39 secondsThe large source received 300,000 USDT at 05:39:57 UTC on 4 May. At 05:40:36, it transferred the same amount to the collection-pattern destination. Both records have successful, solidified token-transfer logs. The 39-second interval shows a quick collection-like pair; it does not reveal the program that handled it. Deposit · Onward transfer.The bounded history contains 183 canonical-USDT transfer entries for this address from 1 January through the cutoff. Its last indexed departure before 21 October is at 05:45:33 UTC on 4 May. No further entry appears before the October departure in that returned range. This is an observed gap in one token’s transfer history. It is not a dated outage log, proof of a software failure since May, or proof that every deposited unit had remained untouched.21 October: a different address still made a collection transferAt 12:13:45 UTC, the sampled deposit address received 9.67 USDT. Twelve seconds later it received 15 TRX from the fee-source address. At 12:14:06 it sent 9.67 USDT to the same collection-pattern destination used in the May pair. The token deposit and onward movement are 21 seconds apart; the TRX transfer precedes the onward movement by 9 seconds. The fee transfer supplies a separate asset and must not be added to the USDT amount. Deposit · 15TRX · Collection transfer.Read Figure 1 from its first timestamp downward. Its arrows show chronological order, not tokens passing through every box. The blue-gray panels are observed records; the beige panel separates funding of the receiving address from the sampled collection pair.Figure 1. A chronology of the sampled address and fee-source records. All times are UTC; spacing is schematic. The 168.63 USDT departure is not the earlier 9.67 USDT deposit being counted again.The important observation is coexistence: a collection-like transfer occurred that day, before later departures to the receiving address. At 12:19:33, the fee-source address sent 100 TRX to that receiving address. At 15:15:21, the sampled deposit address sent 168.63 USDT there. The sequence does not prove that the same operator made all these transactions. The earlier funding of the 168.63 USDT is outside this day’s sample, so the two token amounts are not treated as a single deposit.What remains missing is the operating record: which addresses the sweeper was configured to watch, when jobs failed, whether retries were attempted, and how deposits were credited. An absence of later USDT transfers at one address cannot supply those answers. The company’s statement does not give exact outage start and end timestamps.21 October 15:35:54 UTC: the large transfer reaches the collectorAt 15:35:54, the large source sent 15,819,002 USDT to the receiving address in block 87307956. The token’s Transfer event matches both full addresses and the raw amount 15819002000000. With 6 decimal places this is 15,819,002 USDT. The separate 6.7735 TRX transaction fee does not reduce the token-transfer quantity. Large-source transaction.This establishes delivery of the tokens. It does not establish who controlled either key, whether the transfer was authorized, or what proportion of customers’ balances it represented. The receiving address also has other USDT inflows in the queried range. Its later departures must therefore be read as movements out of a shared token pool, not as uniquely identifiable units from this one deposit.From 17:05 UTC: the collector distributes USDT to six addressesThe first verified outgoing transfer in this window was 10 USDT at 17:05:27 to the address used here as Branch A. A 2,000,000 USDT transfer followed to that same address at 17:07:18. This ordering can be consistent with testing before a larger transfer, but intent is not recorded. Other branches followed later that evening and overnight.All 18 outgoing USDT entries returned for the collector in this window were checked against solidified Transfer logs. They total 15,991,414.313412 USDT across six distinct recipients. That is the collector’s observed outgoing volume, not an independently established incident-loss total. Its 64-entry indexed history also contains 46 incoming entries. Their relationship to the incident has not been individually established. Small receipts remain in the context data rather than being automatically assigned to the incident. Full addresses, not shared prefixes or suffixes, define each counterparty.Start Figure 2 at the receiving address and follow each solid arrow into a recipient panel. Each panel aggregates only collector-to-recipient transfers, without adding any later forwarding as new loss. Colors separate panels rather than claiming different levels of guilt or ownership.Figure 2. Observed first-hop USDT transfers through 23 October 06:30 UTC. Solid arrows show verified token direction; line width and spacing are schematic. No exchange identity, cash-out, or common control is asserted.First-hop recipientVerified collector departuresTMJMTCvtPgMRQmLBYUTmdwfEozoveccUjq7,135,881.313412 USDT in 4 transfersTFaHkHcMGWLnnBCaGVpHBHufb1DNNHbadh4,000,000 USDT in 2 transfersTUNxeav4BWVoFGGaE97ygHkKYdKLJTHkbU3,000,000 USDT in 1 transferTB3U9KPtffSxrNqjvKz3AMYcaT1UWh3Grq1,013,312 USDT in 5 transfersTHkMta6QMbbxNqiX9MifqGjRoDc5xyiYyA822,221 USDT in 5 transfersTVK3dRqe9Aqfcdxvp9fWScAMdGmDBHyG6L20,000 USDT in 1 transferThe diagram shows distribution, not a final destination. Three selected onward records extend the review by one more step. Branch A sent 100,000 USDT to a further address at 17:16:39 on 21 October (record); Branch C sent 1,000,000 USDT at 19:46:15 (record); Branch B sent 1,000,000 USDT at 05:52:27 on 22 October (record). These are selected continuations, not the complete onward history. Their recipients are preserved in the appendix without service labels because independent evidence for such labels was not established here.Once value is pooled with other inflows, a matching amount or a later transfer alone does not earmark particular units from the large-source deposit. A service label, if later confirmed, would identify an investigative contact point—not a person, a completed sale, or recoverable funds.23–24 October: a reported freeze and a narrower state checkAMLBot reported on 23 October that Tether had frozen about $2.2 million linked to this incident. That is AMLBot’s attributed estimate, not a frozen-value total reproduced by this review. A blacklist restricts a token’s use at an address; it is not evidence that funds have been returned to customers.A separate read-only query of the canonical USDT contract shortly after 23:33 UTC on 23 October checked two addresses already in this report. The function isBlackListed(address) returns whether an address is currently on that token’s blacklist. It returned true for the collector’s 20,000-USDT first-hop recipient and false for the selected Branch C onward recipient. These are latest-state responses, not measurements pinned to a historical block or a verification of the blacklist transaction, its timing, or a frozen balance.Existing TRON addressUSDT blacklist response at the follow-up readTVK3dRqe9Aqfcdxvp9fWScAMdGmDBHyG6Ltrue; the 20,000-USDT first-hop recipientTTb34rZMrTi3gHNKeFLg1qaaTqXsdyG48vfalse; selected Branch C onward recipientThe two responses do not reproduce AMLBot’s wider address set or estimated total. A false response also does not mean an address is safe or that every asset is unrestricted. Figure 2 remains a historical transfer map through its stated cutoff, not a map of current restrictions. The sweep failure’s exact interval and cause, ownership, customer credits, and the complete net loss remain unresolved.What the records support, and what they leave openThe narrow result is stronger than a transaction alert but smaller than a full incident reconstruction: a large source-to-collector transfer is verified, the collector’s six first-hop recipients are reconciled, and three further transfers are anchored. A separate deposit sample shows a collection-like transfer on the incident day. None of these records diagnoses the sweep failure described by CoinDCX.QuestionEvidence boundaryWas there a transfer?Yes: canonical token logs and solidified execution receipts match the selected full identifiers.Was the entire sweep system stopped?Not established. A sampled collection transfer occurred on 21 October; address-specific configuration and job logs were not available.Was this a newly compromised active wallet?Not established. Company attribution to deprecated, previously compromised addresses is kept separate from the transfer facts.What was the total loss?Not determined here. Collector volume includes other receipts and cannot replace full incident/net-loss reconciliation.Were users credited or funds recovered?CoinDCX says affected users were credited. Internal credits, recovery transfers and full customer allocation were not independently checked.Who operated the recipients?Unknown. No identity or completed cash-out conclusion follows from these selected records.Where a response can be specificFor the operator, the relevant review is address lifecycle management: compare the retired-address list with the actual watch list, fee-funding rules and collection-job failures. The 12:13–12:14 sample is a useful timestamped control point for that comparison, not proof that every address was functioning. For affected deposit reconciliation, each customer’s original transaction must be matched with the exchange’s internal credit record.For investigators, preserve the 18 collector departure hashes and request account-level evidence only where a recipient’s service attribution can be independently established. An unlabelled downstream address should remain unlabelled. The next technical step is selective service-endpoint verification, not expanding every address into a supposed attacker cluster.Evidence appendixAll addresses below are on TRON. Address links retain the full string and point to address pages; transaction links retain the complete hash. Block times are UTC. USDT quantities exclude separate TRX fees. This appendix contains the selected 27 receipt-verified USDT transfers and 2 native TRX records, not every indexed context entry.AddressRole and ownership boundaryTFLxNHunhEizmeEdiMyA3r2XGLSKaEznGdFee-source address; observed role only; beneficial owner not verified.TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTReceiving address / collector; observed role only; beneficial owner not verified.TMJMTCvtPgMRQmLBYUTmdwfEozoveccUjqFirst-hop recipient; observed role only; beneficial owner not verified.TFaHkHcMGWLnnBCaGVpHBHufb1DNNHbadhFirst-hop recipient; observed role only; beneficial owner not verified.TUNxeav4BWVoFGGaE97ygHkKYdKLJTHkbUFirst-hop recipient; observed role only; beneficial owner not verified.TB3U9KPtffSxrNqjvKz3AMYcaT1UWh3GrqFirst-hop recipient; observed role only; beneficial owner not verified.THkMta6QMbbxNqiX9MifqGjRoDc5xyiYyAFirst-hop recipient; observed role only; beneficial owner not verified.TVK3dRqe9Aqfcdxvp9fWScAMdGmDBHyG6LFirst-hop recipient; observed role only; beneficial owner not verified.TSC5MzYDNqtp3HDpqCNpTAs5pnT7wt4HrdSelected upstream or onward counterparty; observed role only; beneficial owner not verified.TQKJQrWok6fsBqZi3mkLkL6qX4YEgjqWUyLarge source; observed role only; beneficial owner not verified.TU7BbAsb8t371eMijQeiGXsiLvY1vZbsFsCollection-pattern destination; observed role only; beneficial owner not verified.TMRgWCMJ5CL82GypJMDrGemUs5r1zh51k1Sampled deposit address; observed role only; beneficial owner not verified.TBq7LMgo1CetQxBPGJbrTPnjtC77gsqgZcSelected upstream or onward counterparty; observed role only; beneficial owner not verified.TL8WBPjRHVdYRZ5oZRF8LbmzyFPbp1gPRYSelected upstream or onward counterparty; observed role only; beneficial owner not verified.TTb34rZMrTi3gHNKeFLg1qaaTqXsdyG48vSelected upstream or onward counterparty; observed role only; beneficial owner not verified.TJiGzdgjrSnCxAWYDdaN3CBhfw75vjDBk9Selected upstream or onward counterparty; observed role only; beneficial owner not verified.USDT execution records 1–7UTC / quantity / blockFull identifiers2026-05-04 05:39:57 UTC300,000 USDTBlock 8240168157daab0860df1112194d4dbf32adbfd3bbc1edd54af89a59a5fb3ec0b135ba45From TSC5MzYDNqtp3HDpqCNpTAs5pnT7wt4HrdTo TQKJQrWok6fsBqZi3mkLkL6qX4YEgjqWUyRaw token units: 3000000000002026-05-04 05:40:36 UTC300,000 USDTBlock 82401694d9819837a67c65a4768634f54bc55cb67de825a029047615ccf8af85f9694fc7From TQKJQrWok6fsBqZi3mkLkL6qX4YEgjqWUyTo TU7BbAsb8t371eMijQeiGXsiLvY1vZbsFsRaw token units: 3000000000002026-10-21 12:13:45 UTC9.67 USDTBlock 87303913400a5a0d7aecace98ac34614819b9d66840b52bf3870ef803b5572dd5fb2a30fFrom TJiGzdgjrSnCxAWYDdaN3CBhfw75vjDBk9To TMRgWCMJ5CL82GypJMDrGemUs5r1zh51k1Raw token units: 96700002026-10-21 12:14:06 UTC9.67 USDTBlock 87303920e9a0b6b4c05f7eb70719cd33fde5c84915d30b4b7271b6d6b478b10837dbdb75From TMRgWCMJ5CL82GypJMDrGemUs5r1zh51k1To TU7BbAsb8t371eMijQeiGXsiLvY1vZbsFsRaw token units: 96700002026-10-21 15:15:21 UTC168.63 USDTBlock 873075456833f9329980e375b1c2e437d470307e58891366578d539a463226bfc9c50326From TMRgWCMJ5CL82GypJMDrGemUs5r1zh51k1To TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTRaw token units: 1686300002026-10-21 15:35:54 UTC15,819,002 USDTBlock 873079566c555aa65b2a6f38454ad1a52fc2780d159d6338bef0f79b6c42e8b88b16779bFrom TQKJQrWok6fsBqZi3mkLkL6qX4YEgjqWUyTo TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTRaw token units: 158190020000002026-10-21 17:05:27 UTC10 USDTBlock 87309747b53b51b685f5f81d8048ddd9aafbf5a6be0aec59847e2be9602fcda12113f0beFrom TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TMJMTCvtPgMRQmLBYUTmdwfEozoveccUjqRaw token units: 10000000USDT execution records 8–14UTC / quantity / blockFull identifiers2026-10-21 17:07:18 UTC2,000,000 USDTBlock 873097846b14f26ee642ee63509da738fd4c144c2293962f28aa510618b17a3c4f4fb34fFrom TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TMJMTCvtPgMRQmLBYUTmdwfEozoveccUjqRaw token units: 20000000000002026-10-21 17:16:39 UTC100,000 USDTBlock 87309971a7161f359e33c0af883df044c41d82b1fe5e54e9c29e130e48514f7c36bcce44From TMJMTCvtPgMRQmLBYUTmdwfEozoveccUjqTo TBq7LMgo1CetQxBPGJbrTPnjtC77gsqgZcRaw token units: 1000000000002026-10-21 18:57:54 UTC1,000,000 USDTBlock 87311994e000e895a76f4db4dcdef67b33354e2965a94991d518a8e42b021da1c5d5a9f2From TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TFaHkHcMGWLnnBCaGVpHBHufb1DNNHbadhRaw token units: 10000000000002026-10-21 19:04:54 UTC3,000,000 USDTBlock 8731213451bfc70107a8ebb986e1c2211eca8c74e6a541bfeb5efa53c1ceffcb0ad5dbe1From TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TFaHkHcMGWLnnBCaGVpHBHufb1DNNHbadhRaw token units: 30000000000002026-10-21 19:05:30 UTC3,000,000 USDTBlock 873121461ed5c4b9fb1a6accb3ba42f0058903c3efb46fede062286d8a1127805a00ae1bFrom TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TUNxeav4BWVoFGGaE97ygHkKYdKLJTHkbURaw token units: 30000000000002026-10-21 19:46:15 UTC1,000,000 USDTBlock 87312961ce73a1f9f25de7fa8d215265641ad0da8e63e886e01a8800a9ba06e7329f1783From TUNxeav4BWVoFGGaE97ygHkKYdKLJTHkbUTo TTb34rZMrTi3gHNKeFLg1qaaTqXsdyG48vRaw token units: 10000000000002026-10-22 00:51:54 UTC3,000,000 USDTBlock 873190724c698146c1f789fa270ff97dda75aceeeafa5a8d969872ffd824d500f61c6e29From TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TMJMTCvtPgMRQmLBYUTmdwfEozoveccUjqRaw token units: 3000000000000USDT execution records 15–21UTC / quantity / blockFull identifiers2026-10-22 01:17:30 UTC77,761 USDTBlock 8731958459142c2e93e530ff1d1b02c44bacd32ab21d5d1ed32fa8f3dc72f8e47145b6dfFrom TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TB3U9KPtffSxrNqjvKz3AMYcaT1UWh3GrqRaw token units: 777610000002026-10-22 01:27:45 UTC155,521 USDTBlock 87319789c291280f4b5e7264be49bddbdddfc744d7d5f778da7fdd8a26779eca202f97c1From TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TB3U9KPtffSxrNqjvKz3AMYcaT1UWh3GrqRaw token units: 1555210000002026-10-22 01:43:45 UTC156,006 USDTBlock 8732010971fe854fb614adef3b342d79dbbc62bc8655d45dc378e14b7c81ea12c21f4757From TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TB3U9KPtffSxrNqjvKz3AMYcaT1UWh3GrqRaw token units: 1560060000002026-10-22 01:46:48 UTC76,190 USDTBlock 8732017031bebda0b472c20faef0ef7ee1a92e5c067666f3e40423f79651e1e1137bbcfeFrom TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo THkMta6QMbbxNqiX9MifqGjRoDc5xyiYyARaw token units: 761900000002026-10-22 02:05:48 UTC111,111 USDTBlock 87320550ca3f2e28b425331e155cea10d07685a9395e90f669fe02869aa35d60c5ba139eFrom TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo THkMta6QMbbxNqiX9MifqGjRoDc5xyiYyARaw token units: 1111110000002026-10-22 02:30:54 UTC158,730 USDTBlock 87321052c9429963005227a1dbb701b3f13e28813f871c47cc056ec454076dc0f48dcf6cFrom TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo THkMta6QMbbxNqiX9MifqGjRoDc5xyiYyARaw token units: 1587300000002026-10-22 02:33:15 UTC312,012 USDTBlock 873210996cf9e0125ea448cf2e8502d78ac9b3675b260d4c0d4ecb2924817f7e17fcbe6dFrom TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TB3U9KPtffSxrNqjvKz3AMYcaT1UWh3GrqRaw token units: 312012000000USDT execution records 22–27UTC / quantity / blockFull identifiers2026-10-22 02:41:24 UTC317,460 USDTBlock 87321262d23570456c6afa5bdf5f6e7806eba477b6e1b1c0829144a3761cc92e06a2a64aFrom TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo THkMta6QMbbxNqiX9MifqGjRoDc5xyiYyARaw token units: 3174600000002026-10-22 03:06:36 UTC312,012 USDTBlock 873217666f79a3e8dfc06570296495b11363a6128234897ae9b25ba149f166c4490ca07bFrom TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TB3U9KPtffSxrNqjvKz3AMYcaT1UWh3GrqRaw token units: 3120120000002026-10-22 03:12:24 UTC20,000 USDTBlock 873218821b8f2e07b69ef0a9d5bc9b5fb02310bee84c34dde3bb3ca0cd7c52d14ae8fc5aFrom TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TVK3dRqe9Aqfcdxvp9fWScAMdGmDBHyG6LRaw token units: 200000000002026-10-22 03:20:51 UTC158,730 USDTBlock 8732205113ff3288c75bc63d3c86c52cafed16e61c7e7f0277e239175066e5b16736f05aFrom TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo THkMta6QMbbxNqiX9MifqGjRoDc5xyiYyARaw token units: 1587300000002026-10-22 03:22:03 UTC2,135,871.313412 USDTBlock 87322075845295436b162124dc1a1476bb1535a2ff9b92511e62caebdd8e8d16c83c2030From TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTTo TMJMTCvtPgMRQmLBYUTmdwfEozoveccUjqRaw token units: 21358713134122026-10-22 05:52:27 UTC1,000,000 USDTBlock 8732508303309f46ef625713dbff94755e97269770f28f6eb8e4c004db5b0d525eb38326From TFaHkHcMGWLnnBCaGVpHBHufb1DNNHbadhTo TL8WBPjRHVdYRZ5oZRF8LbmzyFPbp1gPRYRaw token units: 1000000000000Native TRX recordsUTC / quantity / blockFull identifiers2026-10-21 12:13:57 UTC15 TRXBlock 87303917b4dc7b6d4eb313f08ef4f7b8c63a4f43730f327d6e2a0925f78be960b3464d7eFrom TFLxNHunhEizmeEdiMyA3r2XGLSKaEznGdTo TMRgWCMJ5CL82GypJMDrGemUs5r1zh51k12026-10-21 12:19:33 UTC100 TRXBlock 8730402990258d083228e2e57b3e74394ff3dae4d10545db69e4634959a99d1ab9eb91f7From TFLxNHunhEizmeEdiMyA3r2XGLSKaEznGdTo TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bTSource and method registerSourceUse and limitationCoinDCX22October follow-upOfficial explanation and crediting claim; not independently audited operational records.Bitquery incident researchDiscovery source for address leads only. Its broad loss, ownership and service conclusions are not adopted here.TRON history documentationConfirmed canonical-USDT indexed history at explicit address/time/page bounds. Not a historical balance proof.TRON execution-receipt documentationSelected solidified receipts independently matched by token contract, full source/destination, event signature, raw amount and timestamp.TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6tCanonical USDT contract used throughout;6 decimal places.The research uses public TRON records and direct event decoding. No complete exchange-custody audit, key-forensics review or downstream recovery finding is implied.