Defend Against Cybercrime with the Power of Community

SentinelTX’s examination of the zkLink Nova withdrawal incident follows one Ethereum signer from preparation to a single transaction that paid ETH and eleven token types, then through conversions and dispersal to three recipient accounts. The execution sequence is visible in the report, but the forged-root explanation, wallet controllers and incident-attributable share of later holdings are not established.The report also contains conflicting confidence labels and material amount warnings. This article preserves those qualifications: the observed DAI balances are not presented as traced cash-out, and the FixedFloat-labelled destination remains an unverified lead rather than a confirmed exit.1. Scope and roles before the numbersThe seed account is the wallet at the centre of the examined withdrawal, not an identified person. Contract roles below distinguish what the call trace shows from identities or functions supplied by public reporting.Label / RecordNetwork and collection: Ethereum mainnet (chain ID 1) only. Collection: 29 October 2026, approximately 13:24–13:31 UTC; chain tip moved from block 26298676 to 26298706. Other chains were not screened.Seed account: 0xaca0655a11200a80d33d0e48786317304cde5718. An externally owned account (EOA): signer of the examined transaction, withdrawal recipient and disperser. Its real-world identity is unknown.Execution contract: 0xd5f162b68a0281686e8dc76db8d67d2f3e6aff07. Created by the seed account and called in the examined transaction.Payout contracts: 0x5fd9f73286b7e8683bab45019c94553b93e015cf paid ETH and was consulted before token transfers; its core/escrow role is an inference. 0xad16edcf7deb7e90096a259c81269d811544b6b6 supplied eleven token types; its zkLink Nova ERC20 bridge identity is reported, not label-verified.Recipient shorthand: 0x211b…9c6a = 0x211b4aebefea02470587286b398ed28fb7e09c6a; 0x75dc…c0f3 = 0x75dcf3395b6cbefc6b66b28d6d93f193b58dc0f3; 0x2d5a…afb0 = 0x2d5a8aabf7af4022e314eb2a54753ba2402bafb0. Similar behaviour does not establish common control.Meaning of an amount: A receipt or transfer is a movement; a balance is a snapshot. Gross movement counts value again at each hop. None is automatically the incident loss, a cash-out total or a recoverable amount. Unlike assets are not added together.Public reporting collected by SentinelTX described a forged batch root injected through a public relayer and attributed detection to Blockaid. The report records estimates from USD 778,625 to about USD 786k; the USD 805k upper bound in the referral did not appear in its search results. These are reported estimates, not a loss calculated by the investigation. Only search snippets were read, not publisher pages, Blockaid’s primary publication or the Defimon Telegram channel.2. From preparation to the withdrawalAll event times below are UTC block timestamps. The report describes a short wallet lifecycle on 28 October 2026:15:49:11, block 26292232: the seed received a reported 0.02723853 ETH from a database-labelled FixedFloat address. The funding hash is not cited in the narrative, and the amount is unverified.15:59:59–17:49:11: preparation included a reported 0.00045-ETH swap for 1.045988 USDC, a zero-value USDC call, a reported deposit of 0.00032933333342 ETH plus 1.0 USDC to the ERC20 bridge, and a reported 0.0021-ETH payment to a contract later seen in the call path. The preparation amounts carry the report’s unverified-amount qualification.18:51:11, block 26293139: the seed created its execution contract at nonce 4.22:21:35, block 26294188: the seed called that contract in position 0 of the block. The transaction succeeded, carried zero native value, used 1,109,471 gas and paid a fee of 0.001161701384313756 ETH. The report records an internal payment of 22.431294525563808989 ETH to the seed plus eleven token types. [E01]The seed then sent itself a zero-value transaction at position 1 of the same block. The narrative gives its fee as about 1 ETH, an unverified amount. A builder-priority-payment interpretation is the report’s assessment, not established intent.The main conclusion treats the withdrawal as block-anchored because its hash is not cited in that section’s prose. Appendix A does list the full seed-transaction hash; it is retained in the evidence register below. That additional reference does not establish whether the withdrawals were authorised.3. What the execution sequence actually showsThe call trace has 100 frames, a maximum depth of 9 and no revert. The seed’s contract first read the ETH-paying contract, then made two relay-path calls through several contracts. Those calls reached the ETH-paying contract before the payout. Next came the ETH payment and eleven calls to the ERC20 bridge. Each token call consulted the ETH-paying contract before ending in a token transfer. [E01]Diagram 1. Simplified execution order within the seed transaction. Solid arrows indicate sequence, not a separately proven funds route. A forged batch root, bypassed checks and a public-relayer identity are not established.Color and line key: slate marks observed execution stages; amber marks claims not established by the record. Solid arrows indicate execution order.Address/role key: seed = 0xaca0655a11200a80d33d0e48786317304cde5718; execution contract = 0xd5f162b68a0281686e8dc76db8d67d2f3e6aff07; ETH-paying contract = 0x5fd9f73286b7e8683bab45019c94553b93e015cf; ERC20 payout contract = 0xad16edcf7deb7e90096a259c81269d811544b6b6. The role of 0x0fdc28e64772a70109d10fd068f859cfa7dea2c6 as a public relayer remains reported, not established.Source: SentinelTX native PDF, CASE-ASYNCEA1, pp. 14–15; seed control record on p. 35.This ordering has the shape of a message or root submission followed by withdrawal finalisation, which is the report’s inference. No selector, event log or calldata was ABI-decoded. The trace therefore does not establish that a root was submitted, that it was forged, or which validation checks were bypassed. No owner-signature execTransaction calls were present; the seed account, not the bridge or protocol, signed the transaction.4. Token receipts and the conversion sequenceThe receipt table records the following eleven token types. Quantities are reproduced at the table’s precision, without adding unlike assets or turning them into a new USD total:pufETH: 245.73789885106106. The two described conversion legs were 132.0 pufETH to the null address with 141.9532103998426 WETH received, then 113.73789885106108 pufETH to a counterparty contract with 123.264115827052162383 ETH returned. Both pufETH leg quantities are flagged unverified. [E02] [E03]USDC: 18,113.448053 received. The later conversion sent 18,113.494041 USDC and returned 18,109.0636110923 DAI. The report explains the larger outgoing USDC amount as the receipt plus 1.045988 USDC bought during preparation, less the 1.0 USDC deposit. [E04]WBTC: 0.17360197 received, followed by a conversion returning 14,048.682073834 DAI. [E05]Renzo Restaked ETH: 12.569253862270157, forwarded to 0x211b…9c6a at 22:55:35. Its subsequent conversion is possible but unverified.rsETH: 6.86647159999; STONE: 6.299750644063014; USDT: 3,360.898152; rswETH: 0.500000001; wstETH: 0.4659585510407948. The report lists sales through MetaMask Swap between 22:42:35 and 22:44:47, but does not itemise their proceeds.mswETH: 2.4826191990067406; mstETH: 2.6372057700999996. These were not moved in the report’s account and remained at the seed at collection.There is a source inconsistency in the pufETH receipt section: its table gives 245.73789885106106 pufETH, while the opening sentence separately describes an unverified receipt attributed as 132.0 pufETH. Both statements remain in the PDF; this article does not substitute the smaller figure for the table total or silently reconcile them.The USDC and WBTC conversions are described as producing 32,157.7456849263 DAI. The seed forwarded a reported 32,157.745684926304 DAI to 0x75dc…c0f3 at 23:03:59; that forwarding amount is flagged unverified. A 22:57:35 WETH-contract call is consistent with an unwrap by its selector, but its amount is not established. Two further zero-value pufETH calls were not decoded.5. Three recipients, with amount and control limitsThe chronology labels three native-ETH dispersals as signer-verified. The conclusion and warning appendix nevertheless mark their quantities unverified. The entries below therefore retain the report’s numbers as qualified source figures, not independently confirmed amounts:22:58:35, block 26294373: 101 ETH to 0x211b…9c6a; amount unverified in the conclusion. [E06]23:00:11, block 26294381: 100 ETH to 0x2d5a…afb0; amount unverified in the conclusion. [E07]23:01:23, block 26294387: 102.061003174173709298 ETH to 0x75dc…c0f3; amount unverified in the conclusion. [E08]The narrative’s gross total is 303.061003174173709298 ETH, subject to the same component-amount qualifications. The recipients then converted ETH into DAI through MetaMask Swap and Uniswap during the first hour of 29 October. Several swaps lack cited hashes or established inputs. Similar timing and sizes support the report’s description of splitting, but do not identify controllers or prove structuring intent; slippage management is an alternative explanation given in the PDF.At 0x75dc…c0f3, the report describes roughly 270,847.79 DAI of inflows and 49,000 DAI leaving: a flagged 24,000-DAI MetaMask movement plus an unresolved approximately 25,000-DAI candidate leg. At 0x2d5a…afb0, the narrative includes an unverified 5,000-DAI transfer and two MetaMask movements of 4,895 DAI and 11,750 DAI. The approximately 25,000-DAI and 5,000-DAI onward legs remain unresolved in its conclusion. [E11] [E12]6. What the recipient balances meanThe report’s balance snapshot is separate from its flow tracing. It records the following holdings at collection; no incident-attributable share was computed, and control of the three recipients is not established.Holder / Observed balance and measurement0x211b…9c6a: 268,344.091493 DAI; 0.012780831346009828 native ETH.0x75dc…c0f3: 221,847.790589 DAI; 0.304521672474179225 native ETH.0x2d5a…afb0: 211,962.663173 DAI; 0.293706861952877501 native ETH.Same-asset totals: 702,154.545255 DAI; separately, 0.611009365773066554 ETH. These are observed balances; no case-attributable share was computed and address control is not established.Seed account: 0.000927 ETH at approximately 13:26 UTC; 2.482619 mswETH and 2.637206 mstETH. These are the PDF’s displayed balance figures, not the higher-precision receipt quantities.Measurement boundary: DAI contract: 0x6b175474e89094c44da98b954eedeac495271d0f. DAI read at approximately 13:30 UTC on 29 October 2026; token-balance block not recorded. The three recipient ETH balances are at block 26298706. Source: PDF pp. 10, 21–22.Figure 2. Observed DAI balances read at approximately 13:30 UTC on 29 October 2026. The token-balance block was not recorded. These balances are not traced proceeds, attributed cash-out or an established recoverable amount.Color key: slate bars show DAI quantities on a common linear zero baseline. Labels preserve the exact reported balance values.Address/role key: 0x211b…9c6a = 0x211b4aebefea02470587286b398ed28fb7e09c6a; 0x75dc…c0f3 = 0x75dcf3395b6cbefc6b66b28d6d93f193b58dc0f3; 0x2d5a…afb0 = 0x2d5a8aabf7af4022e314eb2a54753ba2402bafb0. Recipient control is not established.Source: SentinelTX native PDF, pp. 10, 21–22 and 37. The PDF flags the aggregate 702,154.545255 DAI against a structured traced ceiling of approximately 270.8K DAI; it also explicitly describes the larger number as a commingled destination balance, not attributed cash-out.The warning and the balance description coexist in the source. The larger balance must not be converted into a claim that all 702,154.545255 DAI was traced from this withdrawal. Nor does the smaller approximately 270.8K DAI ceiling establish a recoverable balance, a total incident loss or the status of the separate ETH exchange lead.7. The FixedFloat-labelled lead is not a confirmed exitThe report describes a path from 0x75dc…c0f3 through 0x05b38c2d3c66031d72c990753f464271a7fd6def to 0x4e5b2e1dc63f6b91cb6cd759936495434c7e972f, which its attribution database labels FixedFloat. It gives the two legs as 5 ETH and 4.99999664 ETH, respectively; both amounts carry unverified-quantity qualifications. The second transaction is placed at 01:58:59 UTC on 29 October, block 26295266. [E09] [E10]The PDF’s confidence wording is inconsistent. The executive summary calls this path “anchored end to end,” and a table prints a deposit transaction hash. The cash-out confidence paragraph nevertheless calls the destination an “Unverified lead,” says no inbound hash anchors it, and states that the path cannot be confirmed. The warning appendix repeats that downgrade. This article retains the unverified-lead status and discloses the stronger wording rather than choosing one statement as a repair.Exchange identity is label-based, not a finding about a person. The report also says the incident-derived fraction was not computed because the native-ETH account implies other inflows. The same labelled address reportedly funded the seed earlier; that earlier payment was a withdrawal from the venue, not a deposit. No other exchange-deposit leg was identified, and Uniswap or MetaMask interactions are on-chain swaps, not custodial deposits.8. Mimic records and the remaining evidence gapsThe report excluded four apparent ETH movements after checking their full transaction records. Each was signed by a third party, 0x80d04079ffc53eb14edbeeb37279d126f45552df, carried zero native value and called a third-party contract, while the transfer listing mimicked a case transfer. Other exclusions include token-symbol mimics “ЕТН”, “DAl.” and “ERC ”, look-alike recipient addresses, unsolicited OVER receipts and small apparent ETH receipts that were not signer-verified.That distinction matters because a similar-looking address or symbol does not identify the genuine asset or recipient. The report set aside a DAI branch attributed to a look-alike address. Whether the candidate 5,000-DAI movement was intentional or a poisoning-induced mis-send remains unresolved. [E12]The report’s remaining boundaries are specific:Mechanism and coverage: one withdrawal transaction and one signer were examined. Other bridge withdrawals on 28–29 October were not screened. No cross-chain bridge deposit was identified among observed reachable deposits; this was not a screen of every chain.Trace depth and attribution: onward tracing reached four of five planned steps; 13 of 41 traced transactions are itemised in the retained view described by the narrative; 11 counterparties have no attribution result. The seed’s internal-transaction history was only partly readable. The deterministic cash-out propagation did not complete and was not relied on.Amounts and onward movement: unresolved items include the approximately 25,000-DAI and 5,000-DAI legs, the Renzo Restaked ETH disposition, the ETH inputs to 0x211b…9c6a’s swaps, the seed’s MetaMask proceeds and the WETH unwrap amount. The narrative also describes unexplained native-ETH inflows; these are not assigned to the incident.Measurement and valuation: token balances lack a recorded block. The report’s broader movement inventory includes repeated hops and unidentified token symbols, so it is not a loss total. Its pricing appendix says 53 movements have a USD value, with no price source recorded for 24; six symbols could not be priced.9. Response priorities and conclusionThe report prioritises preservation of the relevant FixedFloat order records, monitoring of the recipient and lead addresses, decoded protocol events and confirmation of contract roles. It also proposes asking the mswETH and mstETH operators whether the residual seed balances can be blocked or recovered; that capability was not verified. These are the report’s proposed actions, not actions taken for this article.Its expert opinion is that the sequence matches a bridge proof or message-forgery exploit with rapid conversion and splitting. The supporting record remains narrower: one examined Ethereum withdrawal, later movements with amount qualifications, observed DAI holdings without established control, and a disputed exchange-destination confidence label. The report’s recovery discussion depends on negotiation, legal identification or later movement to a custodial venue, not on treating the balance snapshot as secured funds.Figure 3. The report’s recorded execution and material limits. The forged-root mechanism and wallet controllers remain unestablished; some transfer quantities are unverified. Observed balances are not attributed cash-out, and other bridge withdrawals were not screened.Color key: slate identifies recorded execution; amber identifies unestablished claims; sage identifies amount and scope limits. The meaning is also stated in text.Source: SentinelTX native PDF, pp. 11, 14–15, 20–23 and 37–38. Its FixedFloat confidence text treats the destination as an unverified lead despite stronger wording elsewhere; that contradiction is preserved above.10. Evidence appendix and source limitations10.1 Selected transaction registerThe evidence IDs in the article link to transaction pages built from hashes printed in the PDF. These links are navigation aids, not a claim of a fresh explorer check. The register states the use, UTC time, block, quantity and source qualification for each selected record. It is not an exhaustive ledger.Evidence ID and use / PDF record and limitationE01 — Seed execution: 28 October 2026, 22:21:35 UTC; block 26294188. Zero native transaction value; the narrative records an internal payout of 22.431294525563808989 ETH and eleven token types. Status: successful control transaction in Appendix A; the main conclusion calls the withdrawal block-anchored. Mechanism and authorisation remain unestablished. PDF pp. 4, 14–15, 21, 35. Full transaction: 0x4f3c23e75b9134e8cae5a462550daad42fbbc19242567fcc34c0a035e297462cE02 — First pufETH leg: 28 October 2026, 22:24:35 UTC; block 26294203. Narrative: 132.0 pufETH to the null address and 141.9532103998426 WETH received. Status: pufETH quantity flagged unverified; the routing table separately prints a verified row. PDF pp. 7, 27, 37. Full transaction: 0xc6918af5df66ff7b632216bd0d01389a888d8c28d83c2572858f85bde4b573b3E03 — Second pufETH leg: 28 October 2026, 22:28:47 UTC; block 26294224. Narrative: 113.73789885106108 pufETH to the counterparty contract; 123.264115827052162383 ETH returned. Status: pufETH quantity flagged unverified. PDF pp. 7, 28, 37. Full transaction: 0x123bd9627d3c06f73498bd466100a62d4f7db76783ef9cd5ce5906a1e4fe4460E04 — USDC conversion: 28 October 2026, 22:30:47 UTC; block 26294234. Narrative: 18,113.494041 USDC sent and 18,109.0636110923 DAI returned. Status: conversion listed; the article uses narrative precision, without substituting the routing table’s additional digits. PDF pp. 7, 25. Full transaction: 0x2ddf70327a009c55960dd4d68fe308df772ef2816ca91215b25546f5c9d306f3E05 — WBTC conversion: 28 October 2026, 22:33:59 UTC; block 26294250. Narrative: 0.17360197 WBTC sent and 14,048.682073834 DAI returned. Status: conversion listed. PDF pp. 7, 25. Full transaction: 0x58bbdeebc886bfab35fa83366905fdf8c370c9ba1f9ff2dc4c39f7991c8cb239E06 — First native dispersal: 28 October 2026, 22:58:35 UTC; block 26294373. Narrative: 101 ETH to 0x211b4aebefea02470587286b398ed28fb7e09c6a. Status: signer-verified in the chronology, amount unverified in the conclusion and warning list. PDF pp. 8, 20, 28, 38. Full transaction: 0x2522281fbc77a612193e78e27f8cddd8147c605759216b67ce40320b9c8ff56eE07 — Second native dispersal: 28 October 2026, 23:00:11 UTC; block 26294381. Narrative: 100 ETH to 0x2d5a8aabf7af4022e314eb2a54753ba2402bafb0. Status: signer-verified in the chronology, amount unverified in the conclusion and warning list. PDF pp. 8, 20, 28, 38. Full transaction: 0x5696e2178bf680110d927d9bf71bdf05fcc22a282ad8a15bbdb938e5f852de44E08 — Third native dispersal: 28 October 2026, 23:01:23 UTC; block 26294387. Narrative: 102.061003174173709298 ETH to 0x75dcf3395b6cbefc6b66b28d6d93f193b58dc0f3. Status: signer-verified in the chronology, amount unverified in the conclusion and warning list. PDF pp. 8, 20, 29, 38. Full transaction: 0x04c207b1b0e181fa3aa6eb5f2ee35cdd629db5d706a555ac8e0e2a26c0b0e3bcE09 — Pass-through leg: 29 October 2026, 01:57:35 UTC; block 26295259. Narrative: 5 ETH from 0x75dc…c0f3 to 0x05b38c2d3c66031d72c990753f464271a7fd6def. Status: amount unverified in the conclusion; the routing table separately prints a verified row. PDF pp. 9, 20, 30, 38. Full transaction: 0x8b6d9b0a7696857ae7b956e458a1999891dcd3f73236fc7d9a10703468fbe8c1E10 — FixedFloat-labelled destination: 29 October 2026, 01:58:59 UTC; block 26295266. Narrative: 4.99999664 ETH to 0x4e5b2e1dc63f6b91cb6cd759936495434c7e972f. Status: destination called an unverified lead in the confidence text; amount unverified; label-based exchange identity and partial case attribution. Stronger wording and verified table rows elsewhere conflict with these qualifications. PDF pp. 4, 11–12, 19–20, 24–25, 37–38. Full transaction: 0x0268cf861201bbec96285c54cf25d66d058100a4ebd81021eeab2747dbe0127cE11 — Candidate onward DAI leg: 29 October 2026, 02:08:35 UTC; block 26295314. Narrative candidate: 24,999.999999999996 DAI to 0xdf410542aa35dab5e1ff3f46fcbd671d5e243977. Status: unverified lead; onward movement not established, despite a verified 25,000.0 DAI row in the routing table. PDF pp. 9, 21–22, 30, 36–37. Full transaction: 0x7c6955ba4e2a9e954966975a3d63187784a75c092a7013de447260e6e1c9d3ffE12 — Candidate 5,000-DAI leg: 29 October 2026, 01:32:35 UTC; block 26295135. Narrative: an unverified amount attributed as 5,000 DAI to 0x791a1cff9f9431ef98ca25c2e31ecb92a8ac2f25. Status: unresolved in the narrative; the hash appears in the routing and control records. Whether this was intended or a poisoning-induced mis-send is unresolved. PDF pp. 10, 16–17, 22, 31, 36. Full transaction: 0x8f0796105a30c02fffe21ae8410217dbc385d653578ef2fa3445073356eec3e010.2 Source and method registerPrimary source: SentinelTX’s 41-page native investigation report, CASE-ASYNCEA1, dated 29 October 2026. Its document-integrity block prints generation time 2026-10-29T13:53:18Z. Use: source for this article’s findings, figures and evidence references. Limitation: the PDF retains its own warnings and conflicting confidence statements. The executive summary also carries the separate case reference CASE-20261029-0001; neither identifier has been silently substituted for the other.Narrative and exhibits, pp. 3–23: used for chronology, call sequence, balances, exclusions, assessments and recommendations. Limitation: reported public accounts, inferred roles and qualified amounts remain distinct from established execution facts. The pufETH receipt wording and FixedFloat confidence wording are internally inconsistent, as described above.Path Routing Evidence, pp. 23–32: used to retain transaction references and their printed fields. Limitation: some rows are marked “verified” and show readable transfer amounts even where the narrative or warning appendix calls those quantities unverified. These conflicting labels are not resolved by this adaptation; no replacement totals or attribution shares were computed.Methodology, pp. 33–36: one recorded 90-day query window, 31 July–29 October 2026. The 217 retained rows with readable timestamps span 28 October 15:49:11 to 29 October 07:35:59 UTC; three retained rows have no readable timestamp. A query window is not the evidenced event span. Provider-wide account lists and the rows followed by a trace are different populations; they are not interchangeable funding or balance totals.Control records, pp. 34–36: used for the creation and call references, including [E01]. Limitation: a selector and successful status do not alone establish storage changes, contract control, actor intent, a loss or cash conversion.Warnings and integrity record, pp. 36–39: the report records one downgraded claim and 19 findings flagged for review, then lists one INV-12 entry and eighteen INV-13 entries. A signed manifest identifies the compiled source; it does not remove the substantive qualifications. Exact material warning wording is retained below.10.3 Exact source warningsThe following is the report’s own warning record, with line wrapping normalised only. Its practical consequences are the unconfirmed destination, unverified transfer quantities and prohibition on treating the full destination balance as attributed cash-out. Where other source passages disagree, those disagreements remain disclosed rather than repaired.PDF p. 3: INTEGRITY GATE — the integrity gate downgraded 1 claim in the text and flagged 19 findings for review. See the appendix at the end of this document for the full list.PDF p. 4, repeated inline amount qualification: [⚠ unverified amount — auto-check: a retained transfer this line names has no readable quantity, so no retained amount bounds this figure]PDF p. 4, holdings qualification: [⚠ exceeds the traced amount — auto-check: the structured evidence traces at most ≈270.8K DAI]PDF p. 20, opening conclusion label: unverified (auto-downgraded) (transaction-hash anchored in this section): the cited transfer of 101 ETH is unverified, as its token scale or symbol was not retrieved andPDF p. 37: [INV-12] Cash-out endpoints (every exchange-deposit leg in the evidence) — a row naming a confirmed freeze target / cash-out deposit address carries no inbound TX hash anchor (a label and co-occurrence cannot establish a destination) → downgraded to an unverified leadPDF p. 37: [INV-13] Case narrative (time order, UTC block timestamps) — the cash-out / attributed amount '702,154.545255 DAI' exceeds the structured evidence's traced ceiling (≈270.8K DAI) by 2.6× → likely a destination's commingled total deposits counted as traced taint; auto-downgraded (re-state against the traced amount)PDF p. 37: [INV-13] Case narrative (time order, UTC block timestamps) — the cited transfer amount '0.00045 ETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 37: [INV-13] Case narrative (time order, UTC block timestamps) — the cited transfer amount '0.00032933333342 ETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 37: [INV-13] Case narrative (time order, UTC block timestamps) — the cited transfer amount '0.0021 ETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 37: [INV-13] Case narrative (time order, UTC block timestamps) — the cash-out / attributed amount '4.99999664 ETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 37: [INV-13] Seed receipts in the seed transaction and their disposition — the cash-out / attributed amount '132.0 pufETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 37: [INV-13] Seed receipts in the seed transaction and their disposition — the cited transfer amount '113.73789885106108 pufETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 37: [INV-13] 0x75dcf3395b6cbefc6b66b28d6d93f193b58dc0f3 — the cash-out / attributed amount '32,157.745684926304 DAI' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 37: [INV-13] 0x75dcf3395b6cbefc6b66b28d6d93f193b58dc0f3 — the cited transfer amount '1.0 ETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 37: [INV-13] 0x75dcf3395b6cbefc6b66b28d6d93f193b58dc0f3 — the cited transfer amount '24,000 DAI' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 37: [INV-13] 0x75dcf3395b6cbefc6b66b28d6d93f193b58dc0f3 — the cited transfer amount '25,000 DAI' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 38: [INV-13] 0x2d5a8aabf7af4022e314eb2a54753ba2402bafb0 — the cash-out / attributed amount '100 ETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 38: [INV-13] 0x2d5a8aabf7af4022e314eb2a54753ba2402bafb0 — the cited transfer amount '49.8 ETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 38: [INV-13] 0x211b4aebefea02470587286b398ed28fb7e09c6a — the cited transfer amount '101 ETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 38: [INV-13] 8. Recommendations — the cited transfer amount '4.99999664 ETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 38: [INV-13] Findings by evidence tier — the cited transfer amount '100 ETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 38: [INV-13] Findings by evidence tier — the cited transfer amount '102.061003174173709298 ETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)PDF p. 38: [INV-13] Findings by evidence tier — the cited transfer amount '5 ETH' names a retained transfer with no readable quantity (its token scale or symbol was not retrieved, or its amount is unusable), so no retained amount bounds it → auto-downgraded (state it against a retained transfer's amount, or as unverified)Source qualification, PDF p. 22: “Treat these as unverified amounts until corroborated against the sealed evidence table.” The same page states that the 702,154.545255 DAI figure is an observed commingled destination balance and must not be presented as traced or attributed cash-out. Labels are database attributions, not identity findings.

Nine ETH deposits are the clearest endpoint in SentinelTX’s report on the reported Arkadiko / StackSwap incident. Between 04:05:59 and 04:11:23 UTC on 23 October 2026, the report records 213.3 ETH moving from one address into a Tornado.Cash Router-labelled address. That is a specific Ethereum transfer sequence—not a complete reconstruction of the Stacks attack, proof of an operator’s identity, or a measure of the incident’s total loss.The distinction matters because the report also leaves cross-chain links unresolved and marks several earlier amounts as unverified. This analysis follows its recorded sequence while keeping those limits attached to the claims they affect. Its source is the 37-page SentinelTX report CASE-ASYNCF7B, generated on 26 October 2026 UTC.The reported governance attack and the Ethereum investigation are different layersSentinelTX recounts a reported governance-capture mechanism on Stacks. A proposal presented as a routine vault update was followed by a large DIKO purchase shortly before voting. The reported sequence is precise: a 3.39 million DIKO purchase at 15:03 UTC on 22 October; a vote of 4,573,197 DIKO at 15:06; voting closed at 16:04; and movements of sBTC and stSTX followed at 16:06 and 16:09. The account says the newly enabled contract’s fund-moving functions did not check the caller. Arkadiko reportedly switched the contract off at 18:08.The same account describes an earlier StackSwap takeover through proposal 4 on 20 October and the draining of 49 pools. These are reported incident details in the PDF, not findings independently established by its Ethereum trace. The report does not anchor the Stacks proposal, vote, drain or USDCx burn transactions. It also does not establish the identity of the controller behind either incident.Diagram 1. The governance mechanism is reported context: buy voting power, pass the proposal and enable code, followed by reported asset movements and USDA minting. It is not a verified Stacks reconstruction. Source: SentinelTX CASE-ASYNCF7B, pp. 4 and 15.Reported losses are presented as $1.16 million overall, including $1.09 million for Arkadiko and $70.5 thousand for StackSwap. The PDF explicitly does not reconcile those valuations to its on-chain quantities. They should not be added to, or substituted for, the ETH and USDC movements below.Stablecoins move through conversion venuesOn Ethereum, the report describes a main seed address with older activity and a separate staging address first active on 22 October. The staging address routed two USDC quantities through the MetaSwap router, with the token legs delivered to a shared contract:21:09:23 UTC, 22 October: 28,521.796245 USDC.22:04:35 UTC, 22 October: 32,204.864217 USDC.Address key: staging address = 0x425679fa1ab564815df9cbd91be68fc27c644073; main seed = 0x9a868f1db69d609a8efe14d979c53ebddd2a3875; MetaSwap router = 0x881d40237659c251811cec9c364ef91dc08d300c; shared recipient contract = 0x74de5d4fcbf63e00296fd95d33236b9794016631. Labels and token symbols follow the report and do not establish ownership or independently verified token identities. Source: pp. 5–7 and 10.The main seed’s conversion activity includes transfers to an address labelled “Rizzolver, Unknown” and interactions with the MetaSwap router. Those roles are distinct from a custodial exchange account. The report leaves onward movements from the Rizzolver-labelled address and the shared recipient contract unresolved.The PDF cites 244,594.20828 USDC arriving at the main seed through zero-address credits, but expressly downgrades that amount as unverified because the retained evidence does not supply a readable quantity that bounds it. A mint-style credit alone also does not establish which Stacks burn, if any, produced it. The source-chain burns and corresponding attestations remain missing links.Consolidation is described, but its exact amounts carry qualificationsThe report describes an ETH transfer from the staging address to the main seed, followed by two transfers from the main seed to a dedicated onward address. It characterises the latter sequence as a small probe followed by a sweep. Its quoted figures are 36.389030808813688987 ETH for the staging transfer, then 0.1 ETH and 213.262264545555095065 ETH for the two onward transfers. Each of these amounts is explicitly marked unverified in the compiled report; they are reproduced here as qualified source figures, not confirmed proceeds totals.There is a second limitation: the staging wallet’s native-ETH record contains its onward transfer, but that transfer is not among the four top-level calls the report lists for the wallet. The signing path is therefore not established. The interpretation that its ETH credits came from the two USDC swaps is an inference, rather than an itemised conversion reconciliation.These qualifications prevent the earlier stages from being treated as a fully reconciled, end-to-end value chain. They do not turn the separate nine-deposit sequence into an incident-wide loss estimate, nor establish what happened after mixer entry.Nine deposits, four denominationsThe report records the onward address sending nine transfers to the Tornado.Cash Router-labelled address on 23 October. The sequence uses four denominations:Two deposits of 100 ETH: 200 ETH combined.One deposit of 10 ETH: 10 ETH.Three deposits of 1 ETH: 3 ETH combined.Three deposits of 0.1 ETH: 0.3 ETH combined.Together, those nine deposits total the report’s 213.3 ETH. The first occurs at 04:05:59 UTC and the last at 04:11:23 UTC. This is the composition of that deposit sequence only; it is not a breakdown of all stolen assets, all Ethereum receipts or all cross-chain exits.Figure 2. Nine deposits into the router-labelled address, grouped by denomination. Values are ETH; group values are deposit count × denomination. Source: SentinelTX CASE-ASYNCF7B, pp. 10–11 and 15. Total: 213.3 ETH. No incident-wide loss denominator is implied.Address key: onward sender = 0xe8cbdc3bb8e7af91f0b7aa91696c5624b4d05006; recipient = 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b. “Tornado.Cash, Mixer, Tornado.Cash: Router, Sanctioned” is the report’s returned label. The report calls for checking current sanctions status before relying on that label in a filing; this article makes no current sanctions determination.Mixer entry is an endpoint in the traced record, not evidence of a completed cash-out or a recovered balance. The report describes any matching withdrawal pattern as a lead only and says deposit-to-withdrawal matching is probabilistic. It does not identify a person controlling the sender or recipient.Earlier service activity is not automatically incident proceedsThe trace also reaches service-labelled activity outside the immediate deposit sequence. SentinelTX lists 11 legs to “Metamask Bridge, Exchange” and one to a Binance hot-wallet-labelled address. Its own interpretation is important: the former is a bridge/swap routing service despite the “Exchange” tag, and its destination networks remain unresolved.Ten of the 11 routing-service legs precede the reported drain. They cannot carry proceeds from that later event. The one post-drain leg is dated 25 October, but its sender is not cited in the report, so its relationship to the main seed is not established. The listed Binance deposit also predates the drain. The PDF consequently states that no custodial exchange deposit of drain-period proceeds is anchored in this report.The report separately excludes suspected address-poisoning and spam transfers. Look-alike addresses and tokens imitating the “ETH” symbol are not evidence of common ownership. Its ETH narrative uses native-ETH records rather than indiscriminately adding every token carrying an ETH-like symbol. Likewise, gross movement totals recount value at successive hops and are not loss figures.What the conclusion supports—and what it does notThere is a material tension within the source. Its conclusion calls the Ethereum sequence a “complete proceeds path”, while its own limitations leave the Stacks linkage partial, parts of the conversion chain unresolved and several amounts unverified. Those statements are not equivalent. We retain the narrower distinction: the PDF describes a specific Ethereum sequence culminating in nine mixer deposits, but it does not establish a complete, reconciled route from the reported Stacks drain to every destination.The report’s practical next steps follow those boundaries: obtain issuer mint and attestation records to connect source-chain burns to Ethereum credits; seek relevant routing-service or solver settlement records through appropriate channels; and examine the reported Bitcoin branch separately. The reported 4.86 BTC exit is not established by this Ethereum investigation, and no link between the cited Bitcoin address and the Ethereum seeds is proved here.Figure 3. Conclusion: 213.3 ETH in nine recorded mixer deposits; the Stacks linkage remains partial, the Bitcoin leg and controller identity are not established, and several upstream amounts remain qualified. Source: SentinelTX CASE-ASYNCF7B, pp. 15–16, 20–21 and 33–34.The useful result is therefore a bounded transfer trail, with transaction anchors and clear questions still open. Keeping reported mechanism, recorded movement, amount verification and ownership separate makes that result more useful—not less—than presenting a single headline total as the whole investigation.Selected transaction anchorsFirst staging USDC leg: https://etherscan.io/tx/0x0f3d50a9551fbcbac726f54067d880bc7b80353b189fc6b9d62fea54eeab353bSecond staging USDC leg: https://etherscan.io/tx/0xbeaa599afdea60457e240160325843d0b69e5b2938840da7495669a0295dbb87First mixer deposit, 100 ETH: https://etherscan.io/tx/0x0fade4caf7576e09a05d73a6706f08529087d7d771dd0645415a03ddf2b5707aLast mixer deposit, 0.1 ETH: https://etherscan.io/tx/0x0ac46a58ac0704d364ca6bc0a167cfd7b09965019cc3d96c5978c8d30257ebafSource and limitations noteAdapted from the actual SentinelTX-generated PDF CASE-ASYNCF7B, 37 pages, generated 26 October 2026 UTC. This is a faithful editorial adaptation, not an independently reproduced investigation. The report’s focus is 22–26 October with earlier funding context; its abstract separately gives an executed query window of 15 September–26 October. Those descriptions are not treated as interchangeable. Explorer links use hashes printed in the PDF and do not establish ownership.The PDF’s reported-incident source name and domain are missing in the rendered text on p. 4. We have not silently repaired that attribution. Its link to Arkadiko’s statement is reproduced below; the PDF says the statement was not independently reviewed for that report. The reported governance mechanism and loss estimates remain attributed to SentinelTX’s account, rather than presented as separately confirmed facts.Arkadiko statement cited by the PDF: https://x.com/ArkadikoFinance/status/2113367201722044512Amount qualification: the PDF flags seven findings under [INV-13] (pp. 33–34), auto-downgrading quantities whose retained transfer record has no readable amount that bounds the claim. Its exact inline warning is: “unverified amount — auto-check: a retained transfer this line names has no readable quantity, so no retained amount bounds this figure”. The affected claims are listed below. A number appearing elsewhere in a table does not remove this qualification.[INV-13] Case narrative — cash-out / attributed amount: 244,594.20828 USDC — auto-downgraded; unverified in the compiled report.[INV-13] Case narrative — cited transfer amount: 36.389030808813688987 ETH — auto-downgraded; unverified in the compiled report.[INV-13] Case narrative — cited transfer amount: 0.1 ETH — auto-downgraded; unverified in the compiled report.[INV-13] Case narrative — cited transfer amount: 213.262264545555095065 ETH — auto-downgraded; unverified in the compiled report.[INV-13] Stablecoin arrival and conversion (22–23 October 2026) — cash-out / attributed amount: 35,843.240369 USDC — auto-downgraded; unverified in the compiled report.[INV-13] Consolidation and mixer entry (23 October 2026) — cited transfer amount: 0.039606555354493989 ETH — auto-downgraded; unverified in the compiled report.[INV-13] Limitations (evidentiary) — cited transfer amount: 36.399562631044986312 ETH — auto-downgraded; unverified in the compiled report.The source also describes 213.3 ETH as 127.7 ETH plus 85.2 ETH in its assessment (p. 17). Those components do not sum to 213.3 ETH. We do not invent a missing component or use that passage as a reconciled allocation. The nine-deposit total above follows the separate deposit chronology, not that proposed origin split.

On 24 October 2026, X100’s Ethereum Freezer contract executed a sequence of governance proposals that moved treasury assets and withdrew liquidity. The crucial question is how addresses that acquired voting weight could use it immediately. The checked receipts show two supporting votes out of three Senate seats, followed by execution within the same transaction. The displayed source explains why that sequence was possible.This report follows three execution transactions, then a narrower onward route from the first USDT recipient through two conversions and one ETH distribution address. It separates the transaction sender, the contract doing the work and the address receiving the proceeds. Those roles are not proof of a person’s identity. E1, E2, E3.1. Before the numbers: what each participant didThe Freezer is the asset-holding governance contract. In the reviewed source, “frozen” tokens are tokens counted as stake for Senate membership; freezing here does not mean a stablecoin issuer or law-enforcement agency blocked an address. A helper contract is an address used during execution to hold stake and cast a vote. A bundler submits transactions for other operations; its presence does not identify the ultimate beneficiary.RoleEthereum addressFreezer: governance and treasury0x79F35A33FE2813414851c4Ae8daeacD14d822A46X token; 6 decimals0x100A2C7F45Fd48e217fdcE72e658dc78Fd43A100USDT token; 6 decimals0xdAC17F958D2ee523a2206206994597C13D831ec7First sender and final USDT recipient0x7ec2afdF3eC5964899894f8D58afa95cbB8FfD63Second transaction sender; explorer labels it ERC-4337 Bundler0xfc3fAcD67138966aB0c841E905B0C4BCA1AbE92FSecond final recipient0xEDac2D8905bF2Bf0033872D420C4ec6ef1dDd0c8Third transaction sender0xDAB137F390dF77caA97fd492540E973fd5e2F8c8Third final recipient0x0A67804462F04B0be1c433fB1C2F7fb76e5166F2Blockaid and Chainalysis supplied the public incident framing and transaction leads. The tables below use independently opened explorer records for movement and event facts. Their public estimates of roughly $4.7 million and roughly 4.85 million USDT are source snapshots, not interchangeable accounting totals. Public statement 1; Public statement 2; Public statement 3; Public statement 4; Public statement 5.2. Scope and the three findingsQuestionChecked scopeChain and event dateEthereum mainnet; 24 October 2026 UTCExecution window14:11:47–14:40:47 UTC; three selected receiptsOnward-route cutoffFour selected 400 ETH transfers through 14:43:59 UTCMethodPublic explorer receipt/log review and displayed exact-match verified source; not an independent node replayAccounting boundary4,848,017.339222 USDT paid to three selected recipients; not a whole-incident loss estimateReview date25 October 2026 KST; historical transactions, not a current-balance snapshotFirst, the governance boundary did not require the proposal to wait until its expiry: the first checked receipt creates, votes on and executes proposal 7 in one transaction. Second, the later executions use the same two newly observed helper addresses as senators, even though transaction senders and execution contracts differ. Third, the first recipient’s USDT payment is exactly matched by two subsequent USDT spends, while the ETH relay receives slightly more ETH than those two conversions produced. That difference prevents an all-funds provenance claim.3. How voting weight became an immediate treasury instructionWhat turned stake into execution permission? In the first receipt, each of two helper addresses receives 19,100.000001 X. Each sends 19,000.000001 X into the Freezer and a further 100 X as a candidacy fee. Frozen, Registered and Ranked events precede proposal creation. This ties the explanation to the actual receipt rather than assuming that any large holder could control the contract. E1.First execution evidenceObserved recordHelper holding stake and voting0xe08107E7Dc7c4540D139392e9D0FEA99ca019F37Second helper holding stake and voting0x176D1eA0ee9569783C6f6E455f7Be6171566619cProposal 7Selector 0xa4376352; v3Swap in the displayed permitted-method sourceVotes at execution2 votes for / 3 Senate seats; ProposalExecuted log 37Treasury leg400,000 X sent to the newly created pool; 35.675313 USDT received on the reverse legPool for that leg0x9A03c41c539880b51508bEbbc2Dde7B738f6f075Read Figure 1 from top to bottom. Arrows show the order of events within the first transaction, not an extra transfer of money. The observation to carry forward is that stake acquisition, voting and treasury execution happen together. The next question is which source checks permit that timing.Figure 1. Event sequence in E1. This is a governance sequence, not an asset-value chart. Full helper addresses and the transaction are in the adjacent table and evidence appendix.In Senate.sol, propose records the proposer’s supporting vote immediately. vote checks current Senate membership. execute tallies the current ranked list and accepts support when support × 2 is greater than senateSize. _state leaves a proposal open until it expires; expiry is a deadline, not a compulsory delay. execute then calls the permitted proposal data on the contract itself. DexTreasury.sol permits v3Swap and v3Decrease and forwards those operations to its module. Freezer.sol obtains voting stake from frozenOf. Displayed verified contract source.This source path and the receipt agree on the narrow failure mode: voting weight could be acquired and used immediately for treasury operations. The reviewed first proposal passes zero as its minimum output parameter; its observed 400,000 X leg receives only 35.675313 USDT. The later swap output elsewhere in the receipt is a different leg, not the treasury’s sale proceeds. We have not independently replayed historical storage, compiled the bytecode or audited every module path, so this is not a comprehensive code audit.4. Three executions do not establish three independent peopleAt 14:35:59 UTC, the second transaction executes proposals 8–13, including five liquidity-decrease instructions and one swap. The receipt creates a different execution contract and two helpers. It ultimately pays 96,381.883491 USDT and 9,894.892631 X to its final recipient. The sender is the bundler-labelled address, not that recipient. At 14:40:47 UTC, the third execution uses the same two helper senators seen in the second receipt, and pays a different recipient. This is a direct operational link, but does not resolve who controlled those addresses. E2; E3.ExecutionVerified final recipient paymentE1 · 14:11:47 UTC4,749,726.096973 USDTE2 · 14:35:59 UTC96,381.883491 USDT + 9,894.892631 XE3 · 14:40:47 UTC1,909.358758 USDT + 549,915.546932 XSelected USDT subtotal4,848,017.339222 USDT; no conversion of X to USDThe first USDT amount is the final transfer to the sender after the observed flash-loan repayment, not the larger gross swap output. An Aave FlashLoan event records a 1,942,457.637245 USDT principal and 971.228819 USDT premium in E1. The gross 6,693,089.638357 USDT swap output must therefore not be called net profit or added to the final payment. Likewise, repeated transfers between execution contracts and recipients are the same funds moving through a route. Native ETH gas is outside this USDT subtotal.Governance executionsReceipt evidenceE1 · proposal 72 / 3; execution log 37E2 · proposals 8–132 / 3 each; execution logs 484, 496, 508, 520, 532, 542E3 · proposals 14–172 / 3 each; execution logs 18, 28, 38, 59Raw final-payment checksE1 log 54: 4749726096973 USDT units; E2 log 554: 96381883491; E3 log 71: 1909358758Raw X check in E3Log 66: 549915546932 units; 6 decimal placesThese are selected recipient payments, not an independently reconciled loss across all treasury assets and all transactions. X-token residuals, changing pool prices and any other incident-linked activity remain outside that conclusion. The first explorer receipt is successful but also displays an internal reverted-call warning; “Success” does not mean every internal attempt succeeded.5. Following the first recipient into ETHWhere did the first USDT payment go? Two later transactions show the first recipient spending 2,000,000 USDT and 2,749,726.096973 USDT through a UniswapX settlement route. Their sum exactly matches the 4,749,726.096973 USDT received in E1. Internal native-asset transfers pay 851.542914929444388864 ETH and 1,170.472889392738131465 ETH back to that recipient. The transaction senders are settlement participants, not automatically the beneficial owner. S1; S2.RecordAmount and meaningS1 · 14:16:35 UTC2,000,000 USDT out; 851.542914929444388864 ETH inS2 · 14:17:47 UTC2,749,726.096973 USDT out; 1,170.472889392738131465 ETH inTwo conversion receipts2,022.015804322182520329 ETH received in totalR1 + R2 · 14:18:59 / 14:19:23 UTC2,022.856704743507502222 ETH sent onwardDifference0.840900421324981893 ETH more sent onward than these two conversions producedThe first recipient then sends 1,000 ETH and 1,022.856704743507502222 ETH to the same distribution address. Because that total exceeds the two conversion receipts, it cannot all be assigned exclusively to those conversions. Other ETH already present or received can mix with converted proceeds. This review proves the selected transfer sequence, not a unique per-wei attribution. R1; R2.Read Figure 2 from the first recipient to the central distribution address, then outward to four branches. Solid arrows are checked native ETH transfers. The top panel reports the separate conversion total and the mixing boundary. The four equal branch transfers are the key observation; their later disposition is the next unanswered question.Figure 2. Historical ETH transfers on 24 October 2026 UTC. Labels use evidence IDs and rounded ETH values for readability; exact quantities and full identifiers are preserved below. No current balances or common ownership are asserted.Distribution roleFull Ethereum addressCentral distribution address0x8296721489d0a7E934edd66ea27159B1C88A42e5D1 · 400 ETH · 14:39:47 UTC0xF637DCeE7Dd96E8FDaB926C5993D558B52D635eaD2 · 400 ETH · 14:40:35 UTC0x6790cF09ba33D05aDA2C13cBB4104F5b8B666391D3 · 400 ETH · 14:43:35 UTC0x64b135Af3d80733c9C290D58873e2CCcb34a81AeD4 · 400 ETH · 14:43:59 UTC0x4fDB9F9A44b356c8A9c2Ea060a40Fb7a9cAaBef3Each of D1–D4 is a successful 400 ETH transfer from the central address, for a selected distribution total of 1,600 ETH. The second and third execution transactions overlap this distribution window; the chronology is not three isolated phases. No outbound activity from the four recipients was exhaustively reviewed. Their historical receipts do not prove that they still hold 400 ETH each, that an exchange accepted them, or that anyone cashed out.6. What the evidence does not establishA shared helper pair links the second and third governance receipts, but shared infrastructure alone does not prove one operator, and different senders do not prove different people. No personal identity is established here. Explorer service labels are navigation clues, not legal findings. There is no verified recovery, asset freeze or exchange account attribution in this bounded review.The source displayed at the Freezer address is exact-match verified, and its creation receipt predates these transactions: 23 October 2026 at 14:25:59 UTC, block 26255911. That does not substitute for a complete historical-state or implementation-change analysis. The reviewed code and the selected emitted events support the immediate-governance path; unreviewed configuration changes and module branches remain limitations. Contract creation receipt.7. Incident-specific response pointsThe governance evidence points to a concrete control question: can newly acquired, currently ranked stake authorize treasury DEX operations before other holders have time to respond? A meaningful remediation review would need to test delayed execution, a prior-state voting snapshot and limits on treasury price execution against this exact same-transaction sequence. This report does not claim that any of those changes have been deployed.For tracing, preserve E1’s recipient payment, the two USDT settlement records and R1/R2 as one route rather than counting each hop as new loss. Preserve D1–D4 as separate historical outputs, with their exact hashes, before making a service-exposure claim. The outstanding recovery question is what happened beyond those four outputs; this review does not answer it.8. Evidence appendix8.1 Selected transaction inventoryAll times below are explorer-displayed UTC on 24 October 2026. Full hashes are deliberately retained. E1’s internal reverted-call warning is a qualified success; the other selected transaction detail pages display Success.Evidence E1RecordTransaction0x38c60844f1923d53fdce7d99e9bc2a2d8c73a08e793341dfbb479f8cc74d81d0UTC / block2026-10-24T14:11:47Z / 26263022Observed factFirst execution; final payment 4,749,726.096973 USDTStatusSuccess; explorer also shows an internal reverted-call warningEvidence S1RecordTransaction0xb861b3710531230449711b04b416cc65ccff87e6dab0457e373e5dbb637e5dd5UTC / block2026-10-24T14:16:35Z / 26263046Observed fact2,000,000 USDT out; 851.542914929444388864 ETH received by first recipientStatusSuccessEvidence S2RecordTransaction0xb25ae55fded129da667ba5375d23fc1c611167e5444b0d20751e86b51668accdUTC / block2026-10-24T14:17:47Z / 26263052Observed fact2,749,726.096973 USDT out; 1,170.472889392738131465 ETH received by first recipientStatusSuccessEvidence R1RecordTransaction0x9a3f04912e1e52ad04fc00ac72efb3169e4a4c73596d1a5d7c055375397cc0dcUTC / block2026-10-24T14:18:59Z / 26263058Observed factFirst recipient → distribution address; 1,000 ETHStatusSuccessEvidence R2RecordTransaction0x3a8908f55e86af180559aed1051f9acc6145dad5e3292ffa48582f5b8bb9e1f2UTC / block2026-10-24T14:19:23Z / 26263060Observed factFirst recipient → distribution address; 1,022.856704743507502222 ETHStatusSuccessEvidence E2RecordTransaction0x77c46e1aa9037ed4fbc9cc7e00d199dcd752acf576b4b5d3446e785dc45235c0UTC / block2026-10-24T14:35:59Z / 26263143Observed factSecond execution; final payments 96,381.883491 USDT and 9,894.892631 XStatusSuccessEvidence D1RecordTransaction0xa08147bbd6cd279678327faf43af3e7f96323aed376f5bdbe44ed9fbef2898e5UTC / block2026-10-24T14:39:47Z / 26263162Observed factDistribution address → branch 1; 400 ETHStatusSuccessEvidence D2RecordTransaction0x5954deb30f637cd2d789403dce8a03caa9a89f2c088f7963976927948804953eUTC / block2026-10-24T14:40:35Z / 26263166Observed factDistribution address → branch 2; 400 ETHStatusSuccessEvidence E3RecordTransaction0x7c49bf28865defd5c1345f6527210360d635e510fa49279d0b62e6e02cfad99aUTC / block2026-10-24T14:40:47Z / 26263167Observed factThird execution; final payments 1,909.358758 USDT and 549,915.546932 XStatusSuccessEvidence D3RecordTransaction0x09c7e5feac1a466c67f9b6816bf82f8f2f16297acfe282e7592b0dbd749366bfUTC / block2026-10-24T14:43:35Z / 26263181Observed factDistribution address → branch 3; 400 ETHStatusSuccessEvidence D4RecordTransaction0x8f2bfb1391244540283d009e05dcd49988452d0ea456a7edba4dd331394cbbd9UTC / block2026-10-24T14:43:59Z / 26263183Observed factDistribution address → branch 4; 400 ETHStatusSuccess8.2 Execution and voting address registerRoleFull Ethereum addressE1 outer contract0x89e903e4512F8a315ceBD99c29a1e40EeE6Fe2C9E1 execution contract0x37541Fc4A6F1eC86889bA506F51DC39f2BeDd10AE2 execution contract0x515Ca27BB80325cdc56f0ad3B9dE69829C869A51E3 execution contract0x554B49369E0e612bC56088E355D3a087006e0C64Helper senator in E2 and E30xC2f69b21BeA8F0C64cbd4597f262C80c993073BASecond helper senator in E2 and E30xb21F45868DCAAe3bE7c842971Ae61DD93D4C7CdEOther seat in checked event lists0xA13a935dce629FbbA304D3EbdA8d96459B05716E8.3 Source and evidence boundariesFreezer verified-source viewer: reviewed functions are listed in the code discussion above. X token metadata and USDT token metadata each display 6 decimals. Public analyst statements establish attribution and reported context; selected explorer receipts establish transfers and events. Arithmetic subtotals are calculations over that stated scope. Ownership, full loss, current holdings and recovery remain unverified.