Defend Against Cybercrime with the Power of Community

CB58259 test post (payload removed).

ChainBounty Investigation Analysis | 9 November 2026A BNB Chain wallet gained 160.257771766360162994 BNB across the seed block, then forwarded a reported 162.169168 BNB to a newly observed intermediary. The following morning, that intermediary made ten deposits totaling 162.1 BNB into an address labeled as the Tornado.cash Proxy.This investigation summary draws exclusively on SentinelTX’s CoreVault / InsurancePool — BNB fund-flow investigation, case CASE-AE964964, dated November 8, 2026. The report establishes a transaction trail while leaving the exploit’s full accounting, the operators’ identities and the destination after mixing unresolved. All times below are UTC.The seed transaction and the balance changeAt 21:50:20 on November 3, 2026, address 0xd3565b191b28b49cc517189b984dacdb1ff05304 submitted a successful contract-creation transaction in block 131507810. The report identifies this address as the signer and deployer.The transaction created 0xc28cfeee046e1421e9dbfb2cf689074bf9f387e2 and produced 93 event logs. Those logs were not decoded in the report, and its evidence does not include the internal call tree.Two native-balance readings anchor the financial result:Block 131507809: 1.911397681184347886 BNB.Block 131507810: 162.169169447544510880 BNB.Net change: +160.257771766360162994 BNB, after the signer’s gas cost.This block-level net increase does not establish the reserve outflow, borrowed principal, or repayment and fee.Seed transaction: 0x072a10a579e2a8afa26a681205a2aaaa38f74bcb9d1064b12bd9e9ebe2c598b3 Source: SentinelTX CASE-AE964964, Executive Summary and Conclusion, pages 4 and 12–13.Why the forwarded amount is largerAt 21:51:56 on November 3, the signer transferred a reported 162.169168 BNB to 0x028491b55d0e18aa81ab3324688e42f91bbadacc. The intermediary was first seen November 3, without an identifying label.The forwarded amount includes funds already present before the seed block. The signer began with 1.911397681184347886 BNB, then experienced the documented net increase. Calling the entire onward transfer “profit” would therefore overstate what the balance comparison establishes.Figure 1. The signer's native balance increased by 160.257771766360162994 BNB across blocks 131507809–131507810, net of its own gas. It later sent 162.169168 BNB to the intermediary at 2026-11-03T21:51:56Z. These are different measurements, not additive quantities or incident-loss totals. The PDF records a pre-seed balance of 1.911397681184347886 BNB, which was already present before the gain.Color key: Slate identifies the seed-block balance change; sage identifies the later transfer. The panel titles carry the distinction in B&W. Color does not imply ownership, risk or proof.Address/role key: Signer = 0xd3565b191b28b49cc517189b984dacdb1ff05304. Intermediary = 0x028491b55d0e18aa81ab3324688e42f91bbadacc. These are transaction roles, not real-world identities.Source: Editorial summary of SentinelTX, CASE-AE964964, Executive Summary, p. 4; Transaction Chronology, p. 6. Quantities retain the PDF narrative’s precision. Seed timestamp: 2026-11-03T21:50:20Z.Forwarding transaction: 0xd08a5eda1116941a92907acd3efdbdc6b71272d5e9daa9e0da367196b4701535Ten deposits, one clear tracing boundaryBetween 04:54:04 and 04:57:20 on November 4, the intermediary sent 162.1 BNB to 0x0d5550d52428e7e3175bfc9550207e4ad3859b17. SentinelTX records the Sentinel Protocol label “Tornado.cash, Mixer, Tornado.cash: Proxy” for that contract.The ten deposits followed fixed denominations:1 × 100 BNB6 × 10 BNB2 × 1 BNB1 × 0.1 BNBThese denominations match mixer pools. The split alone does not establish an intent to evade reporting thresholds.At 04:57:48, the intermediary also sent a reported 0.068098 BNB to 0x02dcd01d534477b5e76628a7284e7fa71c7a7ed7. The report’s rounded reconciliation lists 162.168098 BNB forwarded across eleven transactions, leaving a 0.00107 BNB difference from the rounded receipt, which it describes as consistent with gas.Figure 2. Ten BNB deposits entered the Tornado.cash Proxy on 4 November 2026 between 04:54:04 and 04:57:20 UTC: 1 × 100 BNB, 6 × 10 BNB, 2 × 1 BNB and 1 × 0.1 BNB, totaling 162.1 BNB. Bars show the group totals of 100, 60, 2 and 0.1 BNB on a linear, zero-baseline 0–100 BNB scale. The 0.1 BNB bar is below one pixel wide at 720px; its direct label preserves its value. This is a deposit total, not incident loss. The PDF says the denominations are dictated by the mixer and do not by themselves establish structuring intent.Color key: Slate bars identify deposited BNB. Direct count, denomination and amount labels carry the meaning in B&W; color is not a risk scale.Address/role key: Depositor/intermediary = 0x028491b55d0e18aa81ab3324688e42f91bbadacc. Proxy = 0x0d5550d52428e7e3175bfc9550207e4ad3859b17, labeled “Tornado.cash, Mixer, Tornado.cash: Proxy” in the PDF, with Sentinel Protocol given as the label source.Source: Editorial summary of SentinelTX, CASE-AE964964, Executive Summary, pp. 4–5; Transaction Chronology, pp. 6–7; Transaction Typology, p. 9. The group totals are the stated count × denomination; they reproduce the PDF's 162.1 BNB total without adding onward hops.The first 100 BNB deposit also records a same-transaction hop from the Proxy to 0x1e34a77868e19a6647b1f2f47b51ed72dede95dd. This is part of the deposit route, not proof of a later withdrawal to an operator.First deposit transaction: 0xda5964dcc7f5f93a77c77b2a06be89b308cf234c63970c8183b874fb10dd1cffThe deterministic trail ends at the mixer. No withdrawal is linked to these deposits by the report. Timing or a matching denomination alone would not establish that link.The examined evidence identified zero exchange deposit addresses. This does not establish that the funds never reached an exchange: unlabelled counterparties and activity beyond the mixer remain unresolved.The attack narrative remains partly unverifiedPublic-reporting snippets summarized in the PDF describe a flash-loan-funded price manipulation involving CoreVault redemption and an InsurancePool payout. They report approximately $143.6 million of WBNB borrowed through Lista DAO Moolah, a redemption inflated about 33 times, and a reserve payout.These remain leads. The gross reserve outflow and full execution mechanism have not been established by transaction-level evidence in this record. The dollar-denominated loan estimate is not a verified native WBNB principal.The PDF contains WBNB and USDT transfer rows associated with the seed hash, but those rows do not supply a decoded execution trace identifying the lender, manipulated price source, protocol contracts or repayment.The report’s assessment is that the pattern is consistent with flash-loan-funded DEX spot-price oracle manipulation. The balance increase rounds to the public “160.26 BNB” figure without resolving gross-loss accounting.Separate activity and earlier leadsA separate token-disposal sequence began at 22:07:56 on November 3, when the signer received a reported 3,414.5285767965115 OSK from its earlier-deployed contract 0xd9c2e4f19746b4617ad658152adaa306c47ef86b.At 22:07:57, a transaction through the address labeled PancakeSwap Router v2 recorded:3,073.0757191168605 OSK to 0x5986772dc1970d1d9e030867f1156e36f9b07ce4.170.72642883982556 OSK to 0xfe6085dd822acc23352fb6b1fe52509253492422.170.72642883982556 OSK to the zero address, 0x0000000000000000000000000000000000000000.A reported receipt of 0.06190122454689079 WBNB from 0x3fc593d15c34d2f91ca3b4f2097dddaf3c4de86c.A subsequent WBNB unwrap call is recorded, but its amount was not decoded. BNB, WBNB and OSK remain separate quantities throughout the accounting.On November 2, 8 BNB passed from the signer through its auxiliary contract to 0x302f5084ba0e4a2d4de5e6bc5dd5247028f5d674. The shared recipient 0x02dcd01d534477b5e76628a7284e7fa71c7a7ed7 received a reported 0.066555 BNB from the signer as well as the intermediary’s 0.068098 BNB. Its listed history reaches back to September 21 and includes 25 contract-creation records among 29 control transactions; some creation attempts failed.These relationships are follow-up leads, not evidence of common ownership, identity or earlier attacks. Similar-looking addresses flagged as suspected poisoning had no value-bearing rows in the retained tables and were excluded as connections.Reading the scope correctlyThe report contains 304 movement rows across 30 addresses. Its gross totals include 804,618.047953 WBNB, 27,582,948.606662 USDT, 1,007.303821 BNB, 13,658.114307 OSK and 7.844058 FIST. Value can be counted again at each hop, and broader mixer activity can involve other users. These totals are neither incident losses nor amounts proven to belong to this case.The stated case window is November 3 through November 8, 16:10 UTC. The actual queries extended from October 4 to November 8; retained movement timestamps span November 1–8. The first trace reached three of five requested hops, three address reads were incomplete, and high-volume addresses limited expansion. “No outbound” in the traced set does not establish inactivity outside it.Figure 3. The PDF confirms BNB movement from the signer through the intermediary to the mixer Proxy. Its traced path ends at the mixer, beyond which there is no deterministic on-chain link. The flash-loan principal and repayment, gross reserve outflow, protocol contract addresses, and the identity or control of people behind the addresses remain unestablished. The report recommends decoding the seed receipt and obtaining its call trace, with any later mixer link requiring independent corroboration. It identifies zero exchange deposits in the examined evidence; later exchange use remains unknown.Color and line key: Slate marks structural headings and role boxes only. Solid, equal-width arrows show the observed direction of BNB movement; they do not encode amount or common control. The dashed line beneath the mixer marks the limit of the traced path, not an inferred continuation. Direct labels preserve these distinctions in B&W.Address/role key: Signer = 0xd3565b191b28b49cc517189b984dacdb1ff05304. Intermediary = 0x028491b55d0e18aa81ab3324688e42f91bbadacc. Mixer Proxy = 0x0d5550d52428e7e3175bfc9550207e4ad3859b17. No real-world identity or control finding is made.Source: Editorial summary of SentinelTX, CASE-AE964964, Recommendations and Conclusion, pp. 11–13. The report also states that the first trace reached 3 of 5 requested hops and that three addresses were not fully read.What investigators should pursue nextA full seed trace and decoded receipt are needed to establish the principal, reserve outflow, repayment, fee and gross credit. The report recommends preserving all ten deposit hashes without attributing withdrawals absent independent corroboration.Follow-up priorities include the shared recipient’s deployment history, earlier 8 BNB route, OSK recipients and unlabelled counterparties. The signer’s reported Ethereum and Optimism activity falls outside this investigation’s scope.The report also recommends compliance watch-list circulation and reporting through the affected parties’ national cybercrime and financial-intelligence channels. With no identified exchange deposit, it supplies no specific exchange account for a freeze or KYC request. Current sanctions treatment requires separate checking; the PDF did not assess OFAC status. A return-bounty message is discussed as a low-cost option with limited prospects, not as an action already taken.The documented BNB balance increase was followed by rapid forwarding and ten mixer deposits. Recovery prospects are assessed as poor on the available on-chain trail. Establishing the exact loss and any recoverable destination requires evidence beyond that boundary.

ChainBounty · Ethereum mainnet · Activity window: November 1–4, 2026 · SentinelTX report CASE-CBE85A32, November 5, 2026SentinelTX's report on the publicly reported theft from an EU entity follows three Ethereum addresses through USDC transfers, ETH relays, and ETH-to-USDT swaps. It records a 9,582,349.791029 USDC transfer from the first starting address, four transfers totaling 20,000,000 USDC from the second, and 2,592 ETH dispersed from the third. These are separate observations within the traced activity, not components of a verified total loss.The distinction that shapes the report is between a recorded transfer and a complete account of where its value came from or ultimately went. A USDC route passes through a wallet with mixed funding. A relay reaches an address publicly described as a Kraken deposit address, but the report does not confirm that attribution. A reported USDT freeze also remains unconfirmed.1. Three starting addresses, one Ethereum-only scopeThe report uses three starting addresses, called seeds. Their public descriptions explain why they were selected; those descriptions are not ownership findings. Ownership of the three addresses is not established.Role / scope: Seed 1: reported exchange-paid wallet — Description in the PDF: 0x730bcb…723992. Its inbound exchange payout was not traced because the investigation ran outbound.Role / scope: Seed 2: reported swap wallet — Description in the PDF: 0x9eca05…015547. The report records USDC transfers to a resolver-labeled address and other downstream activity.Role / scope: Seed 3: reported frozen-USDT wallet — Description in the PDF: 0xa3a985…74ae0d. The report records ETH dispersal and a USDT holding, but does not confirm a freeze.Role / scope: Network and analysis window — Description in the PDF: Ethereum mainnet, chain ID 1. November 1, 2026, 00:00:00 UTC, through November 4, 2026, 12:35:00 UTC.Role / scope: Tracing depth — Description in the PDF: Outbound movements, up to three downstream hops per seed. Coverage of Seeds 1 and 2 is incomplete.Role / scope: Balance snapshot — Description in the PDF: Block 26341513, November 4, 2026, 12:41:11 UTC. These are historical balances, not current holdings.The report examines one publicly described withdrawal wallet and two additional starting addresses. It does not establish the full extent of the reported theft.The victim’s identity and the circumstances of the reported theft are not established by these Ethereum transactions. This article uses the broader description “EU entity” without identifying a victim or deriving a loss total.2. The USDC route passes through mixed fundingSeed 1 sent 9,582,349.791029 USDC to an intermediary at 22:06:11 UTC on November 1. That intermediary sent 5,270,291.000000 USDC to a second intermediary at 22:20:23 UTC. The second intermediary then sent Seed 2 a total of 13,495,000.000000 USDC in three transfers after midnight on November 2. The PDF summarizes this route as approximately 9.58 million → 5.27 million → 13.50 million USDC. [E1–E3]Stage: Seed 1 to the first intermediary — Recorded movement and meaning: 9,582,349.791029 USDC to 0xc80f1c…4a8ce4. E1.Stage: First intermediary to the commingled wallet — Recorded movement and meaning: 5,270,291.000000 USDC to 0xb40435…06d39b. E2.Stage: Commingled wallet to Seed 2 — Recorded movement and meaning: 13,495,000.000000 USDC across three transfers: 5,000,000.000000; 5,000,000.000000; and 3,495,000.000000 USDC. E3a–E3c.Stage: Attribution limit — Recorded movement and meaning: Only the approximately 5.27 million USDC inflow is observed coming from the Seed 1 branch. The report does not attribute the entire approximately 13.50 million USDC receipt to Seed 1.These amounts describe successive transfers, not separate losses to add together. The larger outgoing total at the second intermediary reflects the report's finding that it pooled funds from at least one other source; the rest of its inflow was not traced.Seed 2's own activity also has a separate chronology. It sent four transfers of 5,000,000 USDC each to 0x225a38…f2dc17, labeled “Rizzolver, Unknown” in the report, between 23:51:23 UTC on November 1 and 00:15:11 UTC on November 2. The report assesses these as swap inputs, but the corresponding ETH outputs were not itemized. Its public-source description of a UniswapX auction remains an attribution, not a confirmed identification of the resolver as a UniswapX filler. [E4a–E4d]The evidence does not establish which funds financed each resolver payment. No allocation of Seed 1-derived value to those payments is made here.Figure 1. The report describes Seed 1 → Seed 2 as a partial path through commingled funds. Display values are approximate: the first two transfers were 9,582,349.791029 USDC and 5,270,291.000000 USDC. Wallet B subsequently sent 5,000,000.000000, 5,000,000.000000, and 3,495,000.000000 USDC to Seed 2. Its other inflows were not traced. These movements are not a loss total.Color key: slate marks the selected USDC route and its displayed amounts. Direct labels identify each address role; color does not establish ownership or attribution. Equal-width arrows are not scaled to value.Address / role key: Seed 1 = 0x730bcb…723992; Relay A = 0xc80f1c…4a8ce4; Wallet B = 0xb40435…06d39b; Seed 2 = 0x9eca05…015547. Wallet B is the commingled intermediary, not an exchange or pool attribution.Attribution note: The funding source of each resolver payment is not established.Source: SentinelTX, Investigation report CASE-CBE85A32, November 5, 2026, pp. 4, 6–7 and 18–20.A separate transfer sent 7,166,580.962400 USDC from Seed 2 to the unlabeled address 0x52b335…e3fb09 at 00:00:47 UTC on November 2. This is the transaction summarized as approximately 7.17 million USDC in the narrative. The broader flow summary lists two transfers to that address totaling 10,661,580.962400 USDC; the single transaction and the aggregate have different scopes. [E5]3. Seed 3's ETH movements lead to a relay and a separate swap sequenceSeed 3's ledger records five outbound transfers totaling 2,592 ETH. One branch includes a 395 ETH transfer to 0xd359df…0a0573, followed by 395.999977992739261 ETH to 0xf5968b…014ae1 and 395.999955100039942 ETH to 0xfa6766…159556. The final transfer occurred at 10:11:47 UTC on November 3. The chronology displays those last two amounts as approximately 395.999978 ETH and 395.999955 ETH. [E6–E8]These three transfers are presented at their recorded amounts. The evidence does not establish that the entire onward amount originated from Seed 3.The final recipient, 0xfa6766…159556, is described as a Kraken deposit address in the public source cited by the PDF. The report does not independently confirm that attribution. The publicly reported onward sweep was beyond the three-hop depth and was not traced. The observed transfer therefore supports an endpoint lead, not a confirmed Kraken cash-out or an identified account holder.Figure 2. The resolved relay rows are ordered, not scaled to elapsed time. Seed 3 sent 395.0 ETH to R1. R1’s full-ledger outflow was 395.999977992739261 ETH, and R2’s was 395.999955100039942 ETH; the graphic rounds these to six decimals. The onward transfers are not attributed in full to Seed 3.Color key: slate marks the selected transfer times and quantities. Direct labels identify the source, relays, and recipient.Address / role key: Seed 3 = 0xa3a985…74ae0d; Relay R1 = 0xd359df…0a0573; Relay R2 = 0xf5968b…014ae1; Recipient R3 = 0xfa6766…159556. Full identifiers appear in the appendix.Attribution note: R3 has no confirmed service attribution. Its identification as a Kraken deposit address is an attributed public-source lead. The reported onward sweep was beyond the three-hop trace; the figure stops at R3.Source: SentinelTX, Investigation report CASE-CBE85A32, November 5, 2026, pp. 8–10 and 17–18.ETH-to-USDT swaps are a separate branchAt 17:10:23 UTC on November 3, Seed 3 sent 2,000 ETH to 0xb3a21e…f99762. That address subsequently funded 0x2fb89a…df8516, where the report describes two ETH-to-USDT swaps on November 4. This is separate from the relay described above. [E9–E11]Stage: First swap, 07:30:35 UTC — Recorded operation: 87.999 ETH was wrapped and sent out as WETH; 202,156.840322 USDT was received. E10.Stage: Second swap, 07:50:35 UTC — Recorded operation: 43.00091147 WETH was sent out; 98,911.866452 USDT was received. E11.Stage: Combined swaps — Recorded operation: The PDF classifies 130.99991147 ETH of input and 301,068.706774 USDT of output. The wrapping and WETH movements are parts of the swaps, not additional value to count again.Stage: Smaller onward payment, 08:25:23 UTC — Recorded operation: 5.000000 USDT went to 0x70e9b5…352a3c. E12.Stage: Main onward payment, 08:26:47 UTC — Recorded operation: 301,063.706774 USDT went to the unlabeled address 0x7ebce2…133fd4. E13.The printed rows account for the two USDT outputs through the 5 USDT payment and the 301,063.706774 USDT transfer. They do not establish a destination on another chain. The public-source USDT0/LayerZero description remains unverified, as do the report's other attributed off-Ethereum routes.4. Service labels and historical balances have narrower meaningsThe report lists five transfers to an address labeled “Chainflip, Exchange,” totaling 241.00 ETH, on November 2–3. Its narrative places them in the Seed 2 graph. The retained routing table identifies the sender as 0x05184a…d1b01e. These observations do not supply destination-chain settlement records or prove a completed conversion to cash. [E14a–E14e]At the balance snapshot, Seed 3 held two assets. The second ETH holding below comes from a ledger residual rather than a block-anchored balance read, a distinction the PDF explicitly preserves.Address / measurement: Seed 3: ETH balance — Quantity and stated limit: 1,858.999296273752596983 ETH at block 26341513.Address / measurement: Seed 3: canonical USDT balance — Quantity and stated limit: 1,142,716.43173 USDT at block 26341513, under Tether USD contract 0xdac17f958d2ee523a2206206994597c13d831ec7.Address / measurement: 0xb3a21e…f99762: ETH ledger residual — Quantity and stated limit: 1,559.999871347187806602 ETH. The PDF identifies this as ledger-derived, not a block-anchored balance read.Address / measurement: Freeze status — Quantity and stated limit: The reported Tether freeze remains unconfirmed. The available evidence does not establish the reason for the unsuccessful USDT transfers and approval calls.Unsuccessful USDT transfers and approval calls do not, on their own, establish a freeze. The ETH balances are not frozen assets or confirmed recoveries, and none of these snapshot quantities describes the present balance.5. What the report concludesThe report documents substantial transfers, relay activity and swaps. These movements do not establish how the exchange accounts were accessed, who controlled the addresses, or the victim’s total loss.The next investigative steps are to corroborate the publicly attributed Kraken endpoint, obtain confirmation of the reported Tether freeze, and seek relevant venue order and destination records. These are investigative leads, not completed actions or recovery assurances.Figure 3. The report separates observed movements from partial links and attributed claims. Seed 3’s five outbound transfers total 2,592 ETH. Its USDT balance was 1,142,716.43173 USDT at block 26341513 (2026-11-04T12:41:11Z), approximately six minutes after the analysis window closed. A balance is not proof of a freeze or a recovery amount, and the asset quantities are not combined into a loss estimate.Color key: slate marks section headings only. Evidence strength is stated in words, not encoded by color.Address / role key: Seed 1 = 0x730bcb…723992; Seed 2 = 0x9eca05…015547; Seed 3 = 0xa3a985…74ae0d.Scope note: Ethereum mainnet only; the outbound trace reached up to three hops. Seed 1 and Seed 2 coverage was incomplete. A direct funding link between Seed 2 and Seed 3 is not established. The report calls for corroborating the Kraken attribution, confirming Tether’s freeze, obtaining service order records, and establishing the remaining funding links.Source: SentinelTX, Investigation report CASE-CBE85A32, November 5, 2026, pp. 4–5 and 16–18.6. Selected evidence appendixThese IDs organize records reproduced from the PDF; they do not indicate a new investigation. Etherscan links below are navigation links constructed from the full Ethereum hashes printed in the PDF. The PDF remains the source for the descriptions, quantities, status, and timing. “Verified” is the report's status for a transfer, not proof of ownership, intent, victim linkage, or final destination.E1–E5: USDC route and Seed 2 transfersEvidence ID: E1 — PDF record: 0x9aa5e3281ce4c8d83f290e20e7c6a66b056965aab2468311115c10e1433050d8. November 1, 2026, 22:06:11 UTC; block 26322798; 9,582,349.791029 USDC; verified. PDF pp. 6, 18.Evidence ID: E2 — PDF record: 0x5a27bea73f50440194aab5744002757af96583a4f7002254d2c6af276f16e161. November 1, 2026, 22:20:23 UTC; block 26322867; 5,270,291.000000 USDC to the commingled wallet; verified. PDF pp. 6, 19.Evidence ID: E3a — PDF record: 0x3d20cf5a8034f5924c555470e1f4fe75e36704b0da6f25d53ba043afb81e85d4. November 2, 2026, 00:09:35 UTC; block 26323412; 5,000,000.000000 USDC to Seed 2; verified. PDF pp. 7, 20.Evidence ID: E3b — PDF record: 0x7e125322be3021b881bafa7a3ccfcba229d2d30511add1a991e4a12103ee2ae0. November 2, 2026, 00:14:11 UTC; block 26323435; 5,000,000.000000 USDC to Seed 2; verified. PDF pp. 7, 20.Evidence ID: E3c — PDF record: 0xbdd896d7ce518156ecd2d564e6eccb6199fa4fc01f67fc619177236429a13931. November 2, 2026, 00:18:11 UTC; block 26323455; 3,495,000.000000 USDC to Seed 2; verified. PDF pp. 7, 20.Evidence ID: E4a — PDF record: 0x04fd5b5e8fbb800f186656ff0dc22709bb40c2844b6ab00e98c36e6dd2510518. November 1, 2026, 23:51:23 UTC; block 26323321; 5,000,000.000000 USDC to the resolver-labeled address; verified. PDF pp. 7, 20.Evidence ID: E4b — PDF record: 0xc3e3296c6a57f3e340592e7afce01a3d76a4bf3e275fe6a71cea1f356272fcca. November 1, 2026, 23:56:23 UTC; block 26323346; 5,000,000.000000 USDC; verified. PDF pp. 7, 20.Evidence ID: E4c — PDF record: 0x0cc65b5600a9d58aed4c0aeb712caaf928f24dc30a6d205ea692436f724d5798. November 2, 2026, 00:11:59 UTC; block 26323424; 5,000,000.000000 USDC; verified. PDF pp. 7, 20.Evidence ID: E4d — PDF record: 0xf89d84a28d9868d361baee22036c2981bc412487a13fcdb339f5b337a06aa8c7. November 2, 2026, 00:15:11 UTC; 5,000,000 USDC. This row is stated in the chronology on PDF p. 7; no separate block or verification status is printed there.Evidence ID: E5 — PDF record: 0x66c8e8dcbe0750d8bfbfc298895b82fb5bb125ff123c8263d0aafdbd75205c07. November 2, 2026, 00:00:47 UTC; block 26323368; 7,166,580.962400 USDC; verified. PDF pp. 7, 19.E6–E9: ETH relay and funding of the separate swap branchEvidence ID: E6 — PDF record: 0x499ab00a77fc9dceeb7141e5a7d6565c36b936d6de7d052a3973986fb451c08f. November 3, 2026, 09:26:59 UTC; block 26333369; 395.000000000000000000 ETH from Seed 3 to the first relay; verified. PDF pp. 9, 22.Evidence ID: E7 — PDF record: 0xcd36c13ff7ad05d7aac27dd6ab7fd7191bb3fc7ed9e5b0e62bd532e4006bd377. November 3, 2026, 10:08:59 UTC; block 26333579; 395.999977992739261000 ETH to the second relay; verified. PDF pp. 9, 22.Evidence ID: E8 — PDF record: 0xfb7a6f5f819e12e9f5220564e03954c616d714a93c0f3626d3867d9f3a9bdca9. November 3, 2026, 10:11:47 UTC; block 26333593; 395.999955100039942000 ETH to 0xfa6766b362461a20046451b16277ec5f7d159556; verified. PDF pp. 8–10, 21. Kraken attribution is unconfirmed.Evidence ID: E9 — PDF record: 0x9c8279d0abf25b2e4c1c7e978517bc9176b5128647c6917ebc27120d562746db. November 3, 2026, 17:10:23 UTC; block 26335681; 2,000.000000000000000000 ETH from Seed 3 to 0xb3a21eb35ba99f2d9a2bc11f1f6fa17e00f99762; verified. PDF pp. 9, 22.E10–E13: swaps and onward USDT paymentsEvidence ID: E10 — PDF record: 0x504d03a1a6f90611d4ba874106463015ecbebf41a1dad7e2df54ebecfd239327. November 4, 2026, 07:30:35 UTC; block 26339966. Recorded legs: 87.999000000000000000 ETH wrapped, 87.999000000000000000 WETH sent, and 202,156.840322 USDT received; verified. PDF pp. 9, 23.Evidence ID: E11 — PDF record: 0xa8d8666e23819babb2f3653c95c17eaa9a369b010722fc99f1f9e92337cd5d08. November 4, 2026, 07:50:35 UTC; block 26340066. Recorded legs: 43.000911470000000000 ETH wrapped, 43.000911470000000000 WETH sent, and 98,911.866452 USDT received; verified. PDF pp. 9, 23.Evidence ID: E12 — PDF record: 0x7f008e0153463b9301dafd2554b6b1917ab31128e3a64cb6854f6d7ce5ec1ae9. November 4, 2026, 08:25:23 UTC; block 26340238; 5.000000 USDT to 0x70e9b573831d62bbc503b1b00bd611bac4352a3c; verified. PDF pp. 9, 23.Evidence ID: E13 — PDF record: 0x066846fd1d44770473109fe8e16f2a91b069d8019f179f0dafbc1728a9408803. November 4, 2026, 08:26:47 UTC; block 26340245; 301,063.706774 USDT to 0x7ebce287d5db06103152bd5dc114b8d5f2133fd4; verified. PDF pp. 9, 24.E14: service-labeled recordsEvidence ID: E14a — PDF record: 0xc92fb17f37ced481e4fb6d8506a85645322dba764d603d535d2d463ebbd9f082. November 2, 2026, 03:08:23 UTC; block 26324303; 50.000000000000000000 ETH to the Chainflip-labeled address; verified. PDF pp. 8, 21.Evidence ID: E14b — PDF record: 0x0983fc81da40e8f4cca0773f7b2e6ed307804e7924a1bd34e0d8322d16c9d4b8. November 2, 2026, 03:13:59 UTC; block 26324331; 100.000000000000000000 ETH; verified. PDF pp. 8, 21.Evidence ID: E14c — PDF record: 0xf5b035bca990e0de75dba21b42cbcb8f2b2e97cfe76f5fc8991d9def6259e860. November 2, 2026, 05:14:11 UTC; block 26324931; 45.000000000000000000 ETH; verified. PDF pp. 8, 21.Evidence ID: E14d — PDF record: 0x377743658f05b76d8a47e68201c217a2673aa0bd4c99f7878c280ff5d847eefd. November 2, 2026, 05:24:11 UTC; block 26324981; 32.000000000000000000 ETH; verified. PDF pp. 8, 21.Evidence ID: E14e — PDF record: 0x19820a17988318c2d56771b2a6349e6eca027549b61fa6937de02cc0fe8e2dd8. November 3, 2026, 21:51:59 UTC; block 26337084; 14.000000000000000000 ETH; verified. PDF pp. 8, 21.Address and role registerLabel: Seed 1 — Full address and role in the PDF: 0x730bcb1296758c377149d7409f98f041cf723992. Publicly described as exchange-paid; ownership unconfirmed.Label: First USDC intermediary — Full address and role in the PDF: 0xc80f1cd39dc15a341c4ff083ece7d526964a8ce4. Receives E1 and sends E2.Label: Commingled USDC intermediary — Full address and role in the PDF: 0xb4043516a2e5c20e6227ea074c4112457d06d39b. Sends E3a–E3c.Label: Seed 2 — Full address and role in the PDF: 0x9eca05d78f6751c91ab048858b7d21a67c015547. Publicly described as a swap wallet; ownership unconfirmed.Label: Resolver-labeled recipient — Full address and role in the PDF: 0x225a38bc71102999dd13478bfabd7c4d53f2dc17. “Rizzolver, Unknown.”Label: Other USDC recipient — Full address and role in the PDF: 0x52b335fd4d229c4b4ffa6190526e4b5fb8e3fb09. Unlabeled.Label: Seed 3 — Full address and role in the PDF: 0xa3a98584d410c4e32f9825f6af1168f4e774ae0d. Publicly described as frozen-USDT wallet; ownership unconfirmed; freeze unconfirmed.Label: First ETH relay — Full address and role in the PDF: 0xd359dfac0ec3032939f95839cba50b5ad10a0573. Single-forward relay in the report.Label: Second ETH relay — Full address and role in the PDF: 0xf5968bc4d8cd1c75a7ddb93b158689eff9014ae1. Single-forward relay in the report.Label: ETH relay recipient — Full address and role in the PDF: 0xfa6766b362461a20046451b16277ec5f7d159556. Service attribution unconfirmed; publicly attributed Kraken deposit address.Label: Separate ETH branch — Full address and role in the PDF: 0xb3a21eb35ba99f2d9a2bc11f1f6fa17e00f99762. Receives 2,000 ETH from Seed 3.Label: Swap address — Full address and role in the PDF: 0x2fb89a93a1908b1902da6b5a6e3459df75df8516. Site of E10 and E11.Label: Main onward USDT recipient — Full address and role in the PDF: 0x7ebce287d5db06103152bd5dc114b8d5f2133fd4. Unlabeled; bridge role unconfirmed.Label: Chainflip-labeled recipient — Full address and role in the PDF: 0xf5e10380213880111522dd0efd3dbb45b9f62bcc. “Chainflip, Exchange.”7. Source and scopeSource: SentinelTX, Investigation report CASE-CBE85A32, 5 November 2026. This article presents selected records and assessments from the report; it is not an independent on-chain validation. The report cites Bitquery’s EU theft investigation for public-source context.The analysis covers selected Ethereum activity. Some records predate the November 1–4 analysis window and provide background only. Coverage is incomplete; the recorded movements do not establish total incident loss or demonstrate that every listed transfer belongs to the incident. Values moving through successive addresses are not added together, and different assets are not combined into a loss estimate.The Seed 1 route passes through commingled funds. The evidence does not allocate Seed 1-derived value to individual resolver payments or establish a direct funding link between Seed 2 and Seed 3. Service-labeled transactions alone do not establish a case-linked cash-out, an account holder or settlement on another chain.The publicly reported Kraken attribution and Tether freeze remain unconfirmed. A historical balance is not a current holding, confirmed frozen amount or recovery. The report does not establish the victim’s identity, account-access mechanism or final destination of the funds. Other-chain routes remain outside the demonstrated scope.