and recovering crypto assets.
and recovery crypto assets.
to cryptocurrency.
to cryptocurrency.
for illicit funds.
for illicit funds.
и связей между кошельками.
и связей между кошельками.
с криптовалютой.
с криптовалютой.
Contents:
- What Happened: The Victim's Account
- Details of the Attack
- Where the Money Went: Key Findings
- Timeline: How the Funds Moved On-Chain
What Happened: The Victim's Account
What Happened: The Victim's Account
Seventeen minutes later, at 01:26:10 UTC, he clarified that around $40,000 had been taken from his regular wallets and another $720,000 from a single Ledger hardware wallet. Later, he said police were at the scene.
Details of the Attack
Details of the Attack
Solscan flagged the published wallet address as suspicious, displaying a warning that it was linked to the robbery.
Crypto commentator Bala described it as a type of attack the industry rarely discusses. In his view, the central question is how the criminals knew about the victim's holdings and where to find him.
Bala suggested that a leak of Revolut customer data could have led the attackers to the victim. The victim confirmed that he banks with the neobank. There is no official confirmation of any connection between the leak and the attack.
Where the Money Went: Key Findings
Where the Money Went: Key Findings
The stablecoins went to an exchange. Roughly two hours after the post, all 718,735 USDC reached a wallet labeled HitBTC, where they merged into the exchange's pooled balance. Public blockchain data cannot reveal who controlled the credited account or what happened to the funds afterward. Only the exchange has that information.
The SOL was swapped for ETH, most of which remains untouched. A total of 346 SOL was exchanged for 14.7 ETH via the cross-chain service NEAR Intents in just 44 seconds. Of that amount, 13.73 ETH (93%) is still held across three Ethereum addresses and has not moved since October 14. Another 0.97 ETH was sent in three payments to an address labeled Aeroswap.
A second trail emerged that the victim never mentioned. From the same intermediary address that forwarded USDC to the robbers' wallet, another 1,725 USDC was exchanged for around 0.7 ETH. Some of those funds reached an address labeled RedotPay. The link between this trail and the robbery has not been established.
The transaction history was deliberately polluted. Five lookalike Solana addresses appeared along the route, alongside tiny transfers and spoofed Ethereum token events that impersonated senders. We filtered out all of this noise and excluded it from the totals.
What the blockchain cannot tell us. It does not identify the attackers, the owner of the exchange account or the ultimate recipients of payments routed through Aeroswap and RedotPay. Answering those questions requires records from the services involved and confirmation from the victim about each originating wallet.
What follows is the complete trail: every transaction, every address and every amount, down to the last wei.
Timeline: How the Funds Moved On-Chain
Timeline: How the Funds Moved On-Chain
Step 1. Evening of October 12: Funds arrive at the robbers' address. At 22:38, 346 SOL arrived at B3pMs331kxjEjiB8rj6tyNsiGkLaXeKyPjJqTpBAarCR (B3p for short). Seven minutes later, wallet Bj7sy sent 720,464 USDC to intermediary address 7jy. Another 13 minutes later, at 22:58, that intermediary sent 718,735 USDC to B3p. B3p now held approximately $760,000, matching the amount the victim would later report.
Step 2. That same night: A separate branch. The intermediary address 7jy retained 1,728 USDC in remaining funds. Between 23:24 and 23:27, these were sent to address 8gt. From there, 1,725 USDC went to a swap service and were converted into 0.6986 ETH in 44 seconds. The victim did not mention these funds, and it is not yet possible to establish that they came from the same theft.
Step 3. October 13, 01:09: The victim goes public. His first post appeared. Ten minutes later, at 01:19 and 01:20, SOL moved from B3p to intermediary DWMD in two transfers. By 01:24, the funds had reached a NEAR Intents swap deposit; 44 seconds later, 14.7 ETH appeared at Ethereum address 0xf672. At 01:26, the victim broke down the loss: $40,000 from regular wallets and $720,000 from his Ledger.
Step 4. 01:41–02:16: The stablecoins reach an exchange. B3p sent 718,735 USDC to an address labeled HitBTC Dep. Thirty-five minutes later, those funds were swept into the exchange's hot wallet. The publicly traceable USDC trail ends there.
Step 5. 03:52: ETH moves into storage. Almost all 14.7 ETH moved from the payout address to the main wallet, 0xeec3, which would become the attackers' apparent vault.
Step 6. October 13, daytime: The funds are split. Between 14:55 and 16:12 UTC, the main wallet distributed 0.94 ETH and 0.54 ETH to two holding wallets, along with two further payments through chains of single-use intermediaries to an address labeled Aeroswap.
Step 7. Evening of October 14: The final movement. At 22:42, a third payment of 0.0355 ETH reached Aeroswap. No further movement was observed after that. We checked the remaining balances on October 15.
Date and time (UTC) | Event | Amount |
12 Oct 22:38:19 | SOL received from G9VPG at B3p (S01) | 346.128159507 SOL |
12 Oct 22:45:11 | USDC sent from Bj7sy to intermediary 7jy (S02) | 720,464.254644 USDC |
12 Oct 22:58:50 | USDC received from 7jy at B3p (S03) | 718,735.798692 USDC |
12 Oct 23:24:47 | Remaining funds sent from 7jy to 8gt (S04) | 1,720.192395 USDC |
12 Oct 23:25:09 | Remaining funds sent from 7jy to 8gt (S05) | 6.605961 USDC |
12 Oct 23:26:51 | From 8gt to swap deposit 7Sxc (S06) | 1,725 USDC |
12 Oct 23:27:35 | NEAR Intents payout to 0xc099 (E01) | 0.698582915063641659 ETH |
13 Oct 01:09:28 | Victim's first X post | — |
13 Oct 01:19:07 | From B3p to intermediary DWMD (S07) | 20 SOL |
13 Oct 01:20:28 | From B3p to intermediary DWMD (S08) | 326.126662056 SOL |
13 Oct 01:24:15 | From DWMD to swap deposit vj83 (S09) | 346.125169610 SOL |
13 Oct 01:24:59 | NEAR Intents payout to 0xf672 (E02) | 14.700024849433303243 ETH |
13 Oct 01:26:10 | Victim clarifies: $40,000 + $720,000 | — |
13 Oct 01:41:08 | From B3p to DN2c, labeled HitBTC Dep (S10) | 718,735 USDC |
13 Oct 02:16:10 | From DN2c to BfP2, labeled HitBTC Hot Wallet 1 (S11) | 718,735 USDC |
13 Oct 03:52:11 | From 0xf672 to main wallet 0xeec3 (E03) | 14.69997657 ETH |
13 Oct 14:55:59 | From 0xeec3 to first holding wallet 0xa80f (E04) | 0.9382916 ETH |
13 Oct 15:26:11 | From 0xeec3 to second holding wallet 0x13b2 (E05) | 0.536467895376838892 ETH |
13 Oct 15:54:59–16:01:23 | First payment to Aeroswap via 0x2f25 and 0x28c7 (E06–E08) | 0.19940474378446023 ETH |
13 Oct 16:08:11–16:12:47 | Second payment to Aeroswap via 0x2f25 and 0x123b (E09–E11) | 0.730486058801652989 ETH |
13 Oct 17:17:35 | Unrelated spoofed-sender transaction (E12) | 0 ETH |
14 Oct 00:52:59 | From 0xabee to address labeled RedotPay (E13) | 0.031822457352032674 ETH |
14 Oct 22:39:59–22:42:47 | Third payment to Aeroswap via 0x2f25 and 0x1ba8 (E14–E16) | 0.035538672221488689 ETH |
15 Oct | Balance snapshots taken across networks | — |
The USDC Trail Before the Robbery Address
The USDC Trail Before the Robbery Address
At 22:58:50 UTC, that second address sent 718,735.798692 USDC to the published recipient, B3p. The same transaction also sent 0.240900 USDC to account 5JV6dqNV5qjaXcSFmvJoHbfzLdMqv3WyudVJSRhqSCEp, whose on-chain owner is 3YzxGgCjQUx1b38Xq4jkbnM6Fk7HvhKt3yg2eijKLbRt. The purpose of this small accompanying payment is unknown. Evidence: S03.
Publicly available evidence does not establish whether Bj7sy and 7jy belonged to the victim or to someone else. This is the investigation's first fork: if Bj7sy was the victim's wallet, 7jy was either another address under his control or an address already controlled by the attackers.
The Main USDC Outflow: The Route to HitBTC
The Main USDC Outflow: The Route to HitBTC
DN2c was supplied with the label HitBTC Dep, while BfP2 was labeled HitBTC: Hot Wallet 1. The transfers between these exact addresses are confirmed on-chain. The labels themselves, however, could not be independently reconfirmed at the time of collection because access to Solscan was restricted. HitBTC therefore remains a supplied service attribution rather than a newly verified one.
The deposit was swept up in a single batched transaction alongside four other incoming transfers. The amount relevant to this case was 718,735 USDC, while the pooled USDC account increased by 741,403.939201 USDC in total during that transaction. The other deposits are not attributed to this case. After the sweep, the pooled wallet held 827,465.347841 USDC: the exchange wallet's combined balance, not the proceeds of this one incident.
This is where the public trail ends. Tracing the funds further would require the service's records of the specific deposit credit, the customer's account and subsequent instructions involving the internal balance. Outflows from the pooled wallet cannot be attributed to this customer merely because the amounts or timing look similar.
SOL: 44 Seconds to Ethereum
SOL: 44 Seconds to Ethereum
Almost three hours later, the SOL began moving again. Two transfers reached intermediary address DWMDdqJUy9ywU3MVRcpZjehqfpSyTV6o3r9Rf2UQoXwf on October 13: 20 SOL at 01:19:07 UTC and 326.126662056 SOL at 01:20:28 UTC. Then, at 01:24:15 UTC, 346.125169610 SOL was sent to swap deposit address vj83ppgFCvR1MJbopKzkJqZ7PFanmAEpE2aFVPVdQaH. Deposit: S09.
NEAR Intents then executed the cross-chain swap, with SwapKit as the solver. The original order record shows a SUCCESS status, a Solana deposit, an Ethereum payout, the full recipient address and the exact amounts. The deposit and payout were independently verified on their respective blockchains.
Field | Value |
Order created (UTC) | 2026-10-13 01:24:06.837021 |
Deposit (UTC) | 2026-10-13 01:24:15 |
Payout (UTC) | 2026-10-13 01:24:59 |
Elapsed time | 44 seconds |
Payout | 14.700024849433303243 ETH |
Recipient | 0xf672434c9a5c67f4394b3a94842fb86102dd1926 |
Intent hash | GaYzDbARTLv8sWMU4p9e69ydNkHUXkgdJ5jDR5fyWDc6 |
Swap Fees and Deposit Processing
Swap Fees and Deposit Processing
The Solana deposit was processed eight seconds later: 346.125265394 SOL, including 0.000095784 SOL added by the processing address, was sent to 6tckHFBpiJ8YgYN8FUskvtvTpXQZ55g5LHeo1kvELoDQ. Address 9WL2A89YBr6X47ABKYNzPentWiBA3H8tpaiuf5CaYHx6 handled the processing of swap deposits. Shared service infrastructure downstream of the deposit is not classified as an attacker-controlled wallet.
How the ETH Was Distributed and Sent to Aeroswap
How the ETH Was Distributed and Sent to Aeroswap
Later that day, the main address allocated 0.9382916 ETH to the first holding wallet, 0xa80fd27f9946e6235e21e8f0cdf9592624865246 (14:55:59 UTC, E04), and 0.536467895376838892 ETH to the second holding wallet, 0x13b2809c6b3ad71024f624eabf857b59113462e3 (15:26:11 UTC, E05).
Three other transfers followed the same pattern: from the main wallet to distribution address 0x2f254ef9acefeef89a382ba9a194f71c0888779e, then to a single-use intermediary, and finally to 0xfb19ffd1ff9316b7f5bba076ef4b78e4bbedf4e1. An independently retrieved AML attribution identifies this exact recipient address as Aeroswap. The intermediaries were 0x28c741448db4429ca214b3e39a3b61f262b74d1c, 0x123b8f9781529ad3d173171a05937b263f9bebfc and 0x1ba8c07afcc14856099186685724b218969d78f2. Each was used exactly once.
Main-Branch Balances: Reconciled to the Wei
Main-Branch Balances: Reconciled to the Wei
Full Ethereum address | ETH |
0xeec36e6b1dad28331e457d1abf532265d6ee700f | 12.259637912895909298 |
0xa80fd27f9946e6235e21e8f0cdf9592624865246 | 0.9382916 |
0x13b2809c6b3ad71024f624eabf857b59113462e3 | 0.536467895376838892 |
0xf672434c9a5c67f4394b3a94842fb86102dd1926 | 0.000004979010005243 |
The main branch balances reconcile exactly:
14.700024849433303243 ETH paid out + 0.000000004 ETH in external dust = 13.734402387282772335 ETH remaining + 0.965429474807601908 ETH paid to Aeroswap + 0.000192991342929 ETH in network fees.
Put simply, 93% of the 14.7 ETH obtained in exchange for SOL had not moved. That is unusual for extortionists, who generally rush to launder their proceeds. For police, it presents an opportunity.
Almost nothing remains on Solana. B3p held 0.561732 USDC and 0.001508440 SOL, while DWMD held 0.001498441 SOL. B3p's USDC balance includes an unrelated dust transfer of 0.000100 USDC. These small residual balances should not all be treated as unspent portions of the original transfer.
The Second Branch: The 1,725 USDC Nobody Mentioned
The Second Branch: The 1,725 USDC Nobody Mentioned
At 23:26:51 UTC, that recipient forwarded 1,725 USDC to swap deposit address 7SxcLM1Ep56arSKTcB3CzHLtjyf51QgDua8cG8MwVmux. Deposit: S06. Address FvULawNPGBbuwYus74ECaQoV1oH9Tk6XPN7VPN51NYds swept the USDC from this swap deposit.
A second original NEAR Intents order record links the deposit to a payout of 0.698582915063641659 ETH at 23:27:35 UTC to 0xc09925a2ccfb801b45133d129d49a51e3b3c7548. The elapsed time was again 44 seconds. Payout: E01, again from the shared payout address 0x2cff890f0378a11913b6129b2e97417a2c302680. Intent hash: HL25uag7XgDfnrPkqwbxuaojfcfDVntG4zdLozPxVss8. The service lists fees of 5.175000 USDC and 1.725000 USDC payable to hvlnear.near and swapkit.near, respectively.
This branch connects to the main route through their shared upstream USDC address. However, neither the attackers' control over these funds nor their inclusion in the reported loss has been established.
Balances and the Limits of Attribution
Balances and the Limits of Attribution
The remaining balances were 0.000000630547008 ETH at 0xc099, 0.001790471879995659 ETH at 0xcb802 and 0.094736432177307 ETH at 0x390f. The entire balances of older wallets containing commingled funds are not attributed to the case. Address 7jy retained 1.175166 USDC and 8gt retained 1.559126 USDC; neither amount is added to the main branch's retained funds.
Where the Additional ETH Payout Went
Where the Additional ETH Payout Went
- 0.54361855 ETH went to 0x390f90dd7fe8665059869655cf757b9d52a7f1ac.
- 0.13590463 ETH went to 0x41902261f16299c698b9e27a1569bfd27cf7d29b, an address with prior activity and other funds. Its subsequent transfer of 0.136892175210883442 ETH to 0x5b8d2b4acbc8021f38f63ae67b6dd24b4dfca066 formed part of a commingled flow; the entire amount is not attributed to this case.
- Two smaller transfers totaling 0.01702936 ETH went to 0x03547e71b1cd80b30e1c481913063d23386cbe45. That address then sent 0.017021065081774 ETH to high-volume infrastructure address 0x480cd46e6fade651a0437deadda53d5c8e7d846a. Within the one-hour window examined, the latter had 91 standard transactions; the subsequent route of the specific funds could not be established.
Commingled Funds and the RedotPay Connection
Commingled Funds and the RedotPay Connection
- 0.39606671 ETH to 0x56af94348f478cb6f8ed2c75273253547b32acd2. That wallet also received 0.14920665 ETH from another address before sending 0.54522716 ETH to 0xaf5ee32415cac2a5b611eb60169fa74a9e2e201c. This was a combined outflow, and the share attributable to the original branch could not be traced further.
- 0.02625676 ETH to 0xf1da42e4f7a3b7fd35ae541a9338577281d68b41.
- 0.02641072 ETH to 0xabee62571252c285a803987b3bdaa7b85fadc349. Thirty-nine minutes later, that address sent 0.031822457352032674 ETH to 0x9d7d8b567ee10bcb4f9db438245e1d0668175d72, which carries an attribution to RedotPay, a crypto payment card service. The outgoing transfer exceeded the incoming amount from the branch under review. The label applies to this exact recipient address; the entire outgoing amount is not attributed to the case.
Unrelated Transfers and a Fabricated Transaction History
Unrelated Transfers and a Fabricated Transaction History
- Four ordinary external dust transfers of 1 gwei of ETH each to addresses on the main route. They are accounted for separately in the balance reconciliation: the 0.000000004 ETH of "external dust" noted above.
- Events emitted by unrelated ERC-20 contracts with names resembling ETH. The sender field impersonates a wallet under investigation, while the recipient looks similar to a legitimate address. These events are not transfers of native ETH, nor do they establish that the owner of the address named in the event signed anything.
The token events were recorded along with their contract addresses and classified separately. Their amounts are not added to the total ETH moved out. For two examples, the actual transaction sender was independently retrieved. Other suspicious events were classified using the known contract address and event structure; the code of every such token contract was not comprehensively reviewed.
Limits of the Findings and Next Steps
Limits of the Findings and Next Steps
Ownership of the originating addresses and the secondary branch. The victim would need to confirm each originating address and TXID, identify every transaction signed under duress and explain the remaining USDC. The additional 1,725 USDC and 0.69858 ETH are not presented as a confirmed part of the loss.
Tracing beyond commingled funds. Investigators have not identified the customer behind the pooled service wallets, the ultimate beneficiary of the transfer through RedotPay, the specific funds' route beyond infrastructure address 0x480c or the relevant share of the commingled outflow to 0xaf5e. Addresses and verified transfers have been retained for follow-up work.
How the attackers may have identified the victim. The theory that a Revolut customer-data leak led the attackers to the victim (discussed earlier in this article) is not corroborated by the evidence examined and is not treated as an established element of the attack.
Identity and common control. Public on-chain transfers establish how funds moved and what role an address played. They do not identify the attackers, prove that all intermediary wallets had the same owner or implicate the services in the robbery. The incoming label Fake_Phishing4516 is not a substitute for that attribution and likewise could not be independently refreshed through Solscan.
A Shared Transaction-Fee Payer
A Shared Transaction-Fee Payer
How We Verified the Funds Flow
How We Verified the Funds Flow
USDC on Solana was verified against token mint address EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v. A matching token name or ticker alone was not considered sufficient to identify the asset.
Balances on the main Ethereum branch were reconciled across eight addresses: incoming and outgoing amounts, including network fees, match the actual balances exactly. Execution receipts were retained for significant transfers. Both swap orders were matched to their Solana deposits and Ethereum payouts in exact base units.
Short transaction histories for the main Solana addresses and their USDC token accounts were reviewed separately. Sender G9's full history was unavailable: only one page of 100 signatures was preserved. For Bj7 and its USDC token account, collection covers the period under investigation and extends across its October 12 UTC lower boundary, but it is not presented as a complete historical record.
Balances were retrieved through separate queries on October 15, 2026, not through a single atomic snapshot of both networks. Details of internal NEAR operations came from the original swap records and were not independently rechecked on NEAR. The corresponding entry and exit transactions were separately verified on Solana and Ethereum.
What Can Be Reproduced
What Can Be Reproduced
Original swap records: SOL-to-ETH swap and USDC-to-ETH swap.
Address Register
Address Register
Address | Network | Role |
B3pMs331kxjEjiB8rj6tyNsiGkLaXeKyPjJqTpBAarCR | Solana | Recipient address published by the victim |
DWMDdqJUy9ywU3MVRcpZjehqfpSyTV6o3r9Rf2UQoXwf | Solana | SOL intermediary |
DN2cCPNJnHjUxHwmNvfcKbhvcQnNQwvimugZLwDKMt2J | Solana | USDC deposit; supplied label: HitBTC Dep |
BfP2dBiHbiqYvsmESsgHEL8wQtZt25sbDNKnwmNRB34G | Solana | USDC consolidator; supplied label: HitBTC Hot Wallet 1 |
vj83ppgFCvR1MJbopKzkJqZ7PFanmAEpE2aFVPVdQaH | Solana | Deposit for the main SOL-to-ETH swap |
G9VPG4XvHheUUbzPexNzx9Yyx97ii53WYb89PvdM2qQk | Solana | Sender of 346.128159507 SOL |
Bj7syMSdLhR2WfVCwJtgYcqWghc5cHD9dnmu7ZsT9ica | Solana | Upstream sender of 720.464.254644 USDC |
7jyHQUVw5cgUU1S1qjHK5ZLk2JzEwGoLJ9zgxPsBpf6C | Solana | Intermediate USDC address before B3p |
8gt7trRySj1Gzt3HtcsNVDe5UkT7BBPjQjHY62k371Qg | Solana | Recipient of remaining funds; sender of 1.725 USDC |
7SxcLM1Ep56arSKTcB3CzHLtjyf51QgDua8cG8MwVmux | Solana | Deposit for the additional USDC-to-ETH swap |
HdqFSBzMaWzfSuncnPHPj6PSy7F1JUSjrEZdjYSfG2sN | Solana | Network fee payer for two B3p USDC transactions |
3YzxGgCjQUx1b38Xq4jkbnM6Fk7HvhKt3yg2eijKLbRt | Solana | Recipient of small associated USDC payments |
5JV6dqNV5qjaXcSFmvJoHbfzLdMqv3WyudVJSRhqSCEp | Solana | Token account for accompanying payments of 0.240900 and 0.237060 USDC |
9WL2A89YBr6X47ABKYNzPentWiBA3H8tpaiuf5CaYHx6 | Solana | Swap deposit processing |
6tckHFBpiJ8YgYN8FUskvtvTpXQZ55g5LHeo1kvELoDQ | Solana | SOL swept from swap deposit |
FvULawNPGBbuwYus74ECaQoV1oH9Tk6XPN7VPN51NYds | Solana | USDC swept from additional swap deposit |
7jyoZ5AmWYX2iapiCNvWadB5kVRPm8gzMc7TLuuBpf6C | Solana | Lookalike-address dust transfers |
B3pMsPwT1rjR8cSvR7dVhYP9VkE2Titvb9cSQK5G4rCR | Solana | Lookalike-address dust transfers |
DWMDaB7cZp5YKWsV9rnBePuSVkBdP5RepPPvJenJbXwf | Solana | Lookalike-address dust transfers |
DWMDeAz9KuaLs3AcdJpaZBx74zVWk1gwZoJN82Ym2Xwf | Solana | Lookalike-address dust transfers |
vj83NEABwPc5gv6zFrQLBMCLprLCdZfgo329ESizcaH | Solana | Lookalike-address dust transfers |
0xeec36e6b1dad28331e457d1abf532265d6ee700f | Ethereum | Main holding and distribution wallet |
0xa80fd27f9946e6235e21e8f0cdf9592624865246 | Ethereum | First holding wallet |
0x13b2809c6b3ad71024f624eabf857b59113462e3 | Ethereum | Second holding wallet |
0xf672434c9a5c67f4394b3a94842fb86102dd1926 | Ethereum | Initial recipient of main swap |
0x2f254ef9acefeef89a382ba9a194f71c0888779e | Ethereum | Distribution address before Aeroswap |
0x28c741448db4429ca214b3e39a3b61f262b74d1c | Ethereum | First intermediary before Aeroswap |
0x123b8f9781529ad3d173171a05937b263f9bebfc | Ethereum | Second intermediary before Aeroswap |
0x1ba8c07afcc14856099186685724b218969d78f2 | Ethereum | Third intermediary before Aeroswap |
0x2cff890f0378a11913b6129b2e97417a2c302680 | Ethereum | Shared payout address for both swaps |
0xfb19ffd1ff9316b7f5bba076ef4b78e4bbedf4e1 | Ethereum | Recipient of three payments; labeled Aeroswap |
0xc09925a2ccfb801b45133d129d49a51e3b3c7548 | Ethereum | Recipient of additional swap |
0xcb8027c2c36239d0fb15ee2f8995b097ed79f1a1 | Ethereum | Distribution address for additional swap |
0x390f90dd7fe8665059869655cf757b9d52a7f1ac | Ethereum | Recipient of 0.54361855 ETH |
0x41902261f16299c698b9e27a1569bfd27cf7d29b | Ethereum | Recipient of 0.13590463 ETH |
0x5b8d2b4acbc8021f38f63ae67b6dd24b4dfca066 | Ethereum | Recipient of mixed transfer of 0.136892175210883442 ETH |
0x03547e71b1cd80b30e1c481913063d23386cbe45 | Ethereum | Recipient of two small ETH transfers |
0x56af94348f478cb6f8ed2c75273253547b32acd2 | Ethereum | Commingling of the additional branch with other inflows |
0xf1da42e4f7a3b7fd35ae541a9338577281d68b41 | Ethereum | Recipient of 0.02625676 ETH |
0xabee62571252c285a803987b3bdaa7b85fadc349 | Ethereum | Intermediate address before RedotPay |
0x9d7d8b567ee10bcb4f9db438245e1d0668175d72 | Ethereum | Recipient of mixed outflow; labeled RedotPay |
0xaf5ee32415cac2a5b611eb60169fa74a9e2e201c | Ethereum | Recipient of mixed outflow of 0.54522716 ETH |
0x480cd46e6fade651a0437deadda53d5c8e7d846a | Ethereum | Service infrastructure per AML attribution |
0x1584a8ee67789d1fe161065388657ad2f2a3c7dd | Ethereum | Actual sender of unrelated transaction E12 |
0x77eb52e44db06777bce478159f25c0d55a295314 | Ethereum | Recipient of unrelated transaction E12 |
Appendix: Verified Transactions
Appendix: Verified Transactions
Code | UTC | Amount | Sender | Recipient | TXID |
S01 | 2026-10-12 22:38:19 | 346.128159507 SOL | G9VPG4XvHheUUbzPexNzx9Yyx97ii53WYb89PvdM2qQk | B3pMs331kxjEjiB8rj6tyNsiGkLaXeKyPjJqTpBAarCR | |
S02 | 2026-10-12 22:45:11 | 720,464.254644 USDC | Bj7syMSdLhR2WfVCwJtgYcqWghc5cHD9dnmu7ZsT9ica | 7jyHQUVw5cgUU1S1qjHK5ZLk2JzEwGoLJ9zgxPsBpf6C | |
S03 | 2026-10-12 22:58:50 | 718,735.798692 USDC | 7jyHQUVw5cgUU1S1qjHK5ZLk2JzEwGoLJ9zgxPsBpf6C | B3pMs331kxjEjiB8rj6tyNsiGkLaXeKyPjJqTpBAarCR | |
S04 | 2026-10-12 23:24:47 | 1,720.192395 USDC | 7jyHQUVw5cgUU1S1qjHK5ZLk2JzEwGoLJ9zgxPsBpf6C | 8gt7trRySj1Gzt3HtcsNVDe5UkT7BBPjQjHY62k371Qg | |
S05 | 2026-10-12 23:25:09 | 6.605961 USDC | 7jyHQUVw5cgUU1S1qjHK5ZLk2JzEwGoLJ9zgxPsBpf6C | 8gt7trRySj1Gzt3HtcsNVDe5UkT7BBPjQjHY62k371Qg | |
S06 | 2026-10-12 23:26:51 | 1,725 USDC | 8gt7trRySj1Gzt3HtcsNVDe5UkT7BBPjQjHY62k371Qg | 7SxcLM1Ep56arSKTcB3CzHLtjyf51QgDua8cG8MwVmux | |
E01 | 2026-10-12 23:27:35 | 0.698582915063641659 ETH | 0x2cff890f0378a11913b6129b2e97417a2c302680 | 0xc09925a2ccfb801b45133d129d49a51e3b3c7548 | |
S07 | 2026-10-13 01:19:07 | 20 SOL | B3pMs331kxjEjiB8rj6tyNsiGkLaXeKyPjJqTpBAarCR | DWMDdqJUy9ywU3MVRcpZjehqfpSyTV6o3r9Rf2UQoXwf | |
S08 | 2026-10-13 01:20:28 | 326.126662056 SOL | B3pMs331kxjEjiB8rj6tyNsiGkLaXeKyPjJqTpBAarCR | DWMDdqJUy9ywU3MVRcpZjehqfpSyTV6o3r9Rf2UQoXwf | |
S09 | 2026-10-13 01:24:15 | 346.125169610 SOL | DWMDdqJUy9ywU3MVRcpZjehqfpSyTV6o3r9Rf2UQoXwf | vj83ppgFCvR1MJbopKzkJqZ7PFanmAEpE2aFVPVdQaH | |
E02 | 2026-10-13 01:24:59 | 14.700024849433303243 ETH | 0x2cff890f0378a11913b6129b2e97417a2c302680 | 0xf672434c9a5c67f4394b3a94842fb86102dd1926 | |
S10 | 2026-10-13 01:41:08 | 718,735 USDC | B3pMs331kxjEjiB8rj6tyNsiGkLaXeKyPjJqTpBAarCR | DN2cCPNJnHjUxHwmNvfcKbhvcQnNQwvimugZLwDKMt2J | |
S11 | 2026-10-13 02:16:10 | 718,735 USDC | DN2cCPNJnHjUxHwmNvfcKbhvcQnNQwvimugZLwDKMt2J | BfP2dBiHbiqYvsmESsgHEL8wQtZt25sbDNKnwmNRB34G | |
E03 | 2026-10-13 03:52:11 | 14.69997657 ETH | 0xf672434c9a5c67f4394b3a94842fb86102dd1926 | 0xeec36e6b1dad28331e457d1abf532265d6ee700f | |
E04 | 2026-10-13 14:55:59 | 0.9382916 ETH | 0xeec36e6b1dad28331e457d1abf532265d6ee700f | 0xa80fd27f9946e6235e21e8f0cdf9592624865246 | |
E05 | 2026-10-13 15:26:11 | 0.536467895376838892 ETH | 0xeec36e6b1dad28331e457d1abf532265d6ee700f | 0x13b2809c6b3ad71024f624eabf857b59113462e3 | |
E06 | 2026-10-13 15:54:59 | 0.39885608076037926 ETH | 0xeec36e6b1dad28331e457d1abf532265d6ee700f | 0x2f254ef9acefeef89a382ba9a194f71c0888779e | |
E07 | 2026-10-13 15:59:35 | 0.19941639968254413 ETH | 0x2f254ef9acefeef89a382ba9a194f71c0888779e | 0x28c741448db4429ca214b3e39a3b61f262b74d1c | |
E08 | 2026-10-13 16:01:23 | 0.19940474378446023 ETH | 0x28c741448db4429ca214b3e39a3b61f262b74d1c | 0xfb19ffd1ff9316b7f5bba076ef4b78e4bbedf4e1 | |
E09 | 2026-10-13 16:08:11 | 0.53109711358200486 ETH | 0xeec36e6b1dad28331e457d1abf532265d6ee700f | 0x2f254ef9acefeef89a382ba9a194f71c0888779e | |
E10 | 2026-10-13 16:11:23 | 0.73049655880165299 ETH | 0x2f254ef9acefeef89a382ba9a194f71c0888779e | 0x123b8f9781529ad3d173171a05937b263f9bebfc | |
E11 | 2026-10-13 16:12:47 | 0.730486058801652989 ETH | 0x123b8f9781529ad3d173171a05937b263f9bebfc | 0xfb19ffd1ff9316b7f5bba076ef4b78e4bbedf4e1 | |
E12 | 2026-10-13 17:17:35 | 0 ETH (unrelated, spoofed sender) | 0x1584a8ee67789d1fe161065388657ad2f2a3c7dd | 0x77eb52e44db06777bce478159f25c0d55a295314 | |
E13 | 2026-10-14 00:52:59 | 0.031822457352032674 ETH | 0xabee62571252c285a803987b3bdaa7b85fadc349 | 0x9d7d8b567ee10bcb4f9db438245e1d0668175d72 | |
E14 | 2026-10-14 22:39:59 | 0.03555563268538669 ETH | 0xeec36e6b1dad28331e457d1abf532265d6ee700f | 0x2f254ef9acefeef89a382ba9a194f71c0888779e | |
E15 | 2026-10-14 22:41:23 | 0.03554917222148869 ETH | 0x2f254ef9acefeef89a382ba9a194f71c0888779e | 0x1ba8c07afcc14856099186685724b218969d78f2 | |
E16 | 2026-10-14 22:42:47 | 0.035538672221488689 ETH | 0x1ba8c07afcc14856099186685724b218969d78f2 | 0xfb19ffd1ff9316b7f5bba076ef4b78e4bbedf4e1 |
