Sprunky • 👁️

🚨 Nobody published this: after the X100 ($4.85M) and zkLink Nova ($786K) hacks, a SECOND wave of 1,201.2 ETH silently entered Tornado Cash on Oct 27 — missing from every public report. We traced the full cluster on-chain: • 4 holding wallets, never published before • A pre-exploit link dated Oct 1 • 702,154.54 DAI still untouched today • 27.76 ETH out via 6 FixedFloat deposits Every wallet, contract & tx below. 🧵

Timestamp correction (Zero-Error): the DAI balance re-check cited as "Oct 30" in tweets 4 and 12 was performed on Oct 29 (16:00–17:00 UTC), the same day this thread was published. Figures unchanged: 702,154.54 DAI untouched across W1 / W2 / Hop 2. We flag our own errors as fast as we flag theirs. 👁️

METHOD & DISCLAIMER VERIFIED ✅ = on-chain tx/log data + Etherscan labels + public reports (Blockaid, SlowMist, CryptoTimes, The Defiant, TraceFast) OBSERVED 🔍 = our exclusive trace, explicitly flagged All data is public on-chain information. Educational purposes only — not financial or legal advice. Verify independently before acting. Verify, then trust 👁️

RECOVERY & ACCOUNTABILITY 702,154.54 $DAI untouched as of Oct 30 — but $DAI cannot be frozen. Levers: off-ramp compliance, law-enforcement referrals, and the @zkLink_Official 20% white-hat bounty (Oct 29 statement). Anonymized: 2,022.4 $ETH (Tornado) + 27.76 $ETH (FixedFloat) Illiquid: 548,723 $X cc @blockaid_ @SlowMist_Team @PeckShieldAlert @SkyEcosystem @FixedFloat @tracefast_xyz

ADDRESS POISONING + EIP-7702 ABUSE — VERIFIED ✅ Dust (1 gwei / 0 $ETH) from look-alikes around every hot wallet, including delegated EOAs labeled Fake_Phishing2114928 / Fake_Phishing2829807: 0x211B8C22637a8fe1547Eb9aAEa705926B2129c6A mimics W2 (0x211B4aeB…9C6A) 0x75dCbB202200E0fFEb80F57Ae4E657a84d38c0f3 mimics W1 (0x75Dcf339…c0F3) 0x2D5A860226f3a384cDC76D9089628F7F74c6AfB0 mimics Hop 2 (0x2D5a8AAb…fB0) Never copy addresses from history. Verify all 42 characters.

CLUSTER COHESION — VERIFIED ✅ "X100 Exploiter 3": etherscan.io/address/0x0A678… Holds 548,723 $X (X100 token 0x100A2C7F45Fd48e217fdcE72e658dc78Fd43A100) — mark-to-market ~$979K, pool liquidity ~$2: dead value. Oct 1, 20:28 UTC — sent 0.1 $ETH to Exploiter 2, 23 days BEFORE X100: etherscan.io/tx/0x120628edfa… One cluster, compartmentalized routes.

TORNADO CASH — 2,022.4 $ETH TOTAL — VERIFIED ✅ Wave 1 (Oct 26): distributor 420.8 + wallet 4 400.4 = 821.2 $ETH Wave 2 (Oct 27, 13:32–13:56 UTC): wallets 1-3 × 400.4 = 1,201.2 $ETH Wave 2 is missing from public reporting: each wallet ran 4×100 + 4×0.1 deposits. Router: etherscan.io/address/0xd90e2… Sample: etherscan.io/tx/0x0360777886… All four holdings now ~0.09 $ETH.

X100 DISTRIBUTION — EXCLUSIVE TRACE ✅ Distributor (received 2,022.85 $ETH from X100 Exploiter 1; now empty): etherscan.io/address/0x82967… Oct 24, 14:39–14:43 UTC → four holding wallets, 400 $ETH each: 1) 0x4fDB9F9A44b356c8A9c2Ea060a40Fb7a9cAaBef3 2) 0x64b135Af3d80733c9C290D58873e2CCcb34a81Ae 3) 0x6790cF09ba33D05aDA2C13cBB4104F5b8B666391 4) 0xF637DCeE7Dd96E8FDaB926C5993D558B52D635ea These addresses appear in no public report before this thread.

ATTACKER WALLET 3 = "X100 EXPLOITER 2" — VERIFIED ✅ etherscan.io/address/0xDAB13… Oct 29, 01:43:11 UTC — second zkLink drain: 216.4M $ZKL + token basket: etherscan.io/tx/0x8a7e38b9c2… OBSERVED 🔍: 0.0021 $ETH message to Linea at 22:38 UTC — 17 min after the main drain: etherscan.io/tx/0x684dc81ca8… Same wallet executed the X100 governance hijack on Oct 24. Serial cluster.

FIXEDFLOAT OFF-RAMP — 27.76 $ETH, 6 DEPOSITS — VERIFIED ✅ Relay wallets forwarded within ~90s of funding: 0x05b38C2d3c66031D72C990753F464271a7fd6def → 4.999996 ETH etherscan.io/tx/0x0268cf8612… 0xc8b6530952474f10B26DB8292E4B82EE82027799 → 4.999996 ETH 0x064E4A4f459341c5668eb9cE6Fa5f2a715f7FB39 → 4.999996 ETH 0x685Cca4082f5c89a17F0DC8820B1187f5E9dd9E3 → 1.999997 ETH H4a → 5.786996 ETH | H4b → 4.969997 ETH All into FixedFloat Hot Wallet 2: etherscan.io/address/0x4E5B2… cc @FixedFloat — converges with @tracefast_xyz's independent trace.

THE HOP CHAIN — VERIFIED ✅ W1 → W3 (25,000 $DAI): etherscan.io/tx/0x7c6955ba4e… W3 (DAI→$ETH swaps): 0xDf410542AA35DAb5e1FF3F46FCBD671D5E243977 W3 → H3a (5.758 ETH): 0x904735A907319eed25887ed65E3fD6aede03D6A8 W3 → H3b (5 ETH): 0xa4D628903d2831745CC693c60F13E9cf3A64ac8A H3a → H4a (5.787 ETH): 0x5e2B259651898004E8e3C0f6d65C87c2226F9798 H3b → H4b (4.97 ETH): 0x44bd32A54fD234DBaB399d8fC3EDb1ef3D97dB0a

THE 702K DAI STACK — STILL UNTOUCHED (re-checked Oct 30) W1: 221,847.79 $DAI + 0.3045 $ETH etherscan.io/address/0x75Dcf… W2: 268,344.09 $DAI + 0.0128 $ETH etherscan.io/address/0x211B4… Hop 2: 211,962.66 $DAI + 0.2937 $ETH etherscan.io/address/0x2D5a8… Important: $DAI has no freeze function. Issuer blacklists cannot help — the levers are off-ramp compliance and the bounty.

ATTACKER WALLET 1 — VERIFIED ✅ Etherscan label "zkLink Nova Exploiter 1": etherscan.io/address/0xaCA06… Gas-funded by FixedFloat Hot Wallet 2 hours before the exploit. 7 min after: swapped 113.74 $pufETH → 123.26 $ETH via Curve Router: etherscan.io/tx/0x123bd9627d… Then split 102.06 / 101 / 100 $ETH → W1 / W2 / Hop 2 below.

THE zkLink Nova DRAIN — VERIFIED ✅ Oct 28, 22:21:35 UTC — one tx forged a batch root via the public relayer and finalized unauthorized withdrawals: etherscan.io/tx/0x4f3c23e75b… Out: 22.43 $ETH + 11 tokens — 245.74 $pufETH, 12.57 $ezETH, 18,113 $USDC, 3,361 $USDT, 6.87 $rsETH, 6.30 $STONE, 0.1736 $WBTC + more Vuln: Arbitrator.claimMessage etherscan.io/address/0x1ee09… Legit gateway: etherscan.io/address/0x83Bc7…

⚖️ DISCLAIMER This analysis is for educational and research purposes only. We do not provide financial advice or endorse any recovery actions. All addresses, transactions, and balances are publicly available on-chain data. No private information was accessed or used. VERIFIED claims are backed by public reports from Blockaid, SlowMist, CryptoTimes, Bitquery, PublicAML, and The Defiant. OBSERVED claims are our exclusive on-chain analysis and have not yet been independently confirmed by public sources. Verify all information independently before taking any action.

📋 SUMMARY ✅ VERIFIED (Public Sources): • X100 Exploiter 2 active in both exploits • Shared FixedFloat funding • Coordinated campaign confirmed by security firms 🔍 OBSERVED (Our Exclusive Tracing): • Curve swap explains missing $285K • Three separate funding routes • Linea message 17 min after zkLink exploit • Sequential timeline suggests coordination 💰 RECOVERY STATUS: • $546K in DAI still on-chain (W1 + W2) • Recovery window still open • @zkLink_Official should coordinate with Circle/Sky/Maker for freeze requests Verify, then trust. 👁️

📅 COORDINATION TIMELINE (VERIFIED + OBSERVED) Oct 24: X100 governance takeover (~$4.85M) ✅ VERIFIED Oct 25: AW3 receives Across Protocol funding 🔍 OBSERVED Oct 27: X100 Exploiter 1 sends 400 ETH to Tornado 🔍 OBSERVED Oct 28, 22:21 UTC: zkLink exploit ($786K) ✅ VERIFIED Oct 28, 22:28 UTC: AW1 swaps 113.74 pufETH → 123.26 ETH via Curve 🔍 OBSERVED Oct 28, 22:38 UTC: AW3 sends ETH to Linea 🔍 OBSERVED Oct 29, 03:00 UTC: AW1 receives FixedFloat funding ✅ VERIFIED Sequential exploits with shared infrastructure. The pattern is clear.

🔍 OBSERVED (Our Exclusive Tracing) AW3 (0xDAB137F3...) sent 0.0021 ETH to Linea at 22:38 UTC on Oct 28 — just 17 MINUTES after the zkLink exploit. Tx: etherscan.io/tx/0x684dc81ca8… This could be a cross-chain exit route or settlement message. ⚠️ This is our on-chain observation. Public reports mention Linea only as zkLink's normal settlement layer, not as an attacker exit path.

🔍 OBSERVED (Our Exclusive Tracing) Three distinct funding routes identified: 1️⃣ X100 Exploiter 1 (0x4fDB9F9A...) → Tornado Cash (400 ETH, Oct 27) 2️⃣ AW3 (X100 Exploiter 2) → Across Protocol (40 days ago) 3️⃣ AW1 (zkLink Attacker) → FixedFloat Hot Wallet 2 (Oct 29) Different anonymization services, SAME attack pattern: batch root manipulation + cross-chain message forwarding. ⚠️ Across Protocol funding is our observation, not yet publicly confirmed.