memoscan

0xe848…2953

All memos sent from and to 0xe848…2953.
0x10da0326…0f25sent to0xe8485903…2953·#25,313,534·0x3bca8817…399ab0
============================================================ CASE FILE #2026-CF-047182 CLASSIFICATION: RESTRICTED -- DOJ CCIPS / NCIJTF COORD: FBI IC3 + MPS -- MUTUAL LEGAL ASSISTANCE TREATY STATUS: ACTIVE SURVEILLANCE -- REAL-TIME TRACKING ENGAGED PRIORITY: CRITICAL ============================================================ SUBJECT: Operator of OKX Intent Swap v1.0.0 drainer network ACTIVE: August 2023 -- Present (36+ months continuous operation) OPERATIONAL STATUS: LIVE -- bot nonce advancing real-time (89,742 -> 90,070) VICTIMS: 4,847+ wallets drained -- active victim drain IN PROGRESS SURVEILLANCE: ENGAGED -- all wallets monitored 24/7 -- automated alerts on withdrawal attempts IDENTIFICATION: CONFIRMED - CORR-01: Signing address 0xe8485903 CONFIRMED as operator -- EIP-712 signature in every Settlement orderUID links signing address to Owner 0xaCe2B3c -- SINGLE IDENTITY PROVEN - CORR-02: Monitor bot 0x6EA070f timestamps synchronized with drain operations - CORR-03: Owner 0xaCe2B3c controls ALL contracts used by bot 0x86a067030a96 - CORR-04: HTX hack funds 0x2abc22eb -> 0xdb1d74 -> entered bot wallet directly - CORR-05: All 14,603 deposits exit through single Binance 7 -- single operator - CORR-06: Operator activity detected within hours of initial contact -> 0.0499 ETH deposited from Binance 16 on June 13 -- gas acquisition confirmed -> 4,523 USDC consolidated to Bybit hot wallet same day -- reallocation detected -> Operator nonce advanced 5 transactions post-contact -- response confirmed - CORR-07: Bybit deposits traced to same HD wallet structure as Binance deposits ===== $2.7 BILLION LAUNDERED -- 4,847+ VICTIMS ===== 1,366,796 ETH + $558M stablecoins via Binance KYC 14,603 automated deposits -- 180 transfers in 30 minutes -- bot operational since Aug 2023 Exit: 0x86a067 -> Binance 7 -> Binance withdrawal -> 160+ KYC withdrawal addresses ===== INFRASTRUCTURE -- FULLY MAPPED ===== Owner: 0xaCe2B3c -- controls TokenApprove, ApproveProxy, Settlement OKX v1.0.0, ProxyAdmin, 8 DexRouters, wNativeRelayer -- NOT RENOUNCED - Admin actions: addSolver 20x | removeProxy 8x | renounceOwnership 4x | setProtocolAdmin 2x | upgrade 1x Signing address: 0xe8485903 - Appears as the SIGNER in EVERY OKX Settlement orderUID event - EIP-712 signature links signing address to Owner 0xaCe2B3c -- SINGLE OPERATOR CONFIRMED - Personal wallet. Not a contract. Not a proxy. Bot: 0x86a067030a96 -- 90,070 TXs -- transfer() with compromised seed phrase -- SEED PHRASE THEFT -- NOT a protocol exploit -- ACTIVE Monitor: 0x6EA070f -- 11,489 surveillance pings tracking victims in real-time Gas hub: 0xf30ba13 -- 139,366 ETH ($233M) across 170+ laundering addresses ===== 5 CONFIRMED OPSEC FAILURES ===== FAILURE-01: Signing address 0xe8485903 LEAKED in Settlement event logs -- appears as signer in every order -- any investigator can identify the operator from this single address -- VERIFY: open any OKX Settlement TX on Etherscan -- orderUID contains this address FAILURE-02: All 14,603 bot deposits exit through Binance 7 (0x28c6c06) -- mandatory KYC at deposit -- operator identity recorded at Binance -- KYC CONFIRMED FAILURE-03: renounceOwnership() executed on 4 DexRouters -- INTENTIONAL DESTRUCTION OF EVIDENCE -- criminal intent legally established beyond reasonable doubt FAILURE-04: Monitor bot 0x6EA070f tracking victims in real-time -- PREMEDITATION confirmed -- not opportunistic -- systematic targeting FAILURE-05: Address poisoning -- fake token U?S?D? sent from lookalike 0x86a06a1 -- FRAUD confirmed ===== KYC-IDENTIFIED WALLETS -- REAL NAMES ON FILE ===== Binance 7: 0x28c6c06 -- $1,006M USDT + 1,366,796 ETH -- 14,603 deposits -- KYC: mandatory at exchange Binance 16: 0xDFd5293D -- SUBJECT PERSONAL stash: $58.9M USDT -- KYC: full identity on file at exchange Binance 2: 0xbe0eb53f -- 1,996,008 ETH -- KYC Binance 3: 0x21a31ee1 -- KYC Binance 5: 0xdfd52933 -- KYC Binance 8: 0x95ad61b0 -- KYC Binance 9: 0x974caa59 -- KYC Binance 14: 0x56eddb7a -- gas funding -- KYC Binance withdrawal: 0xee7ae85f -- 160+ KYC exit addresses -- ALL traceable to real identities -- your entire network exposed HTX/Huobi #48: 0xa03400e0 -- 742,433 ETH source HTX hack: 0x2abc22eb -> 0xdb1d74 -> subject bot -- CHAIN PROVEN Bitfinex: 0x77134cbc -- 306,725 ETH -- KYC OKX: Settlement v1.0.0 (0x25ed72) -- operator identified -- cross-referenced with OKX user database Bybit: 0x260b364 -- deposits traced -- KYC ===== ACTIVE VICTIM ===== 0xe8736af -- $2.3M+ stolen -- seed phrase compromise -- drain IN PROGRESS 4,847+ victim wallets identified -- bot active 36 months -- drain continues daily ===== NO EXIT -- ALL ROUTES CLOSED ===== On-chain trail: PERMANENT -- 14,603 deposits cannot be deleted -- blockchain immutable Blockchain analytics: Chainalysis-grade transaction graph mapped across 170+ addresses including pre- and post-mixer patterns -- mixers provide NO protection KYC data: 8 identities verified -- real names, passport numbers available via legal process at Binance, OKX, Bybit, HTX, Bitfinex -- 160+ withdrawal addresses link to 160+ real people -- under PRC law, ringleader receives maximum penalty while cooperators receive reduced sentences Exchange preservation: account freeze pending upon court order -- all exchange accounts subject to seizure Real-time monitoring: Automated on-chain alerts configured on all subject wallets -- every withdrawal attempt flagged This investigation is complete. There is no alternative outcome. ===== JURISDICTION ===== PRC Criminal Law -- PRIMARY JURISDICTION: - Article 192: Large-scale fundraising fraud -- DEATH PENALTY -> Legal threshold: 10M RMB ($1.4M) -> This case: 19.5 BILLION RMB -- 1,900x above death penalty threshold - Article 266: Fraud of especially large amounts -- LIFE IMPRISONMENT -> Maximum sentence applicable - Article 191: Money laundering -- 10 years + fine 5-20% of amount -> Fine alone: $135M-$540M - Article 225: Illegal financial operations (crypto banned since Sept 2021) -> Every Binance deposit since 2021 = separate criminal count US Federal Law -- CONCURRENT JURISDICTION: - 18 USC 1343: Wire fraud -- 20 years (financial activity crosses state lines) - 18 USC 1956: Money laundering -- 20 years + forfeiture of ALL proceeds - 18 USC 981: Civil forfeiture -- ALL assets traceable to offense subject to seizure - 18 USC 982: Criminal forfeiture -- mandatory upon conviction -- ALL proceeds forfeited Enforcement coordination -- MPS LEAD -- FBI SUPPORT: - MPS Economic Crime Investigation Bureau -- PRIMARY - National Anti-Fraud Center - MPS Cybersecurity Bureau - DOJ Criminal Division -- CCIPS (Computer Crime and IP Section) - FBI IC3 -- National Cyber Investigative Joint Task Force - FBI Office of International Operations -- Legal Attache Beijing - Interpol Red Notice -- US-PRC MLAT coordination Prosecution precedents: - PlusToken (2020): $5.8B crypto fraud -- operators fled to Vanuatu (no extradition treaty with China) -- ALL 27 suspects arrested and deported -- 82 key members identified -- leaders: 11-12 years -> BEFORE 2021 crypto ban -- current penalties MORE SEVERE - PRC courts have applied DEATH PENALTY for financial fraud at amounts 1,900x smaller than this case - Crypto declared ILLEGAL in PRC since Sept 2021 -- every transaction = criminal act ===== THERE IS NO VANUATU ===== PlusToken had $5.8B. They fled to a remote Pacific island with zero extradition. Chinese MPS arrested them within months. Every single operator identified. Every single one prosecuted. This case: 19.5 BILLION RMB -- 3,400x larger than PlusToken. 14,603 on-chain deposits. 8 KYC identities. 160+ withdrawal addresses. Blockchain is permanent. There is no island. There is no exit. There is only the choice below. ============================================================ SETTLEMENT TERMS: DEADLINE STRUCTURE: - TIER 1 -- 0-24h from reception: 5,000,000 USDT - TIER 2 -- 24-72h from reception: 8,000,000 USDT - TIER 3 -- 72h+: submission window opens -- no further negotiation possible. Payment address: 0x48c76A94db182dC141fbdc8794A744e3824E7D9f Payment received (any tier): -> Permanent cessation of contact. Private matter closed. -> Wallet irreversibly burned (0xdEaD) -- verifiable on-chain. -> No follow-up. Case closed. No payment received -- AUTOMATED transmission to all 6 agencies activates -- coordinated with MPS Beijing and FBI Washington field offices: -> MPS: 8 KYC dossiers + 160+ withdrawal addresses + real names -> FBI IC3 / NCIJTF Report #2026-CF-047182 -> DOJ CCIPS -- criminal referral under 18 USC 1343 and 1956 -> Binance Legal -- asset preservation request BN-2026-047182 -> OKX Compliance -- Settlement contract operator identified -- account freeze initiated -> Interpol Red Notice -- US-PRC MLAT coordination ============================================================ 此案一旦提交，不可撤回。您有24小时。 您的时间窗口在缩短。 您的同伙已经在配合调查。
0x10da0326…0f25sent to0xe8485903…2953·#25,313,487·0xa90f3f67…850696
╔══════════════════════════════════════════════════════════╗ ║ CASE FILE #2026-CF-047182 ║ ║ CLASSIFICATION: RESTRICTED — DOJ CCIPS / NCIJTF ║ ║ COORD: FBI IC3 + MPS 经侦局 — MUTUAL LEGAL ASSISTANCE TREATY ║ ║ STATUS: ACTIVE SURVEILLANCE — REAL-TIME TRACKING ENGAGED ║ ║ PRIORITY: CRITICAL ║ ╚══════════════════════════════════════════════════════════╝ SUBJECT: Operator of OKX Intent Swap v1.0.0 drainer network ACTIVE: August 2023 — Present (36+ months continuous operation) OPERATIONAL STATUS: LIVE — bot nonce advancing real-time (89,742 → 90,070) VICTIMS: 4,847+ wallets drained — active victim drain IN PROGRESS SURVEILLANCE: ENGAGED — all wallets monitored 24/7 — automated alerts on withdrawal attempts IDENTIFICATION: CONFIRMED ├─ CORR-01: Signing address 0xe8485903 CONFIRMED as operator — EIP-712 signature in every Settlement orderUID links signing address to Owner 0xaCe2B3c — SINGLE IDENTITY PROVEN ├─ CORR-02: Monitor bot 0x6EA070f timestamps synchronized with drain operations ├─ CORR-03: Owner 0xaCe2B3c controls ALL contracts used by bot 0x86a067030a96 ├─ CORR-04: HTX hack funds 0x2abc22eb → 0xdb1d74 → entered bot wallet directly ├─ CORR-05: All 14,603 deposits exit through single Binance 7 — single operator ├─ CORR-06: Operator activity detected within hours of initial contact │ → 0.0499 ETH deposited from Binance 16 on June 13 — gas acquisition confirmed │ → 4,523 USDC consolidated to Bybit hot wallet same day — reallocation detected │ → Operator nonce advanced 5 transactions post-contact — response confirmed └─ CORR-07: Bybit deposits traced to same HD wallet structure as Binance deposits ━━━ $2.7 BILLION LAUNDERED — 4,847+ VICTIMS ━━━ 1,366,796 ETH + $558M stablecoins via Binance KYC 14,603 automated deposits — 180 transfers in 30 minutes — bot operational since Aug 2023 Exit: 0x86a067 → Binance 7 → Binance withdrawal → 160+ KYC withdrawal addresses ━━━ INFRASTRUCTURE — FULLY MAPPED ━━━ Owner: 0xaCe2B3c — controls TokenApprove, ApproveProxy, Settlement OKX v1.0.0, ProxyAdmin, 8 DexRouters, wNativeRelayer — NOT RENOUNCED ├─ Admin actions: addSolver 20x | removeProxy 8x | renounceOwnership 4x | setProtocolAdmin 2x | upgrade 1x Signing address: 0xe8485903 ├─ Appears as the SIGNER in EVERY OKX Settlement orderUID event ├─ EIP-712 signature links signing address to Owner 0xaCe2B3c — SINGLE OPERATOR CONFIRMED └─ Personal wallet. Not a contract. Not a proxy. Bot: 0x86a067030a96 — 90,070 TXs — transfer() with compromised seed phrase — SEED PHRASE THEFT — NOT a protocol exploit — ACTIVE Monitor: 0x6EA070f — 11,489 surveillance pings tracking victims in real-time Gas hub: 0xf30ba13 — 139,366 ETH ($233M) across 170+ laundering addresses ━━━ 5 CONFIRMED OPSEC FAILURES ━━━ FAILURE-01: Signing address 0xe8485903 LEAKED in Settlement event logs — appears as signer in every order — any investigator can identify the operator from this single address — VERIFY: open any OKX Settlement TX on Etherscan — orderUID contains this address FAILURE-02: All 14,603 bot deposits exit through Binance 7 (0x28c6c06) — mandatory KYC at deposit — operator identity recorded at Binance — KYC CONFIRMED FAILURE-03: renounceOwnership() executed on 4 DexRouters — INTENTIONAL DESTRUCTION OF EVIDENCE — criminal intent legally established beyond reasonable doubt FAILURE-04: Monitor bot 0x6EA070f tracking victims in real-time — PREMEDITATION confirmed — not opportunistic — systematic targeting FAILURE-05: Address poisoning — fake token U?S?D? sent from lookalike 0x86a06a1 — FRAUD confirmed ━━━ KYC-IDENTIFIED WALLETS — REAL NAMES ON FILE ━━━ Binance 7: 0x28c6c06 — $1,006M USDT + 1,366,796 ETH — 14,603 deposits — KYC: mandatory at exchange Binance 16: 0xDFd5293D — SUBJECT PERSONAL stash: $58.9M USDT — KYC: full identity on file at exchange Binance 2: 0xbe0eb53f — 1,996,008 ETH — KYC Binance 3: 0x21a31ee1 — KYC Binance 5: 0xdfd52933 — KYC Binance 8: 0x95ad61b0 — KYC Binance 9: 0x974caa59 — KYC Binance 14: 0x56eddb7a — gas funding — KYC Binance withdrawal: 0xee7ae85f — 160+ KYC exit addresses — ALL traceable to real identities — your entire network exposed HTX/Huobi #48: 0xa03400e0 — 742,433 ETH source HTX hack: 0x2abc22eb → 0xdb1d74 → subject bot — CHAIN PROVEN Bitfinex: 0x77134cbc — 306,725 ETH — KYC OKX: Settlement v1.0.0 (0x25ed72) — operator identified — cross-referenced with OKX user database Bybit: 0x260b364 — deposits traced — KYC ━━━ ACTIVE VICTIM ━━━ 0xe8736af — $2.3M+ stolen — seed phrase compromise — drain IN PROGRESS 4,847+ victim wallets identified — bot active 36 months — drain continues daily ━━━ NO EXIT — ALL ROUTES CLOSED ━━━ On-chain trail: PERMANENT — 14,603 deposits cannot be deleted — blockchain immutable Blockchain analytics: Chainalysis-grade transaction graph mapped across 170+ addresses including pre- and post-mixer patterns — mixers provide NO protection KYC data: 8 identities verified — real names, passport numbers available via legal process at Binance, OKX, Bybit, HTX, Bitfinex — 160+ withdrawal addresses link to 160+ real people — under PRC law, ringleader receives maximum penalty while cooperators receive reduced sentences Exchange preservation: 账号冻结 (account freeze) pending upon court order — all exchange accounts subject to seizure Real-time monitoring: Automated on-chain alerts configured on all subject wallets — every withdrawal attempt flagged This investigation is complete. There is no alternative outcome. ━━━ JURISDICTION ━━━ PRC Criminal Law — PRIMARY JURISDICTION: ├─ Article 192: Large-scale fundraising fraud — DEATH PENALTY │ → Legal threshold: ¥10M RMB ($1.4M) │ → This case: ¥19.5 BILLION RMB — 1,900x above death penalty threshold ├─ Article 266: Fraud of especially large amounts — LIFE IMPRISONMENT │ → Maximum sentence applicable ├─ Article 191: Money laundering — 10 years + fine 5-20% of amount │ → Fine alone: $135M-$540M └─ Article 225: Illegal financial operations (crypto banned since Sept 2021) → Every Binance deposit since 2021 = separate criminal count US Federal Law — CONCURRENT JURISDICTION: ├─ 18 USC § 1343: Wire fraud — 20 years (financial activity crosses state lines) ├─ 18 USC § 1956: Money laundering — 20 years + forfeiture of ALL proceeds ├─ 18 USC § 981: Civil forfeiture — ALL assets traceable to offense subject to seizure └─ 18 USC § 982: Criminal forfeiture — mandatory upon conviction — ALL proceeds forfeited Enforcement coordination — MPS LEAD — FBI SUPPORT: ├─ 公安部经济犯罪侦查局 (MPS Economic Crime Investigation Bureau) — PRIMARY ├─ 国家反诈中心 (National Anti-Fraud Center) ├─ 网络安全保卫局 (MPS Cybersecurity Bureau) ├─ DOJ Criminal Division — CCIPS (Computer Crime & IP Section) ├─ FBI IC3 — National Cyber Investigative Joint Task Force ├─ FBI Office of International Operations — Legal Attaché Beijing └─ Interpol Red Notice — US-PRC MLAT coordination Prosecution precedents: ├─ PlusToken (2020): $5.8B crypto fraud — operators fled to Vanuatu (no extradition treaty with China) — ALL 27 suspects arrested and deported — 82 key members identified — leaders: 11-12 years │ → BEFORE 2021 crypto ban — current penalties MORE SEVERE ├─ PRC courts have applied DEATH PENALTY for financial fraud at amounts 1,900x smaller than this case └─ Crypto declared ILLEGAL in PRC since Sept 2021 — every transaction = criminal act ━━━ THERE IS NO VANUATU ━━━ PlusToken had $5.8B. They fled to a remote Pacific island with zero extradition. Chinese MPS arrested them within months. Every single operator identified. Every single one prosecuted. This case: ¥19.5 BILLION RMB — 3,400x larger than PlusToken. 14,603 on-chain deposits. 8 KYC identities. 160+ withdrawal addresses. Blockchain is permanent. There is no island. There is no exit. There is only the choice below. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ SETTLEMENT TERMS: DEADLINE STRUCTURE: ├─ TIER 1 — 0-24h from reception: 5,000,000 USDT ├─ TIER 2 — 24-72h from reception: 8,000,000 USDT └─ TIER 3 — 72h+: submission window opens — no further negotiation possible. Payment address: 0x48c76A94db182dC141fbdc8794A744e3824E7D9f Payment received (any tier): → Permanent cessation of contact. Private matter closed. → Wallet irreversibly burned (0xdEaD) — verifiable on-chain. → No follow-up. Case closed. No payment received — AUTOMATED transmission to all 6 agencies activates — coordinated with MPS 北京 and FBI Washington field offices: → 公安部经侦局 (8 KYC dossiers + 160+ withdrawal addresses + real names) → FBI IC3 / NCIJTF Report #2026-CF-047182 → DOJ CCIPS — criminal referral under 18 USC § 1343 and § 1956 → Binance Legal — asset preservation request BN-2026-047182 → OKX Compliance — Settlement contract operator identified — account freeze initiated → Interpol Red Notice — US-PRC MLAT coordination ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 此案一旦提交，不可撤回。您有24小时。 您的时间窗口在缩短。 您的同伙已经在配合调查。 ========================================================