0x10da0326…0f25sent to0xe8485903…2953·#25,313,534·view on Etherscan
============================================================
CASE FILE #2026-CF-047182
CLASSIFICATION: RESTRICTED -- DOJ CCIPS / NCIJTF
COORD: FBI IC3 + MPS -- MUTUAL LEGAL ASSISTANCE TREATY
STATUS: ACTIVE SURVEILLANCE -- REAL-TIME TRACKING ENGAGED
PRIORITY: CRITICAL
============================================================
SUBJECT: Operator of OKX Intent Swap v1.0.0 drainer network
ACTIVE: August 2023 -- Present (36+ months continuous operation)
OPERATIONAL STATUS: LIVE -- bot nonce advancing real-time (89,742 -> 90,070)
VICTIMS: 4,847+ wallets drained -- active victim drain IN PROGRESS
SURVEILLANCE: ENGAGED -- all wallets monitored 24/7 -- automated alerts on withdrawal attempts
IDENTIFICATION: CONFIRMED
- CORR-01: Signing address 0xe8485903 CONFIRMED as operator -- EIP-712 signature in every Settlement orderUID links signing address to Owner 0xaCe2B3c -- SINGLE IDENTITY PROVEN
- CORR-02: Monitor bot 0x6EA070f timestamps synchronized with drain operations
- CORR-03: Owner 0xaCe2B3c controls ALL contracts used by bot 0x86a067030a96
- CORR-04: HTX hack funds 0x2abc22eb -> 0xdb1d74 -> entered bot wallet directly
- CORR-05: All 14,603 deposits exit through single Binance 7 -- single operator
- CORR-06: Operator activity detected within hours of initial contact
-> 0.0499 ETH deposited from Binance 16 on June 13 -- gas acquisition confirmed
-> 4,523 USDC consolidated to Bybit hot wallet same day -- reallocation detected
-> Operator nonce advanced 5 transactions post-contact -- response confirmed
- CORR-07: Bybit deposits traced to same HD wallet structure as Binance deposits
===== $2.7 BILLION LAUNDERED -- 4,847+ VICTIMS =====
1,366,796 ETH + $558M stablecoins via Binance KYC
14,603 automated deposits -- 180 transfers in 30 minutes -- bot operational since Aug 2023
Exit: 0x86a067 -> Binance 7 -> Binance withdrawal -> 160+ KYC withdrawal addresses
===== INFRASTRUCTURE -- FULLY MAPPED =====
Owner: 0xaCe2B3c -- controls TokenApprove, ApproveProxy, Settlement OKX v1.0.0, ProxyAdmin, 8 DexRouters, wNativeRelayer -- NOT RENOUNCED
- Admin actions: addSolver 20x | removeProxy 8x | renounceOwnership 4x | setProtocolAdmin 2x | upgrade 1x
Signing address: 0xe8485903
- Appears as the SIGNER in EVERY OKX Settlement orderUID event
- EIP-712 signature links signing address to Owner 0xaCe2B3c -- SINGLE OPERATOR CONFIRMED
- Personal wallet. Not a contract. Not a proxy.
Bot: 0x86a067030a96 -- 90,070 TXs -- transfer() with compromised seed phrase -- SEED PHRASE THEFT -- NOT a protocol exploit -- ACTIVE
Monitor: 0x6EA070f -- 11,489 surveillance pings tracking victims in real-time
Gas hub: 0xf30ba13 -- 139,366 ETH ($233M) across 170+ laundering addresses
===== 5 CONFIRMED OPSEC FAILURES =====
FAILURE-01: Signing address 0xe8485903 LEAKED in Settlement event logs -- appears as signer in every order -- any investigator can identify the operator from this single address -- VERIFY: open any OKX Settlement TX on Etherscan -- orderUID contains this address
FAILURE-02: All 14,603 bot deposits exit through Binance 7 (0x28c6c06) -- mandatory KYC at deposit -- operator identity recorded at Binance -- KYC CONFIRMED
FAILURE-03: renounceOwnership() executed on 4 DexRouters -- INTENTIONAL DESTRUCTION OF EVIDENCE -- criminal intent legally established beyond reasonable doubt
FAILURE-04: Monitor bot 0x6EA070f tracking victims in real-time -- PREMEDITATION confirmed -- not opportunistic -- systematic targeting
FAILURE-05: Address poisoning -- fake token U?S?D? sent from lookalike 0x86a06a1 -- FRAUD confirmed
===== KYC-IDENTIFIED WALLETS -- REAL NAMES ON FILE =====
Binance 7: 0x28c6c06 -- $1,006M USDT + 1,366,796 ETH -- 14,603 deposits -- KYC: mandatory at exchange
Binance 16: 0xDFd5293D -- SUBJECT PERSONAL stash: $58.9M USDT -- KYC: full identity on file at exchange
Binance 2: 0xbe0eb53f -- 1,996,008 ETH -- KYC
Binance 3: 0x21a31ee1 -- KYC
Binance 5: 0xdfd52933 -- KYC
Binance 8: 0x95ad61b0 -- KYC
Binance 9: 0x974caa59 -- KYC
Binance 14: 0x56eddb7a -- gas funding -- KYC
Binance withdrawal: 0xee7ae85f -- 160+ KYC exit addresses -- ALL traceable to real identities -- your entire network exposed
HTX/Huobi #48: 0xa03400e0 -- 742,433 ETH source
HTX hack: 0x2abc22eb -> 0xdb1d74 -> subject bot -- CHAIN PROVEN
Bitfinex: 0x77134cbc -- 306,725 ETH -- KYC
OKX: Settlement v1.0.0 (0x25ed72) -- operator identified -- cross-referenced with OKX user database
Bybit: 0x260b364 -- deposits traced -- KYC
===== ACTIVE VICTIM =====
0xe8736af -- $2.3M+ stolen -- seed phrase compromise -- drain IN PROGRESS
4,847+ victim wallets identified -- bot active 36 months -- drain continues daily
===== NO EXIT -- ALL ROUTES CLOSED =====
On-chain trail: PERMANENT -- 14,603 deposits cannot be deleted -- blockchain immutable
Blockchain analytics: Chainalysis-grade transaction graph mapped across 170+ addresses including pre- and post-mixer patterns -- mixers provide NO protection
KYC data: 8 identities verified -- real names, passport numbers available via legal process at Binance, OKX, Bybit, HTX, Bitfinex -- 160+ withdrawal addresses link to 160+ real people -- under PRC law, ringleader receives maximum penalty while cooperators receive reduced sentences
Exchange preservation: account freeze pending upon court order -- all exchange accounts subject to seizure
Real-time monitoring: Automated on-chain alerts configured on all subject wallets -- every withdrawal attempt flagged
This investigation is complete. There is no alternative outcome.
===== JURISDICTION =====
PRC Criminal Law -- PRIMARY JURISDICTION:
- Article 192: Large-scale fundraising fraud -- DEATH PENALTY
-> Legal threshold: 10M RMB ($1.4M)
-> This case: 19.5 BILLION RMB -- 1,900x above death penalty threshold
- Article 266: Fraud of especially large amounts -- LIFE IMPRISONMENT
-> Maximum sentence applicable
- Article 191: Money laundering -- 10 years + fine 5-20% of amount
-> Fine alone: $135M-$540M
- Article 225: Illegal financial operations (crypto banned since Sept 2021)
-> Every Binance deposit since 2021 = separate criminal count
US Federal Law -- CONCURRENT JURISDICTION:
- 18 USC 1343: Wire fraud -- 20 years (financial activity crosses state lines)
- 18 USC 1956: Money laundering -- 20 years + forfeiture of ALL proceeds
- 18 USC 981: Civil forfeiture -- ALL assets traceable to offense subject to seizure
- 18 USC 982: Criminal forfeiture -- mandatory upon conviction -- ALL proceeds forfeited
Enforcement coordination -- MPS LEAD -- FBI SUPPORT:
- MPS Economic Crime Investigation Bureau -- PRIMARY
- National Anti-Fraud Center
- MPS Cybersecurity Bureau
- DOJ Criminal Division -- CCIPS (Computer Crime and IP Section)
- FBI IC3 -- National Cyber Investigative Joint Task Force
- FBI Office of International Operations -- Legal Attache Beijing
- Interpol Red Notice -- US-PRC MLAT coordination
Prosecution precedents:
- PlusToken (2020): $5.8B crypto fraud -- operators fled to Vanuatu (no extradition treaty with China) -- ALL 27 suspects arrested and deported -- 82 key members identified -- leaders: 11-12 years
-> BEFORE 2021 crypto ban -- current penalties MORE SEVERE
- PRC courts have applied DEATH PENALTY for financial fraud at amounts 1,900x smaller than this case
- Crypto declared ILLEGAL in PRC since Sept 2021 -- every transaction = criminal act
===== THERE IS NO VANUATU =====
PlusToken had $5.8B. They fled to a remote Pacific island with zero extradition. Chinese MPS arrested them within months. Every single operator identified. Every single one prosecuted.
This case: 19.5 BILLION RMB -- 3,400x larger than PlusToken.
14,603 on-chain deposits. 8 KYC identities. 160+ withdrawal addresses. Blockchain is permanent.
There is no island. There is no exit. There is only the choice below.
============================================================
SETTLEMENT TERMS:
DEADLINE STRUCTURE:
- TIER 1 -- 0-24h from reception: 5,000,000 USDT
- TIER 2 -- 24-72h from reception: 8,000,000 USDT
- TIER 3 -- 72h+: submission window opens -- no further negotiation possible.
Payment address: 0x48c76A94db182dC141fbdc8794A744e3824E7D9f
Payment received (any tier):
-> Permanent cessation of contact. Private matter closed.
-> Wallet irreversibly burned (0xdEaD) -- verifiable on-chain.
-> No follow-up. Case closed.
No payment received -- AUTOMATED transmission to all 6 agencies activates -- coordinated with MPS Beijing and FBI Washington field offices:
-> MPS: 8 KYC dossiers + 160+ withdrawal addresses + real names
-> FBI IC3 / NCIJTF Report #2026-CF-047182
-> DOJ CCIPS -- criminal referral under 18 USC 1343 and 1956
-> Binance Legal -- asset preservation request BN-2026-047182
-> OKX Compliance -- Settlement contract operator identified -- account freeze initiated
-> Interpol Red Notice -- US-PRC MLAT coordination
============================================================
æ¤æ¡ˆä¸€æ—¦æ交，ä¸å¯æ’¤å›žã€‚您有24å°æ—¶ã€‚
您的时间窗å£åœ¨ç¼©çŸã€‚
您的åŒä¼™å·²ç»åœ¨é…åˆè°ƒæŸ¥ã€‚