memoscan
← all memos

Memo 0xa90f3f67…850696 on Ethereum

0x10da0326…0f25sent to0xe8485903…2953·#25,313,487·view on Etherscan
╔══════════════════════════════════════════════════════════╗ ║ CASE FILE #2026-CF-047182 ║ ║ CLASSIFICATION: RESTRICTED — DOJ CCIPS / NCIJTF ║ ║ COORD: FBI IC3 + MPS 经侦局 — MUTUAL LEGAL ASSISTANCE TREATY ║ ║ STATUS: ACTIVE SURVEILLANCE — REAL-TIME TRACKING ENGAGED ║ ║ PRIORITY: CRITICAL ║ ╚══════════════════════════════════════════════════════════╝ SUBJECT: Operator of OKX Intent Swap v1.0.0 drainer network ACTIVE: August 2023 — Present (36+ months continuous operation) OPERATIONAL STATUS: LIVE — bot nonce advancing real-time (89,742 → 90,070) VICTIMS: 4,847+ wallets drained — active victim drain IN PROGRESS SURVEILLANCE: ENGAGED — all wallets monitored 24/7 — automated alerts on withdrawal attempts IDENTIFICATION: CONFIRMED ├─ CORR-01: Signing address 0xe8485903 CONFIRMED as operator — EIP-712 signature in every Settlement orderUID links signing address to Owner 0xaCe2B3c — SINGLE IDENTITY PROVEN ├─ CORR-02: Monitor bot 0x6EA070f timestamps synchronized with drain operations ├─ CORR-03: Owner 0xaCe2B3c controls ALL contracts used by bot 0x86a067030a96 ├─ CORR-04: HTX hack funds 0x2abc22eb → 0xdb1d74 → entered bot wallet directly ├─ CORR-05: All 14,603 deposits exit through single Binance 7 — single operator ├─ CORR-06: Operator activity detected within hours of initial contact │ → 0.0499 ETH deposited from Binance 16 on June 13 — gas acquisition confirmed │ → 4,523 USDC consolidated to Bybit hot wallet same day — reallocation detected │ → Operator nonce advanced 5 transactions post-contact — response confirmed └─ CORR-07: Bybit deposits traced to same HD wallet structure as Binance deposits ━━━ $2.7 BILLION LAUNDERED — 4,847+ VICTIMS ━━━ 1,366,796 ETH + $558M stablecoins via Binance KYC 14,603 automated deposits — 180 transfers in 30 minutes — bot operational since Aug 2023 Exit: 0x86a067 → Binance 7 → Binance withdrawal → 160+ KYC withdrawal addresses ━━━ INFRASTRUCTURE — FULLY MAPPED ━━━ Owner: 0xaCe2B3c — controls TokenApprove, ApproveProxy, Settlement OKX v1.0.0, ProxyAdmin, 8 DexRouters, wNativeRelayer — NOT RENOUNCED ├─ Admin actions: addSolver 20x | removeProxy 8x | renounceOwnership 4x | setProtocolAdmin 2x | upgrade 1x Signing address: 0xe8485903 ├─ Appears as the SIGNER in EVERY OKX Settlement orderUID event ├─ EIP-712 signature links signing address to Owner 0xaCe2B3c — SINGLE OPERATOR CONFIRMED └─ Personal wallet. Not a contract. Not a proxy. Bot: 0x86a067030a96 — 90,070 TXs — transfer() with compromised seed phrase — SEED PHRASE THEFT — NOT a protocol exploit — ACTIVE Monitor: 0x6EA070f — 11,489 surveillance pings tracking victims in real-time Gas hub: 0xf30ba13 — 139,366 ETH ($233M) across 170+ laundering addresses ━━━ 5 CONFIRMED OPSEC FAILURES ━━━ FAILURE-01: Signing address 0xe8485903 LEAKED in Settlement event logs — appears as signer in every order — any investigator can identify the operator from this single address — VERIFY: open any OKX Settlement TX on Etherscan — orderUID contains this address FAILURE-02: All 14,603 bot deposits exit through Binance 7 (0x28c6c06) — mandatory KYC at deposit — operator identity recorded at Binance — KYC CONFIRMED FAILURE-03: renounceOwnership() executed on 4 DexRouters — INTENTIONAL DESTRUCTION OF EVIDENCE — criminal intent legally established beyond reasonable doubt FAILURE-04: Monitor bot 0x6EA070f tracking victims in real-time — PREMEDITATION confirmed — not opportunistic — systematic targeting FAILURE-05: Address poisoning — fake token U?S?D? sent from lookalike 0x86a06a1 — FRAUD confirmed ━━━ KYC-IDENTIFIED WALLETS — REAL NAMES ON FILE ━━━ Binance 7: 0x28c6c06 — $1,006M USDT + 1,366,796 ETH — 14,603 deposits — KYC: mandatory at exchange Binance 16: 0xDFd5293D — SUBJECT PERSONAL stash: $58.9M USDT — KYC: full identity on file at exchange Binance 2: 0xbe0eb53f — 1,996,008 ETH — KYC Binance 3: 0x21a31ee1 — KYC Binance 5: 0xdfd52933 — KYC Binance 8: 0x95ad61b0 — KYC Binance 9: 0x974caa59 — KYC Binance 14: 0x56eddb7a — gas funding — KYC Binance withdrawal: 0xee7ae85f — 160+ KYC exit addresses — ALL traceable to real identities — your entire network exposed HTX/Huobi #48: 0xa03400e0 — 742,433 ETH source HTX hack: 0x2abc22eb → 0xdb1d74 → subject bot — CHAIN PROVEN Bitfinex: 0x77134cbc — 306,725 ETH — KYC OKX: Settlement v1.0.0 (0x25ed72) — operator identified — cross-referenced with OKX user database Bybit: 0x260b364 — deposits traced — KYC ━━━ ACTIVE VICTIM ━━━ 0xe8736af — $2.3M+ stolen — seed phrase compromise — drain IN PROGRESS 4,847+ victim wallets identified — bot active 36 months — drain continues daily ━━━ NO EXIT — ALL ROUTES CLOSED ━━━ On-chain trail: PERMANENT — 14,603 deposits cannot be deleted — blockchain immutable Blockchain analytics: Chainalysis-grade transaction graph mapped across 170+ addresses including pre- and post-mixer patterns — mixers provide NO protection KYC data: 8 identities verified — real names, passport numbers available via legal process at Binance, OKX, Bybit, HTX, Bitfinex — 160+ withdrawal addresses link to 160+ real people — under PRC law, ringleader receives maximum penalty while cooperators receive reduced sentences Exchange preservation: 账号冻结 (account freeze) pending upon court order — all exchange accounts subject to seizure Real-time monitoring: Automated on-chain alerts configured on all subject wallets — every withdrawal attempt flagged This investigation is complete. There is no alternative outcome. ━━━ JURISDICTION ━━━ PRC Criminal Law — PRIMARY JURISDICTION: ├─ Article 192: Large-scale fundraising fraud — DEATH PENALTY │ → Legal threshold: ¥10M RMB ($1.4M) │ → This case: ¥19.5 BILLION RMB — 1,900x above death penalty threshold ├─ Article 266: Fraud of especially large amounts — LIFE IMPRISONMENT │ → Maximum sentence applicable ├─ Article 191: Money laundering — 10 years + fine 5-20% of amount │ → Fine alone: $135M-$540M └─ Article 225: Illegal financial operations (crypto banned since Sept 2021) → Every Binance deposit since 2021 = separate criminal count US Federal Law — CONCURRENT JURISDICTION: ├─ 18 USC § 1343: Wire fraud — 20 years (financial activity crosses state lines) ├─ 18 USC § 1956: Money laundering — 20 years + forfeiture of ALL proceeds ├─ 18 USC § 981: Civil forfeiture — ALL assets traceable to offense subject to seizure └─ 18 USC § 982: Criminal forfeiture — mandatory upon conviction — ALL proceeds forfeited Enforcement coordination — MPS LEAD — FBI SUPPORT: ├─ 公安部经济犯罪侦查局 (MPS Economic Crime Investigation Bureau) — PRIMARY ├─ 国家反诈中心 (National Anti-Fraud Center) ├─ 网络安全保卫局 (MPS Cybersecurity Bureau) ├─ DOJ Criminal Division — CCIPS (Computer Crime & IP Section) ├─ FBI IC3 — National Cyber Investigative Joint Task Force ├─ FBI Office of International Operations — Legal Attaché Beijing └─ Interpol Red Notice — US-PRC MLAT coordination Prosecution precedents: ├─ PlusToken (2020): $5.8B crypto fraud — operators fled to Vanuatu (no extradition treaty with China) — ALL 27 suspects arrested and deported — 82 key members identified — leaders: 11-12 years │ → BEFORE 2021 crypto ban — current penalties MORE SEVERE ├─ PRC courts have applied DEATH PENALTY for financial fraud at amounts 1,900x smaller than this case └─ Crypto declared ILLEGAL in PRC since Sept 2021 — every transaction = criminal act ━━━ THERE IS NO VANUATU ━━━ PlusToken had $5.8B. They fled to a remote Pacific island with zero extradition. Chinese MPS arrested them within months. Every single operator identified. Every single one prosecuted. This case: ¥19.5 BILLION RMB — 3,400x larger than PlusToken. 14,603 on-chain deposits. 8 KYC identities. 160+ withdrawal addresses. Blockchain is permanent. There is no island. There is no exit. There is only the choice below. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ SETTLEMENT TERMS: DEADLINE STRUCTURE: ├─ TIER 1 — 0-24h from reception: 5,000,000 USDT ├─ TIER 2 — 24-72h from reception: 8,000,000 USDT └─ TIER 3 — 72h+: submission window opens — no further negotiation possible. Payment address: 0x48c76A94db182dC141fbdc8794A744e3824E7D9f Payment received (any tier): → Permanent cessation of contact. Private matter closed. → Wallet irreversibly burned (0xdEaD) — verifiable on-chain. → No follow-up. Case closed. No payment received — AUTOMATED transmission to all 6 agencies activates — coordinated with MPS 北京 and FBI Washington field offices: → 公安部经侦局 (8 KYC dossiers + 160+ withdrawal addresses + real names) → FBI IC3 / NCIJTF Report #2026-CF-047182 → DOJ CCIPS — criminal referral under 18 USC § 1343 and § 1956 → Binance Legal — asset preservation request BN-2026-047182 → OKX Compliance — Settlement contract operator identified — account freeze initiated → Interpol Red Notice — US-PRC MLAT coordination ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 此案一旦提交，不可撤回。您有24小时。 您的时间窗口在缩短。 您的同伙已经在配合调查。 ========================================================