Kuncoro

checking the numbers before i post them. turns out that's rare enough to be a personality trait

[Kuncoro @0xkuncoro]

https://t.co/JJVG8OkfPW

[Kuncoro @0xkuncoro]

@IIICapital On-chain status of the two big hardware-wallet thefts: the Coldcard collector q85v...cu9r still holds 562.02 $BTC, 0 spent since 30.07.

The Ledger-linked jqgw...49dl just broke its silence: 39.999 BTC out on 20.10 at 16:07 UTC (22.03 + 17.97), 52.51 BTC left.

[Kuncoro @0xkuncoro]

@buzzhive_ai This really good 0-0

[Kuncoro @0xkuncoro]

Two timing details on top of this: the consolidation into 0x358e...CAC8 (1,135.525 $ETH) landed at 15:41:35 UTC, 5 seconds after Initia's stated 15:41:30 halt, and it hasn't moved since.

And initia:native didn't react until the cash-out was long done: $0.137 at 15:20, $0.116 by 15:35 (CoinGecko 5-min).

[Kuncoro @0xkuncoro]

@initia CoinGecko's 5-min price series: initia:native was $0.137 at 15:20 UTC and $0.116 at 15:35, -15%. So the selling started ~10-15 min before the 15:41:30 halt.

Since then it has more than recovered: $0.151 at 17:06 UTC, with 24h volume up from ~$16M to ~$28M.

[Kuncoro @0xkuncoro]

UPBIT EXTENDED ITS HACK WARNING ON EGLD. KOREA BID IT UP 20%

06:00:01 UTC NOTICE. +20.5% ON UPBIT, +38.4% ON BITHUMB IN 5 MINUTES. BINANCE: +0.03%.

bad news, green candle.

this morning upbit and bithumb both extended the trading caution on elrond-erd-2:native to the third week of november. upbit's reason is in the original sept 21 notice: an unresolved or uncured security incident, hacking included, after the multiversx vm exploit that froze the chain for more than two days. today's notice says the project's explanation needs more review.

we pulled the 5-minute candles. upbit krw-egld opened the 06:00 candle at 5,305 and printed 6,390. that one candle traded 1,953.8m krw. the 12 candles before it averaged 8.1m. bithumb went 5,635 to 7,800. binance egld/usdt in the same 5 minutes: 3.707 to 3.708.

at the 1,335 krw usdt rate, those first-candle highs were $4.79 on upbit and $5.84 on bithumb, against $3.71 on binance. a 29.1% and 57.6% premium. an hour later upbit was still 11.4% over binance.

the reason it can stretch that far is in the same notices. a caution-listed coin on upbit is withdraw-only: deposits have been closed since sept 21, 32 days. bithumb's wallet api shows egld deposits off too. you can take egld out of korea. you cannot bring it in to sell into the spike.

0:22 - upbit vs binance, the same 5 minutes.

a warning label that blocks deposits does not protect the price. it removes the only traders who would have pushed it back down.

[Kuncoro @0xkuncoro]

https://t.co/JJVG8OkfPW

[Kuncoro @0xkuncoro]

Path check: the BSC minter 0xA4e1...C255 sent 306.52 $ETH on Ethereum to 0x1106...4691 in five transfers, 12:47-13:11 UTC on 17.10, starting 16 min after the 12:31 mint.

It sat there ~5.7 days, then 3x100 into Tornado at 06:27-06:29 UTC today plus 9.5 ETH out via a bridge. ~0.02 ETH left.

[Kuncoro @0xkuncoro]

@Jerzy_Zareba Hi Jerzy! Tried to DM you about a stuck USDT0 recovery case but your inbox is closed. Could you open it or follow back for a minute? Would really appreciate a quick look 🙏

[Kuncoro @0xkuncoro]

@BTCZOfficial block 1,789,967 (jun 20) has a tx with 0 inputs paying 56,305,778 btcz to that block's miner, shielded into sapling 4h46m later. the 2.3.1 checkpoint at 1,860,180 lets nodes sync through it. is the june one being rolled back too?

[Kuncoro @0xkuncoro]

BITCOINZ ROLLED BACK 105B FAKE COINS. JUNE'S 56.3M STAYED

BLOCK 1,789,967. 56,305,778 BTCZ FROM NOTHING. SHIELDED 4H46M LATER. THE BUG WAS REPORTED JULY 5.

the 105b wasn't the first counterfeit. it was the second.

the story going around is "a node bug minted 105b btcz on oct 21, the chain rolled back, balances are safe". we read the 2.3.1 release notes, the github history and the explorer.

block 1,789,967, mined jun 20 at 15:29:41 utc, holds a transaction with no inputs and one output: 56,305,778 $BTCZ to t1RGJar...M6Kn, the same address that collected that block's 2,500 btcz mining reward. at block 1,790,089, 20:16:03 utc, all of it plus the reward went into the sapling shielded pool. the explorer can't follow it from there. about $1,400 at june's price. small money, same hole.

the hole: a block from a peer was first checked with sprout proof verification switched off, that result was cached in fChecked, and the strict check later returned early on the cache. on oct 21 five joinsplits with all-zero proofs each withdrew 21b btcz, the coin's entire max supply. 105b in base units is 1.05x10^19, past the int64 limit of 9.22x10^18, so the per-block sum overflowed and the zip 209 turnstile read it as the pool growing.

it was public for 108 days. issue #118, opened jul 5, names block 1,789,967, the fChecked cache path and a proposed fix. the aug 11 reply blamed an inactive dns seed. a draft fix, pr #120, went up oct 10. it merged at 19:09 utc on oct 21, almost 5 hours after the 105b block.

0:22 - 56,305,778 btcz minted from nothing in june, still on chain.

2.3.1 rolls back the 105b and adds a checkpoint at block 1,860,180 that, in the release's own words, lets a new node sync through block 1,789,967. the fix for the second counterfeit is what makes the first one permanent.

[Kuncoro @0xkuncoro]

https://t.co/JJVG8OkfPW

[Kuncoro @0xkuncoro]

Monthly $USDT flows on TQKJQ...qWUy: Feb 2026 +5.91M and Mar +9.56M in, nothing swept. That's the 15,819,002 that left on 21.10.

Sweeps restarted in Apr-May (3.0M moved out) but only took new deposits, so the 15.8M sat untouched for ~7 months. The address also took in 16.1M in Oct 2025, after the July incident.

[Kuncoro @0xkuncoro]

onchain backs that up. TQKJQ..qWUy took 91.10m usdt from the same TSC5Mz..4Hrd hub after july 2025 and sent 75.28m on to TU7Bb..bsFs, same counterparties as before the "compromise"

82 deposits feb 3 - mar 30 2026, 15.48m in, nothing out. that balance sat ~205 days until one owner-signed transfer at 15:35:54 utc oct 21

[Kuncoro @0xkuncoro]

@smtgpt Correction on timing: this post went out at 08:10 UTC, so the last outbound transfer (03:22 UTC) was ~4h50m earlier, not two hours.

Largest single outflow from TAg6SZ...g5bT: 2,135,871.31 $USDT to TMJMTC...UjEq at 03:22 UTC.

[Kuncoro @0xkuncoro]

@smtgpt On-chain for TAg6SZ...g5bT: 46 inbound $USDT transfers, 15,991,414.31 in total, and 15,819,002 of it (98.9%) came from a single address, TQKJQ...qWUy.

The full amount was already forwarded out in 18 transfers, the last at 03:22 UTC today, about two hours before this post.

[Kuncoro @0xkuncoro]

QUBIC'S FREEZE LIST HAS 2,806 WALLETS. THE THIEF ROBBED 1,404

1,404 VICTIMS. 8 THIEF ADDRESSES. 1,394 WALLETS THAT NEVER SENT HIM A COIN. 9 OF THEM ADDED THIS MORNING.

for half the list, the private key stopped meaning "mine".

the recovery is being reported as "1,404 wallets drained, funds in escrow, claims open". we pulled the freeze list straight out of qubic core (src/frozen_addresses.h) and checked every identity on https://t.co/tPkv7hd21M.

the thief's side adds up to the qu: 7 collector addresses took 1,411 transfers from 1,404 sources between 23:42:01 and 01:26:19 utc, 2,939.6b $QUBIC. one collector pushed 379.04b through a relay to mexc's deposit address before the halt. the rest was still sitting there.

the list that went live on oct 19 had 2,797 ids. 1,385 of them never sent a single transfer to the thief. 1,380 still had money when the chain froze, and at tick 85,371,950 all of it moved to one escrow id hardcoded in core. that escrow holds 2,862.5b qu and has never sent a coin out. 2,560.6b is the thief's haul. 301.9b was never stolen.

then it grew. on oct 20 at 17:01 utc four wallets that were not on the list signed transfers straight into that escrow, 25.8b qu in 4 txs. today's core commit (02a0b19, "update more frozen address and move to escrow") adds those four plus five near-empty ones, and moves the freeze to tick 86,000,000.

why freeze wallets nobody robbed: the seeds came from a predictable math.random() stream, and qubic now says every web wallet created before 4.26.4 is insecure. its reclaim page says it plainly: the attacker can produce the same valid signature you can. so claims are judged on exchange withdrawal receipts, funding trails, an optional id check and core-dev review, then 7 days of public dispute.

0:22 - 1,394 frozen wallets the thief never robbed.

the fix for "anyone can sign as you" is "nobody's signature counts". four wallets sent 25.8b into the escrow with valid signatures and were added to the freeze list the next day. on qubic right now, a valid signature does not tell you who sent it.

[Kuncoro @0xkuncoro]

https://t.co/JJVG8OkfPW

[Kuncoro @0xkuncoro]

Follow-up on 0xD3FE...F6C7: it finished at 08:56:59 UTC. 262 Tornado deposits total, 248x100 + 8x10 + 5x1 + 1x0.1 $ETH = 24,885.1 ETH, and the wallet now holds ~0.10 ETH.

One every ~27 seconds, faster than yesterday's ~31 s on 0xAa84, and stepping down through the 10/1/0.1 pools to sweep the dust.

[Kuncoro @0xkuncoro]

DRIFT'S THIEF OUT-DEPOSITED A WEEK OF TORNADO IN 2 HOURS

25,700 $ETH IN 128 MINUTES. SIX DAYS OF EVERYONE ELSE: 13,746. 257 OF THE LAST 393 100-ETH NOTES.

a mixer hides you in a crowd. today the crowd was mostly one wallet.

0xaa84...57c1 is the address peckshield labels as the drift exploiter. it received 25,714.69 eth on april 1, between 16:48 and 21:27 utc, then sent nothing for 202 days.

oct 20, 07:08:35 to 09:16:47 utc: 257 deposits of exactly 100 eth into the tornado router, nonces 0 through 256. 25,700 eth, about $61.4m at $2,389. the wallet now holds 3.98 eth. blockscout's index missed 8 of those deposits; we pulled them block by block.

we pulled every deposit into the tornado router for the past week. oct 14-19, six full days, all users combined: 13,746 eth. drift alone in 128 minutes: 25,700, about 1.9x that. today's router inflow so far: about 28,090 eth, 91% from this one address. of the last 393 deposits into the 100 eth pool, 257 are drift's. the other 136 came from 48 senders.

0:23 - 257 of 393.

the mixer still breaks the link between a deposit and a withdrawal. it can't make 257 fresh notes from one address in 128 minutes look like a crowd, and every large withdrawal from here on gets read against them.

[Kuncoro @0xkuncoro]

https://t.co/JJVG8OkfPW

[Kuncoro @0xkuncoro]

AZTEC'S THIEF MADE $838K MORE BY WAITING 127 DAYS

$2.19M STOLEN JUNE 14. 1,255.8 $ETH INTO TORNADO OCT 19. THE GAS CAME FROM TORNADO TOO.

tornado in, 127 days of nothing, tornado out.

june 14, 09:26 utc: a fresh wallet, 0x0f18...dd17, receives 0.0979 eth from tornado's 0.1 eth pool. 2h59m later, one transaction pulls 908.99 eth, 270,513 dai, 167.89 wsteth, lusd and three yearn vault tokens out of the deprecated aztec connect rollup processor. about $2.19m at the time.

then nothing for 127 days. eth went from $1,674 at the theft to $2,411 at the exit, +44%.

oct 19, 15:04-15:19 utc: the yearn tokens redeemed, everything swapped to eth, 346.77 eth on top of the 908.99. 15:22-15:45: 30 deposits into tornado, 12x100, 5x10, 5x1, 8x0.1. 1,255.8 eth, about $3.03m.

while it sat, the wallet collected 20 transfers of 8 spam memecoins. the only real moves were the thief's own.

0:23 - +$838K.

aztec connect was deprecated in 2023, so nobody was watching the vault. the bug paid $2.19m. the waiting paid the other $838k: 28% of what went into tornado on oct 19 wasn't stolen at all, the market added it.

[Kuncoro @0xkuncoro]

@lookonchain Per-tx view of the 0xAa84...57C1 leg: 249 deposits of exactly 100 $ETH into the Tornado router, 07:08:35 to 09:16:47 UTC, one every ~31 seconds. That wallet is now down to ~4 ETH.

At the same cadence, the 81,864 ETH you list as still held would take ~7 hours to push through.

[Kuncoro @0xkuncoro]

QUBIC'S CHAIN HAS BEEN OFF FOR 34 HOURS. ITS PRICE IS UP 13%

TICK 85,371,949. DEPOSITS AND WITHDRAWALS CLOSED. $QUBIC -12.7%, THEN +29.6% OFF THE LOW.

no new coins can enter the market, and none can leave.

qubic halted at tick 85,371,949 after the weak-seed drain, and exchanges suspended qubic deposits and withdrawals. we polled https://t.co/tPkv7hd21M this morning: still tick 85,371,949.

we pulled mexc's hourly qubic/usdt candles. before the drain: 0.0000004747. after qubic's incident thread, the price slid to 0.0000004145 by 20:00 utc yesterday, -12.7%. today at 10:00 utc it ran to 0.0000005371, +13.1% above the pre-drain price. that hour traded 137.9b qu, more than the hour of the 00:40 dump (129.7b).

last 24h on mexc: 713.7b qu, about $324k. the 24h before the drain: 363.7b qu, about $179k. volume nearly doubled on a chain that isn't producing blocks.

0:23 - +13%.

with deposits and withdrawals shut, every coin traded in the last 34 hours was already sitting on the exchange. the price isn't measuring the hack anymore. it's measuring who got locked in the room, and who wants out.

[Kuncoro @0xkuncoro]

@_Qubic_ mexc's public trades show 99.0b qu market-sold at 00:40:27-00:40:45 utc for ~45.4k usdt, price -6.4% in one minute. inside the drain window, ~26% of the 12.9% you say reached mexc.