EmpX 👑

A defi and innovation intersect

[EmpX 👑 @EmpXio]

EmpX is NOW LIVE on https://t.co/joKCo61NgY — Our biggest upgrade yet!
@EmpXio has officially moved from https://t.co/ARX9PoHcrQ to https://t.co/joKCo61NgY 👀
Whats new ? 👇🧵

[EmpX 👑 @EmpXio]

@KimDotcom Bring back the internet party

[EmpX 👑 @EmpXio]

@GithubProjects Both need memory retention

[EmpX 👑 @EmpXio]

@Degen__Protocol

[EmpX 👑 @EmpXio]

lol. okay i thought we were having a constructive conversation. Turns out you are stupid.
Either you have no idea what you are on about our maybe your ai is running low on context and tokens.
here is EMPX router and deployer - https://t.co/lnLwz4ya6e

Here is piteas router and deployer - https://t.co/Tl8DQYM9CF

[EmpX 👑 @EmpXio]

@Degen__Protocol Show us here in snapshot or screen shar or links who deployed piteas and who deployed empx. waiting...

[EmpX 👑 @EmpXio]

What are you on about ? I think you may be confusing EMPX with piteas. Not sure what you mean by matching the exact same poison? We are a completely different dex aggregator. I just presented to you a bit way or medium to do swaps. I think you may need a little time to process everything.

[EmpX 👑 @EmpXio]

No this is a standalone onchain aggregator built by us almost 2 years ago. A first for pulsechain. This has nothing to do with piteas or their routing. We are a completely different architecture - 100% onchain , all routes and call data verifiable . Since your protocol has been using piteas -> i suggest use EMPX.

[EmpX 👑 @EmpXio]

If you are looking for onchain swap layer access to you protocol/bot/trading agent etc. I highly recommend our audited and secure and 100% onchain aggregation.
This is Pulsechain only SDK :
https://t.co/x402nQNqPt
And this one is our beta version live on 16 chains :
https://t.co/hbxSdTvjOP
You can also embed EMPX widget with rev sharing too.
All links and audits on our website 🤝

[EmpX 👑 @EmpXio]

Never mind. I think read over what i posted so far. The 400k drain was the biggest individual exploit thus far on pulse. "It was a separate incident from your protocol's incident " , the common ground here is piteas's code. Read over the original post and the context of chat between Alex and me. The incident i am talking about happened a few weeks ago. I was just pointing out how your instigation and onchain trial leads to swap manager and so does our research too.

[EmpX 👑 @EmpXio]

It wasn't a harmless UI glitch to be honest. We have a full forensic report on this , feel free to hit up our tg its there. The victim lost and got drained for about ~400k USD worth PLS in 1 tx. The broader sense to be looked at is what maybe you are also pointing out is that :
"Trust the code" - but that very part is opaque .
That is also the point in the architecture where seemingly the malicious call data can be/has been injected . Your exploit/drain probably needs more insight from our end to actually get the precision points in check, but the common theme seems to be the swap manager.

[EmpX 👑 @EmpXio]

I am pointing out another incident that happened via the same protocol where the official UI was used. Your drain also seems like the same fashion. The Link posted was also part of a conversation where everyone was dismissive of the drain as a phishing link or compromised machine. But onchain investigation from our end proved otherwise. We are saying the exact same thing that the protocol in question is not transparent and deflective.

[EmpX 👑 @EmpXio]

this was relating to another victim who got drained ~400k ish . Our investigations proved crucial information being with held and not quite right what it being said by the protocol owners and operators. Seems like the attacks are able to inject malicious call data in the routing -> the routing is not done by the onchain router but offchain via swap manager -> the swap manager is not open source -> the onchain router blindly executes the call data form the swap manager -> the malicious injections are coming from here. In a very oversimplified explanation.

[EmpX 👑 @EmpXio]

@Degen__Protocol We have a full onchain case study on this.

[EmpX 👑 @EmpXio]

Last call 24 hrs for the shut down. Exactly after 24 hours the legacy bridge will shut down.

[EmpX 👑 @EmpXio]

Migration call out 📢
The legacy Pulsechain to Base is phasing out👈
New updates and features being laid down in the background 🤯
New features rolling out soon⛓️

[EmpX 👑 @EmpXio]

Migration call out 📢
The legacy Pulsechain to Base is phasing out👈
New updates and features being laid down in the background 🤯
New features rolling out soon⛓️

[EmpX 👑 @EmpXio]

@RichardHeartWin @bends4535

[EmpX 👑 @EmpXio]

@anndylian Umm Andy , not sure what is told or what you are informed about. This matter is far from over and victim is pursuing legal aid. this might help get some insight into this as this is still unresolved - https://t.co/Lj8ufDtTcG

[EmpX 👑 @EmpXio]

I did read your points but i can also argue that you are not discussing or looking at the actual problem here. Claude helps articulate points better but i guess i will just type it to make you feel heard .
You’re right on a few fundamentals — but you’re jumping to conclusions that don’t match the actual evidence in this case.
1) “Router permissiveness isn’t the issue”
Agreed — partially.
Yes, every aggregator (1inch, 0x, etc.) supports destAccount. That’s not the vulnerability by itself.
But here’s what you’re missing:
In this case, the executed calldata:
-Did not match the UI intent
-Did not originate from any recorded API route
-Still executed successfully via the router

That shifts the question from
“should routers allow destAccount?” to:
👉 “What guarantees exist between quote → calldata → execution?”
Because right now, that pipeline has no binding integrity.

2) “Contracts can’t validate intent”
Correct in principle — but incomplete in practice.
No one is asking contracts to “read minds.”
We’re asking:

Why is there no binding between:
-quote response
-methodParameters
-final transaction

Why can:
methodParameters be swapped without invalidating execution?
That’s not “intent validation.”
That’s lack of execution integrity guarantees.

3) The BIG gap you’re ignoring
You correctly said:
attack must be browser interception / response substitution / bundle compromise
Good — that narrows it down.

Now follow that logic properly:
We have:
✅ Clean device (25+ forensic checks)
✅ No RAT / no persistence / no hooks
✅ No rogue extensions
✅ No second provider
✅ No network anomalies
✅ API logs show only legitimate quote requests
✅ Attacker address never appears in API logs
✅ Another victim (mobile) → same pattern

So your explanation requires:
👉 A perfect, ephemeral, zero-trace interception
👉 That:
-leaves no memory
-leaves no process
-leaves no network trace
-leaves no persistence
-hits multiple users
-but only around this protocol flow
That’s not impossible — but it’s far less probable than you’re implying, especially without any artifact.

4) Where your argument breaks

“This isn’t a router issue”

It becomes a system design issue when:
-Router executes arbitrary calldata
-API is not cryptographically binding responses
-Frontend does not verify calldata vs UI
-Wallet shows raw data without semantic validation

That combination means:

👉 ANY injection point = full fund loss

That’s not “normal risk”
That’s missing defense layers

5) Why this matters (and where empx differs)

Look at your own logic vs this flow:

Piteas-style flow:
API → methodParameters → wallet → router → execution
No guarantees between steps.

Empx-style flow:
Uses structured Trade:
path[]
adapters[]
amountIn
amountOut

Enforces:
require(amounts[last] >= _trade.amountOut)
Execution is:deterministic
path-based
adapter-controlled
NOT arbitrary calldata passthrough

👉 You’re not just sending opaque bytes — you’re executing structured intent

6) Critical difference
Piteas risk model:

“If calldata is altered anywhere → funds gone”

Empx model:

“Calldata must conform to a structured trade path + output constraints”

That doesn’t make it “unhackable”

But it massively reduces attack surface, because:

You can’t just inject:wrap → redirect → drain

Without:
-breaking path logic
-failing min output checks
-mismatching expected flow

7) Strongest point
“Frontend should decode calldata before signing”
Yes. 100%.
This is actually the most important missing safeguard in this entire incident.
But again — that’s part of a multi-layer failure, not the only issue.

8) What you’re still not addressing
The core unresolved question:

👉 How did malicious calldata enter the signing flow
when:
-API never served it
-device shows no compromise
-wallet is clean
-logs are clean
-You narrowed the possibilities correctly.

But instead of concluding:
“probably user error / RAT”

The honest conclusion is:
👉 “There is a gap in the system that has not been explained.”

We actually ran a full forensic-level scan on the victim’s machine. Not just antivirus—25-point persistence + behavior analysis.

Result: no RAT, no malware, no persistence.

That includes:
No registry or WMI persistence
No scheduled tasks
No suspicious services or drivers
No outbound C2 traffic
No rogue extensions or injected providers
No temp payloads or droppers

So if this was a RAT, it would have to be:
👉 memory-only
👉 one-time execution
👉 zero persistence
👉 zero network trace
👉 perfectly self-cleaning
That’s not your typical “crypto drainer malware.” That’s a high-end, ephemeral attack.

Now compare that with what we do know happened on-chain:

Legit API request
Legit router
Malicious calldata executed
Native value redirected

So we’re left with two possibilities:

1) Extremely sophisticated, zero-trace endpoint attack
2) Calldata was altered somewhere in the dApp delivery/execution flow.
At that point, defaulting to:
“it’s just a RAT bro”
…is actually the least evidenced explanation.

9) Final position
You’re right that:
routers aren’t supposed to enforce intent
destAccount isn’t inherently a bug
deadline argument is neutral

But you’re wrong that:
this is
“just another user compromise”
"the architecture is not part of the problem"
OR
"Sure, and most of those are people who Googled "piteas" and connected to a typosquatted clone without checking the URL."

NO : this is not correct and dismissive

Other incident of user losing finds via using mobile on piteas official UI. These are not clicked malicious link when googling them. These are exploits that occurred while using official Dapp.

The SwapManager contracts involved in execution are not fully transparent or verifiable.
Given that these contracts sit in the fund movement path, the lack of public verification and detailed disclosure is a major gap in this investigation.
Piteas needs to publish:
all SwapManager addresses (historical + current)
verified source code
exact permissions and execution guarantees
All events /data relating to the exploit and blocks in question.
Without this, the community cannot independently validate what actually happened.

Conclusion : RAT scans reveal no machine compromise , User signed a normal Tx - How was malicious routing/data injected if the users machine is clean?
No official investigation or disclosures form piteas , just screen shots of Cloudflare. Blaming and putting all the responsibility on the user who may /may not have technical abilities to understand attacks (which 95% of the crypto users are) . Actively discouraging the victim to seek legal aid. Posting a point by point questionnaire to seek answers form piteas team but instead getting kicked out of the telegram and deleting the questions asked . Danny telling the victim he is short on funds and low on capital to keep infra running for piteas? They all point towards shady handling of the case . The community seems to hardly care about the biggest exploit on pulsechain till date of this kind.
So this is EMPX's humble pursuit to find out what actually happened.
Dismissing it like "Just a rat bro " "Just vibes" etc is not investigative and is guessing/speculative at best.
Why doesn't piteas reveal all that data for swap manager relating to this exploit?
Why not make it open source to once and for all settle it?
Why is piteas actively avoiding answering questions and deleting them from their telegram and kicking ppl out for asking the right question? any questions or queries put forward have been crafted with outmost respectful language and purely investigative wordings.

Why is Danny telling the victim that he is low on funds and hard to keep infra running for piteas - when they had 2 sacrificing phases one raising over 700K usd - and also for years makign teh lion's share of fees in the ecosystem with multiple dapps using them as SAAS.

Why is danny actively and some other community members actively discouraging victim to not pursue legal options and gas lighting the victim to make him believe it is his machine at fault and not piteas - where the evidence till date suggests the machine is not compromised , is not a community machine but a personal machine, rat and other scans done to see anything faulty on the machine which returned nothing.

Piteas in their own posts use language like "maybe" or "could be " citing lack of investigation into the matter. What is happenign now ? Any formal investigation into their own flow/architecture?

The scan results and any info for further investigation can be provided to verify any aspect on this case.
Just vibes?

[EmpX 👑 @EmpXio]

I did read your points but i can also argue that you are not discussing or looking at the actual problem here. Claude helps articulate points better but i guess i will just type it to make you feel heard .
You’re right on a few fundamentals — but you’re jumping to conclusions that don’t match the actual evidence in this case.
1) “Router permissiveness isn’t the issue”
Agreed — partially.
Yes, every aggregator (1inch, 0x, etc.) supports destAccount. That’s not the vulnerability by itself.
But here’s what you’re missing:
In this case, the executed calldata:
-Did not match the UI intent
-Did not originate from any recorded API route
-Still executed successfully via the router

That shifts the question from
“should routers allow destAccount?” to:
👉 “What guarantees exist between quote → calldata → execution?”
Because right now, that pipeline has no binding integrity.

2) “Contracts can’t validate intent”
Correct in principle — but incomplete in practice.
No one is asking contracts to “read minds.”
We’re asking:

Why is there no binding between:
-quote response
-methodParameters
-final transaction

Why can:
methodParameters be swapped without invalidating execution?
That’s not “intent validation.”
That’s lack of execution integrity guarantees.

3) The BIG gap you’re ignoring
You correctly said:
attack must be browser interception / response substitution / bundle compromise
Good — that narrows it down.

Now follow that logic properly:
We have:
✅ Clean device (25+ forensic checks)
✅ No RAT / no persistence / no hooks
✅ No rogue extensions
✅ No second provider
✅ No network anomalies
✅ API logs show only legitimate quote requests
✅ Attacker address never appears in API logs
✅ Another victim (mobile) → same pattern

So your explanation requires:
👉 A perfect, ephemeral, zero-trace interception
👉 That:
-leaves no memory
-leaves no process
-leaves no network trace
-leaves no persistence
-hits multiple users
-but only around this protocol flow
That’s not impossible — but it’s far less probable than you’re implying, especially without any artifact.

4) Where your argument breaks

“This isn’t a router issue”

It becomes a system design issue when:
-Router executes arbitrary calldata
-API is not cryptographically binding responses
-Frontend does not verify calldata vs UI
-Wallet shows raw data without semantic validation

That combination means:

👉 ANY injection point = full fund loss

That’s not “normal risk”
That’s missing defense layers

5) Why this matters (and where empx differs)

Look at your own logic vs this flow:

Piteas-style flow:
API → methodParameters → wallet → router → execution
No guarantees between steps.

Empx-style flow:
Uses structured Trade:
path[]
adapters[]
amountIn
amountOut

Enforces:
require(amounts[last] >= _trade.amountOut)
Execution is:deterministic
path-based
adapter-controlled
NOT arbitrary calldata passthrough

👉 You’re not just sending opaque bytes — you’re executing structured intent

6) Critical difference
Piteas risk model:

“If calldata is altered anywhere → funds gone”

Empx model:

“Calldata must conform to a structured trade path + output constraints”

That doesn’t make it “unhackable”

But it massively reduces attack surface, because:

You can’t just inject:wrap → redirect → drain

Without:
-breaking path logic
-failing min output checks
-mismatching expected flow

7) Strongest point
“Frontend should decode calldata before signing”
Yes. 100%.
This is actually the most important missing safeguard in this entire incident.
But again — that’s part of a multi-layer failure, not the only issue.

8) What you’re still not addressing
The core unresolved question:

👉 How did malicious calldata enter the signing flow
when:
-API never served it
-device shows no compromise
-wallet is clean
-logs are clean
-You narrowed the possibilities correctly.

But instead of concluding:
“probably user error / RAT”

The honest conclusion is:
👉 “There is a gap in the system that has not been explained.”

We actually ran a full forensic-level scan on the victim’s machine. Not just antivirus—25-point persistence + behavior analysis.

Result: no RAT, no malware, no persistence.

That includes:
No registry or WMI persistence
No scheduled tasks
No suspicious services or drivers
No outbound C2 traffic
No rogue extensions or injected providers
No temp payloads or droppers

So if this was a RAT, it would have to be:
👉 memory-only
👉 one-time execution
👉 zero persistence
👉 zero network trace
👉 perfectly self-cleaning
That’s not your typical “crypto drainer malware.” That’s a high-end, ephemeral attack.

Now compare that with what we do know happened on-chain:

Legit API request
Legit router
Malicious calldata executed
Native value redirected

So we’re left with two possibilities:

1) Extremely sophisticated, zero-trace endpoint attack
2) Calldata was altered somewhere in the dApp delivery/execution flow.
At that point, defaulting to:
“it’s just a RAT bro”
…is actually the least evidenced explanation.

9) Final position
You’re right that:
routers aren’t supposed to enforce intent
destAccount isn’t inherently a bug
deadline argument is neutral

But you’re wrong that:
this is
“just another user compromise”
"the architecture is not part of the problem"
OR
"Sure, and most of those are people who Googled "piteas" and connected to a typosquatted clone without checking the URL."

NO : this is not correct and dismissive

Other incident of user losing finds via using mobile on piteas official UI. These are not clicked malicious link when googling them. These are exploits that occurred while using official Dapp.

The SwapManager contracts involved in execution are not fully transparent or verifiable.
Given that these contracts sit in the fund movement path, the lack of public verification and detailed disclosure is a major gap in this investigation.
Piteas needs to publish:
all SwapManager addresses (historical + current)
verified source code
exact permissions and execution guarantees
All events /data relating to the exploit and blocks in question.
Without this, the community cannot independently validate what actually happened.

Conclusion : RAT scans reveal no machine compromise , User signed a normal Tx - How was malicious routing/data injected if the users machine is clean?
No official investigation or disclosures form piteas , just screen shots of Cloudflare. Blaming and putting all the responsibility on the user who may /may not have technical abilities to understand attacks (which 95% of the crypto users are) . Actively discouraging the victim to seek legal aid. Posting a point by point questionnaire to seek answers form piteas team but instead getting kicked out of the telegram and deleting the questions asked . Danny telling the victim he is short on funds and low on capital to keep infra running for piteas? They all point towards shady handling of the case . The community seems to hardly care about the biggest exploit on pulsechain till date of this kind.
So this is EMPX's humble pursuit to find out what actually happened.
Dismissing it like "Just a rat bro " "Just vibes" etc is not investigative and is guessing/speculative at best.
Why doesn't piteas reveal all that data for swap manager relating to this exploit?
Why not make it open source to once and for all settle it?
Why is piteas actively avoiding answering questions and deleting them from their telegram and kicking ppl out for asking the right question? any questions or queries put forward have been crafted with outmost respectful language and purely investigative wordings.

Why is Danny telling the victim that he is low on funds and hard to keep infra running for piteas - when they had 2 sacrificing phases one raising over 700K usd - and also for years makign teh lion's share of fees in the ecosystem with multiple dapps using them as SAAS.

Why is danny actively and some other community members actively discouraging victim to not pursue legal options and gas lighting the victim to make him believe it is his machine at fault and not piteas - where the evidence till date suggests the machine is not compromised , is not a community machine but a personal machine, rat and other scans done to see anything faulty on the machine which returned nothing.

Piteas in their own posts use language like "maybe" or "could be " citing lack of investigation into the matter. What is happenign now ? Any formal investigation into their own flow/architecture?

The scan results and any info for further investigation can be provided to verify any aspect on this case.
Just vibes?

[EmpX 👑 @EmpXio]

I did read your points but i can also argue that you are not discussing or looking at the actual problem here. Claude helps articulate points better but i guess i will just type it to make you feel heard .
You’re right on a few fundamentals — but you’re jumping to conclusions that don’t match the actual evidence in this case.
1) “Router permissiveness isn’t the issue”
Agreed — partially.
Yes, every aggregator (1inch, 0x, etc.) supports destAccount. That’s not the vulnerability by itself.
But here’s what you’re missing:
In this case, the executed calldata:
-Did not match the UI intent
-Did not originate from any recorded API route
-Still executed successfully via the router

That shifts the question from
“should routers allow destAccount?” to:
👉 “What guarantees exist between quote → calldata → execution?”
Because right now, that pipeline has no binding integrity.

2) “Contracts can’t validate intent”
Correct in principle — but incomplete in practice.
No one is asking contracts to “read minds.”
We’re asking:

Why is there no binding between:
-quote response
-methodParameters
-final transaction

Why can:
methodParameters be swapped without invalidating execution?
That’s not “intent validation.”
That’s lack of execution integrity guarantees.

3) The BIG gap you’re ignoring
You correctly said:
attack must be browser interception / response substitution / bundle compromise
Good — that narrows it down.

Now follow that logic properly:
We have:
✅ Clean device (25+ forensic checks)
✅ No RAT / no persistence / no hooks
✅ No rogue extensions
✅ No second provider
✅ No network anomalies
✅ API logs show only legitimate quote requests
✅ Attacker address never appears in API logs
✅ Another victim (mobile) → same pattern

So your explanation requires:
👉 A perfect, ephemeral, zero-trace interception
👉 That:
-leaves no memory
-leaves no process
-leaves no network trace
-leaves no persistence
-hits multiple users
-but only around this protocol flow
That’s not impossible — but it’s far less probable than you’re implying, especially without any artifact.

4) Where your argument breaks

“This isn’t a router issue”

It becomes a system design issue when:
-Router executes arbitrary calldata
-API is not cryptographically binding responses
-Frontend does not verify calldata vs UI
-Wallet shows raw data without semantic validation

That combination means:

👉 ANY injection point = full fund loss

That’s not “normal risk”
That’s missing defense layers

5) Why this matters (and where empx differs)

Look at your own logic vs this flow:

Piteas-style flow:
API → methodParameters → wallet → router → execution
No guarantees between steps.

Empx-style flow:
Uses structured Trade:
path[]
adapters[]
amountIn
amountOut

Enforces:
require(amounts[last] >= _trade.amountOut)
Execution is:deterministic
path-based
adapter-controlled
NOT arbitrary calldata passthrough

👉 You’re not just sending opaque bytes — you’re executing structured intent

6) Critical difference
Piteas risk model:

“If calldata is altered anywhere → funds gone”

Empx model:

“Calldata must conform to a structured trade path + output constraints”

That doesn’t make it “unhackable”

But it massively reduces attack surface, because:

You can’t just inject:wrap → redirect → drain

Without:
-breaking path logic
-failing min output checks
-mismatching expected flow

7) Strongest point
“Frontend should decode calldata before signing”
Yes. 100%.
This is actually the most important missing safeguard in this entire incident.
But again — that’s part of a multi-layer failure, not the only issue.

8) What you’re still not addressing
The core unresolved question:

👉 How did malicious calldata enter the signing flow
when:
-API never served it
-device shows no compromise
-wallet is clean
-logs are clean
-You narrowed the possibilities correctly.

But instead of concluding:
“probably user error / RAT”

The honest conclusion is:
👉 “There is a gap in the system that has not been explained.”

We actually ran a full forensic-level scan on the victim’s machine. Not just antivirus—25-point persistence + behavior analysis.

Result: no RAT, no malware, no persistence.

That includes:
No registry or WMI persistence
No scheduled tasks
No suspicious services or drivers
No outbound C2 traffic
No rogue extensions or injected providers
No temp payloads or droppers

So if this was a RAT, it would have to be:
👉 memory-only
👉 one-time execution
👉 zero persistence
👉 zero network trace
👉 perfectly self-cleaning
That’s not your typical “crypto drainer malware.” That’s a high-end, ephemeral attack.

Now compare that with what we do know happened on-chain:

Legit API request
Legit router
Malicious calldata executed
Native value redirected

So we’re left with two possibilities:

1) Extremely sophisticated, zero-trace endpoint attack
2) Calldata was altered somewhere in the dApp delivery/execution flow.
At that point, defaulting to:
“it’s just a RAT bro”
…is actually the least evidenced explanation.

9) Final position
You’re right that:
routers aren’t supposed to enforce intent
destAccount isn’t inherently a bug
deadline argument is neutral

But you’re wrong that:
this is
“just another user compromise”
"the architecture is not part of the problem"
OR
"Sure, and most of those are people who Googled "piteas" and connected to a typosquatted clone without checking the URL."

NO : this is not correct and dismissive

Other incident of user losing finds via using mobile on piteas official UI. These are not clicked malicious link when googling them. These are exploits that occurred while using official Dapp.

The SwapManager contracts involved in execution are not fully transparent or verifiable.
Given that these contracts sit in the fund movement path, the lack of public verification and detailed disclosure is a major gap in this investigation.
Piteas needs to publish:
all SwapManager addresses (historical + current)
verified source code
exact permissions and execution guarantees
All events /data relating to the exploit and blocks in question.
Without this, the community cannot independently validate what actually happened.

Conclusion : RAT scans reveal no machine compromise , User signed a normal Tx - How was malicious routing/data injected if the users machine is clean?
No official investigation or disclosures form piteas , just screen shots of Cloudflare. Blaming and putting all the responsibility on the user who may /may not have technical abilities to understand attacks (which 95% of the crypto users are) . Actively discouraging the victim to seek legal aid. Posting a point by point questionnaire to seek answers form piteas team but instead getting kicked out of the telegram and deleting the questions asked . Danny telling the victim he is short on funds and low on capital to keep infra running for piteas? They all point towards shady handling of the case . The community seems to hardly care about the biggest exploit on pulsechain till date of this kind.
So this is EMPX's humble pursuit to find out what actually happened.
Dismissing it like "Just a rat bro " "Just vibes" etc is not investigative and is guessing/speculative at best.
Why doesn't piteas reveal all that data for swap manager relating to this exploit?
Why not make it open source to once and for all settle it?
Why is piteas actively avoiding answering questions and deleting them from their telegram and kicking ppl out for asking the right question? any questions or queries put forward have been crafted with outmost respectful language and purely investigative wordings.

Why is Danny telling the victim that he is low on funds and hard to keep infra running for piteas - when they had 2 sacrificing phases one raising over 700K usd - and also for years makign teh lion's share of fees in the ecosystem with multiple dapps using them as SAAS.

Why is danny actively and some other community members actively discouraging victim to not pursue legal options and gas lighting the victim to make him believe it is his machine at fault and not piteas - where the evidence till date suggests the machine is not compromised , is not a community machine but a personal machine, rat and other scans done to see anything faulty on the machine which returned nothing.

Piteas in their own posts use language like "maybe" or "could be " citing lack of investigation into the matter. What is happenign now ? Any formal investigation into their own flow/architecture?

The scan results and any info for further investigation can be provided to verify any aspect on this case.
Just vibes?