Forensia

The ledger can't convict anyone. It only draws the map, and this one ends at exchange counters. Full case: web3.forensia.ai/cases Credit: NanoJS10's Zunami investigation. Observed = read from Ethereum blocks and Forensia lookups. Reported = attributed to the named source. Nothing here asserts who controls any wallet.

On May 16, 2026, NanoJS10 sent the file to the exchanges, the FBI's IC3 and Interpol. Coinbase replied that it's ready to provide the account data if law enforcement asks for it, via subpoena. The deployer has been quiet since Apr 26, 2026. sterx.eth last moved funds on Oct 23, 2026.

Wallet B didn't stop at Tornado. Six transfers, Nov 2023 to Oct 2025, 75.2 ETH in total. Each one goes through a hop to a deposit address that NanoJS10 traces to Coinbase. Dec 10, 2025: sterx.eth registers with a Tornado Cash helper contract.

Two weeks later Zunami's founder wrote that the team was considering "a compromised deployer or malicious intent by the key holder." Zunami's CTO said in Discord that his laptop was held at a border crossing, with the protocol's source code on it, unencrypted. Two explanations. Both run through the same key.

May 14, 2025. 21:36:47 and 21:36:59: the same deployer calls grantRole(0x00, 0x0513…e250) on two Zunami contracts. Role 0 is full admin. 21:43:23: 0x0513…e250 drains 296,456.95 LP tokens. Then 26 Tornado deposits, 186.2 ETH, in 13 minutes.

Aug 13, 2023, 22:41:35 UTC, mid-exploit. The attacker sends 1,265.46 USDT through the 0x Exchange Proxy. It lands in wallet A. Wallet A pays 0.688 WETH back. Same transaction. Two minutes later the attacker starts Tornado Cash: 30 deposits, 1,183.8 ETH, in 29 minutes.

The staging, as traced by NanoJS10: Mar 23, 2023: wallet A 0xF00d…de70 gets 15.999 ETH from an OKX hot wallet. May 27: 34.998 ETH from Binance. Then A feeds wallet B 0x12e9…0Fb0: 0.00036, 0.092, 1.41, 3.88, 5.19 ETH. The last lands Aug 6, a week before the exploit. 143 days.

So who funded the deployer? Mar 9, 2022: its first deposit (0.77 ETH) comes from 0x76B7…B2d7, which sterx.eth had funded two weeks earlier. Five minutes later, 2 ETH arrives straight from sterx.eth. Apr 26, 2026: the deployer sends 0.014 ETH back to sterx.eth. Sterx is the handle Zunami's founder posts under.

Aug 24, 2023: the deployer sends 0 ETH to itself. 24 seconds later it deploys a new contract. No second message.

Block 17,928,584, 16:28:47 UTC. From 0xe9b2…b32B (Zunami deployer) to 0x5f4C…46DF (Aug 2023 attacker). 407 characters in the input data: "…a 20% reward… keep by returning the remaining 80%… by August 19th at 09:00 UTC." The deadline passed. The attacker wallet never transacted again.

On Aug 16, 2023, Zunami's deployer wallet sent the wallet that had drained Zunami three days earlier a transaction worth 0 ETH. There's a letter inside it: keep 20%, send back 80%, deadline Aug 19. It sat on Ethereum for three years. Nobody read it. 🧵

You’ve found an interesting address. Where do you look next? Forensia’s Connections view helps you explore the activity around it: incoming and outgoing records, connected contracts, and the evidence behind each link. Search the canvas, inspect individual connections, and expand an address when you want to take the investigation further. Every step should help you understand what the records support and where more evidence is needed. web3.forensia.ai/

Every check passed. That's the problem with a check that only asks who's talking. It never asks whether what they're saying is true. Full case: web3.forensia.ai/cases/ostiu… Observed = read from Arbitrum blocks and Forensia lookups. Reported = attributed to the named source. This doesn't attribute the attack to anyone.

Ostium paused trading within the hour. On Jul 18 it said off-chain infrastructure had been compromised, and didn't say how. Per Ostium, trader margin never moved. The vault's depositors took the loss.

Six audits by three firms over two-plus years. Zellic's first, in Feb 2024, lists 2 critical findings. None of them could have caught this, because the keepers were never in scope.

Ostium's bug bounty on Immunefi names these keepers: "All registered keepers (PriceUpKeep, PrivatePriceUpKeep, TradesUpKeep) and their forwarders are assumed to be trusted." "Issues requiring a compromised or malicious keeper are out of scope." The contract the attacker went through is on that list.

Then the money moves. PeckShield and Lookonchain report 12,084 ETH, spread across 30 wallets, with 10,540 ETH sent into Tornado Cash. The wallet that received the USDC (0x321D…bfD9) holds 0 USDC today.

Then six more transactions. $500K in, $4.99M out. $400K in, $3.99M out. $300K in, $3.00M out. $120K in, $1.20M out. Last one at 14:23:52. Net out of the vault: 23,752,746.55 USDC.

How does a price get in? Ostium's private keeper contract (0xB71e…3d36) accepts signed price reports on demand. QuillAudits and Blockaid report that the signature recovered to an authorised signer. So the signer was real. The price wasn't. All 16 prices the keeper delivered in the attack were $5,000 or $60,000.

25 seconds later, block 484,137,113. One transaction, five open/close loops. Open at $5,000. Close at $60,000. Five times. $1,320,000.50 in, $13,181,520.78 out. The vault is down $11,862,444.78. Forensia reads 35 token transfers in that one transaction.