$FET is Fetch.ai's token, now the token of the Artificial Superintelligence Alliance. It exists on two chains: Ethereum and BNB Chain. One supply means a bridge burns coins on one side and mints the same amount on the other. The two books have to match. The ledger that would show they match has never been published. This is the fourth time we have asked for it. Still no reserve ledger. 20 Sep — first trace, no answer xitter.cf/sprunky_eth/status/210… 29 Sep — 452M FetchHub mint, no matching Ethereum inflow, and a 109,350 residual xitter.cf/sprunky_eth/status/210… 30 Sep — we called it the third ask. @Fetch_ai said the contracts were not affected. The arithmetic was not answered xitter.cf/sprunky_eth/status/210… This number was not in those threads. In 2021 Fetch minted a second $FET supply on BNB Chain. The Ethereum books were later closed. These coins were not. 939,887,544 $FET are still in one safe. About 81% of that 1.15 billion. Read today. Token bscscan.com/token/0x031b41e5… Safe bscscan.com/token/0x031b41e5… Not the September exploit. The safe was not hacked. Same rule as 27 Sep: a gap, not a fraud claim. Nobody has shown the burn that makes the two ledgers match. @Fetch_ai @ASI_Alliance @SingularityNET @oceanprotocol @CUDOS_ If the Ethereum supply is closed, what is this 939,887,544? A reserve you disclosed, or a supply you never subtracted? Verify, then trust. 👁️ $FET

update: the CreateCall factory used here is already deployed with identical bytecode on Arbitrum, Base and Optimism. the initiator itself has no deployments on those chains. arbiscan.io/address/0xb22d63…

update: the 42,500 WAVAX was bridged to ethereum and arrived as WETH on 0x70d54baf9ffa48b8fe4e843774a44e24ff452099. it is still sitting there, untouched. etherscan.io/address/0x70d54…

Update on the initiator. 0x36B1…21B3 received the Safe funds in the same tx that deployed the sweeper. He later messaged on-chain that he is a whitehat bot that front-ran a failed attack (tx 0xf1f87d37…) and is offering to return the funds for a 5–10% bounty. Safe owner 0xa79f… replied on-chain on 27 Oct that the bot may keep 42,500 WAVAX. That matches the remaining balance currently sitting at 0x11eb…. Factory 0xB22D…0316 is the public Safe CreateCall library. Same bytecode is deployed on Avalanche, Ethereum, BNB, Arbitrum, Base and Optimism. Still watching the outbound bridges. 👁️

📢 Defimon’s alert is public. The CreateCall bytecode match, the exact creation Tx, and the live bridge-tracing are ours. Verify the links. Then trust the data. 👁️

💰 The funds are currently sitting at: snowscan.xyz/address/0x11Eb9… Balance: 42,500 WAVAX (\~$372K). Account age: 5 hours. ⏳ In the last \~10 minutes it has been bridging WAVAX, BTC.b, WETH.e and USDC off Avalanche. 🌉

🔍 We verified the factory that deployed CreateCall. 🏭 Factory (official Safe CreateCall): snowscan.xyz/address/0xB22D6… Bytecode matches the official Safe CreateCall library on Avalanche, Base and Ethereum. ✅ 📜 Creation Tx: snowscan.xyz/tx/0xf88a7960a0… 👤 Initiator: snowscan.xyz/address/0x36B11…

🔐 The Safe approved unlimited WAVAX, USDC, WETH.e and BTC.b to: snowscan.xyz/address/0x3725b… That address is what Safe’s public CreateCall contract produces on its 13th deployment. On Avalanche it was empty. The approvals were never revoked. Anyone could deploy their own code at that address and spend the allowances. ⚠️

🧠 DERIVED HYPOTHESIS (needs Bloom confirmation) CUSTODIAL KEY MANAGEMENT FAILURE Reports indicate some victims had imported private keys into Bloom's Telegram bot. If Bloom processes keys on central servers, a third-party compromise explains: • Simultaneous multi-wallet drain • Direct signing from victim wallets • SOL-only pattern (token accounts stay under user control) This is a technical INFERENCE. Bloom cited a possible "third-party security compromise" but confirmed no root cause yet.

⚖️ ATTRIBUTION TIMELINE (exact UTC timestamps) ✅ VERIFIED: • 01:33 — @apedev_sol accuses RapidLaunch • 01:37 — same account corrects to "ITS BLOOM" • 01:52 — @leonidERD: "rapid launch - not bloom" • 04:41-04:46 — @BloomTrading: "9 users", "fully reimbursing", "not an exit scam" • 07:54-08:32 — Bloom staff denies some wallets were ever in the bot ⚠️ UNVERIFIABLE: • Whether RapidLaunch posted since 20 Oct (none found) • The "God's work" narrative chain (only one post confirmed) • Coordinated astroturfing between camps No official Bloom post accuses RapidLaunch.

❌ TWO COMMUNITY CLAIMS DEBUNKED 1️⃣ "RapidLaunch is a Chrome extension involved in the drain" → FALSE. RapidLaunch is a web/API token-deployment toolkit on Solana (confirmed by DefiLlama). No official Chrome extension exists. 2️⃣ "An extension update triggered the drain" → FALSE. Bloom v6.2.5 was published 22 Sep 2026. Drain happened 26 Oct. No temporal overlap. Still UNVERIFIABLE without raw tx inspection: • Durable nonce abuse • Exact token breakdown (SOL-only is a social claim, not on-chain confirmed)

🕵️ EXCLUSIVE: FUNDER IDENTIFIED The drainer was seeded with 0.01 SOL by a deployer wallet that follows a bot-network pattern (seeds fresh drainer wallets, then goes dark). Funder now empty. Last outflow: 0.2554 SOL to an unknown active wallet (~6.73 SOL). This infrastructure fingerprint is not yet public elsewhere. Funder wallet ↓ solscan.io/account/9LxMdvs1m…

🔗 VERIFIED ON-CHAIN FACTS • Drain: 9,408 SOL from 49 wallets • Time: 04:30 UTC (05:30 Amsterdam), 26 Oct 2026 • Victims: 49 wallets = 9 users (per Bloom) • Largest loss: 1,636 SOL (~$166K) • Speed: ~41 wallets in 51 sec (Gate community report) • Drainer now empty after sweep Sweep transaction ↓ solscan.io/tx/ADe8xTkY71BXz5… Drainer wallet ↓ solscan.io/account/7kY8qx8Mq…

🛡️ ACTIONABLE DEFENSE: If you interacted with ynerax.one 1️⃣ REVOKE approvals immediately via revoke.cash • Phase 2 Contract: 0x71836fb11cf133c38c71dc1c4ed00e678ccccd29 • Fee Collector: 0x7ea1a854a3d3064ea8187d70842fe1e2d218e338 • Funnel Node: 0xF390125789bDF368F7281714Cef50a2e136cbb80 2️⃣ Monitor your wallet for unauthorized Transfer or Permit events. 3️⃣ Report the infrastructure to: • Local cybercrime authorities • @kucoincom Compliance (verified cash-out destination) 4️⃣ Warn airdrop farming communities. Share this thread. ⚠️ WHAT WE DO NOT CLAIM: We do not claim KuCoin is complicit in this scam. We report that their deposit addresses are being used as the final off-ramp for these laundered funds, requiring their compliance team's immediate attention. The scam relies on sunk cost psychology. Break the cycle.

⚠️ PREDICTION for Nov 1: @Ynerax_one promised "#Ynx new Claim Date 1st Nov 2026" with "$75 rewards" 🔴 Most likely: Another delay + NEW FEE (70%) "Solana bridge fee" / "migration fee" / "validation fee" New urgency: "FINAL CHANCE" 🔴 Rebrand to Solana via @YneraX_Sol (20%) New domain, same playbook 🔴 Exit when fees stop (10%) 🚨 DO NOT PAY. DO NOT SIGN. DO NOT CONNECT. This is a perpetual fee farm, not a legitimate project.

👥 Who's being targeted: 🌍 Demographics (name/language analysis): • South Asia: Indonesia, Bangladesh, Pakistan, India • Nigeria • Languages: English, Urdu, Indonesian, Vietnamese, Chinese • Losses: $0.40-$10+ per person (mass scale) 🤖 Astroturfing network: • 38% of promoters = NEW accounts (same day) • Shared template: "Free $75 USDT Eligible Alhamdulillah 😁🔥" • Same typo "Distibution" across accounts • Scheduled posts detected 🔄 Rotating accounts: • @Ynerax_one (Oct 7, 2026) • @YneraX_Sol (Sept 2024, 26 posts - ready for Solana pivot)