Receipts

The work, with its sources attached.

Each receipt reconstructs one event from public chain data. The transaction hashes are printed in full, the arithmetic is reproducible from them, and where a finding rests on somebody else’s attribution we say whose it is and what it does not establish.

These are retrospective traces of events that have already happened. They are not predictions, not live warnings, and not allegations of legal guilt. The methodology states what has and has not been measured.

Receipts are numbered when an investigation opens, so the list has gaps. Numbers 002, 003, 004, 005 are still in review: a receipt is published only after every figure in it has been checked against its source.

• 001 · 3 September 2026

  Receipt 001: Fintoch — the $31.66M stablecoin exit

  A transaction-by-transaction reconstruction of Fintoch's May 2023 exit: 31.66M USDT, a fresh execution wallet, SWFT, Multichain, and the limits of the public trail.

  subject 0x19a00e359990ec7daf6e9dd9a2fb7664014bb5f7

  receiptforensicsrug-pullbnb-chaincross-chain

• 007 · 1 August 2022

  Receipt 007: Nomad — the same message, replayed fifteen times

  One address in the Nomad bridge drain, measured end to end: 51.5M in tokens across 34 transfers in 77 minutes, including the same 202,440.73 USDC fifteen times. Every stablecoin forwarded to a DAI/USDC/USDT pool to the wei.

  subject 0x56D8B635A7C88Fd1104D23d632AF40c1C3Aac4e3

  receiptforensicsbridge-exploitethereum

• 006 · 23 March 2022

  Receipt 006: Ronin — the Ethereum leg, measured

  The Ronin bridge withdrawals as they appear on Ethereum: 173,600 ETH and 25,500,000 USDC into a wallet whose first two transactions they were, then 182,165.96 ETH out to 26 addresses — seven of which carry OFAC designations. Every figure measured from the chain, and the account closes to the wei.

  subject 0x098B716B8Aaf21512996dC57EB0615e2383E2f96

  receiptforensicsbridge-exploitroninofac