Receipt 001: Fintoch — the $31.66M stablecoin exit

# Receipt 001: Fintoch

Executive summary

On 22 May 2023, a fresh execution wallet called swapForUSDT on Fintoch's BNB Chain contract and received 31,666,317.817167183900341924 USDT in a single successful transaction; the amount is visible in the transaction receipt, not inferred from a price chart (rug transaction). Three minutes and six seconds later, that wallet forwarded the full USDT balance to a collector, which subsequently sent 10,286,959 USDT through 70 SWFT calls and 477,000 USDT into Multichain Router V4 on the day of the exit (collector transfer, first SWFT call, first Multichain call). This is a retrospective trace—not a prediction, a live warning, or an allegation of legal guilt—and it stops where public evidence stops.

The receipt

Timeline

All timestamps below are UTC and come from the cited block explorer records.

T−315 days — contract deployment

At 2022-07-11 16:05:37, 0x8a0d…aa63 deployed the FTH contract in its nonce-0 transaction. A nonce of zero proves that this was the deployer's first outgoing BNB Chain transaction; it does not prove who controlled the wallet or where its gas funding originated (deployment transaction, deployer history).

T−108 seconds — inventory moves into position

At 2023-05-22 12:57:06, 0xfce4…3a20 transferred 34,341 FTH into the contract call path. This is the last material setup transaction in the verified sequence before the exit (transaction).

T=0 — 31.66M USDT leaves the contract

At 12:58:54, 0xec1a…aa77 called swapForUSDT with 20,000 FTH. The successful receipt records 31,666,317.817167183900341924 USDT moving to that same wallet (transaction).

The execution wallet's nonce was zero at the call. Its next two outgoing transactions were the full USDT transfer and a 10 BNB gas transfer to the same collector, making the sequence operationally compact: execute, consolidate, fund the collector (full USDT transfer, 10 BNB transfer, execution-wallet history).

T+186 seconds — full-balance consolidation

At 13:02:00, the execution wallet sent the complete 31,666,317.817167183900341924 USDT balance to 0x398d…acf4. At 13:03:24, it sent that collector 10 BNB for gas (USDT transfer, BNB transfer).

T+39 minutes to T+7 hours — fragmentation through SWFT

From 13:38:03 to 20:05:30, the collector made 70 successful calls to 0x1ed5…4751, a contract identified as SWFT. The decoded call data names USDT(TRON) and includes Tron recipient addresses; summing the source amounts in those 70 calls yields 10,286,959 USDT (first call: 109,790 USDT, 198,000 USDT call, 200,000 USDT call, last call: 175,000 USDT, SWFT contract identification).

The 70-call count and aggregate are reproducible from the collector's transactions; they should not be read as the total amount Fintoch routed through every SWFT-related wallet. CertiK separately reports that the majority of the stolen funds moved toward Tron through SWFT, but that broader attribution includes branches beyond the single collector quantified here (collector history, CertiK trace).

T+58 minutes onward — Multichain to Ethereum

The collector also made three successful calls to Multichain Router V4, sending 118,000, 209,000, and 150,000 USDT toward Ethereum recipient 0x58d6…de8d. Each receipt emits LogAnySwapOut with source chain 56 and destination chain 1; the source total is 477,000 USDT (118,000 transaction, 209,000 transaction, 150,000 transaction, router).

On Ethereum, that recipient received 117,970.1 USDT at 13:58:59 and 29,941.2453 USDT at 17:49:35 from the verified destination branch, for 147,911.3453 USDT observed at that address (first Ethereum payout, second Ethereum payout). The difference between the BNB Chain source total and this observed recipient total is not assigned here; cross-chain routing can involve fees, alternate settlement legs, and later delivery, and the cited transactions do not prove a single explanation.

T+7 days — attributed exchange branch

On 29 May, 0x58d6…de8d sent 147,911 USDT and then 0.092 ETH to 0x1f7e…6112 (USDT transaction, ETH transaction). CertiK attributes the Ethereum destination branch primarily to HitBTC and Tornado Cash; the transfers are independently visible, but the HitBTC ownership label and the wider Tornado branch are CertiK's attribution, not facts established by the two transactions above (CertiK trace).

Deployer and identity analysis

The deployer 0x8a0d…aa63 began with the contract-creation transaction itself. That gives the wallet no earlier outgoing history from which to infer an operator pattern; it does not establish whether its incoming gas originated at an exchange, a mixer, or another private wallet (deployment transaction, address history). We therefore make no funding-source claim.

No verified real-world identity is recoverable from the deployer or execution-wallet histories. Off-chain reporting instead documents false Morgan Stanley backing and fabricated or actor-supplied team identities; Morgan Stanley itself issued a warning that it had no affiliation with Fintoch (Distributed Networks incident record, CertiK follow-up). Those facts explain the identity gap; they do not identify the controller of 0x8a0d…aa63.

Bridge trace: what was—and was not—observed

The verified post-exit route used SWFT toward Tron and Multichain Router V4 toward Ethereum (SWFT example, Multichain example). The core addresses in this trace produced no exact contract match against Scienter's 64-contract registry for Wormhole, LayerZero, Stargate, Across, Hop, Synapse, or deBridge. That statement is deliberately narrow: the registry does not include the defunct Multichain router or the SWFT contract, and an absence of a match is not proof that no later branch touched another bridge.

CEX destination: what can be said safely

The chain proves the 147,911 USDT transfer to 0x1f7e…6112; CertiK labels the relevant destination branch as HitBTC (Ethereum transaction, CertiK attribution). We found no independent explorer label on that exact recipient, so this receipt does not upgrade “CertiK attributes” into “Scienter independently confirmed.” No other centralized exchange destination is claimed.

OFAC cross-reference

We exact-matched ten addresses from the verified path—the FTH contract, deployer, setup wallet, execution wallet, first collector, SWFT contract, Multichain router, Ethereum recipient, HitBTC-attributed recipient, and the later BNB collector—against Scienter's 2026-09-03 fallback snapshot of 991 current and 10 historical OFAC crypto addresses. There were zero exact-address matches.

That result is not a compliance clearance. It is a point-in-time comparison against a local fallback snapshot, not a live OFAC search, ownership analysis, or 50 Percent Rule review. Tornado Cash addresses in the repository are retained as historical/delisted records after the March 2025 delisting, and CertiK's Tornado attribution does not by itself create an exact match to a currently listed address (U.S. Treasury delisting announcement, CertiK trace).

Three comparable exits

The useful commonality is not “all rugs look the same.” It is the repeated operational sequence: privileged control, conversion into a liquid asset, a fresh or low-history execution wallet, immediate consolidation, then fragmentation across venues or chains. The cited transactions show each case's mechanics; they do not prove a common operator.

What this receipt establishes

• The Fintoch exit amount and recipient are directly verifiable in one BNB Chain receipt (transaction).
• The complete amount moved to the first collector 186 seconds later (transaction).
• A verified subset of the collector's same-day route comprises 70 SWFT calls totaling 10,286,959 USDT and three Multichain calls totaling 477,000 USDT (collector).
• HitBTC and Tornado Cash are secondary-source attributions by CertiK, clearly labeled as such (CertiK).
• The local OFAC snapshot produced no exact match; that is not the same as sanctions clearance (Treasury).

Screenshot policy

Scienter's existing /ledger/[hash] page accepts Scienter call hashes; it is not a general BNB Chain transaction renderer. We did not manufacture dashboard screenshots for foreign hashes that the route cannot resolve. The BscScan and Etherscan transaction permalinks above are the canonical visual receipts.

Method and limitations

This reconstruction used archived BNB Chain and Ethereum JSON-RPC responses, transaction receipts, decoded event logs, and chain-native explorers. Amounts are raw token transfers normalized by the token decimals; totals were summed from successful transactions only. Off-chain identity and destination labels are attributed to the publisher that supplied them.

The analysis is retrospective and incomplete by design. It does not identify a natural person, prove intent, cover every downstream hop, or constitute legal, investment, or sanctions advice. It also makes no claim that Scienter predicted this event: the historical data needed for a defensible launch-time predictor is not yet available.

Source index

• Fintoch contract
• Primary exit transaction
• First collector
• CertiK follow-up investigation
• Smart Contract Hacking incident reconstruction
• Distributed Networks incident record
• Original ZachXBT alert