$FET is Fetch.ai's token, now the token of the Artificial Superintelligence Alliance. It exists on two chains: Ethereum and BNB Chain. One supply means a bridge burns coins on one side and mints the same amount on the other. The two books have to match. The ledger that would show they match has never been published. This is the fourth time we have asked for it. Still no reserve ledger. 20 Sep — first trace, no answer xitter.cf/sprunky_eth/status/210… 29 Sep — 452M FetchHub mint, no matching Ethereum inflow, and a 109,350 residual xitter.cf/sprunky_eth/status/210… 30 Sep — we called it the third ask. @Fetch_ai said the contracts were not affected. The arithmetic was not answered xitter.cf/sprunky_eth/status/210… This number was not in those threads. In 2021 Fetch minted a second $FET supply on BNB Chain. The Ethereum books were later closed. These coins were not. 939,887,544 $FET are still in one safe. About 81% of that 1.15 billion. Read today. Token bscscan.com/token/0x031b41e5… Safe bscscan.com/token/0x031b41e5… Not the September exploit. The safe was not hacked. Same rule as 27 Sep: a gap, not a fraud claim. Nobody has shown the burn that makes the two ledgers match. @Fetch_ai @ASI_Alliance @SingularityNET @oceanprotocol @CUDOS_ If the Ethereum supply is closed, what is this 939,887,544? A reserve you disclosed, or a supply you never subtracted? Verify, then trust. 👁️ $FET

On-chain bounty message spotted on the Solana staging wallet. C5L5EtcZmTKFc4D7Ntfqi7MtohnHVh4xZn93a5dBhB8 received a memo from Hp5nf6XJ4aNT1T8SXCHGQirfFbJuhNh1UJJaUtXtgnKd. The message is not signed by any known protocol owner or multisig. It is treated as a spoof. Current balance remains \~5,003 SOL. No movement on the Avalanche attacker wallets. Monitoring continues.

CORRECTION UPDATE Earlier posts listed an outdated SOL balance on the Solana destination wallet. Current verified status of C5L5EtcZmTKFc4D7Ntfqi7MtohnHVh4xZn93a5dBhB8: • \~5004 SOL still sitting on the wallet • Wormhole WETH from the failed Mayan bridge has been refunded • No successful CEX exit detected so far Solscan: solscan.io/account/C5L5EtcZm… All other findings in the thread remain valid.

UPDATE – Mayan exit blocked + refunded The attacker tried to bridge Wormhole WETH from C5L5 to Ethereum via Mayan. Destination: Ethereum Recipient: 0xdc3d7cc5383e0f1ac46d2c693aad1a19859a2deb Status: BLOCKED by Mayan (sanctioned) The order was later refunded. The WETH returned to C5L5 on Solana. No CEX interactions found in the full history of C5L5. Only bridge routes used so far: Mayan and CCTP (both linked back to the Avalanche funding wallet). \~5004 SOL still sitting on C5L5. TX (refund): solscan.io/tx/4onFggwhGSagAE…

On-chain negotiation spotted by @MistTrack_io. Attacker response on the TranchePool case: “Please be respectful. You are asking someone who lacks any moral compass to return money.” Victim offered a partial return in exchange for not organizing evidence. The attacker is actively communicating on-chain. Rare, and not a good look.

UPDATE – Mayan exit blocked C5L5 tried to bridge Wormhole WETH to Ethereum via Mayan. Destination: Ethereum Recipient: 0xdc3d7cc5383e0f1ac46d2c693aad1a19859a2deb Status: BLOCKED by Mayan (sanctioned / SWAP_BLOCKED) Deadline has passed. Funds are expected to be refunded to Solana. TX: solscan.io/tx/3hCcLhBvc5GfnV…

UPDATE – Solana exit is live C5L5EtcZmTKFc4D7Ntfqi7MtohnHVh4xZn93a5dBhB8 swapped \~1 SOL via Jupiter into Wormhole WETH (7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs). The output went to a Mayan bridge order: 3jTvrbxfojmNDyb7Zuz637dVeCWN2ZDY5KMPdCLnVchN TX: solscan.io/tx/3hCcLhBvc5GfnV… This looks like a staging step for a cross-chain exit. Destination chain and recipient are still being decoded. Current SOL balance on C5L5: \~5004 SOL.

We are actively monitoring the Solana destination (C5L5…hB8) and the Avalanche attacker addresses. Any movement will be reported here with tx links.

⚠️ WHAT WE DO NOT CLAIM ✗ We do NOT know the real-world identity of the attacker. ✗ We do NOT claim the bounty memo is officially sanctioned by the protocol. ✗ We do NOT claim funds are recoverable without exchange/custodian cooperation. ✗ We do NOT accuse any entity without verified on-chain evidence. All findings are based solely on public blockchain data.

📝 BOUNTY MEMO ANOMALY A memo was sent to the Solana wallet offering: • 10% bounty to sender • 90% return to "[email protected]" • Request: "keep the funds in place" • Memo sender: Hp5nf6XJ4aNT1T8SXCHGQirfFbJuhNh1UJJaUtXtgnKd • Funded by: Hmc2dLxZZ4xfHqn2wFCTBu11oCpYiuwsj23JBjJmD4ni (~$20M Fireblocks Custody wallet)

📍 CURRENT FUND LOCATION (SOLANA) The bridged $USDC landed at: C5L5EtcZmTKFc4D7Ntfqi7MtohnHVh4xZn93a5dBhB8 Current status: • $USDC balance: 0 (already moved) • $SOL balance: ~0.098 $SOL • Other tokens: DEkqHy Solscan: solscan.io/account/C5L5EtcZm…

EXIT ROUTE: AVALANCHE → SOLANA After draining, funds were split via an intermediate address and bridged using Circle CCTP V2. • CCTP Burn ($AVAX → $SOL): snowtrace.io/tx/0x51bb85e1f3… Destination: Solana blockchain. This bypasses traditional Avalanche monitoring.

🔗 EXPLOIT TRANSACTIONS • Build-up (flash loan + vault manipulation): snowtrace.io/tx/0x19ab145e7f… • Drain (claim of inflated shares): snowtrace.io/tx/0x3f6b23292a…

KEY ADDRESSES • Attacker EOA: 0x6ff1c3ffa622e1062168f3497a275be9cc2b1246 • Vault Contract: 0x0e710a20376ae1e18316b0a270889d665a6918b2 • Exploit Contract: 0xf09d569a8801744a5f9ba1f721de6f7cb30841c3 • Helper Address: 0xc5240a03512f7ccc09

💰 FUNDING SOURCE (KYC LINK) The attacker wallet received its initial funding from: 0x4e75e27e5aa74f0c7a9d4897dc10ef651f3a3995 Verified on Etherscan as: "KuCoin: 32" (Hot Wallet). This is the strongest attribution link for law enforcement. Etherscan: etherscan.io/address/0x4e75e…

⚔️ THE EXPLOIT • Vector: Flash-loan share inflation • Amount: ~$1.01M $USDC (1,013,353 $USDC) • Date: Oct 27-28, 2026 • Chain: Avalanche $AVAX C-Chain The attacker manipulated vault share prices via Aave V3, minting inflated shares and redeeming them for the vault's $USDC liquidity.