James Edwards Profile picture
#Blockchain #BlockSec #OSINT #CyberSec #Darkweb | Isaiah 54:17 Fingerpint: 54EADD6FCBCF520E37A003E04D3ECE027AEFA381

Apr 1, 2021, 24 tweets

1/ In light of the ramapnt fraud that has been perpetrated by @bitfinex, @Tether_to, @paoloardoino, @cz_binance, @binance, @HuobiGlobal and others - this thread is designed to bring light to their actions by tracking down all ERC20 USDT.

librehash.org/tracking-down-…

2/ In order to do this, I decided to start with the Treasury - where all funds are minted via an "issue" call made on the relevant smart contract.

The Bitfinex "MultiSigWallet" is responsible for confirming any and all "issue" calls made to the Tether smart contract.

2a/ Visiting the "logs" panel on Etherscan afford us knowledge of the smart contract for the token being minted [USDT] (i.e., this tells us what the 'Tether' smart contract address is)

2b/ The Bitfinex "Multi Sig 2" wallet we see has the address 0xc6cde7c39eb2f0f0095f41570af89efc2c1ea828

Bloxy provides the addresses listed as owners. 3/6 signatures are needed here to approve Tether mints.

bloxy.info/address/0xc6cd…

2c/ The execution trace shows us that the "confirm transaction" call must be executed first before any USDT are issued.

So every issuance is done by Bitfinex

This multi-signature address by Bitfinex is governed by these standards

medium.com/mycrypto/intro…

3/ Given what we know above, we can unequivocally state that @CryptoWhalebot is purposefully hiding the identity of @bitfinex by placing "unknown" instead of "Bitfinex" whenever Tether issuances (minting) occur.

They should know well enough @bitfinex is issuing / minting USDT

4/ Moving forward though - if we look at the Bitfinex Multi Sig address we see nothing too remarkable at first.

However, visitin the 'Erc20 Token Txns' panel, we can see every outgoing USDT transfer was to the same address

0x5754284f345afc66a98fbb0a0afe71e0f007b949

5/ It doesn't take long for one to start to realize that the 0x575 address is actually the Tether Treasury.

In total, its received 25.66 billion USDT on the blockchain.

Source = explorer.bitquery.io/ethereum/addre…

As we can see disbursements are made to an assortment of counterparties

6/ Going further - we want to get a breakdown of *where* these funds are going.

Again, thanks to Bloxy - we can see that the "top receiver" is definitively a Bitfinex address

However, we still don't know about the others

source: explorer.bitquery.io/ethereum/addre…

6a/ Fortunately, this space has crafted plenty of tools that allow users to ascertain where funds are going.

This tweet contains a GIF of the 'ethtective' tool (completely free ; ethtective.com)

edit: had to remove it in order to tweet this thread

6b/ Another solid choice for an analytical deep dive is 'Bitquery' ; inputting the Treasury address, we received this initial relational transaction map showing the primary recipients of the lion's share of funds

Specifically, we can see that was @bitfinex frequently

6c/ We can also see that 22.3 billion worth of USDT have been minted (or at least sent from the MutliSigWallet we covered above) + a non-trivial 300M+ from @Poloniex for some reason

7/ Getting confused? Don't worry - here's a quick recap.

We started with a TX alert message from @CryptoWhalebot , which involved the Bitfinex multisig contract to confirm

We then discovered that this contract was designed to always send to one outgoing address (0x575)

8/ That address (0x575) is the @Tether_to treasury, which we're examining now. Thus far, we've observed *billions* in USDT being shipped directly to @bitfinex

In total, 9B USDT can be seen on screen alone.

8a/ The @NewYorkStateAG made it abundantly clear that @bitfinex and @Tether_to are ran by the same entity.

This is important to keep in mind as we can continue along through the rest of this thread

9/ Here are some quick notes regarding the relationship between the attached addresses to the @Tether_to treasury.

10 / Here, we can see 1.608 billion USDT that went to a nondescript address (0xf36a47300f002c0c9f8c131962f077c3543b2fc6)

This address is interesting since its also received significant amounts of UDST, ETH, LINK, REN, SNX, and ANT

Photo of wallet entity map is attached too

11/ More important than the 1st nondescript address is this second one that's received 5.65 billion USDT

The address is (0xf44e17140b4c32ef1e9fab15cbcb14074bd832ee)

Since there are only 16 outgoing USDT TXs, tracking them to @binance was easy

12/ Additionally, 800M USDT was sent directly to @binance's exchange wallet (no clear reason for why 5.6B+ USDT needed to be sent covertly through the other wallet).

Now we know at last 6.4B USDT went to @binance via disbursements. Nearly 10B were issued to @bitfinex

13/ Attached to this tweet is a photo of all of the *Ethereum* USDT mint events (there is significant activity on Tron we're going to bring to light as well in another thread)

Remember address 0x575 is the Treasury

source: stablecoin.tokenview.com/en/usdt

14/ Knowing the treasury address allows us to identify anomalous periods like the one isolated in the photo attached to this tweet showing 3.2 billion USDT being minted over the course of *4* days.

source: eth.tokenview.com/en/address/0xc…

15/ Now that we've looked at the primary recipients of the ERC20 USDT (@binance and @bitfinex) , we're going to move on to examine whether Tether disbursements have catalyzed $BTC's price run.

The real "run" started around Oct. 8th 2020.

16/ Curiously there are no 100% accurate sources for Tether online - but this is the best one since it gets the *total* amount minted in that time frame correct (they just incorrectly identify ownership among exchanges)

17/ Overall, 16-17B USDT (at least) were minted... *just on the Ethereum blockchain!* This does not include anything going on with @Tronfoundation @justinsuntron at all.

That thread is coming soon. Hopefully this thread serves as a useful resource.

Share this Scrolly Tale with your friends.

A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.

Keep scrolling