API tools faq
paste
Advertisement
Guest User

scream pt.2

a guest
May 17th, 2022
513
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.55 KB | None | 0 0
raw download clone embed print report
  1. Scream fUSD market manipulation
  2. ================================================================================
  3.  
  4. The address in question is 0xf2c155be5d19d20037b3ea7118100aed4b4a5dc2
  5. --------------------------------------------------------------------------------
  6. The wallet seems to have been funded by:
  7.  
  8. 0x8736a1B280e765930A27e8e6F7F95Ac77B766f53 (Wallet balance: 0.00397670004461664 FTM [inactive]),
  9. 0xB80297D5847824c3181ba1C4F1C90606ac40cE29 (Wallet balance: 0.003976700009384631 FTM [inactive]),
  10. 0x217C5bB8a8a48D6172D4E9A76Bb8C28b4a8b016E (Wallet balance: 0.003976699995707209 FTM [inactive]),
  11. 0x4A424E65Ad26b408eC143D75d68be7B32C3b14d2 (Wallet balance: 0.008947575021749427 FTM [inactive]),
  12. 0xd439f3a2CA404Cc6E01dbABc295D7737824D21C3 (Wallet balance: 230.002011099919634333 FTM [inactive]),
  13. 0x2fFED8e9ccdc940434bB7ff35c3FFEA60B7a52Bc (Wallet balance: 0.098487400000483971 FTM + 0.133626262119522015 wFTM [inactive]),
  14. 0x42FcD6c8fC5715B390a76A02344347a291bbdd48 (Wallet balance: 0.004476699995 FTM [inactive] + 100 FTM on Ethereum),
  15. 0x8D7E07b1A346ac29e922ac01Fa34cb2029f536B9 (Wallet balance: 6,434.26682779375256936 FTM + 32,842.290263801734857627 SCREAM + 30,910.039907 USDC + 1,442,384.130832335041589982 FTMO + More tokens [ACTIVE: Wallet balance via DeBank is $8,707,868]),
  16. 0xB7c993CA96444c4677A4A956c3fa37cC342769fc (Wallet balance: 4.902832342067544926 FTM [Semi-active, last OUT tx was on Feb-25-2022 04:49:30 PM +UTC]),
  17. 0xEBf4FBB9C81b84dd5CF89BC75588E5d0018501b3 (Wallet balance: 2,302,070.225577217198375149 FTM + $450,000 in various tokens -- seems to be a CEx wallet, as it transacts multiple times a minute),
  18. 0x8800528F6b9480DBbffD65Fe6d8cC075bac7C1A8 (Wallet balance: 7,512.8947255319392 FTM [inactive, but there have been some IN transfers within the last 120 days] + 1000 USDT on Ethereum),
  19. 0x4FD1f477144f2D81DC2CeF011164a63cFc2cFD57 (Wallet balance: 0.098533600203520522 FTM [inactive]),
  20. 0xd6A37423Be930019b8CFeA57BE049329f3119a3D (Wallet balance: 17,039.263147567522822931 FTM [ACTIVE: FTMScan comments seem to indicate this address' balance is stolen {see note #1}])
  21.  
  22. 0x8D7E07b1A346ac29e922ac01Fa34cb2029f536B9 seems to have been the most active sender, so the primary addresses for the manipulator are most likely:
  23.  
  24. = 0xf2C155be5d19d20037B3eA7118100aeD4B4a5DC2
  25. = 0x8D7E07b1A346ac29e922ac01Fa34cb2029f536B9
  26. => Total balance is $189,790 + $8,777,430 = $8,967,220
  27.  
  28. 0x8D7E... has over 500 followers on DeBank, but this just seems to be the fame associated with a top-10,000 wallet.
  29. 0xf2C1... has 2 followers, one of which is 0xbbc02dbd39941fffa605171a977d44c6baf915c2, or Kesha (Kryptopaid on github), the other is 0xcff8097b146dc56f40bdf34e18e0283dd404765f, which does not have many significant connections.
  30.  
  31. Node 38, A.K.A. nodo38
  32. --------------------------------------------------------------------------------
  33. 0xf2C155be5d19d20037B3eA7118100aeD4B4a5DC2 is the address for validator node #38 on Fantom.
  34. Their alias is nodo38, which leads you to their Twitter account, @nodo38FTM (329 Followers at time of writing).
  35. That leads you to their almost unknown telegram group, t.me/nodo38group. From there, you can find the admin is @nodo38FTM on telegram.
  36.  
  37. Additionally, searching 'nodo.38' leads you to an Instagram account with the tag being @nodo.38.
  38.  
  39. > Prepare yourself for the potentially most useless tangent ever! <
  40.  
  41. @nodo.38 on Instagram follows 15 people:
  42. >> libreria4m
  43. >> marcelascz
  44. >> gonzalodosio
  45. >> estefania_guidi
  46. >> ing.levato
  47. >> david.gonzalez.tattoo
  48. >> nomanches.deco
  49. >> bicside_fabrica
  50. >> santi.poyo.guzman
  51. >> rosariocentral (verified)
  52. >> limacafe.pasteleria
  53. >> mesabe_bien
  54. >> holasalero
  55. >> alegrasrl
  56. >> equipamientosrosariok
  57.  
  58. @rosariocentral seems to be the biggest clue as to where @nodo.38 is located -- somewhere near Rosario Central (who could have guessed).
  59.  
  60.  
  61. \/ THIS IS PROBABLY IRRELEVANT \/
  62. Rosario Central is a sports club located in Argentina. It was established 132 years ago, which seems to justify the large amount of followers on the Instagram acct.
  63. If @nodo.38 is located in Argentina, this would align with the times that @nodo38FTM is active on Telegram.
  64.  
  65. I won't look much more, since the point of this was not to get people to go harass a person.
  66.  
  67. Other networks:
  68. --------------------------------------------------------------------------------
  69. Ethereum:
  70. ================================================================================
  71. 0xf2C155be5d19d20037B3eA7118100aeD4B4a5DC2 on ETH is funded by 0x98f5C6B9e3D0A8b254bBC7639255594E3C1Bb942 with 0.2 ETH, and Binance 10 at txhash 0xdb64fe374daaa11f264717c477589cbabfa84416cba7dd1e27953e4bc071f4df
  72. 0x98... is funded by 0x8D7E07b1A346ac29e922ac01Fa34cb2029f536B9 and Binance 2 is a similar pattern to nodo38's wallet, which further solidifies the connection of these 2 wallets.
  73. \/ new wallet found \/
  74. 0x8D... is initially funded by 0x25E94Baa6891FA32b90f0D48850CE552edD01bd4, and nodo38. This gives us a new wallet to look into.
  75. 0x25... seems to be an intermediary wallet with no Ether in it. 0x25... is funded by 0x84583173EA6104660901090A708C3666014f570D.
  76.  
  77. Something to note about 0x84... is that it sends funds to 'Coinbase: Miscellaneous', which gives us another CEx which hopefully has nodo38's identity.
  78. At a first glance, on etherscan (https://etherscan.io/address/0x84583173EA6104660901090A708C3666014f570D) it seems like the ETH just appeared out of no-where. If you click on 'Internal Txns', you see wallet 0x604df452158e7ddf3e44338308edc079a953c9da funded 0x84... at txhash 0xdd6d56c6f24511471739278962e35a2b8de5132815351bb741bf6d244c18ed86. This wallet did so using an unverified multisig contract (0x0a1820f0ff7dc9fce0a4f0b589ee14ddae88233c).
  79.  
  80. 0x0a1820f0ff7dc9fce0a4f0b589ee14ddae88233c holds an Enjin NFT. This NFT on Enjin's website can be seen here https://enjinx.io/eth/asset/1000000000000428/
  81. This NFT was sent to it by 0x5Df2E003CEcb0ebf69cBd8F7Fbb6F44F690331F2 in a batch transfer. This address does not seem to be connected, so let's move on...
  82.  
  83. The creator of 0x0a1... is 0x604df452158e7ddf3e44338308edc079a953c9da.
  84. This address seems to be the primary address (which seems botted, or just very active at the time of writing [11 txns in 1 hr]). It was funded by Binance over 1400 Days ago. It also recieved Ether from Bitfinex & Hotbit.
  85.  
  86. However, 0x41d57e163b6c64fca2cd6535fcaa199b1fedd98b also sent it 0.39... ETH. This transaction has some data, and if we look at it, it says:
  87. "COINOMAT/FROM TARGET 0.39636900000000"
  88. The same thing happened a few days later, with the message being:
  89. "COINOMAT/FROM TARGET 0.46910000000000"
  90.  
  91. 0xFEEA60EEdb79686B3033AeCB6fC206E0c5517ecf also sends it some Ether.
  92.  
  93. CoinoMat is a Russian-based, for-profit company, their crunchbase reads: "Coinomat is a gateway service for Waves Platform".
  94. This may contradict the findings about nodo38 being Argentine. Why is this significant? Because 0xbbc02dbd39941fffa605171a977d44c6baf915c2 on DeBank is Kryptopaid on github. Kryptopaid's avatar is a mouse saying something in what seems to be the Cyrillic alphabet (I'm not sure), with the Ukrainian flag behind it.
  95. Additionally, CoinoMat's Twitter account was suspended (@coinomat).
  96. https://www.facebook.com/Coinomat has been inactive since 2016.
  97.  
  98.  
  99. Created contracts:
  100. --------------------------------------------------------------------------------
  101. 0x33545e5a75DA445F36C41e564003F65757194A0d, a literal nothing contract, the bytecode is `0x`
  102.  
  103. Notes:
  104. --------------------------------------------------------------------------------
  105. #1) LAmara1 on FTMScan claims that over 20,000 FTM got stolen from them, but there is no on-chain evidence for this. The 'return' address is 0x94c147ab659ff47d9d8e5c508616cb25a02239d4, which DID get a total of 52,334 FTM sent to them from the 'robber' address, but as the first two transactions that wallet ever received. Scammer or another address in disguise?
  106.  
  107. [==============================================================================]
  108. Finding where all the other addresses were funded would be a huge task, and definitely not something I would want to spend the little free time I have on.
  109.  
  110. This is all the research I will be doing for now, as I do not see many more trails worth following.
  111. If you want to contact me further, send me a DM here at @zdotftm or on Telegram @OHMKI/@zdotftm (I check @OHMKI more often).
  112. To donate, my address is z.ftm/0x3e522051a9b1958aa1e828ac24afba4a551df37d,
  113. but I would prefer you to register your own .ftm name at https://rave.domains (@rave_names) :)
  114.  
  115. Thanks for reading through this mess,
  116. RandomZ
  117.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!