[GUEST ACCESS MODE: Data is scrambled or limited to provide examples. Make requests using your API key to unlock full data. Check https://lunarcrush.ai/auth for authentication information.]  Tay 💖 [@tayvano_](/creator/twitter/tayvano_) on x 88.1K followers Created: 2025-07-22 15:34:22 UTC Sorry, I still don't understand how anyone reasonably gets from point a to point b, even via Tokenlon X. These are insanely active DEX contracts The Payback report names 0x03f34be1bf910116595db1b11e9d1b2ca5d59659, which is the contract that handled the processing of the $4m swap on Nov 15, but not the contract that actually routed any of the assets. This means that this address won't show up on the transfer pages anywhere which makes it basically impossible to be following funds "thru" this address. I guess they could somehow pull 0x03f3 later looking at the raw transaction hash (or something?) The Tokenlon address that someone could maybe manage to "trace thru" would be Tokenlon: PMM 0x8D90113A1e286a5aB3e496fbD1853F265e5913c6 (the actual asset router.) 0x8D90 handled well over XXX million swaps. In Nov 2021 alone the volume was $XXXX billion (so XXXX billion worth of assets were swapped from one type of asset to another) If we assume the relevant transaction on the victim side is the one on 2021-10-26.....that's weeks before the relevant transaction shows up going to Tornado Cash (2021-11-15). On both Oct XX and Nov 15, 2021, there were over 1500 swaps involving Tokenlon contracts. That would mean that ~15k-20k "transfers" "occurred" in between (if we pretend we have shit for brains, pretend we think assets are literally sent to Tokenlon, and then pretend we "traced thru" Tokenlon). So what, they traced thru but also ignored the intermediary 20k "transfers"??????? X. Is there any plausible swap transaction that's "close" to the Nov XX swap? To answer this I grabbed every single address within X hops from the victim and X hops from the address Payback identified (excluding clearly labeled CEX hot wallets like Binance, HTX, etc.) That's XX address in the "Victim" cluster (image 2) and XX addresses in the "Payback" cluster (image 3) Were talking about XXX addresses that collectively do well over a billion in volume. I then grabbed every single transaction involved any of those XX address and ALL Tokenlon addresses. Obviously, none of the XX addresses sent or received to/from any of the XX addresses. A selection of addresses in both clusters did interact with Tokenlon addresses. Attached Image X is the cutout from the spreadsheet for the relevant time period. I don't see anything that makes sense....still. It doesn't make sense to follow $1000 thru tokenlon to a $XXXXXXXXX out of tokenlon. But it also doesn't make sense how the victims $148k turned into a $4m swap let alone a $450k Tornado Cash deposit in the first place. This is not good tracing. There is no forensic accounting here. This is a joke. X. Maybe they just got confused because of a bridge in / bridge out via Tokenlon / imBTC stuff? Well.....every Tokenlon swap (300+ swaps from these addresses) was a single-txn basic swap. Meaning that an address swapped X asset for another asset, both on the Ethereum blockchain, and the swap was finalized within a single transaction, and address for the origin token = address of the outgoing token. For anyone confused by this description, this is literally how a basic Uniswap swap works. It is NOT like: - an "advanced mode" swap where the swap initiator receives the output asset in a different address than the one they initiated with - a Tokenlon swap involving (im)BTC where only half of the swap occurs on Ethereum and would be visible on Etherscan. If it was like one of those it might be more understandable how this trace occured. But its not.  XXX engagements  **Related Topics** [$4m](/topic/$4m) [0x03f34be1bf910116595db1b11e9d1b2ca5d59659](/topic/0x03f34be1bf910116595db1b11e9d1b2ca5d59659) [tokenlon](/topic/tokenlon) [tokenlon dex](/topic/tokenlon-dex) [coins defi](/topic/coins-defi) [coins exchange tokens](/topic/coins-exchange-tokens) [coins arbitrum](/topic/coins-arbitrum) [$xwp](/topic/$xwp) [Post Link](https://x.com/tayvano_/status/1947681636470166011)
[GUEST ACCESS MODE: Data is scrambled or limited to provide examples. Make requests using your API key to unlock full data. Check https://lunarcrush.ai/auth for authentication information.]
Tay 💖 @tayvano_ on x 88.1K followers
Created: 2025-07-22 15:34:22 UTC
Sorry, I still don't understand how anyone reasonably gets from point a to point b, even via Tokenlon
X. These are insanely active DEX contracts
The Payback report names 0x03f34be1bf910116595db1b11e9d1b2ca5d59659, which is the contract that handled the processing of the $4m swap on Nov 15, but not the contract that actually routed any of the assets.
This means that this address won't show up on the transfer pages anywhere which makes it basically impossible to be following funds "thru" this address.
I guess they could somehow pull 0x03f3 later looking at the raw transaction hash (or something?)
The Tokenlon address that someone could maybe manage to "trace thru" would be Tokenlon: PMM 0x8D90113A1e286a5aB3e496fbD1853F265e5913c6 (the actual asset router.)
0x8D90 handled well over XXX million swaps. In Nov 2021 alone the volume was $XXXX billion (so XXXX billion worth of assets were swapped from one type of asset to another)
If we assume the relevant transaction on the victim side is the one on 2021-10-26.....that's weeks before the relevant transaction shows up going to Tornado Cash (2021-11-15).
On both Oct XX and Nov 15, 2021, there were over 1500 swaps involving Tokenlon contracts. That would mean that ~15k-20k "transfers" "occurred" in between (if we pretend we have shit for brains, pretend we think assets are literally sent to Tokenlon, and then pretend we "traced thru" Tokenlon).
So what, they traced thru but also ignored the intermediary 20k "transfers"???????
X. Is there any plausible swap transaction that's "close" to the Nov XX swap?
To answer this I grabbed every single address within X hops from the victim and X hops from the address Payback identified (excluding clearly labeled CEX hot wallets like Binance, HTX, etc.)
That's XX address in the "Victim" cluster (image 2) and XX addresses in the "Payback" cluster (image 3)
Were talking about XXX addresses that collectively do well over a billion in volume.
I then grabbed every single transaction involved any of those XX address and ALL Tokenlon addresses.
Obviously, none of the XX addresses sent or received to/from any of the XX addresses.
A selection of addresses in both clusters did interact with Tokenlon addresses.
Attached Image X is the cutout from the spreadsheet for the relevant time period.
I don't see anything that makes sense....still. It doesn't make sense to follow $1000 thru tokenlon to a $XXXXXXXXX out of tokenlon. But it also doesn't make sense how the victims $148k turned into a $4m swap let alone a $450k Tornado Cash deposit in the first place.
This is not good tracing. There is no forensic accounting here. This is a joke.
X. Maybe they just got confused because of a bridge in / bridge out via Tokenlon / imBTC stuff?
Well.....every Tokenlon swap (300+ swaps from these addresses) was a single-txn basic swap.
Meaning that an address swapped X asset for another asset, both on the Ethereum blockchain, and the swap was finalized within a single transaction, and address for the origin token = address of the outgoing token.
For anyone confused by this description, this is literally how a basic Uniswap swap works.
It is NOT like:
- an "advanced mode" swap where the swap initiator receives the output asset in a different address than the one they initiated with
- a Tokenlon swap involving (im)BTC where only half of the swap occurs on Ethereum and would be visible on Etherscan.
If it was like one of those it might be more understandable how this trace occured. But its not.
XXX engagements
Related Topics $4m 0x03f34be1bf910116595db1b11e9d1b2ca5d59659 tokenlon tokenlon dex coins defi coins exchange tokens coins arbitrum $xwp