Graphic Tracking TokenStore (3): $8.7 million in cryptocurrency inflows

Since the June 10th financial wallet TokenStore has been exposed, in the past month, every chain transfer of running funds has affected the nerves of the majority of victims. Blockchain security company PeckShield has monitored and real-time alerts on TokenStore's running assets "ETH part, USDT part, ETC part, EOS part, XRP part".

In the past week, PeckShield security personnel have discovered that assets on the TokenStore USDT chain are beginning to shift, while the ETH portion is frequently transferred to multiple exchanges, and assets on the EOS and XRP chains have not changed.

USDT

The main distribution of USDT assets after TokenStore runs:

At 19:21, Beijing time on July 08, the PeckShield Digital Asset Escort System (AML) monitored the change of the address on the TokenStore USDT chain. 10,000 USDTs were transferred from the address starting with 3CBmnx to the address starting with 1EJuro, passing through the block. Chain browser, we can see the transaction details:

• The investment in mainstream currency is the most favorable investment method for ordinary investors.
• When Veil, which had been invested by Sequoia and other institutions, was out of service, did DeFi encounter the first Waterloo?
• QKL123 Quotes | After another wave of waterfalls, where is the stage bottom? (0712)

After 8 minutes, this part of the USDT was transferred to the address starting with 1Puais, and then there were 50,000 and 41,005 USDTs starting from the address starting with 3CBmnx and flowing into the address starting with 1Puais through the address starting with 1EJuro. PeckShield security personnel initially determined that the address beginning with 1Puais is the address of the ZB exchange.

From July 08 to July 11, all funds in three addresses were transferred to the ZB exchange address starting with 1Puais and the address of the stock exchange beginning with 1HckjU. The specific capital flow chart is as follows:

PeckShield security personnel followed up and found:

1, the number of USDT is more stored in the P2SH address at the beginning of 3, and the P2SH address is often used for multi-signature;

2. The addresses starting with 3CBmnx and 3GRDtY are transferred using a number of different ZB exchange currency addresses (light yellow in the above figure);

3. The maximum single transfer amount is 120,000 USDT, which was successfully transferred to the ZB exchange;

4. Unlike TokenStore, where multiple addresses are confusing and transferring funds to each other on ETH, USDT is directly transferred to the exchange;

In just four days, multiple addresses of USDT were successfully transferred to the exchange, for a total of 702,933 USDT.

ETH section

According to the analysis of the previous article "Text Tracking TokenStore "Running Road Assets Money Laundering (2)", there are still 27,527 ETHs staying in 27 addresses.

In the past 7 days, PeckShield Digital Asset Escrow (AML) found that running molecules increased the frequency of transferring funds to the exchange, not only emptying the small assets in multiple addresses, but also storing the two ETHs with 0x01b2535 and 0x6aa315. The big address also began to shift after a month of silence.

In less than two days from July 10th to 11th, 7,669 ETHs flowed into the exchange, and a total of 16,782 ETHs flowed into the exchange in the past week. In addition to being transferred to the aforementioned exchanges such as ZB and Coin, the funds were partially transferred to other exchanges such as Coinbene and KuCoin.

Asset summary

Since TokenStore was exposed, as of July 11, in the ETH part of the running assets, there were 27,538 ETHs flowing into the exchange in 38,283 ETH, and the remaining 10,745 ETHs were temporarily stored in 3 addresses;

Most of the USDT part of the running assets have flowed to the two exchanges of ZB and Firecoin.

PeckShield security staff collated the distribution of assets on the TokenStore chain to the exchange, as follows:

As of now, the cryptocurrency of the TokenStore running assets flowing into the exchange has been monitored for a total value of $8.7 million. Regarding the flow of more running assets, PeckShield security personnel will continue to follow up on the monitoring and disclose details in subsequent articles.

TS Run Road Funds Guardian Action: Graphic Tracking Asset Transfer Money Laundering (continuous update)

TS Run Road Funds Defence Action: Graphic Tracking Asset Transfer Money Laundering (2)

We will continue to update Blocking; if you have any questions or suggestions, please contact us!