9 NOVEMBER 2026 / FULL REPORT

Download this report (Word) ↓

Evidence cutoff: 9 November 2026 UTC. Balances are dated observations, not live balances. The 15 November WEAVE token-launch date is the announced schedule recorded in this evidence, not a guarantee that trading will begin then.

The Hens rug and the Zebra connection: full report

Investigation report, publication merge v6.06, updated 9 November 2026. Covers Hens, its HEGG token, and the wallets behind them, on Robinhood Chain, Ethereum, Arbitrum, Avalanche, Base, Polygon, Solana, Fantom, Hyperliquid and HyperEVM.

How to read this report

This is the long version of the Summary. It walks through each finding: what happened, the transactions that show it, why it matters, and how strong it is.

• Times are UTC unless marked ET (US Eastern). Eastern-Australian times are given where the time of day matters.
• Dollar figures use about $2,323 per ETH, the rate the insiders themselves got when they cashed out on 26 October 2026.
• Wallets have plain names that say what they did (“the Hens liquidity wallet”, “Zebra’s funding wallet”). Each name also has a short code (LP1, EAD697) used in the Evidence Workbook and the research data. The full address of every wallet is listed at the end.
• Receipts: a reference like (R11) points to a transaction in the Key transactions list at the end. The Receipts zip holds the raw record of each one, as returned by the blockchain itself, so anyone can check it.
• Strength is stated for each link:
  • Confirmed transaction: the payment itself, read from the chain.
  • Traced funds: the same money followed across several steps or chains.
  • Pattern: timing, habits or shared services. These support a reading but don’t prove it alone.

The other files in this package are: - Summary, the short version to send to someone new. - Evidence Workbook, a spreadsheet of every wallet and transaction, with explorer links. - Wallet map, one picture of how the wallets connect. - Research data for AI, every finding as structured text, for anyone who wants to continue with an AI assistant. - Receipts, the raw transaction records.

1. What happened

The project

Hens was an NFT farming game on Robinhood Chain, built around the Chikn community. Holders of Chikn NFTs (an older Avalanche collection) could claim matching Hens, and new Hens were sold for 0.012–0.024 ETH each. The game’s token was HEGG, traded in a Uniswap v4 pool.

• 17 Sep 2026: the hens.farm website domain was registered.
• 28 Sep 03:25: the developer created and seeded the HEGG pool.
• 28 Sep 07:39: a commit credited to Boxhedlecky published the HEGG Uniswap v4 hook source (section 5).
• 28 Sep 07:53: the first HEGG purchase, 14 minutes later.
• 1 Oct 00:00: Hens claims opened. Over the following weeks 2,751 wallets claimed Hens.
• 7 Oct: HEGG hit its peak price.
• 15 Oct 22:02: the Hens admin deployed the NFT sale contract, with the payee wallet written into its code (R71).
• 16 Oct 00:00: the paid Hens sale opened, at 0.012–0.024 ETH per Hen. Under two hours later, insider-funded wallets minted 100 of them (below).

What buyers were promised

Hens sold its NFTs on more than a farming game. Hens’ own announcement said each Hen would become “her own business bank”: real-world assets and crypto under one roof, liquidity drawn across chains, and tools to launch tokens with custom Uniswap v4 hooks. “HEGG remains central to that direction. Its role grows; its supply will never be diluted.” The project’s X account (@hensdotfarm) kept the mint going with “Two Hens. A free Cornerstone. The foundations of your own bank.” On 23 October, the day before the exit, a Hens admin told the Discord that “anyone mints this round gets a Cornerstone dropped plus that cornerstone is auto upgraded to the final piece.” The accounts that made these promises were deleted after the exit.

The setup

On 3 October the liquidity wallet put 0.835 ETH and 148,858 HEGG into the HEGG pool (R07). That made it a liquidity provider: its money is what other traders buy from and sell into. It had brought that ETH onto Robinhood Chain eight minutes earlier, from money it kept on the Hyperliquid exchange.

On 7 October (the evening of the 6th in ET) the developer deployed a custom contract (the “liquidity operator”) that fed project revenue into this one position, number 3,559,469. The Hens liquidity wallet approved it 26 minutes later (R08). No other liquidity provider could join. Over the next week the operator topped up the Hens liquidity wallet’s position 19 times, using creator fees from the project. The amount was small (about 0.08 ETH and 700 HEGG), but it shows the project and the Hens liquidity wallet working together. Ordinary investors had no such arrangement.

The Hens liquidity wallet and the top HEGG seller also bought cheap HEGG early. The top HEGG seller was the 4th buyer ever (28 Sep) and the Hens liquidity wallet the 22nd (29 Sep), both before Hens claims opened.

The 100-Hen self-purchase

On 15–16 October (01:50–02:09 UTC on the 16th) the Hens liquidity wallet and the top HEGG seller paid 1.225 ETH into a collector wallet. That money funded 34 fresh wallets, which bought 100 Hens from the sale contract in 19 minutes. A courier wallet then gathered all 100, using a helper contract deployed by the Hens creator, and sent them to one final holder. The Hens liquidity wallet also sent that holder 1 ETH. The team was buying its own NFTs: about 1.2 ETH (~$2,800) of the sale revenue was its own money going round.

The exit

All on 24–25 October 2026 (UTC): - 05:42 on 24 Oct: the top HEGG seller sold about 60,000 HEGG in two swaps, 21 seconds apart. - 05:57: the Hens liquidity wallet pulled its whole position: 2.536 ETH and 51,982 HEGG (R13). That is three times the ETH it had put in, because buyers’ money had flowed into its position as the price rose. It was about a third (32%) of the main HEGG pool’s active liquidity at that moment: the pool’s last trade before the pull shows 1.110 × 10²¹ liquidity units, the pull removed 0.360 × 10²¹, and the first trade after shows 0.751 × 10²¹. - 06:29: Zebra began selling its Hens NFTs, 32 minutes later (R14) (section 4, link 8). - 23:37: the Hens liquidity wallet sold its HEGG for 2.33 ETH. The pool price fell 46% in that one swap (R15). - 01:01 on 25 Oct: the developer made its only real HEGG sale (R16). Between 01:07 and 01:10, six project wallets returned about 0.123 ETH to the developer, who bridged it out. - 03:21 on 25 Oct (11:21 PM ET on the 24th): the NFT sale payee bridged 31.88 ETH, everything collected from Hens sales before the exit, to Ethereum in one transfer (R77). Three minutes later the payee sent all of it to a one-time ChangeHero order address, which passed it into ChangeHero’s wallet (R78, R79) (section 6). - 03:45–03:49: Zebra made its last Hens sale (R17), and its second wallet sold 6 more two minutes later (R18). - 05:17 on 25 Oct (1:17 AM ET): a public warning about dumps appeared in the community. By then the insiders had finished. - 26 Oct 00:36–00:37: the Hens liquidity wallet and the top HEGG seller bridged everything to Ethereum within one minute of each other and turned it into 30,298.84 USDC. - 26–27 Oct: the developer (0.644 ETH) and the top HEGG seller (2.678 ETH) deposited to the HitBTC exchange.

The project’s social accounts disappeared around the same time.

How much the team took

• Hens NFT sales: about $74,000. Players bought 2,447 Hens in 1,106 purchases, 32.44 ETH in total. The 31.88 ETH collected before the exit was all bridged out on exit night.
• HEGG dump profit: about $25,000. The Hens liquidity wallet and the top HEGG seller put about 2.65 ETH (~$6,150) into HEGG and took out 13.43 ETH (~$31,200):
  • The Hens liquidity wallet: 1.24 ETH in, 5.13 ETH out, +3.90 ETH (~$9,050).
  • The top HEGG seller: 1.41 ETH in, 8.30 ETH out, +6.89 ETH (~$16,010).
  • Together +10.79 ETH, about five times their money. After subtracting the 1.2 ETH they spent on the 100 Hens, +9.56 ETH (~$22,200).
• Total: about $96,000 (about 41 ETH), counting the self-purchase once.

These HEGG figures come from complete transfer logs read directly from the chain. They include both routes the sells went through (the main pool and a second pool route). Gas is under 0.01 ETH per wallet and is left out.

How big the insiders’ part in the crash was

• From 23 October until the public warning, the Hens liquidity wallet and the top HEGG seller made 80.41% of all HEGG selling across the six HEGG pools. That is 80% of the HEGG sold, not 80% of the supply. Their sales added up to under 2% of HEGG’s supply.
• In the main HEGG/ETH pool over the same window, sellers took out 7.34 ETH, and the two wallets took 5.21 ETH of it (71%). The Hens liquidity wallet’s 2.54 ETH pool withdrawal comes on top.
• HEGG’s price halved over those two days. The November 4 quote was approximately 97% below its October 24 pre-dump price (about 0.000071 to 0.0000021 ETH). By the November 8 snapshot, it had fallen further, to approximately 0.000001867 ETH per HEGG, a 97.37% decline from the pre-dump quote. This is distinct from its roughly 99% decline from the earlier October 7 peak.

2. The team wallets

These are the wallets that ran the project and the dump. Codes are in brackets.

• The developer, “HenBok” (Hens deployer). Deployed the Hens and HEGG contracts. Its OpenSea profile, created October 2026, uses the name “HenBok”. Its very first money was a ChangeHero payout: 0.3653 ETH from ChangeHero’s main wallet 0x016606acc6b0cfe537acc221e3bf1bb44b4049ee on 26 September 2026 at 11:56 UTC (tx), bridged onto Robinhood Chain 7 minutes later. The rest came from Binance-labelled exchange wallets: 0.0413 ETH on 28 September (tx) and 0.98665 ETH on 9 October (tx), each bridged within 15 minutes. The next day, 27 September, the deployer gave the Hens admin its first money (0.005 ETH, tx). So ChangeHero sits at both ends of the operation: it paid out the money that started the team’s wallets, and a month later it took in the NFT money. It cashed out to HitBTC.
• The admin (Hens admin). Ran the project contracts day to day. The developer funded it, and so did Zebra (link 1).
• The NFT sale payee. Collected the Hens sale money and moved the 31.88 ETH out on exit night.
• The Hens liquidity wallet (LP1). Owned the HEGG liquidity position the developer topped up, pulled it, and dumped.
• The top HEGG seller (b3cab). Sold the most HEGG. Funded by the Hens liquidity wallet (0.5 ETH), Zebra’s funding wallet (1 ETH) and the team capital wallet (1 ETH).
• Zebra’s funding wallet (EAD697). Bankrolled the Hens liquidity wallet and the top HEGG seller (link 2). Its first-ever money came from Zebra.
• Supporting wallets: the creator-fee wallet and its revenue vault, the liquidity operator contract, the 100-Hen collector, distributor, courier and final holder, a team capital wallet (E060) that traded ETH back and forth with the Hens liquidity wallet before Hens, and a trading-vault wallet (Cable Alpha) that received $10,008 from the Hens liquidity wallet in May 2026 (R41).

The Hens liquidity wallet, the top HEGG seller, the funding wallet and E060 were moving money between each other months before Hens launched, so this is a standing group, not strangers who met at launch.

3. How the Zebra wallet came into the investigation

Wallet 0x41316a07012aaeaca79b12df40dbf2f3e0f9bda2 was found by following the Hens evidence, not suspected beforehand. It kept turning up next to the team: it paid the admin, it gave the funding wallet its first money, and it sold Hens on exit day.

The wallet itself then showed who it presents as: - It holds the Avalanche name icestationzebra.avax. Its predecessor wallet (Old Zebra) registered the name on 1 Jan 2023 (R21). A .avax name works like a username for a wallet: Avalanche’s naming service lets a wallet owner register a readable name that points to their wallet address, the way a web address points to a website. The name then passed down through the group’s wallets and reached Zebra on 18 Nov 2023 (R22). The wallet named itself “Ice Station Zebra” on-chain, which is much stronger than a social post. - It holds the legendary cube-head Chikn #86 “Jeff”, which the Ice Station Zebra persona showed off on social media in 2023. Old Zebra bought Jeff in November 2021. In July 2023 a migration wallet moved 115 NFTs, Jeff among them, into this wallet in one transaction. - It plays the Chikn rooster-fighting game (CoqFight) as “Station of Iced Zebras”. - The persona talked about one of Old Zebra’s sales. In the Chikn Discord, Ice Station Zebra said a Chikn had been sold by accident. The marketplace sales bot shows that sale: Chikn #6391 for 1.50 AVAX on 12 March 2023 at 9:47 PM ET. On-chain, the seller was Old Zebra, at 01:47:04 UTC on 13 March, the same exact minute (R55). That was the night Old Zebra started moving its collection to the migration wallet, which is when a forgotten listing could fill by accident. The persona speaking about a sale only that wallet made ties the persona to the wallet lineage in its own words.

The persona is an alt. On 13 April 2024 the X account “Zebra Station” (@stationofzebra, avatar: the cube-head Chikn) posted: “Logging out of Zebra Station for good. I’ll see many of you on my main.” The main account is not identified here.

The rest of this report calls this wallet Zebra, and the wallets that move money with it Zebra’s group.

4. The nine links between Zebra and the Hens team

Link 1. Zebra paid the admin’s gas before its main setup session

In short: Zebra paid the Hens admin wallet’s fees 13 minutes before the admin’s main session setting up the Hens launch.

What happened. On 15 October 2026 at 22:37, Zebra bridged money onto its own Robinhood Chain address. One minute later, at 22:38:29, it sent the Hens admin 0.01 ETH (R11). That was Zebra’s only plain payment ever on Robinhood Chain. Earlier that evening, at 22:02, the admin had deployed the NFT sale contract and, seconds later, upgraded the claim contract. At 22:51, 13 minutes after Zebra’s payment, it started a 122-transaction work session (R12): a batch operation across about 3,074 holder wallets, then setting up the sale contract. The public sale opened at midnight, and the 100-Hen self-purchase came less than two hours after that.

Why it matters. Someone who merely knows a team doesn’t top up its admin wallet minutes before a launch session. It fits one person working two wallets, or someone sending on request in real time.

Strength: confirmed transaction, plus timing.

Link 2. Zebra gave the first money to the wallet that bankrolled the dump

In short: Zebra gave a brand-new wallet its first money. Minutes later $77k arrived in it from Binance and Bybit. That wallet later paid the Hens liquidity wallet and the top HEGG seller, the two wallets that dumped HEGG, so this $77k is the money behind the dump. Keep the names Binance and Bybit in mind: Zebra’s group had deposited about $81k into those same two exchanges a few months earlier (link 3).

What happened. - 30 Oct 2025 00:11: Zebra sent 0.7 ETH to a brand-new wallet (R01). Before that payment the wallet had never made a transaction and held nothing. This is Zebra’s funding wallet. - 00:23 and 00:29, 12 and 18 minutes later: 56,974.54 USDT from Binance (R02) and 20,176.52 USDT from Bybit (R03) arrived in it. That is $77,151 of exchange money. - The same night, scammers sent “look-alike” spam from addresses imitating Zebra’s to the new wallet. They do this to wallets that have just received money from a real counterparty, which confirms Zebra was visible as a sender. - Feb–Apr 2026: the funding wallet swapped the USDT to ETH, put 16 ETH into the HYPE token (R42), and on 12 April sent the Hens liquidity wallet 30,108.63 USDC (29,912.92 after fees) (R05, R06). An earlier 529.75 USDC went the same way on 12 March, the seed for the Hens liquidity wallet’s “Cable” vault (R04; link 9). It also gave the top HEGG seller 1 ETH. - The Hens liquidity wallet kept that money on Hyperliquid and brought it onto Robinhood Chain when it needed it: 14,904 USDC in August (which became 4.21 ETH) and 5,001 USDC on 3 October, which became 1.83 ETH. Eight minutes later it put 0.835 ETH of that, with 148,858 HEGG, into the new HEGG position.

So the chain runs: Zebra seeds the wallet → $77k of exchange money lands in it → it funds the Hens liquidity wallet and the top HEGG seller → they build their HEGG positions → they pull out and dump.

Why it matters. Sending a little ETH to a fresh wallet to cover fees, then withdrawing your exchange balances into it, is a recognisable sequence. The natural reading is one person doing both. The alternative is that Zebra set up the wallet for someone else, which still puts Zebra at the start of the operation’s money.

Zebra stayed hands-on. On 11 October 2026 the funding wallet was in the middle of a three-minute run of small trades: - 21:44:23, 21:44:47, 21:45:35: three swaps of USDC into ETH. - 21:46:35: Zebra sent it 0.0454 ETH, its entire ETH balance (R09). - 21:47:23, 48 seconds later: the funding wallet deposited 0.3823 ETH (R10).

Reading the funding wallet’s balance at each block shows it was 0.027 ETH short of that deposit until Zebra’s payment arrived. Zebra emptied its own wallet to cover the gap in real time.

Strength: confirmed transactions, and real-time coordination. Zebra’s own money here is the seed and the top-up; the bulk is exchange money. Whose exchange accounts made the $77k withdrawals is the key open question (section 9).

Still moving together, two weeks after the rug (8 November 2026). At 10:26 pm Sydney time, Zebra’s main wallet sent 1.25 HYPE on HyperEVM, Hyperliquid’s EVM network, to a brand-new wallet, 0xa7a7ffc86cf7df84c7ddf63078427cbeb712a56e (tx). A minute later it sent the 17.71 HYPE it had just bridged from Robinhood Chain to the same wallet (tx). At 10:32 pm Zebra’s funding wallet, which had just moved its leftover Ethereum and Arbitrum balances onto HyperEVM, sent 0.75 HYPE to the same new wallet (tx). A previously unknown wallet funded from Solana, 0x591b9478cf3164f85084bdfc9a2bf44965c3c1ee, paid in between them. At 10:37 pm the new wallet moved the combined 20.87 HYPE to Elysium, a newly opened network, and spent it on a newly launched token.

The amounts are small (about US$1,600). But two wallets paying the same brand-new wallet minutes apart, during Zebra’s usual evening hours, is strong evidence that one person controls both. It also shows Zebra still running the funding wallet two weeks after the rug. Strength: strong.

Link 3. Zebra’s group wallet 028044, and Binance and Bybit again

In short: Zebra’s group put $81k into Binance and Bybit in spring 2025, the same two exchanges that later sent the $77k into Zebra’s funding wallet (link 2). If the exchanges confirm it is the same customer, the bulk of the money behind the dump was Zebra’s group’s own.

What happened. Wallet 028044 is part of Zebra’s group (section 5). Zebra and group wallet 58d2 both paid it on Avalanche, and group wallet 119cd7 gave it its first money. - Jan 2025: about $90,000 reached 028044 from Zebra’s Solana wallet, through three Chainflip swaps (#255529, #255535 and #262761) and one Allbridge transfer (R35–R38). Chainflip records the destination address the sender chose for each swap, and all three name 028044. 028044 deposited the money to Hyperliquid within minutes. - Mar–Apr 2025: 028044 withdrew it and deposited 61,925.46 USDC to Binance (10 Mar) (R39) and 19,201.33 USDC to Bybit (20 Apr) (R40). Each went to a one-time deposit address that swept straight into a labelled exchange wallet (“Binance 54” and “Bybit: Hot Wallet”). - 1 Jun 2026: 028044 paid the Hens liquidity wallet 51.93 USDC (R20).

Why it matters. The $90k did not fund the Hens team, and 028044’s only payment to the Hens liquidity wallet is small. What makes it important is the exchanges: Zebra’s group put about $81k into Binance and Bybit in spring 2025, and six months later $77k came out of Binance and Bybit into the wallet Zebra had just created. Two big exchanges on their own prove little. But this gives one precise question for each exchange: is the customer who received 028044’s deposits the same customer who withdrew into Zebra’s funding wallet? If yes, the $77k was Zebra’s group’s own money too. Zebra’s money is in the operation either way: Zebra seeded the funding wallet and topped it up in real time (link 2), paid the admin’s fees (link 1), and its Cable project ties it straight to the Hens liquidity wallet (link 9). A match would add the biggest piece.

Strength: traced funds for 028044 being part of Zebra’s group. The payment to the Hens liquidity wallet is a confirmed transaction but small.

Link 4. One Kraken account at the centre of Zebra’s group

In short: One Kraken account collects money from Zebra and three of its group wallets. Two months later, Kraken withdrawals gave three fresh group wallets their first money; the timing points to the same account, which only Kraken can confirm. Those wallets pooled $207k into Zebra’s Solana wallet, and one of them created 028044 (link 3). It shows Zebra’s group is one operation, with one account to ask Kraken about.

What happened. An exchange deposit address is credited to a customer’s account, so wallets paying the same address in the same period are paying into the same account. Kraken deposit address 0x15cc06d6a3f3d4a58fecd729787435fa87917e3b was paid by: - Zebra: 115 AVAX (4 Jul 2024). - ac481: 2,162.03 AVAX (7 Jul 2024). - 5cb2: 0.127 ETH (8 Jul 2024) (R28), at the end of a sweep of eight farm wallets. - the group’s hub: 10.7 billion PEPE (5 Aug 2024).

No one outside Zebra’s group ever paid it. Kraken withdrawals then gave three fresh group wallets their first money within three days: the Fantom bridger (144,394 FTM, 23 Sep 2024), 119cd7 (1.37 ETH and 5.35 billion PEPE, 25 Sep 01:09) (R29), and the sweep wallet (1,099.95 AVAX, 25 Sep 01:16) (R30). For each it was their very first money.

On 19 January 2025 all three sent money into Zebra’s Solana wallet: the sweep wallet 1,022 AVAX (worth $40,235) (R32), the Fantom bridger $104,506 (R33) and 119cd7 $62,887 (R34). That is about $207,000 pooled in one day. 119cd7 had also created 028044.

Why it matters. It shows the group is run as one, with one Kraken account as its consolidation point. That account is the single most useful item for a records request.

Strength: confirmed deposits into one account, plus traced funds out. That the payouts came from the same Kraken account is the leading reading from the timing, the amounts and the first-funding pattern; only Kraken can confirm it.

Link 5. The same small exchange: HitBTC

In short: Zebra’s group and the Hens team wallets both use HitBTC, a small exchange that almost no other Hens holders used.

What happened. Zebra’s group made 132 deposits to HitBTC on Avalanche from 2023 onward (Zebra 37, group wallet 6bff88 65, and the rest spread across the group). On the team side, the funding wallet (9 Oct 2026), the developer (26 Oct) and the top HEGG seller (27 Oct) all deposited to HitBTC on Ethereum.

Why it matters. HitBTC is small: about 0.1% of global exchange volume. Among about 500 Hens holders active on Ethereum, the only recent HitBTC users were the team wallets. Both sides favour the same uncommon exchange.

Strength: moderate. No shared deposit address was found, so it isn’t proof of one account. HitBTC also reuses deposit addresses between customers over time (each earlier depositor on the team’s addresses used them once, months or years apart), so only HitBTC’s records can say who held each address on the team’s deposit dates.

Link 6. The same wallet software

In short: Zebra, the Hens developer and the Hens liquidity wallet all use the same uncommon wallet setup.

What happened. Zebra, the developer and the Hens liquidity wallet all upgraded to the same smart-account software (EIP-7702 delegation to 0x63c0c19a282a1b52b07dd5a65b58948a07dae32b). Zebra upgraded on 18 Oct inside a Hens sale (R19); the developer on 25 Oct inside its final HEGG sale (R16). Only 50 of 4,045 Hens and HEGG addresses (about 1 in 80) use it.

Why it matters. It is probably a mainstream wallet app’s feature, so it shows the same app and the same choice, not the same person. Three key wallets sharing a 1-in-80 setting is still notable.

Strength: supporting.

Link 7. The same daily schedule, in south-eastern Australia

In short: Zebra’s wallets and every hand-run Hens team wallet go quiet at the same hours, which are night-time in south-eastern Australia, and Zebra has referred to Australia as their home.

What happened. - Zebra’s wallets go quiet every night from about 14:00 to 20:00 UTC, weekends included. That is midnight to 6 am in eastern Australia. The pattern holds across 582 activity sessions from 2023 to 2026, and across Old Zebra’s 1,454 sessions from 2021 to 2023. - Every hand-operated team wallet keeps the same gap: the developer, the Hens liquidity wallet, the top HEGG seller, the funding wallet and the admin. The only team wallets with different hours are scripts (an automated fee wallet and a trading bot), which run around the clock. - The gap is rare. Among the 76 most active other Hens players, only 3 never act in that window. Most players are busy then, as you’d expect from the Americas and Europe. Zebra, the developer, the Hens liquidity wallet and the top HEGG seller all show 0% across 26–47 sessions each. The three other players with the gap were checked: none are connected to either side. - The code accounts’ clocks match. The Boxhedlecky commit (28 Sep) carries +10:00 and the zvg26dphvw-sys commits (9 Oct) carry +11:00. Each matches southeastern Australia on its date: AEST before the 4 October daylight-saving change and AEDT after it. Brisbane would read +10 on both dates. These are two accounts, and each committed on only one side of the change, so this shows a matching region, not one clock switching. Time zones come from the committing computer and can be set deliberately. - Zebra’s schedule follows southeastern Australia’s clock changes. For each daylight-saving change with enough activity on both sides, we compared when the wallet became active after its overnight gap (in UTC), over the 10 weeks before and after. Old Zebra moved +1.7 h at the April 2022 change and −1.4 h at the October 2022 change; Zebra’s main wallet moved +2.1 h at the April 2024 change. Southeastern Australian time (Sydney, Melbourne, Canberra, Hobart) predicts +1 h in April and −1 h in October. US and European clock changes happen in March and November, in the opposite direction, and Brisbane has none. The shifts are noisy, so this supports the southeastern Australia finding rather than proving it. - The hens.farm domain was registered at 4:40 pm Sydney time. - Community members described the Hens developer as Australian, citing Australian slang. - Zebra refers to Australia as home. On 14 March 2022, replying in the Chikn Discord to a question about Australia, Zebra’s account (ISZ) wrote: “Much of the centre of the country is desert, our immense coastlines are forested paradise tho.” - Both of Zebra’s Discord usernames echo Australian songs. The earlier one, kaankaant, matches “Kaan Kaant”, a song by the Sydney punk band Frenzal Rhomb. The current one, choogiewoogie, echoes “Choogie Woogie Boogie”, listed as a song from the Australian children’s cartoon The Eggs (see link 9).

The commit’s unsigned author metadata does not establish who wrote or pushed it, who controlled the account, or involvement in the later exit. Possible explanations include a shared developer, reused author settings, copied history or deliberately assigned attribution. None is established or ruled out by this clue alone; a shared developer would not by itself prove involvement in the exit.

Why it matters. It is independent of the money. It fits one person, or a small team in the same region. It does not fit unrelated people in different parts of the world.

Strength: supporting. Time-zone settings can be changed by hand, but the activity pattern over years is much harder to fake.

Link 8. Zebra dumped its Hens right after the insiders pulled out

In short: Zebra began selling its Hens 32 minutes after the insiders pulled out, and sold them all before the public warning.

What happened. The Hens liquidity wallet pulled its money at 05:57 UTC on 24 October (R13). Zebra’s first Hens sale came 32 minutes later, at 06:29 (R14). Zebra sold all 34 of its remaining Hens before the public warning, finishing at 03:45 on the 25th (R17). Two minutes after that, Zebra’s second wallet (the Collector) sold its 6 Hens to the same buyer (R18).

From the liquidity pull to the public warning, holders made 79 Hens transfers out. Zebra’s side made 40 of them. The next-largest seller made 4. The rest of the market was quiet: 21 wallets sent Hens on 24 October, against 96 the day before.

Why it matters. The amount was small (Zebra’s 39 Hens sales over October netted about 0.37 ETH, ~$860). The timing is the point: Zebra moved with the insiders, not with the public.

Strength: strong (timing and share of selling). The caveat is that the liquidity pull was visible on-chain, so a watchful trader could have reacted. No other holder did on this scale.

Link 9. “ISZ” says they built Cable, and Cable’s own website names the Hens liquidity wallet as a bot operator

In short: Zebra’s Discord account says Zebra built Cable, an on-chain crypto trading-bot platform. Cable’s own website code names the Hens liquidity wallet as one of its bot operators, and Zebra’s funding wallet paid for those bot accounts. This ties Zebra directly to the Hens liquidity wallet.

What happened. - 14 February 2026, 9:31 PM ET (15 Feb 02:31 UTC, 1:31 pm in Sydney): in the Chikn community’s Discord, in the channel for promoting projects, Zebra’s own Discord account, “ISZ”, posted: “A lot of you would know me from the early days of Chikn so I wanted to share something I built. See if anyone has any feedback. It’s a cross chain bridge…” It describes features (“I am also currently working on…”, “I will be adding further tokens very shortly – might start with EGG as a salute to Chikn”) and links cable.ninja (“Cable | Cross-Chain DEX Aggregator”). Cable is a crypto platform: it swaps tokens between blockchains, and it runs copy-trading bots, each a public on-chain vault on the Hyperliquid exchange that anyone can deposit into. - The account’s username is choogiewoogie (earlier kaankaant). It was created in January 2018 and joined the Chikn server in November 2024. “Kaan Kaant” is not a made-up word: it is the title of a song by Frenzal Rhomb, a Sydney punk band, another Australian touch on Zebra’s account (see link 7). - ISZ is Zebra’s account. In the Chikn community it goes by Ice Station Zebra (“ISZ”) and talks about Jeff and the other NFTs held in the Zebra wallet. The post’s early-days Chikn claim matches the wallet history (Old Zebra bought Jeff in 2021). - Cable’s X account (@_cableninja) was also created in February 2026. - 12 March 2026, 09:50:47–09:52:11 UTC: Zebra’s funding wallet sent 0.26 ETH to each of four wallets within 84 seconds (R43–R45, R04). Each arrived as about 530 USDC (R46–R48). One of the four was the Hens liquidity wallet. - 10:04–10:19 UTC, 15 minutes later: each of the four created a Hyperliquid trading vault: Cable Alpha (“The flagship Cable bot”), Cable Beserker, Cable Maverick and Cable Warlord. In Sydney that was 9:04–9:19 pm. - The Cable website itself lists these vaults. cable.ninja advertises six “live trading bots” (Raptor, Berserker, Maverick, Warlord, Captain Sensible, The Sniper) under “deposit USDC into any vault, copy the bot automatically”. The site’s own code lists each bot’s Hyperliquid vault and the wallet that runs it: - Raptor: the Cable Alpha vault, run by 0x7eebbc1857496dcdb606a21d7b4118a0ebacb527. - Berserker: the Cable Beserker vault, run by the Hens liquidity wallet 0x8d2c8b60c12e2df344d0a33319509ae1a72d3d69. - Maverick and Warlord: run by the other two wallets the funding wallet paid on 12 March. - Captain Sensible and The Sniper: two more accounts, funded on 22 March. - 17 May 2026, 10:49–10:51 UTC: four of the bot accounts (Captain Sensible, The Sniper, Maverick and Warlord) withdrew everything and sent it to the Raptor/Alpha wallet within two minutes (R56–R59). Twelve minutes later that wallet deposited the exact total, 1,173.52 USDC, back into Hyperliquid (R60). One person was running the whole bot fleet.

Why it matters. This is Zebra speaking in their own words. Zebra says they built Cable. Cable’s own website says the Hens liquidity wallet, the wallet that later dumped HEGG, runs one of its bots. And Zebra’s funding wallet paid for the bot accounts. Zebra is therefore tied directly to the Hens liquidity wallet through its own project’s published code, not only by money trails.

Strength: confirmed transactions, the website’s own published code, and Zebra’s own Discord account.

Zebra’s second wallet

The Collector, 0xec0b24b6c04501ddee4992c091d3e9efbcbe13d7, behaves like Zebra’s own second wallet: - On Avalanche, Zebra and 028044 fed it within 18 minutes of each other on 30 November 2025. - On Robinhood Chain, each of its sessions began 38 seconds to 2 minutes after a Zebra session ended, repeating the same contract calls at the same pace. The two never overlap. - It sold on exit night right after Zebra, to the same buyer.

Updated receipt detail for the already documented November 8 HyperEVM pooling event: Weave main wallet 0x591b9478cf3164f85084bdfc9a2bf44965c3c1ee sent 1.169771836246209695 HYPE at 11:31:06 UTC to 0xa7a7ffc86cf7df84c7ddf63078427cbeb712a56e (tx 0x6e92a2963d1b7dcbc093ca1b08319e7a74c9238112b81cc1b9d9f4f3991872a8). The 19-address Weave-family screen did not find a direct or one-intermediary ETH/USDC/USDT deposit into the Ethereum collection wallet of the likely Living Room of Satoshi service in the checked histories. No broad negative conclusion or cash-out attribution follows from this screen.

After the rug: Weave, and a new token due on 15 November 2026

In short: One of the wallets that paid the same new wallet as Zebra’s main wallet and Zebra’s funding wallet on 8 November funded another wallet, and that wallet created the launch contract for a new token, WEAVE. WEAVE is due to start trading on Robinhood Chain on 15 November 2026 at 00:00 UTC (11 am Sydney). The project’s website was registered five days before the Hens rug, its white paper was saved on an eastern-Australian clock, its builders keep Zebra’s hours, and the wallet behind it uses the same smart-account setting as Zebra and the Hens team.

The wallet chain: - 8 November: Zebra’s main wallet (10:26–10:27 pm Sydney), 0x591b9478cf3164f85084bdfc9a2bf44965c3c1ee and Zebra’s funding wallet (10:32 pm) all paid the same brand-new wallet, which moved everything on five minutes later (see Link 2). - 27 October 2026, three days after the rug: 0x591b… received its first money, a payout from a Binance wallet that matches the top HEGG seller’s HitBTC deposit six minutes earlier (see below). Twenty-two minutes later it funded 0x4e075f7c5fbf6feb45930a380c5e546f3a31ac08 (tx), which over the next two days deployed Weave’s contracts: 14 on Ethereum, 11 on Base, 6 on Arbitrum and 10 on Robinhood Chain. - 3 November, 10:55 am Sydney: 0x591b… sent 0.099 ETH on Robinhood Chain to a fresh wallet, 0x39fb186631d39684754345a93b9f5dac65dedde9 (tx). - Seven minutes later (11:02 am): that wallet’s first-ever contract was the WEAVE launch contract, 0xB0351ac6FBB85415fC444E858f59728526296a74. In the same transaction it created the WEAVE token, 0x4af85f314Cf3925956F75aB0d4567e35a5362Af6, minted all 100 million tokens, put 29 million into two reserve lockers and kept 71 million for the launch (tx) (R86). Weave’s website links both contracts as its own.

The project. weavefi.xyz presents Weave as a way to “build, hold and trade” baskets of crypto, tokenized stocks and gold across Arbitrum, Arc, Base, Robinhood Chain and Solana, with an X account (@WeaveFi_xyz), a Telegram group and a white paper. Its token page sets the WEAVE launch for 15 November 2026 (WEAVE/ETH pair, 0% tax) and the protocol launch for 31 December. 20% of the supply (20 million WEAVE) is a “founding allocation” for four founder wallets written into the launch contract. Those wallets, the contract’s administrator and its liquidity recipient have never been used, so they will show where the founders’ tokens go after launch. The same family also created a “Weave (WEAVE)” token on Solana (1 November) whose description points to weavefi.xyz, from a developer wallet funded by the Solana developer wallet 91d4fvuaRzGzoRYuqV5sxbkcAvmxU1hjeUvkUwyXHq8K.

Why we think it is the same people: - The money. Each step above is a direct on-chain payment or contract creation, starting from a wallet that paid the same new wallet as Zebra’s two wallets on 8 November. - The same wallet setting. 0x591b… uses the same smart-account implementation as Zebra’s main wallet, Zebra’s funding wallet, the Hens liquidity wallet and the deployer (Link 6), switched on in a relayed transaction on 2 November (tx). Only about 1 in 80 Hens addresses use it. - The same clock. The white paper PDF was created on 17 October 2026 at 11:23 am at UTC+11, eastern Australia’s daylight-saving time. The 41 contract deployments ran between 9:44 am and 12:10 am Sydney time, and none fell between 1 and 7 am, the hours Zebra’s wallets are always quiet (Link 7). In those hours it is mid-afternoon in Europe and the working day in the US, so the pattern fits eastern Australia. - Hens wallets and Weave worked at the same time. On 28 October at 9:43:16 am Sydney time, Zebra’s funding wallet placed a market buy on Hyperliquid; 55 seconds later the Weave deployer put a contract live on Base, and 12 seconds after that another on Ethereum. On 27 October the funding wallet’s 4:50 pm buy was followed by a Weave deployment at 4:55 pm. On 2 November, 0x591b…’s smart account was switched on between two payments by the suspected cash-out wallet (11:03 and 11:33 am). On 17 October the white paper was saved 19 minutes after a Hens liquidity wallet swap and 16 minutes after a Zebra session. - The team’s own cash-outs likely fed it. The Hens team three times paid ETH into HitBTC, and each time a new wallet received almost the same amount from a large exchange minutes later, the way an instant-swap service pays out. Both new wallets ended up in the same family: - Deployer, 26 October: 0.644213 ETH into HitBTC at 3:26:47 pm (tx) (R82); seven minutes later 0.63305 ETH to the new wallet 0xe25b6f59c566dbcf722321a35bb5fd9f40317be3 (tx) (R83). On 8 November that wallet sent its money to 0x1eb693a9957528807558f54ea2cd297b04ec8782 (tx), a wallet 0x591b… also funds. - NFT sale payee, 26 October: its last 0.547018 ETH into HitBTC at 3:29:11 pm (R80), three minutes after the deployer; seven minutes later a large exchange paid 0.53725 ETH to the same 0xe25b6f59c566dbcf722321a35bb5fd9f40317be3 (tx) (R87), 2.5 minutes after it received the suspected deployer-linked payout. Those two payouts are the only money 0xe25b… has received on Ethereum. - Top HEGG seller, 27 October: 2.67826 ETH into HitBTC at 1:29:47 pm (tx) (R84); six minutes later Binance paid 2.63875 ETH to the new 0x591b… (tx) (R85), its first money ever. - The later payout audit found additional amount candidates. These are plausible timing-and-amount matches, not unique proven swap orders; exchange records are needed to confirm them. - The same set-up as Hens. weavefi.xyz was registered at GoDaddy on 19 October 2026, 10:27 pm Sydney, five days before the rug. It uses GoDaddy’s name servers, Vercel hosting, and Microsoft 365 email bought through GoDaddy, the same email set-up as hens.farm. This set-up is common, so it only supports the rest. - The same way of building websites. Both weavefi.xyz and hens.farm are hand-built static sites (no app framework) that tag each file with a dated version label, such as ?v=mobile-20261016-2 on hens.farm and ?v=20261106-mobile-1 on weavefi.xyz. Supporting only.

What we checked and ruled out. A June 2026 hackathon project is also called “Weave”. Its code, compiler and design are different, and nothing connects it to this case. Weave’s contracts also share no code with the Hens contracts or Cable’s website, so the link rests on the wallets, the clock and the set-up, not on shared code.

Why it matters. If this is right, the people behind the Hens rug are launching a new token on the same network three weeks after it, with a fifth of the supply set aside for themselves. It also gives investigators new records to request (see Next steps).

Strength: strong. Every step is a confirmed transaction or contract creation, and 0x591b… is tied to Zebra and the team four ways: the 8 November payments, the same smart-account setting, the same clock, and Hens wallets and Weave wallets acting within seconds to minutes of each other. Its first money, and all the money in a second family wallet, very likely came from three of the Hens team’s own HitBTC cash-outs (the deployer, the NFT sale payee and the top HEGG seller) through instant swaps. The one thing these cannot show is whether 0x591b… is Zebra’s own wallet or a close partner’s, the same limit as Zebra’s second wallet above.

5. Zebra’s group and the “Boxhed” name

One group, run together

Zebra is not one wallet but a group of wallets run together. The clearest signs: - Shared Kraken account (link 4). - Sweeps: on 18 January 2025, nine wallets paid one sweep wallet within four minutes, using the same odd amounts (ending .x001 and .x501). Every one of the nine is financially tied to Zebra, and 028044 was one of them. Standard on-chain analysis treats a sweep like this as one controller. - Shared first funders: for example, Zebra and 028044 fed the Collector within minutes; group wallet fc5061 gave 58d2 its first money. - Layering: on 5 January 2024 the group’s hub sent 101 AVAX through three near-empty relay wallets in 13 minutes to fc5061. Zebra had paid one of those relay wallets earlier.

The group launches its own projects, under the name “Boxhed”

• June–July 2023, Ethereum: a group farm wallet deployed a “BoxHeds” NFT collection through HeyMint (R26). Its description: “Welcome to BoxHed country, a land of whimsy and intrigue…” A sibling farm wallet launched a “Hotdog Eating Races” (DOGG) token the same month (R27).
• December 2023, Avalanche: a token called Big Dog (BDOG) (0x9d2e0cb07d60ce2fcc3d1c3cc1b8785662ddbf93), launched by group wallet 87476e (R61–R64), the wallet that later bought Boxheds at launch.
• 5 January 2024, Avalanche: group wallet fc5061 registered boxheds.avax, nine minutes after the relay money arrived, and still holds it (R23).
• 20–23 February 2024, Avalanche: a “Boxheds” ERC-404 token. Group wallet b5711d deployed the first contract on 20 February (R24). Zebra had sent b5711d 370.8 million COQ tokens. Builder wallets funded by group wallet ac481 then made the later versions, ending with the final contract on 22 February (R25). Group wallet 58d2 added the liquidity, and b5711d and 87476e bought. Discord user “Darius” and X account “Chief Box” announced it, speaking for the project. On 21 February 2024 at 11:31 UTC, Darius posted in the Chikn Discord: “Boxheds is about to add liquidity to its ERC404 contract. Find us on Twitter at boxhedsnft or at boxheds dot life. We think we’ve got unique art come find out for yourself.” On-chain, Zebra-group wallet 58d2 received 5 AVAX at 11:52 and approved a Boxheds contract (0xa49a1b893e774150661aea82ffd750bc922936ac, the second version, deployed by builder wallet BoxDev2 at 09:02 UTC that morning, tx) at 12:35, an hour after the post. It then added and moved the Boxheds liquidity over the next day and a half. Darius was announcing what Zebra’s group wallet was about to do. Darius only ever made a couple of posts, both promoting Boxheds, so it was most likely a single-purpose account: a Zebra alt, or someone on Zebra’s team.
• April 2024, Base: a token called Brojak, deployed five times and never traded. The hub-farm wallet b46dd4 (0xb46dd434b0fe37617a63ba9190e8af85f3e7cac6) deployed it twice on 9 April (R65, R66). On 26 April it sent 2.8 ETH to a fresh wallet (0x12f9d16e0b201473c0b84575ca15eec6f8d719ba), which deployed it a third time four minutes later (R67) and passed the ETH to a second wallet (0x9a5e5adeb8491df5462b8f707b7892154550b642). That wallet deployed it a fourth time (R69), then sent the 2.8 ETH straight back to 028044, the group wallet that later paid the Hens liquidity wallet (R70). 028044 deployed a fifth copy the same day (R68). Every copy still holds its full supply in the wallet that made it.
• November 2024, Base: a “Burgs” (BURG) token (0x9c02368d2534a3cf0c04d292e42c6d439098f8ea), deployed by a wallet funded by a group farm wallet. Zebra’s Solana wallet topped it up, and its last payment went to 028044.
• August 2026, Robinhood Chain: GLIZZY (0x7f306bd45694b2944ceae5f1f166a61c2a5b2d13). Zebra’s funding wallet sent money through two hop wallets (0x00891c39e1f4613280414ab3da7c9b057834de6f, 0xc35f623cdd6fc0b6843f7a3dc2b567b788f64ac1) to the GLIZZY launcher (0xa6d6bda6c122158356d1464d7503c2fa0fbf178b), about 0.434 ETH in all. GLIZZY went live about ten minutes later, one month before Hens, on the same chain.
• August 2026, Robinhood Chain: BILL (0x345e8e9be5c9c2e699aebbf15a04914871e3cb4b, 14 August) and CAMBODIA (0xbad432a49513cb7fefa23e0a3747ea4ea69cf8f7, 31 August), launched by the team capital wallet E060 (0xe060683a5d6b4cbf84a7f63725ac33b68990048c) (R72, R73). E060 traded funds back and forth with the Hens liquidity wallet and funded the top HEGG seller. A GLIZZY bot wallet also paid E060 0.2269 ETH on 30 August (R81).

These were mostly small projects (outside buyers put about 3 AVAX into Boxheds). They show the group builds and launches its own tokens and NFTs, always from fresh wallets, from 2023 right up to the weeks before Hens. Hens was not its first launch. The food names run through them too: Hotdog Eating Races (2023), Burgs (2024) and GLIZZY, slang for a hot dog (2026).

A second set of hands on Boxheds

The Boxheds launch had two phases, and they ran on different clocks.

• The first launch was on Zebra’s side. The GitHub account Boxhedlecky was created at 03:30 UTC on 20 February 2024 (2:30 pm in Sydney). At 11:00 UTC that evening (10 pm in Sydney), group wallet b5711d, which Zebra had sent 370.8 million COQ, deployed the first Boxheds contract (0x59f890435608efd3c274208b555894a429e425b4) (R24). Both fit Zebra’s usual hours.
• The fix-up was done at different hours. After Chief Box posted about “minor issues with our contract”, two builder wallets funded by group wallet ac481 made the later versions: BoxDev1 (0xd463265e53f1f68ed5bbedf5748d6508f0aa0091) and BoxDev2 (0xf124b569a74090b045f8b381714c48cf273ef920), which deployed the final contract (0x95eace4ed65e4c2e9fd691b978b36e75f740dd14) on 22 February. They worked from about 13:00 to 17:30 UTC, midnight to 4:30 am in Sydney, the hours Zebra’s hand-run wallets never use. The wallets hand off rather than overlap, so this is either Zebra working through two nights or a second developer. In UTC terms those hours are evening in South Asia, or morning in Europe and the Americas.
• A wallet that moves with the builders. Box Peer (0x8211310a6d22b2098193a68a006fa6b0784df9e3) was funded by BoxDev1 and by ac481, made the same COQ trade one minute after BoxDev1 (11 March 2024), and emptied into the same wallet as BoxDev1 on the same day on two chains (6 June 2025). Unlike the group’s fresh wallets, Box Peer has been active since 2018, received regular monthly USDC payments in 2023–2025, and sent them on to its own Binance account (deposit addresses 0xc140ffae3bf2af34dc4d6502cf91c64fbb3c002a and 0x5cd108c028d0728e5dbf3c81cf4815cb2beda2ff). That is the pattern of someone paid for ongoing work.
• Box Peer has a name on it. On 22 June 2022 it registered the ENS name hirenkavad.eth for itself (registration). It may be its owner’s real name, but ENS names are free text and wallets can change hands, so it is a lead, not an identification. Binance’s records for the two deposit addresses above would show who controls Box Peer.

Attribution limits. The commit’s unsigned author metadata does not establish who wrote or pushed it, who controlled the account, or involvement in the later exit. Possible explanations include a shared developer, reused author settings, copied history or deliberately assigned attribution. None is established or ruled out by this clue alone; a shared developer would not by itself prove involvement in the exit.

An earlier token that was abandoned: Astroturf (TURF), April 2023

Zebra’s group also bankrolled a token that ended the way Hens did: the developer sold and the socials disappeared. - 25 April 2023, 21:09 UTC: Zebra’s migration wallet (the wallet that moved Jeff and the Chikn collection to Zebra) sent 100 AVAX to a brand-new wallet (R49). That was the new wallet’s only funding, ever. - 21:14, five minutes later: the new wallet created Astroturf (TURF), 1 billion tokens (R50). At 21:36 it put 90 AVAX and 900 million TURF into a Trader Joe pool. - 26 April, 05:37: the migration wallet itself bought TURF with 1 AVAX (R51). That morning a Chikn Discord member posted the migration wallet’s address as the “Turf funder”. - 2 May 2023, 11:40: the developer sold 31.85 million TURF for 73.7 AVAX (R53). At 11:50 it swapped its AVAX to 1,482 USDT and bridged it to its own address on Optimism (R54, R74). In June 2023 it sent all of it to an onward wallet (0xd56fc52741652a5d5c058963820a48e108c27121) (R75). That wallet’s gas money came from Zebra hub-farm wallet 0x5cb2b918823a183521bf1ed626cc137c6169a731. The onward wallet then took the money on a round trip: - 18 June 2023: it bridged the money to Ethereum through Hop, arriving as 0.83 ETH (tx), and sent 0.824 ETH on to PulseChain through the PulseChain bridge (tx). - 27 June 2023: 0.62 ETH came back from PulseChain (tx). One minute later it sent 0.70 ETH to 0x906c167324791ca5b61a9037119dcfb810141f40 (tx), which had paid its gas a minute before. That wallet’s first money, 1 ETH and 2 ETH on 24–25 June 2023, came from the Zebra group’s hub 0xcc1e3688997fd4e1ac6e995d11320cae47346194 (tx, tx). - 11 June 2024: the onward wallet swept its leftover into 5cb2 (R76), and three minutes later 0x906c… paid 5cb2 as well (tx). - 26 August 2026: another 0.39 ETH came back from PulseChain to the onward wallet (tx), a month before Hens launched. It is still there.

Most of the TURF money, by then converted to ETH, ended up back in Zebra’s group. - On the day of the sale, 2 May 2023, community members noted that the developer had sold and deleted the token’s Twitter and Telegram. The price collapsed.

The money was small, and the developer wallet came out with less than the 100 AVAX it was given. But the shape matches Hens: - a Zebra-group wallet funds a fresh developer wallet minutes before launch; - a Zebra-group wallet buys in; - the developer dumps and the socials disappear.

Developer wallet: 0xd60090cae8e9c8140e26181979a89c2b558e34b7. Token: 0x1ea8ad85b69d6e13f82679ba4944d26b3d49e802. Pool: 0x8e21ff9156bc8518f958622a83bd5bd0e47deacc.

The Hens code’s author metadata credits “Boxhedlecky”

• 20 February 2024, 03:30 UTC: GitHub account Boxhedlecky was created. That is the day of the Boxheds launch, 7½ hours before group wallet b5711d deployed the first Boxheds contract.
• The preserved public record does not show intervening activity; this does not establish that the account was unused.
• 28 September 2026, 07:39 UTC: a commit credited to Boxhedlecky is dated at this time and contains the HEGG Uniswap v4 hook source in the zvg26dphvw-sys repository. The README named the HEGG pool, hook, token and fee-collector addresses. The first HEGG purchase came 14 minutes later. The repository was created six minutes after the commit, and the same code later appeared in the official Hens project repository.
• Both the domain and the account use the same uncommon spelling, “boxhed” (no “a”).

Attribution limits. The commit’s unsigned author metadata does not establish who wrote or pushed it, who controlled the account, or involvement in the later exit. Possible explanations include a shared developer, reused author settings, copied history or deliberately assigned attribution. None is established or ruled out by this clue alone; a shared developer would not by itself prove involvement in the exit.

Alternative explanations should be considered alongside the independently documented wallet and Cable records.

1. Deliberately assigned attribution is one possibility, but there is no verified evidence here of a deliberate frame-up. GitHub account-creation dates are public API metadata, not secret information.
2. A shared developer. Someone who worked on Boxheds in 2024 still had that identity set up on their computer and later worked on Hens. That still means the same person worked on both projects.
3. Coincidence. An unrelated person created a “Boxhedlecky” account on Boxheds launch day, and its identity ended up on the Hens code by chance.

These alternatives are not established or ruled out, and the list is not exhaustive. Authenticated push records and responses from those involved could help distinguish them.

6. Where the money is now

Latest checks: - The Hens liquidity wallet: 20,093.44 USDC on Ethereum as of 9 November UTC, after a 1,392.03 USDC payment. - The top HEGG seller: 10,819.19 USDC on Ethereum as of 9 November UTC, after a 1,834.90 USDC payment and a separate 0.828455 USDC fee transfer. - Zebra’s funding wallet: about 79,251 USDC on Hyperliquid. It is still trading: it reopened a leveraged DOGE bet on 4 November and closed it on 4–5 November for a small profit, all during Sydney daytime hours.

Together that is about $30,913 of USDC in the two dumping wallets (LP1 on 9 November UTC; seller 9 November UTC). Circle, which issues USDC, can freeze USDC at a specific address on a law-enforcement request, so this is time-sensitive. Funds on Hyperliquid are harder to freeze.

The Weave family (checked 8 November). Its wallets hold little money: about 0.67 ETH in 0xe25b6f59c566dbcf722321a35bb5fd9f40317be3, 0.65 ETH in 0x1eb693a9957528807558f54ea2cd297b04ec8782 and 0.1 ETH in the WEAVE launcher 0x39fb186631d39684754345a93b9f5dac65dedde9; the HYPE moved on 8 November went on to Elysium. What matters is the token. All 71 million WEAVE for the launch are still in the launch contract 0xB0351ac6FBB85415fC444E858f59728526296a74, which has not launched yet, and 29 million sit in two reserve lockers. If WEAVE begins trading on the announced 15 November schedule, the four founder wallets (see Key wallets) will show where the founders’ share goes (section 4).

The NFT money (about $74k). On 25 October at 03:24 UTC the sale payee sent 31.5733 ETH to 0x88c532ad000138de5791860ef5fb7a43a3f21d77 (R78). That address was used exactly once, in and out, which is how an instant-swap service such as ChangeHero hands each customer order its own deposit address. Two minutes later it passed the money into the service’s main wallet, 0x016606acc6b0cfe537acc221e3bf1bb44b4049ee (R79), which the OKLink explorer tags as ChangeHero (OKLink), which sweeps its takings into its own Kraken account (0x8e2d74e4cbea2c5bcd6718de20f6d81507f0b7d2: 367 of its 425 deposits come from that service wallet). The customer took the payout out as another coin or on another chain; only the service’s private order record shows which, and where to. On 26 October the payee sent its last 0.547 ETH to a HitBTC deposit address that has been in use since 2021 (0x48c597b6fb00bb20b76f5dd96671859f1a616108) (R80).

The likely payout (not confirmed). We searched every transfer worth $73,000–74,700 on 18 networks (Ethereum, Arbitrum, Base, Optimism, Avalanche, BNB Chain, Polygon, Sonic, Robinhood Chain, Bitcoin, Litecoin, Bitcoin Cash, Dogecoin, Dash, Zcash, Groestlcoin, Tron and XRP) in the hour after the order. One stands out. At 03:42 UTC, 18 minutes after the order, a HitBTC-funded payout wallet publicly listed as using Union Chain software (0x963737c550e70ffe4d59464542a28604edb2ef9a) sent 30.9793 ETH to a brand-new wallet, 0xb02e1e357d1b06c98102fb42bef7b838f2226b0f (tx). That is the order’s 31.5733 ETH less about 1.9%, a normal swap fee, and an ETH-for-ETH swap is a common way to break a trail. The next day, at 1:02 pm Sydney time, the new wallet swapped it to about 71,300 USDC. From 30 October to 5 November it then paid nine amounts of about 3,615–3,673 USDC and one of 1,868.61 USDC (a tenth of about that size, 3,579.93 USDC, followed on 7 November) into one-time deposit addresses of a BitGo-custodied payment business (owning wallet 0x1f2deef0066b5ea22d703f434df7733ab6b93be8; for example this deposit). The Hens liquidity wallet used the same business: on 20 August it sent a 75.95 USDC test payment (A$100) and, four minutes later, 3,718.78 USDC; on 23 October it paid 1,868.99 USDC, about six hours before it pulled its liquidity; and Zebra’s older wallets used it from 2022. Within 40 minutes of the swap it had also split 21,000 USDC off to four fresh wallets (0xf0e5a19bd44f41181437b90074745f9ae927ef27 10,000, 0x7583f882922f577f0c35a7fbdda98a69d23e8d69 5,000, 0xa374e9254ee52f8f728df7d9998924508ecdad53 3,000 and 0xe73327bbdc9254b8b4346715763b872d6feaf8b3 3,000). On 5 November the new wallet sent the two larger ones 0.02 ETH each for fees, and within two minutes each paid the same payment business (3,207.42 and 1,865.03 USDC); the two 3,000 wallets have never moved. At the 9 November UTC checkpoint (Ethereum block 26,374,747), 46,989.99 USDC from the five-wallet group had reached the collector and 24,336.30 USDC remained in the group, including 8,408.75 USDC in the original b02e wallet. Every transaction the new wallet signed up to 5 November falls between 9 am and 3:30 pm Sydney time (the 7 November payment was at 12:23 am Sydney). ChangeHero has publicly listed HitBTC among the exchanges its engine trades through, so a payout arriving from a HitBTC withdrawal wallet fits how a ChangeHero order can be filled.

9 November UTC update (R88–R91): At 01:45:35, the suspected NFT candidate wallet b02e sent 3,593.28 USDC to deposit address 0x0efab0a79dc1bf64bc2329b7b4cbd03613795fca (R88), which forwarded it at 01:46:35 to collector 0x1f2deef0066b5ea22d703f434df7733ab6b93be8 (R89). At 01:57:59, LP1 independently sent 1,392.03 USDC to deposit address 0x0c948645b61507d47100e5764b746558c63207de (R90); that address forwarded the full amount to the same collector at 01:59:11 (R91). The sending payments were 12 minutes 24 seconds apart. Count each payment once; the forwarding receipts are not additional proceeds. LP1's 1,392.03 USDC is separate from the NFT candidate's 46,989.99 USDC collector total. These receipts strengthen the same-collector link but do not establish the collector's operator, bank settlement, or common wallet control. Full transaction hashes and block JSON are in the receipts addendum.

Rate cross-check for R88 and R90 (reference, not confirmed settlement): Living Room of Satoshi's published 8 November 2026 rate was 1 USDC = A$1.3676, with its spread reflected in the quoted rate. The NFT-route payment of 3,593.28 USDC corresponds to A$4,914.17, 0.29% above A$4,900. The separate LP1 payment of 1,392.03 USDC corresponds to A$1,903.74, 0.20% above A$1,900. Both fit near-round Australian-dollar amounts and strengthen the suspected Australian cash-out-service connection. The quote was not recorded at either transaction's exact execution time; these calculations do not prove actual AUD settlement amounts, that the service is Living Room of Satoshi, or that the two senders share an operator.

9 November UTC follow-up (R92–R94): At 03:57:59 UTC, top HEGG seller b3cab (0xb3cab79db9aedc103c38d2a70d05a3148cb2713c) sent 1,834.90 USDC to new deposit address 0x399f2d58fea5105b6f5b5395e2a8da3a3a68e95e (R92, 0x13827b2bf112fd67893d631f9c8be7a55709d88591ab4f97e4004fb6f78e1089). At 03:58:59 UTC the deposit forwarded that same 1,834.90 USDC to the existing payment-service receiving wallet 0x1f2deef0066b5ea22d703f434df7733ab6b93be8 (R94, 0x2efff1080d0665a392da95c2f714077fd7319c5974bdfc1df29b8e723bcdcccc). Separately, in the originating block b3cab sent 0.828455 USDC to its previously used fee address 0xe3478b0bb1a5084567c319096437924948be1964 (R93, 0xdce601870fdf9a7651e062dcdcf2a0f99e09dc4aa77a15ccc80b1b8963b66672). At the November 8 reference rate of 1.3676 AUD/USDC, the deposit corresponds to A$2,509.41, just 0.38% above A$2,500; this is not a transaction-time quote or proof of actual AUD settlement, beneficiary, or service operator. Count R92 and R94 as one payment. This b3cab flow is separate from the suspected NFT proceeds and followed the LP1 payment by two hours. b3cab's observed USDC balance is now 10,819.19; with LP1 at 20,093.44, the two hold 30,912.63 USDC at their 9 November checkpoints. Raw RPC records, block data and checksums are bundled in the receipts addendum.

Separate trading activity (9 November 2026, Hyperliquid): At 12:44:03.197 UTC the funding wallet 0xead697c62da4eec160aca375b791a8f8b0cf23b5 opened a 143,810 DOGE perpetual long in a market order with eight fills (approximately 10,000.42 USDC notional). Order 599494215913; Hyperliquid explorer transaction 0x38fb6fde17f3a5a33a7504486aa5ef0204c400c3b2f6c475dcc41b30d6f77f8d. The checked Hyperliquid ledger interval showed no deposit, withdrawal or transfer. This records trading exposure, not a movement to the suspected Australian payment service. Original order status, fills, perp-state snapshot, explorer transaction and ledger query are preserved in the dated receipts addendum.

9 November UTC side-wallet follow-up (R95–R98): A separately funded wallet in the suspected NFT payout cluster, 0xf0e5a19bd44f41181437b90074745f9ae927ef27, paid 2,202.74 USDC at 11:29:35 UTC into 0x4014d05ca47b540a9ca88a998b7030ec5010b9ac (0xf1061fa77faaafc01f8a087cd092e04f7f86367c777e9ba68c5005d33b589ff3, R95). At 11:30:47 UTC that deposit address forwarded the same sum to 0x1f2deef0066b5ea22d703f434df7733ab6b93be8 (0x7c471ddaa67d84dba1b7d34aee3b88d0bd74db0ea97fa0a3f632b74f98f0e746, R96). At 12:24:47 UTC the same side wallet sent 513.66 USDC into 0xa124fe7382bec2e1ec060a69afcd267758c731d8 (0x8d63eee3c03b5cf3d872c192c8a951c2624899fba0277c1957c51ed2e407c84b, R97), forwarded to the same collection wallet at 12:25:59 UTC (0xa59570813f5dd5e0c036a4a9516c8eb73f042bce7e93988c1607e9bffed02a25, R98). The forwarding transactions each moved the original deposit: count 2,716.40 USDC once, not 5,432.80. At Ethereum block 26,378,310, the five-wallet cluster had deposited 49,706.39 USDC cumulatively and held 21,619.90 USDC in total (main b02e wallet 8,408.75; sending side wallet 4,076.18). The separate LP1 and b3cab payments do not enter these NFT-cluster totals. At the 8 Nov 2026 service-rate snapshot of 1.3676 AUD per USDC, these two new amounts imply A$3,012.47 and A$702.48, respectively, near round A$3,000/A$700 targets; this is a retrospective approximation, not transaction-time pricing or proof of an actual AUD payout. The collector’s operator, payout route and beneficiaries are not established.

The payments are fixed amounts in Australian dollars. In US dollars the new wallet’s payments drift (3,580–3,670 USDC), but converted at each day’s reference rate nearly all of them come to about A$5,220, and the 1,868.61 and 1,865.03 payments to about A$2,660. The Hens liquidity wallet’s two payments to the same business convert the same way: 3,718.78 USDC on 20 August is A$5,233, and 1,868.99 USDC on 23 October is A$2,661. The payment business’s own deposits show how its pricing works: across all its customers, deposits cluster at round AUD amounts plus about 6.3% above the market rate (A$1,000 comes in at about A$1,064, A$2,500 at about A$2,660), with no flat fee, which looks like a service quoting round AUD payments at an all-in rate. On that basis the A$2,660 payments are A$2,500, and the A$5,220 payments are about A$4,900, just under A$5,000. Other customers sending exactly A$5,000 pay about A$5,316.

An earlier screen of 2,810 USDC deposits since 2020 suggested an Australian-dollar pricing pattern. A later 9 November screen indexed 2,964 USDC inflows to the collector and revised the historical amount-match count. The combined evidence shows two things. First, the business itself appears to price in AUD: 28 deposits since 2023, mostly from unrelated customers, come to A$2,650–2,675 while their USDC amounts ranged from 1,682 to 1,880 as the exchange rate moved. That suggests an Australian-facing service (for example a card top-up, bill-payment or cash-out service), with Living Room of Satoshi now the likely provider based on later public-feed matches, not proof of the operator. Second, the ~A$4,900 amount is rare: the later 9 November screen found 11 candidate A$4,900-scale deposits: nine from the suspected NFT payout wallet, one from the Hens liquidity wallet (August 2026), and one from an unattributed December 2025 wallet. These are deposits, not proof of 11 different customers. The repeated amounts and shared collection wallet support the proposed link; five later matches to Living Room of Satoshi’s own payment feed provide stronger service-attribution evidence. The liquidity wallet tested the service with A$100 before its first large payment; the new wallet went straight to about A$4,900, which fits someone already familiar with it. One difference: the liquidity wallet paid its network fees in USDC through a wallet-app feature, while the new wallet pays them in ETH.

Which service it is likely to be (suspected, not confirmed). The pricing matches Living Room of Satoshi, an Australian service (operating since 2014) that converts crypto into payments to Australian bank accounts and bills. It says it charges no separate fees and earns on its exchange rate, which it publishes. On 8 November 2026 that rate was 1 USDC = A$1.3676, against a market rate of US$1 = A$1.4554: buying A$1,000 cost the equivalent of about A$1,064 at market, a 6.4% markup, the same as the 6.2–6.4% seen across the payment business’s deposits in every month of 2025 and 2026. The rest fits too: AUD pricing, USDC accepted, a one-time address per payment, and common amounts (A$700, A$800, A$1,000, A$1,400, A$2,000) that look like rent and bank transfers. The BitGo custody and Kraken settlement are not publicly tied to Living Room of Satoshi, so pricing alone does not establish the provider; at least five identified public-feed matches described below strengthen that attribution.

Public-feed cross-check (captured 9 November 2026, 16:53:20 UTC): Living Room of Satoshi publishes a rolling record of recent payments at https://www.livingroomofsatoshi.com/graphs. In the 131-row captured response (13 entries labeled USDC), at least five USDC rows matched independently estimated round-AUD amounts and the displayed hour of Hens-linked Ethereum deposits to the common payment-service collection wallet. The comparisons were: NFT payout candidate 3,593.28 USDC (01:45:35 UTC deposit) vs A$4,900 to Indue Limited (15 hours old); LP1 1,392.03 USDC (01:57:59) vs A$1,900 to Westpac Bank (14 hours old); b3cab 1,834.90 USDC (03:57:59) vs A$2,500 to Great Southern Bank (12 hours old); NFT-linked side wallet 2,202.74 USDC (11:29:35) vs A$3,000 to Great Southern Bank (5 hours old); and the same side wallet 513.66 USDC (12:24:47) vs A$700 to Great Southern Bank (4 hours old). A second A$700 USDC row was 19 hours old, outside the relevant window. Each of the five matched values had one row at the expected age in the captured feed. The feed records a displayed institution, relative age and AUD amount, not a wallet address, transaction hash, identified customer or confirmed final settlement. These five documented matches strongly support attribution to Living Room of Satoshi, but neither the provider's legal control of 0x1f2deef0066b5ea22d703f434df7733ab6b93be8 nor individual transaction-to-feed matches are independently proven by a cryptographic identifier. These are comparisons with existing deposits (R88, R90, R92, R95 and R97), NOT five additional payments; NFT proceeds and LP1/b3cab money remain separately accounted for. Raw JSON, capture metadata, matched rows and SHA-256 checksums are preserved under the dated feed addendum in 6_Receipts.zip.

Consolidated sender inventory (9 November 2026 UTC; documented minimum, not a comprehensive account of the payment business). The evidence workbook now contains an “LRoS sender totals” tab and a deposit-level “LRoS traced deposits” tab derived from the original F1 trace, F66 checkpoint and November 9 receipts. The tracked service collection address is 0x1f2deef0066b5ea22d703f434df7733ab6b93be8. The separate asset totals are 59,458.08 USDC + 979.33 USDT + 47.0587 ETH; these must not be merged into a USD total without transaction-date conversion. The NFT payout group’s 49,706.39 USDC is one cluster total, including its four funded side wallets, not additional to its constituent payments. Both the LP1 1,392.03 USDC and b3cab 1,834.90 USDC latest payments sit outside that NFT amount. The fee and all one-time forwarder sweeps are also excluded from cash-out deposits. See LRoS_Identified_Wallets_and_Totals_2026-11-09.md and the source CSV.

Investigative significance of shared service use. The same Ethereum payment-service collection wallet received funds routed from Zebra, its predecessor and funding wallets, other Zebra-linked senders including 028044 and Cable Alpha Leader, the Hens liquidity wallet LP1, the top HEGG seller b3cab, and the suspected NFT payout cluster. This is one observed collection infrastructure across independently traced sender groups, including the likely NFT payout route. That is stronger contextual support for the candidate NFT payout-cluster attribution, not proof of common beneficial ownership: the service receives deposits for unrelated customers, and only its internal customer and settlement records could establish which account holders were involved. Historical receipts and separate asset totals follow below.

Twelve individually documented sender addresses — representative service deposits (Ethereum):

Zebra predecessor — 0xa3b04015a3d86d0ab9a6d54086f523afb756986f · deposit (1.1882 ETH)

Zebra main wallet — 0x41316a07012aaeaca79b12df40dbf2f3e0f9bda2 · deposit (0.2018 ETH)

Zebra-linked 028044 — 0x02804443b94728a7c2ebc4e49e7faef8cadfae77 · deposit (0.4576 ETH)

Zebra funding (EAD697) — 0xead697c62da4eec160aca375b791a8f8b0cf23b5 · deposit (0.3823 ETH)

Zebra group hub — 0xcc1e3688997fd4e1ac6e995d11320cae47346194 · wallet · deposit (1.1473 ETH)

Zebra-linked funder 119cd7 — 0x119cd7966c62b8f66cd5098308913c7a6c418dcd · wallet · deposit (0.0592 ETH)

Cable Alpha Leader — 0x7eebbc1857496dcdb606a21d7b4118a0ebacb527 · deposit (979.33 USDT)

Hens liquidity (LP1) — 0x8d2c8b60c12e2df344d0a33319509ae1a72d3d69 · deposit (1392.03 USDC)

Top HEGG seller — 0xb3cab79db9aedc103c38d2a70d05a3148cb2713c · deposit (1834.90 USDC)

Suspected NFT payout wallet — 0xb02e1e357d1b06c98102fb42bef7b838f2226b0f · deposit (3593.28 USDC)

NFT-linked side wallet — 0xf0e5a19bd44f41181437b90074745f9ae927ef27 · deposit (2202.74 USDC)

NFT-linked 5k side wallet — 0x7583f882922f577f0c35a7fbdda98a69d23e8d69 · wallet · deposit (1865.03 USDC)

Each linked deposit was routed toward the common payment-service collection wallet. The deposit is counted once; forwarder transfers are not additional payments. The NFT-group cumulative amount now reconciles to 16 individually listed deposit transactions across three sending wallets in the accompanying ledger. Shared service use does not prove common control.

Additional 9 November follow-up: The previously identified December payer 0x29624ec04e977da22811e683b570b344eb8f1142 made six verified USDC deposits totaling 7,915.61 USDC (18 November 2025–29 January 2026); the 3,497.45 USDC December 24 payment is included in that sum. This is a separate unattributed customer lead, excluded from the Zebra/Hens/Weave sender ledger and tracked-wallet totals. Full transactions and receipt paths are preserved in addendum 6g. No developer-project connection was established.

Historical collector audit and coverage (9 November UTC): A 42,211-inflow Ethereum collector index through block 26,378,854 was compared with 81 investigation addresses. The supplied receipts verify 27 additional original deposits plus their forwarding legs: Zebra group hub (24 payments, 20.7698 ETH), and Zebra-linked funder 119cd7 (three payments, 0.129 ETH and 861.04 USDC). These are already linked wallets; the scan did not verify a new developer-project connection. The December 24, 2025 payer 0x29624ec04e977da22811e683b570b344eb8f1142 sent 3,497.45 USDC (deposit 0x24c27dc37002c307ff35d08793ac230d169770f45037c66d290a3467f34c3475; forward 0xd2b6eb0e21c263b829e393ee5469dd150f075a69d1620820e099d032d95b7235), corresponding to an estimated ~A$4,909 under a modeled spread, but has no verified Zebra connection and is excluded from tracked totals. The 48-hour feed comparison corrects to 29 on-chain USDT transfers versus 27 feed rows, or 60 on-chain ETH/USDC/USDT transfers versus 57 feed rows; these are coverage counts, not customer attribution.

Historic sender breakdown: Zebra migration predecessor 23.1791 ETH (12 deposits, Dec 2022–Apr 2023); Zebra main 0.2018 ETH (one, Oct 2025); Zebra-linked 028044 0.4576 ETH (one, Nov 2025); EAD697 funding wallet 1.9192 ETH (five, Apr–Oct 2026); Zebra group hub 20.7698 ETH (24 deposits, 2023 onward); Zebra-linked funder 119cd7 0.129 ETH and 861.04 USDC (three, Feb 2025); Cable Alpha Leader 979.33 USDT (one, May 2026); Hens liquidity wallet LP1 7,055.75 USDC and 0.4022 ETH (five recorded deposits, Aug–Nov 2026); top HEGG seller b3cab 1,834.90 USDC (one, Nov 2026); suspected NFT payout cluster 49,706.39 USDC cumulatively (Oct–Nov 2026). The NFT total is now itemized into 16 verified deposits: 41,917.54 USDC from the main candidate (12); 5,923.82 USDC from a funded side wallet (three); and 1,865.03 USDC from another funded side wallet (one). The old 43,396.71 USDC aggregate placeholder is removed rather than double-counted. Developer and NFT-sale cash-outs to HitBTC and inferred subsequent Weave wallet funding are distinct financial trails and must not be counted here.

Source preservation: the original Living Room of Satoshi 131-entry public feed response at 2026-11-09 16:53:20 UTC is retained in 6_Receipts.zip and 6e_LRoS_Page_Evidence_2026-11-09_UTC.zip with its original checksums, a mobile screenshot excerpt, and an offline HTML viewer of all rows. The offline viewer is a reconstruction from the original JSON data, NOT a verbatim capture of the public site HTML, JavaScript, CSS or browser DOM. Direct acquisition of the site’s full source HTML was unavailable in this work environment. The public payment feed gives approximate ages and institutions but no exact tx hashes, account holders or payout proofs.

Why it matters if right. Living Room of Satoshi must verify every customer’s identity under Australian anti-money-laundering law, and it supports bills and bank-account transfers in Australia. Its records for the deposits from the new wallet, its side wallets and the Hens liquidity wallet would show the verified customer and the destination bank accounts, a direct route to a name.

Why it is not confirmed: that payout wallet also pays ordinary HitBTC withdrawals, the payment business has many unrelated customers, and other customers send it similar amounts. The timing, the size, the shared payment business and the Sydney-daytime hours together make it the strongest candidate; HitBTC’s and the payment business’s records would confirm or rule it out.

7. How this was traced

The investigation started at the Hens contracts and worked outward, one wallet at a time, across eight networks. The approach was to follow the money only as far as the evidence stayed strong: first funding, repeated private payments, sweeps, and amounts that match exactly across a bridge. Shared big exchanges, public contracts and airdrops were given little weight. Some of the methods behind the key findings:

• Reading the chain directly. The profit figures, exit-day sales and timing were built from Robinhood Chain’s own transfer logs, and every key transaction was checked against the chain.
• Following money through bridges with the bridges’ own records. Cross-chain transfers were matched using each service’s public data rather than guesswork:
  • Chainflip’s swap records, which name the destination wallet (this is what tied Zebra’s Solana wallet to 028044);
  • Mayan’s order explorer, which listed every bridge in and out of Zebra’s Solana wallet, including one from Zebra’s main wallet (R31);
  • Allbridge, Squid/Axelar and Wormhole transfer messages;
  • Relay, Across and Eco order records;
  • and Circle’s CCTP messages, decoded to show where USDC landed.
• Finding the exchange accounts. Each exchange deposit was traced one step before the exchange’s pooled wallet, to the customer’s own deposit address. That is how the shared Kraken account turned up. Exchange labels came from Etherscan, Arbiscan, Arkham and OKLink.
• Hyperliquid’s public ledger showed deposits, withdrawals, current balances and vault ownership for the funding wallet, the Hens liquidity wallet, 028044 and the six Cable bot accounts.
• The Cable website’s own code, which lists each trading bot with its Hyperliquid vault and operator wallet.
• Decoding what transactions say. The registration record for the wallet name icestationzebra.avax; the Uniswap swap events behind the profit figures; marketplace sale data showing what Zebra sold and for how much.
• Balance at each block, to prove the funding wallet could not have made its 11 October deposit without Zebra’s top-up.
• Timing against a baseline. Activity hours were compared with 76 other active players, so the shared sleep schedule could be judged against what is normal. GitHub commit times were checked across the daylight-saving date.
• Wide searches for further links. Multi-hop money searches from both sides, shared tokens and NFTs, shared exchange deposit addresses, and checks on the other players who keep the same hours.

The original key transactions were fetched again on 4–8 November 2026. Additional transactions and public-feed records were collected on 9 November 2026 and are preserved in the dated evidence addenda, including the later exchange-payout audit. Retrieval dates describe evidence checkpoints, not continuous live verification.

8. What this adds up to

Someone could try to explain away any one of these on its own. Taken together, they tell one story: - Zebra’s group has launched its own tokens and NFTs since 2023, under the Boxhed name among others. - In 2023 Zebra’s migration wallet funded the developer of Astroturf (TURF), which dumped and deleted its socials, the same pattern as Hens. - A Discord account called “ISZ”, claiming early-Chikn history, says they built Cable. Cable’s own website lists the Hens liquidity wallet as the operator of its “Berserker” trading bot, and Zebra’s funding wallet paid for the bot accounts. - The Hens code was published under an account created on Zebra’s group’s Boxheds launch day. - Zebra gave the first money to the wallet that bankrolled the dump, and topped it up in real time. - Zebra paid the admin’s gas as the launch session began. - Zebra dumped its Hens right after the insiders pulled out, before any public warning. - Zebra and every hand-run team wallet keep the same south-eastern-Australian hours, a pattern only a few percent of Hens players share. - Both sides favour the same small exchange and the same wallet software. - After the rug, the team’s own HitBTC cash-outs, likely passed through instant swaps, funded a new wallet family that is launching a token, WEAVE, on Robinhood Chain on 15 November. That family paid the same new wallet as Zebra’s two wallets on 8 November, and its builder was active within a minute of Zebra’s funding wallet (section 4).

Likely purpose of the setup (interpretation). Two things the insiders did would have made Hens look more successful than it was, encouraging players to buy before the exit: - Fake early demand. Under two hours after the public sale opened, 34 freshly funded wallets minted 100 Hens straight from the sale contract, all paid for by the Hens liquidity wallet and the top HEGG seller (section 1). That is about 4% of all Hens ever sold, bought by the team itself at launch. - An inside liquidity provider. The Hens liquidity wallet supplied HEGG’s main liquidity and was topped up 19 times with project fees through the developer’s private operator. That makes a token look deep and safe to trade, until the provider pulls out, which it did on exit day.

Reading: Zebra is either the whole Hens team or the leader of a small team in the same part of Australia. Zebra’s group controls the money, ran the earlier launches and seeded the team’s wallets, which points to Zebra being in charge rather than working for someone else. The evidence points to one person: - Zebra and every hand-run team wallet keep the same sleep schedule. - On Robinhood Chain, Zebra and the core team wallets take turns rather than acting at the same time. That is the pattern of one person switching between wallets, and the same pattern as Zebra and its second wallet, the Collector. - On 11 October 2026 Zebra covered the funding wallet’s 0.027 ETH shortfall in the middle of a run of trades, and the deposit went through 48 seconds later.

Still unknown: - whether anyone helped Zebra (the evidence above points to one person); - whose exchange accounts paid for the operation (the $77k); - where ChangeHero sent the customer’s payout of the $74k of NFT money (its order record shows the coin, chain and address); - who holds the four WEAVE founder wallets; - any real-world name. Only handles are known: Ice Station Zebra / Zebra Station (@stationofzebra), ISZ on Discord (choogiewoogie, earlier kaankaant), HenBok, Boxhedlecky, Darius, Chief Box, @boxhedsnft, @bigdogavax. Zebra Station said it had a “main” account, which is not identified.

9. Next steps: putting a real name to Zebra

The on-chain evidence already ties Zebra to the Hens team. What public records cannot show is the real person behind the wallets, or whose exchange accounts the money went through. The records below would show that. They need law enforcement or a lawyer. Nothing here involved contacting the exchanges or the people behind these accounts.

1. Circle: freeze the about $30,913 USDC still held by the Hens liquidity wallet and the top HEGG seller on Ethereum. This is time-sensitive.
2. Binance and Bybit: who made the 30 October 2025 withdrawals into Zebra’s funding wallet (R02, R03)? Is it the same customer whose deposit addresses received 028044’s March and April 2025 deposits (R39, R40)? Binance also for the developer’s September–October 2026 withdrawals. Binance also for the owner of Box Peer’s deposit addresses 0xc140ffae3bf2af34dc4d6502cf91c64fbb3c002a and 0x5cd108c028d0728e5dbf3c81cf4815cb2beda2ff (the wallet named hirenkavad.eth; section 5).
3. ChangeHero: two private order records. (a) The order behind the 31.5733 ETH sent to order address 0x88c532ad000138de5791860ef5fb7a43a3f21d77 at 03:24 UTC on 25 October 2026 (R78): the payout coin and address. (b) The order that paid 0.3653 ETH to the Hens deployer 0xcc835f851c2ed175e74cc312861e26b3a1f9ff51 at 11:56 UTC on 26 September 2026: what the customer paid in, and from where. For both, any email or IP address the order used.
4. Kraken: the owner of the account behind deposit address 0x15cc06d6a3f3d4a58fecd729787435fa87917e3b, the account that paid out to the Fantom bridger, 119cd7 and the sweep wallet in September 2024. Kraken operates in Australia as Bit Trade Pty Ltd (ABN 42 163 237 634), registered with AUSTRAC.
5. HitBTC: whose withdrawal paid 30.9793 ETH to 0xb02e1e357d1b06c98102fb42bef7b838f2226b0f at 03:42 UTC on 25 October 2026 (a possible NFT-money payout), and the accounts behind the team’s October 2026 deposits (the developer’s 0x5625e03ff727182c35d32e4fe8eb5ea5172fabd6, the top HEGG seller’s 0xc497ea6a9080b34cdc0e7153002ae8fea200e8ac, and the sale payee’s 0x48c597b6fb00bb20b76f5dd96671859f1a616108, in use since 2021) and the Zebra group’s Avalanche deposits. The developer’s deposit at 04:26 UTC on 26 October and the top HEGG seller’s at 02:29 UTC on 27 October (R82, R84) and the sale payee’s at 04:29 UTC on 26 October (R80) look like instant-swap orders whose payouts went to the Weave family; HitBTC’s records would show which service placed them, and that service’s order records the customer.
6. The BitGo-custodied payment business behind 0x1f2deef0066b5ea22d703f434df7733ab6b93be8, suspected to be Living Room of Satoshi (unconfirmed; see the payout section): the verified customer and destination bank accounts behind the deposits from 0xb02e1e357d1b06c98102fb42bef7b838f2226b0f and its side wallets 0xf0e5a19bd44f41181437b90074745f9ae927ef27 and 0x7583f882922f577f0c35a7fbdda98a69d23e8d69 (26 October – 9 November UTC 2026), and from the Hens liquidity wallet (20 August, 23 October and 9 November UTC 2026).
7. GitHub: the email and login records behind Boxhedlecky and zvg26dphvw-sys, the two accounts under which the Hens code was published. Copies of both code histories, with every commit’s original time zone, are saved in the receipts.
8. X: the records behind @stationofzebra (which would show the “main” account), @boxhedsnft, @bigdogavax and @_cableninja.
9. Discord: the account records behind “ISZ” (username choogiewoogie, earlier kaankaant) and “Darius” (dariusashford).
10. The websites. Each domain’s registrar and host holds the account, payment and login records behind it. All four connected domains use GoDaddy’s name servers:

• hens.farm (the Hens game): registered at GoDaddy on 17 September 2026, 06:40 UTC (4:40 pm Sydney), 11 days before HEGG launched. Its email is Microsoft 365 bought through GoDaddy (tenant NETORGFT21192344.onmicrosoft.com, mail server hens-farm.mail.protection.outlook.com). It sits behind Cloudflare and has its own X login integration. Ask GoDaddy, Microsoft and Cloudflare.
• cable.ninja (ISZ’s Cable): hosted on Vercel, with GoDaddy name servers. It carries a Google site-verification code (google-site-verification=1FAk7DEdbOsGjTcHwlu5FSPcwVBnj1gRh7U18FzjirU), which ties it to one Google account. Ask GoDaddy (or the registrar of record), Vercel and Google. Also ask X about @_cableninja.
• glizzy.wtf (the GLIZZY token the funding wallet’s money helped launch): registered at GoDaddy on 26 August 2026, 23:48 UTC (9:48 am Sydney), and hosted on Vercel. Ask GoDaddy and Vercel.
• boxheds.life (Zebra’s group’s 2023–24 Boxheds project): first certificate issued through GoDaddy in December 2023; the domain has since lapsed. Ask GoDaddy for the historical registrant.
• GoDaddy and Vercel are very common, so sharing them proves nothing on its own. The value is that one GoDaddy request could cover all four domains, and show whether any share an account.

1. Weave (weavefi.xyz): GoDaddy for the account behind weavefi.xyz (registered 19 October 2026, 11:27 UTC) and its Microsoft 365 tenant (NETORGFT21239828.onmicrosoft.com); Vercel for the hosting account; X for @WeaveFi_xyz; Telegram for the WeaveFinanceCommunity group; Binance for the account that paid 0x591b9478cf3164f85084bdfc9a2bf44965c3c1ee on 27 October 2026 (R85), which is likely the swap service’s payout rather than a customer’s own withdrawal.
2. Other platforms behind the handles: OpenSea (HenBok), HeyMint (the 2023 BoxHeds collection).

Key wallets

Zebra’s side

Zebra (“Ice Station Zebra”)
Code: 413
0x41316a07012aaeaca79b12df40dbf2f3e0f9bda2

Zebra’s second wallet (the Collector)
0xec0b24b6c04501ddee4992c091d3e9efbcbe13d7

Old Zebra (registered icestationzebra.avax)
Code: 316b
0x316b17b90e93f6f7853567e9bb21cca465da883b

Zebra’s Solana wallet
7MwVNThWtNiTHfbKAHv4S3c7vA9CaWZZwCkoEkhuQq8o

Probable Zebra wallet (paid the same new wallet as Zebra on 8 Nov 2026)
0x591b9478cf3164f85084bdfc9a2bf44965c3c1ee

WEAVE launcher (funded by 0x591b…)
0x39fb186631d39684754345a93b9f5dac65dedde9

Weave contract deployer (funded by 0x591b…)
0x4e075f7c5fbf6feb45930a380c5e546f3a31ac08

Weave family wallet (received the likely swap payouts of the deployer’s and the sale payee’s cash-outs)
0xe25b6f59c566dbcf722321a35bb5fd9f40317be3

Weave family wallet (funded by 0xe25b… and 0x591b…)
0x1eb693a9957528807558f54ea2cd297b04ec8782

WEAVE founder wallets (written into the launch contract, unused)
0xce04f2e86295a40767467a04cea41ef10c653d49
0x2e39e0b3c3ac996d60fe54a676c3df4418c0dd4e
0x88d16b0b909f040bb2082125438918ec9481a72c
0x2a4ea330e07dc1bbb2c68410c5b7c895a6c7d9af

WEAVE launch contract / WEAVE token (Robinhood Chain)
0xB0351ac6FBB85415fC444E858f59728526296a74 / 0x4af85f314Cf3925956F75aB0d4567e35a5362Af6

Zebra’s group wallet (Binance/Bybit deposits)
Code: 028044
0x02804443b94728a7c2ebc4e49e7faef8cadfae77

028044’s first funder
Code: 119cd7
0x119cd7966c62b8f66cd5098308913c7a6c418dcd

Group wallet ac481
0xac481aa04d86fedd29064844fced42756b6ab567

Group wallet 58d2
0x58d2fcf0d8f83536b1a54e17fbf11b2bac9fa8c2

Group hub
0xcc1e3688997fd4e1ac6e995d11320cae47346194

boxheds.avax holder
Code: fc5061
0xfc50613e61da054b75f4557e2bd237fe78329235

First Boxheds deployer
Code: b5711d
0xb5711de1218f3bd4545751c643ccf7527a85c16b

Sweep wallet
0x23c7a3d3d9d4d4bf448298c5cb8e981649d37675

Fantom bridger
0xddadab1b90feb948d552ea0417c90f036242b555

Zebra’s group Kraken deposit address
0x15cc06d6a3f3d4a58fecd729787435fa87917e3b

Astroturf (TURF) developer, funded by the migration wallet (2023)
0xd60090cae8e9c8140e26181979a89c2b558e34b7

Zebra migration wallet
Code: a3b
0xa3b04015a3d86d0ab9a6d54086f523afb756986f

Zebra group wallet 87476e (launched Big Dog)
0x87476eef73fd7e867a76da7656e2f6ad61786168

Brojak deployer (fresh wallet funded by b46dd4)
0x12f9d16e0b201473c0b84575ca15eec6f8d719ba

Brojak fourth-copy wallet (sent the ETH back to 028044)
0x9a5e5adeb8491df5462b8f707b7892154550b642

GLIZZY launcher
0xa6d6bda6c122158356d1464d7503c2fa0fbf178b

The Hens team

Zebra’s funding wallet
Code: EAD697
0xead697c62da4eec160aca375b791a8f8b0cf23b5

The Hens liquidity wallet
Code: LP1
0x8d2c8b60c12e2df344d0a33319509ae1a72d3d69

The top HEGG seller
Code: b3cab
0xb3cab79db9aedc103c38d2a70d05a3148cb2713c

The developer (“HenBok”)
Code: Hens deployer
0xcc835f851c2ed175e74cc312861e26b3a1f9ff51

The admin
Code: Hens admin
0x582a99d6ba8da5d3ed5ffda2cfcd3196a9c2ee53

Hens NFT sale contract (deployed by the admin)
0xc1117f2fd60e5e4e6a0f348713a1e5d96bcd8dbb

NFT sale payee
0xd4baffee663e3a974bf2781ed8bfcbc9f80cd6d8

ChangeHero order address (took the NFT money)
0x88c532ad000138de5791860ef5fb7a43a3f21d77

Team capital wallet E060 (launched BILL and CAMBODIA)
0xe060683a5d6b4cbf84a7f63725ac33b68990048c

GLIZZY bot wallet (paid E060)
0xf5779df10eccb29217439e2b18de8b37a3002de6

Liquidity operator (developer-built)
0x8f059fee953153ccdde5ab92ed665e26d1d125e0

100-Hen final holder
0x2b58c86017a231adc4c40b1aa96b1a5fef8d0828

Cable Alpha vault leader
0x7eebbc1857496dcdb606a21d7b4118a0ebacb527

Cable Maverick vault leader
0xc15987c22e741e37b3da89b2556488ea35adf04a

Cable Warlord vault leader
0xf9f7acced107d11ab75703286f47b2033a185766

HitBTC wallet that both sides’ cash-outs reached
0x80787af194c33b74a811f5e5c549316269d7ee1a

ChangeHero’s main wallet
0x016606acc6b0cfe537acc221e3bf1bb44b4049ee

The Evidence Workbook lists every other wallet mentioned, with explorer links.

Key transactions

Each line: reference, time (UTC), network, what it shows, and the transaction ID. The raw record of each is in the Receipts zip under the same reference.

R01 · 30 Oct 2025 00:11 UTC · Ethereum
Zebra gives the funding wallet its very first money (0.7 ETH).
0x227a020d9d34ced68cd031be2dda8f52d21ed137c45ac33256564854aece7b48

R02 · 30 Oct 2025 00:23 UTC · Ethereum
Binance withdrawal into the funding wallet, 12 minutes later (56,974.54 USDT).
0x2680bd53cd5d5e63a6e13ed4d53a8846335ac6fd2eb92b3cec4014481db4e3ea

R03 · 30 Oct 2025 00:29 UTC · Ethereum
Bybit withdrawal into the funding wallet (20,176.52 USDT).
0x04df46cfad41e0fd7ae5a26ad72e12e12acf90b9f8a5bbf958dfc892de1a9c48

R04 · 12 Mar 2026 09:51 UTC · Ethereum
Funding wallet pays the liquidity wallet (Mayan order, origin): 0.26 ETH sent, 529.75 USDC delivered (0.26 ETH).
0xb8595968270b6f55c9fdf4f9a15c15fefc09e3156dff60ad3251e337be124acf

R05 · 12 Apr 2026 03:37 UTC · Ethereum
Funding wallet pays the liquidity wallet (Eco order, origin) (30,108.63 USDC sent / 29,912.92 received).
0xa473fa5970bef98e8b60ec48e863504e57960971c5e1430d3428c61b3cef1fc0

R06 · 12 Apr 2026 03:37 UTC · Arbitrum
Liquidity wallet receives the Eco order (fill) (29,912.92 USDC).
0xa280e7147ddf300656c17a4c932f78f1b7354f3ef5252c0bf374074a0f44b634

R07 · 3 Oct 2026 07:43 UTC · Robinhood
Liquidity wallet opens its HEGG position (0.835 ETH + 148,858 HEGG).
0x77404f5eb069bc7de798b00d4fb14ddd33458e7a58c91845c18f3a091add6193

R08 · 7 Oct 2026 02:53 UTC · Robinhood
Liquidity wallet approves the developer’s private operator (approval).
0x97b38de3d97b30fe28eeda4dfa80e9b838854dfde33803fc8043cdb7918c951c

R09 · 11 Oct 2026 21:46 UTC · Ethereum
Zebra empties its wallet into the funding wallet mid-trade; deposit follows 48 s later (0.0454 ETH).
0x3dde5734e19c5020f8d8190add7f9b74861336e6e796ec55b73b734c491756a1

R10 · 11 Oct 2026 21:47 UTC · Ethereum
Funding wallet’s deposit that needed Zebra’s top-up (0.3823 ETH).
0x81431b1e03565859ffc8accd8e2987ac2a1cbddee0da4fbab9ff4daaa8a1175b

R11 · 15 Oct 2026 22:38 UTC · Robinhood
Zebra pays the Hens admin’s gas, 13 minutes before its 122-transaction session (0.01 ETH).
0x4ea085d9c5cc9643c837d0e20b4641de576a8336e183b6230264f785e34db267

R12 · 15 Oct 2026 22:51 UTC · Robinhood
Admin’s batch session begins (batch).
0x843dae3d068384ec0a27b0202cb2ab73b5d73774fc97613d3ca34e0c37ecf3c2

R13 · 24 Oct 2026 05:57 UTC · Robinhood
Liquidity wallet pulls its whole position (2.536 ETH + 51,982 HEGG out).
0xfb9746e4c297c090612cfba2926b9b2286d488ad31f96281e551251a6490e492

R14 · 24 Oct 2026 06:29 UTC · Robinhood
Zebra’s first Hens sale, 32 minutes after the pull (Hens NFT sale).
0xa7fb443dd763bd04d1d6002e6c4f27673c6617a83aef689117d48bf628c42967

R15 · 24 Oct 2026 23:37 UTC · Robinhood
Liquidity wallet sells its HEGG; price falls 46% in one swap (2.326 ETH).
0x70e7a5101f7535a619b6fd0d738158d6ca3ec4a156b801ae764a57624597447b

R16 · 25 Oct 2026 01:01 UTC · Robinhood
Developer’s final HEGG sale (also upgrades to the shared smart-account software) (0.059 ETH).
0x5fca113a1ba957d03c5c0a1f2f32f2c141284c1f28e439b08f268537c4cbe508

R17 · 25 Oct 2026 03:45 UTC · Robinhood
Zebra’s 34th and last Hens sale of the day (Hens NFT sale).
0xdce7e4aba2725a6f8c8b6660572c797dc650aacf0f66f741756de73d969beff3

R18 · 25 Oct 2026 03:47 UTC · Robinhood
Zebra’s Collector sells its 6 Hens two minutes later, same buyer (Hens NFT sales).
0x42b37b99c423ff0d008ca03267315ac87d8b94503fca136ed9bffda203423ac1

R19 · 18 Oct 2026 02:46 UTC · Robinhood
Zebra upgrades to the same smart-account software as the developer and liquidity wallet (upgrade).
0x91664989d3fddff235138266d298ba032fd04e9631c85bf6b374ac561bf68ce4

R20 · 1 Jun 2026 07:29 UTC · Arbitrum
Zebra’s group wallet 028044 pays the liquidity wallet (51.93 USDC).
0xcc996696788dfe3e9a4421dc256995c1bee038de849ee9b4a87c53a23e142134

R21 · 1 Jan 2023 08:50 UTC · Avalanche
Old Zebra registers icestationzebra.avax (name registration).
0xb0f97f7b12a7225a3eef88e99d5b8ba496af85fcfb5e95770f6a42aa0433bfad

R22 · 18 Nov 2023 19:45 UTC · Avalanche
icestationzebra.avax passed to Zebra (name transfer).
0x21de7bee526e8af28ac353687e3a25d1daa3a8fd2d80d31506886f52fc7d85bd

R23 · 5 Jan 2024 01:13 UTC · Avalanche
Zebra-group wallet fc5061 registers boxheds.avax (name registration).
0xc74c013fa166a66c9c735ae19abb06552d1e5497c2fb9a091a67ae6e58f5662b

R24 · 20 Feb 2024 11:00 UTC · Avalanche
Zebra-group wallet b5711d deploys the first Boxheds contract (deployment).
0x73ad69fb58a6427ad5713af7cffb46db1b3b43ef797bf7553ffa3ebb0d965ea4

R25 · 22 Feb 2024 17:06 UTC · Avalanche
Final Boxheds contract deployed (deployment).
0x02c7c8fb6084f48163b51881db4b103ce3c9cbb04eb9d0aee9852e2505293b20

R26 · 26 Jun 2023 11:08 UTC · Ethereum
Zebra-group farm wallet deploys the 2023 BoxHeds NFT (deployment).
0x44aefb284c94ab2cefba2976993376a2b56503fdb6c428f4b5544c06c048bb95

R27 · 22 Jul 2023 07:31 UTC · Ethereum
Farm wallet deploys ‘Hotdog Eating Races’ (DOGG) (deployment).
0x81d6b0278e7149314848dbb2366e9e7589bbd96d26b2799d36fe9725d8ef98f1

R28 · 8 Jul 2024 04:52 UTC · Ethereum
5cb2 pays the group’s Kraken deposit address (0.12739 ETH).
0x8637fbc85616c8b5f0d05cc034757f723fb10ee96bea509fb7816d70a71d2660

R29 · 25 Sep 2024 01:09 UTC · Ethereum
Kraken pays 119cd7 its first funds (1.367 ETH).
0x4b1c42e2df1809e964b8a0fcc84e8af727365b0e67a036c8c9d4ed709365b8e7

R30 · 25 Sep 2024 01:16 UTC · Avalanche
Kraken pays the sweep wallet its first funds (1,099.95 AVAX).
0xc0927ac3c163e9bcb9853ad6a536650c22cab2021427369be0f2232e3fe739d1

R31 · 10 Mar 2024 10:20 UTC · Avalanche
Zebra bridges into its Solana wallet (Mayan) (22 AVAX).
0x870711df630f84780903e7568696b879d455aba123dad2d2a2356f26c87b6b3d

R32 · 19 Jan 2025 00:28 UTC · Avalanche
Sweep wallet bridges to Zebra’s Solana wallet (1,022 AVAX = 40,235 USDC).
0x0f7800da8a09366869d1df9230e5e98c37838b16a7062a5c954bba34c811d070

R33 · 19 Jan 2025 09:17 UTC · Ethereum
Fantom bridger sends ~$104.5k to Zebra’s Solana wallet (104,505.54 USDC).
0x9fd7847d134db944546f5990e466378b8f918945b31a33290f68c0ad6e6355ce

R34 · 19 Jan 2025 10:04 UTC · Ethereum
119cd7 bridges 63,643.34 USDC to Zebra’s Solana wallet (Allbridge); 62,886.99 USDC arrives after fees (63,643.34 USDC).
0x82b3c27cff04efdb893b356b64efc87e5fbf54e69b9dda040a0f0e09606d613f

R35 · 27 Jan 2025 12:24 UTC · Arbitrum
Chainflip swap #255529 pays 028044 (from Zebra’s Solana wallet) (~29,910 USDC).
0x4af8739ab6df31c1d973fab43a0407822784d54c5733d4746588c9594f56e307

R36 · 27 Jan 2025 12:30 UTC · Arbitrum
Chainflip swap #255535 pays 028044 (~19,931 USDC).
0x270597c61242acb3b157db748b31a9ffbdfc0619a16afc3eb47e46a9ee55389e

R37 · 30 Jan 2025 04:30 UTC · Arbitrum
Chainflip swap #262761 pays 028044 (~19,864 USDC).
0x06701144d06e5fa626edc053c57d732b496f585a35090015a74f72b46b9253f6

R38 · 30 Jan 2025 04:40 UTC · Arbitrum
Allbridge delivers 19,903 USDC from Zebra’s Solana wallet to 028044 (19,903.32 USDC).
0x736d985b699d48d0d16d10b64aec61ff7ee11f5eea9d5d386b61e76bbbfef29b

R39 · 10 Mar 2025 03:25 UTC · Arbitrum
028044 deposits to Binance (61,925.46 USDC).
0xc3d44b78db78613f45f6656518ab69f598a66095e007ea0d5a7a810d5010b252

R40 · 20 Apr 2025 12:10 UTC · Arbitrum
028044 deposits to Bybit (19,201.33 USDC).
0x21fdfb077885bf164ca7c06a5a18b8ee39619b270acd3999bdb5dfa9228bf4f5

R41 · 25 May 2026 01:49 UTC · Arbitrum
Liquidity wallet pays the team trading-vault wallet (10,008.25 USDC).
0x043dfe4887f0baa918b6d2926f7a66e5fc016799660d7eae80a006b127fb1224

R42 · 13 Mar 2026 01:30 UTC · Ethereum
Funding wallet swaps 16 ETH to HYPE (same exchange pot) (16 ETH).
0x34ce9aaddeabf43553603a46407fbadce9eb982f4f049749c4855d6b7204a126

R43 · 12 Mar 2026 09:50 UTC · Ethereum
Funding wallet sends 0.26 ETH toward the Cable Alpha vault leader (LI.FI/Relay) (0.26 ETH).
0xefa81cdb32871f100a60afab3f64e64b03cf1527e88ed352c0d642fdd9186db2

R44 · 12 Mar 2026 09:51 UTC · Ethereum
Funding wallet sends 0.26 ETH toward the Cable Maverick vault leader (0.26 ETH).
0xe2967cc5fb8c7b4ac0a297c0e7155e96610b073effdd874e7d78632ed7d1adf5

R45 · 12 Mar 2026 09:52 UTC · Ethereum
Funding wallet sends 0.26 ETH toward the Cable Warlord vault leader (Mayan) (0.26 ETH).
0x593a8c613061364b439390c5502062cdc32c557992424c0dfd5e53a65a2225d1

R46 · 12 Mar 2026 09:50 UTC · Arbitrum
Cable Alpha leader receives the bridged funds (530.44 USDC).
0x55283b3e754da1df3daf8a03868b8aa3c17b87ca39df0d73a1222afda8d060c7

R47 · 12 Mar 2026 09:51 UTC · Arbitrum
Cable Maverick leader receives the bridged funds (530.54 USDC).
0x1bce9f194ae4e1e31dc901c5f99e52306dd8ccb6dfe543b05a0053f15cf0c660

R48 · 12 Mar 2026 09:52 UTC · Arbitrum
Cable Warlord leader receives the bridged funds (529.85 USDC).
0xdb3cad3c606db4ce283b6e99ebfec98cae82218a232db838ceaddbfe5dbc5db1

R49 · 25 Apr 2023 21:09 UTC · Avalanche
Zebra’s migration wallet gives the TURF developer wallet its only funding (100 AVAX).
0x37b6ba5dde2ccac4ddd3350772a777430809e127668ce2bf9c1dc3f30a0920bd

R50 · 25 Apr 2023 21:14 UTC · Avalanche
TURF developer creates the Astroturf token, five minutes later (creation).
0x6e8ea398bb77716e5b69e36885e4814b5e01f50adaa1dbee067f01eaff197cfa

R51 · 26 Apr 2023 05:37 UTC · Avalanche
Zebra’s migration wallet buys TURF (1 AVAX).
0xe9e8361be88db6e92a314066a1eacaec2994ddc1844960c162b0abc6c14d8253

R52 · 26 Apr 2023 08:20 UTC · Avalanche
TURF developer burns the pool tokens (LP burn).
0x0d59a7451c9b4e1272974f8c99ff0e1b6961b217ca3c5f4df999d14840d496da

R53 · 2 May 2023 11:40 UTC · Avalanche
TURF developer sells 31.85M TURF (73.7 AVAX).
0x24699849009f2b8fa6be7754af6b521b200537f428ddced7ea248035a3ff4a04

R54 · 2 May 2023 11:50 UTC · Avalanche
TURF developer bridges 1,482 USDT to its own address on Optimism (1,482 USDT).
0x09ec41c966167e6807e02ad2dfaa2cb2a3314dc263e106e434e4bc62a50b8ea0

R55 · 13 Mar 2023 01:47 UTC · Avalanche
Old Zebra’s Chikn #6391 sells on a marketplace, the sale the Zebra persona called accidental (1.5 AVAX).
0x5d796215672f069c2c88de83ba0fb04a6e1f41898f264202c01032f7034f1ebb

R56 · 17 May 2026 10:49 UTC · Arbitrum
Cable ‘Captain Sensible’ account sweeps its funds to the Raptor/Alpha wallet (273.57 USDC).
0x796b079ad96cc93f452730011ad7294249da3de55a5ff0571acaa24f2c19f059

R57 · 17 May 2026 10:49 UTC · Arbitrum
Cable ‘The Sniper’ account sweeps to the Raptor/Alpha wallet (264.17 USDC).
0xd7d8b343bcb851764503b01199b9607a2241011628e2ecac3aa0803c375cafd6

R58 · 17 May 2026 10:50 UTC · Arbitrum
Cable ‘Maverick’ leader sweeps to the Raptor/Alpha wallet (310.96 USDC).
0x198c8d8c48bdab81aea868d4021ea3503fdc0a0f93ae99bad67aff98f327e7df

R59 · 17 May 2026 10:51 UTC · Arbitrum
Cable ‘Warlord’ leader sweeps to the Raptor/Alpha wallet (324.83 USDC).
0xc8df13be7e26fa95265941ae1e5fcba7c3ea44ce479c90c4158a1337e3bad0ca

R60 · 17 May 2026 11:03 UTC · Arbitrum
Raptor/Alpha wallet deposits the exact total back into Hyperliquid (1,173.52 USDC).
0xc8bb9a2754f6edf0a56aa63d85071cd9676c3173425e7b36f7cbd34a3bd92906

R61 · 22 Dec 2023 09:27 UTC · Avalanche
Zebra-group wallet 87476e creates Big Dog (BDOG) (deployment).
0x66f7290829582c04cad094c6f972feb91a522c6d01c42d8c5abfe4f5f598e10b

R62 · 22 Dec 2023 09:40 UTC · Avalanche
87476e adds 50 AVAX and 99% of BDOG to the pool (50 AVAX).
0xbab367da4e737fabe3d2d3a32465f2f0e3ecf1cb7e3b2e37dfd916b3fd471841

R63 · 22 Dec 2023 09:56 UTC · Avalanche
87476e burns the BDOG pool tokens (LP burn).
0x63c0154c217e41edbc9f79e0fcb32bf8761eae6689b193a7420318041c710da9

R64 · 22 Dec 2023 09:58 UTC · Avalanche
87476e renounces the BDOG contract (renounce).
0xf1e0754a9e413f8f93549601ef84a76c3cc3a40609f4a4936a5b813e6703c6e4

R65 · 9 Apr 2024 01:56 UTC · Base
Hub-farm wallet b46dd4 deploys Brojak (BRO), first copy (deployment).
0x2a57c93de19c385917f968186e8c08427ff46bfaad22affde07066addea436a9

R66 · 9 Apr 2024 03:01 UTC · Base
b46dd4 deploys Brojak, second copy (deployment).
0xf807cd86de5382e47ee84359c05d0d3bf3e41fcdb51c43c717161da34f64451b

R67 · 26 Apr 2024 02:45 UTC · Base
Fresh wallet funded by b46dd4 deploys Brojak, third copy (deployment).
0x54f16972a235728153923b7b2f5e43cbd79e7b1987e648299d50be890137cdeb

R68 · 27 Apr 2024 00:56 UTC · Base
028044 deploys Brojak, fifth copy (deployment).
0x1d1cf02885b88b6b3fc12c61b2b2349de094153babf82bdbde76b9392d0f1b6f

R69 · 26 Apr 2024 05:50 UTC · Base
Wallet that received the Brojak deployer’s ETH deploys Brojak, fourth copy (deployment).
0xfd94abc4bffca5d3c407fb9f588d98bfa8ae2402eb236ece8a51d0b3d1c5eb27

R70 · 27 Apr 2024 00:51 UTC · Base
Same wallet sends the ETH back to Zebra group wallet 028044 (2.8035 ETH).
0xc233ca39a575c48a504895dafccb536a2eb7e2fcc13da1b4f7d7bced68246219

R71 · 15 Oct 2026 22:02 UTC · Robinhood
Hens admin deploys the NFT sale contract with the payee written into its code (deployment).
0x11ba463e60799516176cc6ffeef507604a6f532eacf25354ecce3babbc8b803f

R72 · 14 Aug 2026 06:18 UTC · Robinhood
Team capital wallet E060 deploys the BILL token (deployment).
0xe80712a276644fa257298b7b9a9b61b295e0e71f86e11bf51083854550aa929d

R73 · 31 Aug 2026 12:53 UTC · Robinhood
E060 launches the CAMBODIA token through a launch factory (launch).
0x48b9d3176aa0dce13a25eeb145fbca77cc9321b5b847ad32e9ef078664910190

R74 · 2 May 2023 11:51 UTC · Optimism
TURF developer’s USDT arrives on Optimism (1,464.80 USDT).
0x3e2d44bdd56f3fcf7e5d05e93abd6b2bfdcfaf93c028dd68d94243ad695ed6b2

R75 · 18 Jun 2023 07:20 UTC · Optimism
TURF developer sends all of it to an onward wallet (1,464.80 USDT).
0x39f7fa073120db9633f0f4b3877c8bd2d6d9fedb2088cfd1aa95c4ff5463250a

R76 · 11 Jun 2024 23:36 UTC · Ethereum
That onward wallet sweeps into Zebra hub-farm wallet 5cb2 (0.0099 ETH).
0x4cabec2d02a0ce15730d66b6e0b1159e7fbd0f742bc5f14d94caf39ca510caa0

R77 · 25 Oct 2026 03:21 UTC · Ethereum
Hens NFT sale money arrives on Ethereum at the payee (31.5734 ETH).
0x01bd12d02c8e036b71604e829f410d9b312b917f6e6f9eb0e9405f5e8302c807

R78 · 25 Oct 2026 03:24 UTC · Ethereum
Payee sends it all to a one-time ChangeHero order address (31.5733 ETH).
0x7518eae51fad87f0bb782fc35e46ae7f2b0d05b26355d99076ce7a0e6c6ee7cc

R79 · 25 Oct 2026 03:26 UTC · Ethereum
Order address forwards it into ChangeHero’s wallet (31.5733 ETH).
0x587030761f3971808f480ab58bfc0b1d127e32a88e143d616c56e2c1b40c698e

R80 · 26 Oct 2026 04:29 UTC · Ethereum
Payee sends its leftover ETH to a HitBTC deposit address (0.547 ETH).
0x56147915b0e28f9837ac1b6e898c748930adeaf8182734828742b6f78100feab

R81 · 30 Aug 2026 22:35 UTC · Robinhood
GLIZZY bot wallet F577 pays team capital wallet E060 (0.2269 ETH).
0xea9366ba9e022711556c46a2c85ba3e13ac411f5c328d98f4d9ab38b4ad93a4b

R82 · 26 Oct 2026 04:26 UTC · Ethereum
Hens deployer pays ETH into its HitBTC deposit address (0.644213 ETH).
0x1e9df21e1450b20c0562b802d90daad10824faa4ed17eda9e56f9cfa4f7a3829

R83 · 26 Oct 2026 04:33 UTC · Ethereum
Seven minutes later, a matching payout to a brand-new Weave family wallet (0.63305 ETH).
0x6fcd3b45d14c4874661e7f7d20245fd4c3c126d6d4392490c9d45c31ea26f6da

R84 · 27 Oct 2026 02:29 UTC · Ethereum
Top HEGG seller pays ETH into its HitBTC deposit address (2.67826 ETH).
0xae4f4304b547d6d8ba70b796c13e1b8bbbb8b9e8275b774ea82ed364b3d9da84

R85 · 27 Oct 2026 02:35 UTC · Ethereum
Six minutes later, a matching Binance payout gives 0x591b… its first money (2.63875 ETH).
0x850332ae4da2ffde918678898865666c1c786671b82a534b6077b694e58dbdd5

R86 · 3 Nov 2026 00:02 UTC · Robinhood
Wallet funded by 0x591b… creates the WEAVE launch contract and token (100,000,000 WEAVE).
0x6b62143a4a226df009dd963182a3f1a555aca3db20e0ff12b54e097e26712d77

R87 · 26 Oct 2026 04:36 UTC · Ethereum
Seven minutes after the sale payee’s HitBTC deposit, a matching payout to the same Weave family wallet (0.53725 ETH).
0xc615b8063b682e47aeaa535484a3990e82d3ce5d3e9434e23f80cddabbe52702

Publication clarification — 9 November 2026

Evidence cutoff: 9 November 2026 UTC. Balances are dated observations, not live balances. The 15 November WEAVE token-launch date is the announced schedule recorded in this evidence, not a guarantee that trading will begin then.

The commit’s unsigned author metadata does not establish who wrote or pushed it, who controlled the account, or involvement in the later exit. Possible explanations include a shared developer, reused author settings, copied history or deliberately assigned attribution. None is established or ruled out by this clue alone; a shared developer would not by itself prove involvement in the exit.

These are two accounts, each observed on one side of the daylight-saving change; they do not demonstrate a single clock switching. The observations support a regional hypothesis, not proof of location or common control.

Use of the same commercial payment service does not by itself establish a shared customer, common control, an Australian-dollar settlement, or the identity of a beneficiary. The Living Room of Satoshi attribution and the candidate exchange payouts remain inferences pending private records.

Editor’s note: We contacted Zebra directly and gave them 48 hours to respond. We also publicly announced that we were seeking comment from people we suspect were involved. Zebra did not respond within that period.

Reporting by @_lilrag. You can support our investigators with donations to 0x08A8f3F517B8B0e4B60295AE22dB0D9833AD5460.

Current transaction index

The workbook contains R01–R98 plus HL1. Browse all 99 transaction entries and original receipts →