H·HENS / HEGGEVIDENCE ARCHIVE V6.06 · 09 NOV 2026

9 NOVEMBER 2026 / INVESTIGATION SUMMARY

Download this report (Word) ↓

Evidence cutoff: 9 November 2026 UTC. Balances are dated observations, not live balances. The 15 November WEAVE token-launch date is the announced schedule recorded in this evidence, not a guarantee that trading will begin then.

The Hens rug: what happened, and who is behind it

Investigation summary, publication merge v6.06, updated 9 November 2026. Times are UTC unless marked ET (US Eastern). ETH is converted at ~$2,323, the rate the insiders themselves got when they cashed out.

In brief

Who’s who

Five wallets carry the story. Each name says what the wallet did and how it links back to Zebra.

The money at a glance

How big the insiders’ part in the crash was: - In the final two days (23 October until the public warning, 25 October 1:17 AM ET), the Hens liquidity wallet and the top HEGG seller made 80% of all HEGG selling. - In the main HEGG/ETH pool they took 71% of the ETH that sellers pulled out (5.2 of 7.3 ETH). The Hens liquidity wallet also withdrew 2.5 ETH of pool money on top of that. - HEGG’s price halved over those two days. The Hens liquidity wallet’s single sale knocked it down 46% instantly. In the November 8 price snapshot, HEGG was more than 97% below its pre-dump price on October 24 (about 0.000071 ETH to 0.000001867 ETH per HEGG). It was also down approximately 99% from its October 7 peak.

Still held (as of 9 November UTC): about $30,912.63 in USDC is sitting in the Hens liquidity wallet and the top HEGG seller. Circle may be able to block USDC addresses under its policies and applicable legal process; blocking transfers is not the same as recovering funds. Zebra’s funding wallet also still holds ~$79,000 on the Hyperliquid exchange, though funds there are harder to freeze.

1. The rug: how the insiders made their money

The setup. The developer launched HEGG on 28 September 2026. Five days later, the Hens liquidity wallet put 0.83 ETH and its HEGG into the token’s trading pool. That made it one of the market’s liquidity providers, which means its money is what other traders buy from and sell into. On 6 October the developer built a custom contract that fed the project’s revenue into the Hens liquidity wallet’s position specifically, 19 times. No other liquidity provider could use it. So the project itself was topping up an insider’s position.

The exit. On 24 October at 05:57 UTC, the Hens liquidity wallet pulled its whole position out of the pool. It took 2.54 ETH, three times the ETH it had put in, because buyers’ money had flowed into its position as the price rose. It also took about 52,000 HEGG, and that evening it sold the HEGG. The price fell 46% on that one sale. Meanwhile the top HEGG seller sold about 122,000 HEGG between 16 and 24 October, most of it in the last two days.

The profit. Together the two wallets put about 2.65 ETH (~$6,200) into HEGG and took out about 13.4 ETH (~$31,200). That is roughly $25,000 profit, five times their money. On 26 October both wallets moved everything to Ethereum within the same minute and converted it to $30,300 in USDC.

The NFT money, the bigger prize. The paid Hens sale opened on 16 October 2026 at 0.012–0.024 ETH per Hen. Players bought 2,447 Hens in 1,106 purchases, 32.4 ETH in all. The 31.9 ETH (~$74,000) collected before the exit was moved off the chain in one go at 11:21 PM ET on 24 October, the same day as the dump. Three minutes later it went to a one-time order address at ChangeHero, an instant-swap service, which paid the customer out in another coin or on another chain. Only ChangeHero’s private order record shows where. That is three times what the HEGG dump made. About 1.2 ETH of it was the insiders’ own money: on 15 October the Hens liquidity wallet and the top HEGG seller funded 34 fresh wallets that bought 100 Hens, so the team was partly buying its own NFTs.

Where the NFT money likely went (not proven). ChangeHero’s records would show who received the $74k, and we can’t see them. Using the best evidence available to us, this is our strongest candidate: - 18 minutes after the ChangeHero order, a brand-new wallet (0xb02e1e357d1b06c98102fb42bef7b838f2226b0f) received 30.98 ETH, the order amount less a normal swap fee. It came from a HitBTC-funded payout wallet (publicly listed as using Union Chain software), and ChangeHero has publicly listed HitBTC among the exchanges it trades through. - The next day the wallet swapped it to about 71,300 USDC, split 21,000 across four more fresh wallets, and since 30 October has paid about 49,706 USDC, in steady amounts, into one payment service. About 21,620 USDC remains across the five wallets. - The Hens liquidity wallet paid the same service the same amounts: a A$100 test and then about A$4,900 in August, and A$2,500 on 23 October, about six hours before it pulled its liquidity. - The service’s pricing matches Living Room of Satoshi, an Australian service that converts crypto into payments to Australian bank accounts. Its published exchange rate sits about 6.4% above the market rate, the same markup seen across the service’s deposits for years.

New 9 November UTC payment receipts (R88–R91): the suspected NFT payout wallet paid 3,593.28 USDC and, 12 minutes 24 seconds later, the Hens liquidity wallet independently paid 1,392.03 USDC. Both payments were forwarded to the same payment-service wallet. Zebra had used that service a year earlier, sending funds through a different deposit address in October 2025. The latter LP1 payment is not part of the NFT proceeds. Across the five candidate NFT wallets, 46,989.99 USDC had reached the collector and 24,336.30 USDC remained at Ethereum block 26,374,747 (8,408.75 USDC in the main wallet). This strengthens the shared-collector link but does not identify its operator or final recipient.

Australian-dollar cross-check (provisional): at Living Room of Satoshi's published rate recorded on 8 November 2026 (1 USDC = A$1.3676), the two new payments correspond to approximately A$4,914 and A$1,904—close to A$4,900 and A$1,900. This reinforces the round-AUD pattern already documented for the suspected payment service. The rate is a dated snapshot, not a quote from the exact transaction times; the service identity and actual AUD settlement amounts remain unconfirmed.

Top HEGG seller follow-up (9 November UTC, R92–R94): At 03:57:59 UTC, b3cab sent 1,834.90 USDC into a new deposit address. One minute later it reached the same payment-service wallet already used by the suspected NFT payout route, LP1 and Zebra's network. b3cab separately paid 0.828455 USDC to its previously used fee address. At the recorded 8 November rate, the larger payment equals about A$2,509, close to the existing A$2,500 pattern; actual AUD settlement is unconfirmed. LP1 and b3cab then held 20,093.44 and 10,819.19 USDC respectively, or 30,912.63 USDC combined. The NFT-wallet proceeds remain separately accounted for.

Additional NFT-cluster checkpoint (9 November UTC, R95–R98): Side wallet 0xf0e5a19bd44f41181437b90074745f9ae927ef27 sent 2,202.74 USDC at 11:29:35 UTC to deposit address 0x4014d05ca47b540a9ca88a998b7030ec5010b9ac (R95), forwarded at 11:30:47 UTC (R96); it sent another 513.66 USDC at 12:24:47 UTC to 0xa124fe7382bec2e1ec060a69afcd267758c731d8 (R97), forwarded at 12:25:59 UTC (R98). Both deposits reached the same existing payment-service receiver 0x1f2deef0066b5ea22d703f434df7733ab6b93be8; forwarded amounts are not additional proceeds. Cumulative suspected NFT-cluster service deposits rise to 49,706.39 USDC, with 21,619.90 USDC still held across five wallets at Ethereum block 26,378,310 (8,408.75 USDC in the original wallet and 4,076.18 USDC in this side wallet). At the 8 November reference rate of A$1.3676 per USDC, the new amounts correspond to approximately A$3,012.47 and A$702.48, close to A$3,000 and A$700. The rate is not a transaction-time quote, and the payment-service identity, AUD settlement and recipients remain unverified. LP1 and b3cab service payments are separate from these NFT-cluster totals.

Public payment-feed comparison (9 November 2026): Living Room of Satoshi's public feed, captured at 16:53:20 UTC, showed at least five USDC payments matching the expected Australian-dollar amounts and approximate hours of Hens-linked deposits: A$4,900, A$1,900, A$2,500, A$3,000 and A$700. Each of the five documented amount-and-hour combinations had one matching row in the captured feed; this is not an exhaustive count of all possible matches. This makes Living Room of Satoshi the likely service, more strongly than exchange-rate similarities alone. The feed does not supply transaction hashes, sending wallets, customer identities or bank settlement receipts; the individual matches remain circumstantial. Source: https://www.livingroomofsatoshi.com/graphs; preserved 9 November UTC feed capture in 6_Receipts.zip.

Shared payment-service connection: the same collection wallet has received funds routed from Zebra, its predecessor and funding wallets, other Zebra-linked wallets (including 028044 and Cable Alpha Leader), the Hens liquidity wallet (LP1), the top HEGG seller, and the suspected NFT payout cluster. That common destination strengthens the connection between the suspected NFT payout route and the wider Zebra/Hens network, but because this is a commercial payment service it does not, by itself, prove a shared customer or common control.

Twelve individually documented sender addresses — representative service deposits (Ethereum):

Zebra predecessor — 0xa3b04015a3d86d0ab9a6d54086f523afb756986f · deposit (1.1882 ETH)

Zebra main wallet — 0x41316a07012aaeaca79b12df40dbf2f3e0f9bda2 · deposit (0.2018 ETH)

Zebra-linked 028044 — 0x02804443b94728a7c2ebc4e49e7faef8cadfae77 · deposit (0.4576 ETH)

Zebra funding (EAD697) — 0xead697c62da4eec160aca375b791a8f8b0cf23b5 · deposit (0.3823 ETH)

Zebra group hub — 0xcc1e3688997fd4e1ac6e995d11320cae47346194 · wallet · deposit (1.1473 ETH)

Zebra-linked funder 119cd7 — 0x119cd7966c62b8f66cd5098308913c7a6c418dcd · wallet · deposit (0.0592 ETH)

Cable Alpha Leader — 0x7eebbc1857496dcdb606a21d7b4118a0ebacb527 · deposit (979.33 USDT)

Hens liquidity (LP1) — 0x8d2c8b60c12e2df344d0a33319509ae1a72d3d69 · deposit (1392.03 USDC)

Top HEGG seller — 0xb3cab79db9aedc103c38d2a70d05a3148cb2713c · deposit (1834.90 USDC)

Suspected NFT payout wallet — 0xb02e1e357d1b06c98102fb42bef7b838f2226b0f · deposit (3593.28 USDC)

NFT-linked side wallet — 0xf0e5a19bd44f41181437b90074745f9ae927ef27 · deposit (2202.74 USDC)

NFT-linked 5k side wallet — 0x7583f882922f577f0c35a7fbdda98a69d23e8d69 · wallet · deposit (1865.03 USDC)

Each linked deposit was routed toward the common payment-service collection wallet. The deposit is counted once; forwarder transfers are not additional payments. The NFT-group cumulative amount now reconciles to 16 individually listed deposit transactions across three sending wallets in the accompanying ledger. Shared service use does not prove common control.

Historical collector audit (9 November UTC): 27 additional verified transfers from two already Zebra-linked wallets reached the same service collection address: 24 deposits totaling 20.7698 ETH from group hub 0xcc1e3688997fd4e1ac6e995d11320cae47346194, and three totaling 0.129 ETH plus 861.04 USDC from funder 0x119cd7966c62b8f66cd5098308913c7a6c418dcd. The 16 NFT-cluster deposits are now individually documented, and the separate unlinked December 2025 wallet is excluded. No new developer-project link was established.

Consolidated service-use ledger (identified tracked wallets, through 9 November UTC). The existing records now combine Zebra’s predecessor (12 ETH deposits), Zebra itself (one), Zebra-linked 028044 (one), the EAD697 funding wallet (five), Zebra group hub (24 ETH deposits), Zebra-linked funder 119cd7 (three mixed ETH/USDC deposits), Cable Alpha Leader (one USDT deposit), LP1 (five mixed ETH/USDC deposits), the top HEGG seller (one), and the suspected NFT payout group. Across these documented senders the separate asset totals are 59,458.08 USDC, 979.33 USDT and 47.0587 ETH; these are not a single dollar-valued total. They include 49,706.39 USDC from the NFT payout cluster, 7,055.75 USDC plus 0.4022 ETH from LP1, and 1,834.90 USDC from the top seller. The developer’s separate HitBTC cash-out is excluded. The complete itemization, dates and receipt links are in the new LRoS ledger workbook tabs and its accompanying CSV; historical coverage is not exhaustive.

This is not proven. Each piece has innocent explanations on its own: transfers of that size are not rare, the payout wallet serves many HitBTC customers, the service has many customers, and the payment-feed matches do not identify individual customers or prove the final bank settlements. If it is the right route, though, it leads straight to a name: Living Room of Satoshi must verify every customer’s identity under Australian anti-money-laundering law, and it supports bill payments and transfers into Australian bank accounts. Its records would show the customer and the receiving accounts, without proving which kind of payment was made from blockchain records alone.

Where the cash went. The developer, the top HEGG seller and Zebra’s funding wallet all cashed out through HitBTC, a small exchange. Section 5 explains why that matters.

2. Where the insiders’ money came from: Zebra

Tracing the team’s money backwards keeps returning to one wallet: 0x41316a07012aaeaca79b12df40dbf2f3e0f9bda2.

This wallet names itself Ice Station Zebra. It holds the Avalanche name icestationzebra.avax, registered by its predecessor wallet in January 2023 and passed down to it. It holds the legendary cube-head Chikn NFT #86 “Jeff”, which the Ice Station Zebra persona showed off on social media. It also plays the Chikn rooster-fighting game under the name “Station of Iced Zebras”. And when the persona mentioned in the Chikn Discord that it had sold a Chikn by accident, that sale (#6391, March 2023) turns out to have come from Zebra’s predecessor wallet, to the exact minute. Nobody suspected Zebra before the Hens money led here.

Zebra gave the first money to the wallet that bankrolled the dump. On 30 October 2025, Zebra sent 0.7 ETH to a brand-new, empty wallet: Zebra’s funding wallet. It was that wallet’s very first money. Twelve minutes later, $77,000 arrived in it, withdrawn from the Binance and Bybit exchanges. This is a recognisable pattern. Someone sends a little ETH to a fresh wallet to cover fees, then withdraws their own exchange balance into it. One person doing both is the natural reading.

That money became the dump. In March–April 2026, Zebra’s funding wallet sent the Hens liquidity wallet $30,400. The Hens liquidity wallet parked it on the Hyperliquid exchange and moved it onto Robinhood Chain when needed. For example, on 3 October it brought 1.83 ETH onto Robinhood at 07:35, and eight minutes later, at 07:43, put 0.83 ETH into the HEGG pool. That is the same position it pulled out on exit day. Zebra’s funding wallet also gave the top HEGG seller 1 ETH. So the chain runs: Zebra seeds its funding wallet → $77k of exchange money lands in it → it funds the Hens liquidity wallet and the top HEGG seller → they build their HEGG positions → they pull out and dump for $25k profit.

Zebra stayed hands-on. On 11 October 2026, Zebra’s funding wallet was in the middle of a three-minute run of trades and came up 0.027 ETH short. Zebra emptied its own wallet into it, and the funding wallet completed its deposit 48 seconds later. On 15 October, Zebra paid the Hens admin’s fees. One minute earlier Zebra had moved the money onto Robinhood Chain, and the admin started a 122-transaction work session 13 minutes after Zebra’s payment. Someone who is merely friendly with a team doesn’t do this. It looks like one operator moving between wallets, or someone working in real time with the team.

Still together after the rug. On 8 November 2026, Zebra’s main wallet and Zebra’s funding wallet both paid the same brand-new wallet, six minutes apart, between 10:26 and 10:33 pm Sydney time. That wallet then moved the money (about US$1,600) to a newly opened network. Two wallets paying one new wallet within minutes points to one person controlling both, and it shows Zebra still running the funding wallet.

A new token, due on 15 November. A third wallet that paid that same new wallet on 8 November, 0x591b9478cf3164f85084bdfc9a2bf44965c3c1ee, funded the wallet 0x39fb186631d39684754345a93b9f5dac65dedde9, which seven minutes later created the launch contract for a new token, WEAVE (0x4af85f314Cf3925956F75aB0d4567e35a5362Af6), on Robinhood Chain. The recorded token-launch schedule was 15 November 2026 at 00:00 UTC, with 20 million tokens set aside for four “founder” wallets. The project’s website, weavefi.xyz, was registered five days before the Hens rug; its white paper was saved on an eastern-Australian clock; its contracts were deployed during Zebra’s waking hours; and 0x591b… uses the same smart-account setting as Zebra and the Hens team. 0x591b… is tied to Zebra by the 8 November payments, the same wallet setting and the same clock, and the work overlapped: Zebra’s funding wallet and the Weave developer wallets were active within a minute of each other, as if one person were switching between them. Its first money appears to have come from the Hens team’s own cash-outs: three times, the deployer, the NFT sale wallet and the top HEGG seller paid ETH into HitBTC, and minutes later a new wallet received almost the same amount from a large exchange. The candidate deployer and sale-wallet payouts landed in the same wallet, and both receiving wallets are in this family.

Why Binance and Bybit matter. Another wallet in Zebra’s group deposited $81,000 into Binance and Bybit in March and April 2025. These are the same two exchanges that put the $77k into Zebra’s funding wallet six months later. On their own, two big exchanges prove little. But it gives investigators one precise question for each exchange: is the customer who made Zebra’s group’s 2025 deposits the same one who withdrew the $77k into Zebra’s funding wallet? If yes, the $77k was Zebra’s group’s own money too. Zebra’s money is already in the operation either way: it seeded the funding wallet, topped it up in real time and paid the admin’s fees.

3. Zebra’s wallet group, and the “Boxhed” name

Zebra is not one wallet but a group of wallets run together. The clearest proof is one Kraken customer account that Zebra and two other group wallets all paid into in mid-2024. Paying the same exchange deposit address means paying into the same person’s account. In September 2024, Kraken withdrawals created three fresh wallets, and all three later sent money into Zebra’s Solana wallet, about $207,000 in one day (19 January 2025). The timing points to the same Kraken account, but only Kraken can confirm that.

The group launches its own projects, under the name “Boxhed”: - 2023: a “BoxHeds” NFT collection on Ethereum, deployed by a group wallet. - January 2024: a group wallet registers the name boxheds.avax, and still holds it. - February 2024: a “Boxheds” token on Avalanche. A core group wallet that Zebra had sent tokens to deployed the first version. Other group wallets funded, built and supplied it, including one that Zebra pays directly.

The HEGG commit is attributed to a GitHub account called Boxhedlecky, created on February 20, 2024, the day Zebra’s wallet group launched Boxheds on Avalanche. The matching name and creation date support investigating a possible development connection. The commit is dated 14 minutes before HEGG’s first trade; this is not a verified publication time. The commit’s unsigned author metadata does not establish who wrote or pushed it, who controlled the account, or involvement in the later exit. Possible explanations include a shared developer, reused author settings, copied history or deliberately assigned attribution. None is established or ruled out by this clue alone; a shared developer would not by itself prove involvement in the exit.

The commit’s unsigned author metadata does not establish who wrote or pushed it, who controlled the account, or involvement in the later exit. Possible explanations include a shared developer, reused author settings, copied history or deliberately assigned attribution. None is established or ruled out by this clue alone; a shared developer would not by itself prove involvement in the exit.

4. Exit day: Zebra dumps alongside the insiders

The Hens liquidity wallet pulled its money out at 05:57 UTC on 24 October. Zebra started selling its Hens NFTs at 06:29, 32 minutes later, and sold all 34 before the public warning (1:17 AM ET on 25 October). Two minutes after Zebra’s last sale, Zebra’s second wallet sold 6 more to the same buyer. Between the liquidity pull and the public warning, Zebra’s side made about half of everything Hens holders sold (40 of 79), while the rest of the market was almost silent. The amount was small (~$860). The timing is the point: Zebra moved with the insiders, not with the public.

5. “I built Cable”: the persona’s own words

On 14 February 2026, Zebra’s own Discord account, “ISZ” (username choogiewoogie, earlier kaankaant), posted in the Chikn Discord: “A lot of you would know me from the early days of Chikn so I wanted to share something I built.” It linked cable.ninja: Cable is a crypto platform for swapping tokens between blockchains, with copy-trading bots that trade on-chain on the Hyperliquid exchange, where each bot is a public on-chain vault. ISZ is Zebra’s account: in the Chikn community it goes by Ice Station Zebra and talks about Jeff and the other NFTs held in the Zebra wallet.

Cable’s own website names the Hens liquidity wallet. The site advertises six copy-trading bots. Its own code lists the Hyperliquid account behind each one. The bot called “Berserker” is run by the Hens liquidity wallet, the same wallet that later dumped HEGG.

Zebra’s funding wallet paid for the bots. On 12 March 2026 it sent about $530 each to four wallets within 84 seconds. Fifteen minutes later each created one of the Cable bot vaults. In May, the bot accounts swept their money into one of them within two minutes, so one person was running them all.

So Zebra, in their own words, says they built the very project that Zebra’s funding wallet paid for and the Hens liquidity wallet helps run.

6. It happened before: Astroturf (TURF), 2023

In April 2023, Zebra’s migration wallet (the one that passed the Jeff NFT to Zebra) sent 100 AVAX to a brand-new wallet. Five minutes later that wallet launched a token called Astroturf (TURF). The migration wallet then bought some itself, and community members flagged it at the time as the “Turf funder”. A week later the developer sold its tokens and deleted the token’s Twitter and Telegram. The money was small, but the pattern is the same as Hens: a Zebra wallet bankrolls a fresh developer wallet, then the developer dumps and the socials vanish.

Most of the TURF developer’s money later ended up back in Zebra-group wallets.

Hens also wasn’t the group’s first launch. Besides TURF and the Boxhed projects, a Zebra-group wallet launched a token called Big Dog in December 2023, and group wallets deployed another, Brojak, five times in 2024; one copy’s ETH went straight back to the Zebra wallet that later paid the Hens liquidity wallet. In August 2026, a month before Hens, money from Zebra’s funding wallet reached the launcher of GLIZZY minutes before it went live, and a wallet that traded with the Hens liquidity wallet launched BILL and CAMBODIA. Zebra’s group is used to launching tokens.

7. Same place, same habits

Same corner of Australia. The Boxhedlecky commit on 28 September carried a +10:00 clock setting. The other Hens code account committed at +11:00 on 9 October. Each matches southeastern Australia on its date, before and after the 4 October daylight-saving change (Sydney, Melbourne, Canberra or Hobart; Brisbane stays +10). Zebra’s wallets show a compatible activity pattern: across southeastern Australia’s daylight-saving changes, their daily schedule moved by about an hour in the direction that clock predicts. These are two accounts, each observed on one side of the daylight-saving change; they do not demonstrate a single clock switching. The observations support a regional hypothesis, not proof of location or common control.

Same sleep schedule. For years, Zebra’s wallets go quiet between midnight and 6 am eastern-Australian time, weekends included. Every hand-operated Hens team wallet shares that gap. Among 76 active Hens players, only 3 others do, and we checked them: none are connected. Community members also described the Hens developer as Australian, citing Australian slang. Zebra has referred to Australia as their home: on 14 March 2022, replying in the Chikn Discord to a question about Australia, Zebra’s account (ISZ) wrote, “Much of the centre of the country is desert, our immense coastlines are forested paradise tho.”

Same exchange habit. Zebra’s group has used HitBTC, a small exchange, at least 132 times since 2023. The Hens team’s exit cash-outs went to HitBTC too, which is rare among Hens holders.

Same wallet setup. Zebra, the developer and the Hens liquidity wallet all use the same smart-account software. Only about 1 in 80 Hens addresses use it.

What this adds up to

Someone could try to explain away any one of these on its own. Taken together, they tell one story: - Zebra’s group has run its own token launches since 2023. - Zebra gave the first money to, and topped up, the wallet that bankrolled the dump. - Zebra paid the admin’s fees minutes before its main setup session. - The Hens code was published under an account born on Zebra’s Boxheds launch day. - Zebra dumped right after the insiders. - The setup made Hens look busier and safer than it was: the team minted 100 of its own Hens right after launch, and its own wallet supplied the token’s main liquidity until it pulled out. - Zebra’s own Discord account (ISZ) says Zebra built Cable, and Cable’s website names the Hens liquidity wallet as a bot operator. - Zebra’s wallets have launched tokens before. One of them, TURF (April 2023), dumped and deleted its socials, like Hens. - Zebra and the team keep the same Australian hours. - After the rug, the team’s cash-outs likely funded a new wallet family that is launching WEAVE on 15 November, and that family paid the same new wallet as Zebra on 8 November.

Our reading: Zebra is either the whole Hens team or the leader of a small team in the same part of Australia. Zebra’s group controls the money and ran the earlier launches, which points to Zebra being in charge rather than working for someone else. The evidence points to one person: Zebra and every hand-run team wallet keep the same sleep schedule, and on Robinhood Chain they take turns rather than acting at the same time, the pattern of one person switching between wallets. Zebra also covered the funding wallet’s shortfall mid-trade within seconds.

Still unknown: whether anyone helped Zebra (the evidence points to one person), who received the $74k of NFT money (we have a likely route, in section 1, but it is unconfirmed), and any real-world name (only handles are known, including ISZ on Discord). On 13 April 2024 the X account “Zebra Station” (@stationofzebra) said they were logging out “for good” and would see people “on my main”. So the persona is an alt, and the main account is unknown.

How this was traced

Everything here comes from public records, mostly blockchain data, followed wallet by wallet across eight networks. Where money crossed between chains, it was matched using the bridges’ own records, such as Chainflip swap records that name the destination wallet and Mayan’s order history for Zebra’s Solana wallet. Exchange deposits were traced to the customer’s own deposit address, which is how the shared Kraken account turned up. Because Robinhood Chain’s explorer was missing many transactions, the key figures were rebuilt from the chain itself. Every key transaction was fetched again between 4 and 8 November 2026 and is in the Receipts file.

Next steps: putting a real name to Zebra

The on-chain evidence already ties Zebra to the Hens team. What public records can’t show is the real person behind the wallets, or whose exchange accounts the money went through. These records would show that, and they need law enforcement or a lawyer: 1. Circle: determine whether the ~$30,913 USDC still held by the Hens liquidity wallet and top HEGG seller could be restricted under applicable law and policy; restriction is not recovery (time-sensitive). 2. Binance and Bybit: who withdrew the $77k into Zebra’s funding wallet, and is it the same customer who received Zebra’s group’s 2025 deposits? 3. ChangeHero: two private order records. One for the $74k of NFT money (order address 0x88c532ad000138de5791860ef5fb7a43a3f21d77, 25 October 2026 03:24 UTC), which shows where it came out. The other for the developer’s very first money, 0.3653 ETH that ChangeHero paid out to the Hens deployer 0xcc835f851c2ed175e74cc312861e26b3a1f9ff51 on 26 September 2026, which shows who paid for it. ChangeHero sits at both ends of the operation. 4. Kraken: the owner of the account Zebra’s group paid into. Kraken operates in Australia as Bit Trade Pty Ltd, registered with AUSTRAC. 5. GitHub and X: the email and login records behind Boxhedlecky and @stationofzebra. 6. HitBTC: the accounts behind the team’s cash-out deposits, including the developer’s and the top HEGG seller’s deposits of 26 and 27 October 2026, which look like instant-swap orders paid out to the Weave family. 7. Living Room of Satoshi (suspected operator of the payment service at 0x1f2deef0066b5ea22d703f434df7733ab6b93be8, unconfirmed): the verified customer and destination bank accounts behind the payments from 0xb02e1e357d1b06c98102fb42bef7b838f2226b0f and its side wallets (26 October – 9 November UTC 2026) and from the Hens liquidity wallet (20 August, 23 October and 9 November UTC 2026). 8. Discord: the account behind “ISZ” (choogiewoogie, earlier kaankaant). 9. Weave: GoDaddy and Microsoft for the account behind weavefi.xyz (registered 19 October 2026, five days before the rug), Vercel for its hosting, and X and Telegram for @WeaveFi_xyz and its group.

This is an investigation summary, not an accusation. Wallet links show money and coordination, not who held the keys. The Full Report walks through every link, and the Receipts file holds the raw transaction records.

Key wallets

Zebra (“Ice Station Zebra”)
Code in the detailed reports: 413
0x41316a07012aaeaca79b12df40dbf2f3e0f9bda2

Zebra’s funding wallet
Code: EAD697
0xead697c62da4eec160aca375b791a8f8b0cf23b5

The Hens liquidity wallet
Code: LP1
0x8d2c8b60c12e2df344d0a33319509ae1a72d3d69

The top HEGG seller
Code: b3cab
0xb3cab79db9aedc103c38d2a70d05a3148cb2713c

The developer (“HenBok”)
Code: Hens deployer
0xcc835f851c2ed175e74cc312861e26b3a1f9ff51

The admin
Code: Hens admin
0x582a99d6ba8da5d3ed5ffda2cfcd3196a9c2ee53

Zebra’s group wallet (Binance/Bybit deposits)
Code: 028044
0x02804443b94728a7c2ebc4e49e7faef8cadfae77

Zebra’s group Kraken deposit
0x15cc06d6a3f3d4a58fecd729787435fa87917e3b

HitBTC wallet that both cash-out routes reached
0x80787af194c33b74a811f5e5c549316269d7ee1a

Weave wallet family (paid the same new wallet as Zebra on 8 Nov 2026)
0x591b9478cf3164f85084bdfc9a2bf44965c3c1ee

WEAVE launch contract / WEAVE token (Robinhood Chain, launch 15 Nov 2026)
0xB0351ac6FBB85415fC444E858f59728526296a74 / 0x4af85f314Cf3925956F75aB0d4567e35a5362Af6

Publication clarification — 9 November 2026

Evidence cutoff: 9 November 2026 UTC. Balances are dated observations, not live balances. The 15 November WEAVE token-launch date is the announced schedule recorded in this evidence, not a guarantee that trading will begin then.

The commit’s unsigned author metadata does not establish who wrote or pushed it, who controlled the account, or involvement in the later exit. Possible explanations include a shared developer, reused author settings, copied history or deliberately assigned attribution. None is established or ruled out by this clue alone; a shared developer would not by itself prove involvement in the exit.

These are two accounts, each observed on one side of the daylight-saving change; they do not demonstrate a single clock switching. The observations support a regional hypothesis, not proof of location or common control.

Use of the same commercial payment service does not by itself establish a shared customer, common control, an Australian-dollar settlement, or the identity of a beneficiary. The Living Room of Satoshi attribution and the candidate exchange payouts remain inferences pending private records.

Editor’s note: We contacted Zebra directly and gave them 48 hours to respond. We also publicly announced that we were seeking comment from people we suspect were involved. Zebra did not respond within that period.

Reporting by @_lilrag. You can support our investigators with donations to 0x08A8f3F517B8B0e4B60295AE22dB0D9833AD5460.

Current transaction index

The workbook contains R01–R98 plus HL1. Browse all 99 transaction entries and original receipts →