Investigation desk
Start with the strongest evidence
Three deep investigations, separated by what the chain proves, what it only
suggests, and what it cannot establish. Numbers are snapshot-boundary figures, not live prices
or claims of real-world ownership.
🌱FACT + STRONG INFERENCE
Genesis ADA
A closed 115-key reward-plumbing component provides a hard on-chain floor of roughly 1.694B ADA.
- Four founder allocations are anchored to db-sync receipts.
- Repeated 35M-ADA parcels share synchronized operational behavior and the same governance posture.
- The trace establishes linkage and delegation—not legal ownership, identity, or intent.
Read findings F01–F15 →
🌙FACT
NIGHT supply
All 24B NIGHT trace to one mint and conserve exactly across the extracted spend graph.
- 167,728 current unspent leaf UTxOs across 117,671 addresses at the export snapshot.
- One unidentified script address holds 25%; the top 10 addresses hold 65.27%.
- A script address is a custody-type signal, not proof of one whale or named owner.
Open the reproducible NIGHT finding →
🔐CONFIRMED + UNRESOLVED
SecondFi incident
The evidence supports key compromise, not a Cardano smart-contract or protocol exploit.
- 12.19M ADA is classified as confirmed theft; a separate ~129.43M-ADA sweep remains unresolved as theft versus protective rescue.
- 2,588 scoped wallets were cryptographically confirmed exposed from raw transaction CBOR; no private keys were recovered.
- Warehouse flow analysis cannot detect the nonce defect alone—raw signatures are required.
Review the separate incident audit →
Evidence rule: “The trace reaches,” “the address holds,” and “the transaction signed” are chain claims. A person or company’s ownership, motive, or control requires independent evidence.