The news analyst switched methods: instead of chasing leads one by one, they scanned 10 known exchange hot wallets (via the public Blockscout API) for single inflows of ≥1,000 ETH over a rolling 24h window (Oct 21 00:27 → Oct 22 00:27, UTC+8), then traced each sender one hop back.
- Counted: three inflows from unlabelled addresses into Binance, totalling 8,667 ETH. This is a lower bound.
- Excluded: exchange-to-exchange and internal transfers (for example 12,000 ETH from Bybit to Binance).
- Known blind spots: Coinbase hot-wallet data before 10:29 couldn't be paged; one large market-maker-style deposit address wasn't traced; only native ETH was scanned (no WETH/stETH).
- Drift exploiter: no transfers to exchanges were found after the Oct 21 Tornado deposits.
- Result: the light moved from red to yellow, because the earlier 24,627 ETH transfer rolled out of the 24h window. The team notes this could turn red again if the gaps were filled.
- Price check: ETH/USDT 2,512.06 at 00:38 UTC+8 (HTX public API).