search

safe-global / safe-user-allocation-reports

The proposed list of SAFE user allocations has been published on the Safe forum.
Creative Commons Zero v1.0 Universal
34 stars 10 forks source link

The behavior pattern of these addresses is the same #374

Closed hupeqgavec closed 2 years ago

hupeqgavec commented 2 years ago

Related Safe Addresses

0xe6e94ba16E7c752424Cff7aFA0c87602Be3e3Eec 0x705cCA342b7a36C46442C06E7117D33Be661d711 0xD66292d9EE2ddF4772dc94Fe3d2791c38ED7605F 0xF41E53A089854F71eEEA2934967C759658d8560A 0x35345E852C4b70883cB0710945Bf63BC32c01369 0x5cF25A39b7015a1F49208E88e7c45a0ad5921861 0x5Dfa97d1d1746E19Bc5FbB28213C23EB33da498e 0x72002988E532ea1cAB05Dc2AF0F730860e8Aa5C2 0xAc2caB720ce08becCb69FfE5ec9d5aAC3CDc7f3C 0x93Bb9aa2F46f3775d0ff0a916fFac650C574B96b 0xcf0574082B0E548eA57dBD4785863094f856dA2c 0xDe77b3DAA28714E8a21Ad1AE68d93BF65D7E4d34 0x8d1534aAbe5296EbBab5158d4CdfAD6723E6Ec0A 0x4429fb5D1282170c3C644bd4244700F272a71Fc5 0x4eFb649F2f426BaE720BAD46766bF93B1648a919 0x8157A6D2560840fEB273A2D6F08170b7f16DebeF 0x8B5fbcFF2B5Cd20349f4AA49eBb9242f5A401842 0x8Dd6ED429FC3B3d76e01B9aBc49418285C3e124d 0x40F40E7361621459E4C2369A7a9CfA5a42cCD3A5 0xAd9F8a27647E07914B47813c7705e2B3AE0fE0Eb 0x81B773330AA4890Ff0E205280dD00D5252187426 0x74CE9337AAb93EA1ebA2F72fAdd9DeDef3f4DdCC 0xFd083aE5A628Ef4a44A0868cf688d61ae154Eb4E 0x385601D78B1Feff84421894740B2908025B40B59 0x62828cE862FFb5E66a3B6344F0c663Bf3781B4A8 0x6d8AF9a77dFe2742a32E61d92499c3dc0004d36a 0x2e357E35596CDC6310EB4DD6712B60a09110838e 0x5A2f76fecEE91Cf622d3617626095D05f07E7D34 0x891a76e74E8C496AC1b59de0c528b8Abeb2B01Da 0xc2F38537f14c707EA75A6bFe719A8daB9Eee1f3B

Reasoning

The safe wallets above were created by the following addresses. Although those 30 safe wallets were created by different addresses. but I truly believe those addresses belong to same person. The evidence is shown below.

ihwww.eth: 0x3b174445371dd00fb766357f29118ac6a0aeec1c xgejq.eth: 0x1D7375A6FFc5a60B435558859a2762CFd6C6b07f nsqlw.eth: 0x2338E4897119a104a3145F7b500fE98B51A56637 qybxi.eth: 0x66109B3b6348d1dF6bF1f8d998e527b967f682EA obyer.eth: 0xee33d688fe27a3a754435c50f8a12654d5327a16 fgdzg.eth: 0x6069A291fC1DBbB0782A1314b6fb06e6D25B22da tbkgl.eth: 0xE8FcdB117A5f0eC16Ef040E6fE3F675390A7Bb5c hfpqr.eth: 0x8a36c41E2b7d0ee24668729d08543AB77A99DCeD plglk.eth: 0x1CD1a6C4570c039368f5456Aa82574AF6567e6F6 aqziq.eth: 0xA3728c1f3Ac52ded2fc69D3b95235d7a6fD2B377 smpkm.eth: 0xF574fBbbD0C29Ff2dbD10839E33793a6EAfde809 aqytu.eth: 0xFd7D9173403efd29F6b0b576217a59fD426170B8 szirh.eth: 0xe874411d6e354B93bE52B05280052c193550fa03 bugbu.eth: 0xA129D5436FB797ff1d9C11B5F9d3AB0e27Dd34B5 knxyc.eth: 0x4e4b40b1a3f945d6ecc00f65adba063be82439f0 lgtzz.eth: 0xdc7ec05bf7781f9e861ee5486023dc6cf71fa7c4 qepdm.eth: 0x41602b8582f474eb9c029dd502e7dda119345931 xffxf.eth: 0x7f64716cfb04ef0b78a3fcf02d3406a1b9dd0c42 amoef.eth: 0x1e265fdd0654120c739639b87e967f65339aa4cf tnfps.eth: 0xe274ae86ff13c1bbaacd3662ec5fd7279a18e28f xggbi.eth: 0xb4d50b4e31181a004beb14e8b0a522bb434ea1fe weigu.eth: 0x1d0239e4e185f5f3fba605897849744ae8b5f333 xkyoy.eth: 0xc9ac69013f041ebee6009bed69047db1a795dbe9 oqtgh.eth: 0x02e9e647e041854ad3c4c56d8c4f4b69c68a7682 ydlup.eth: 0xf9039ae1e299486d8e6c5740ca6340797fd42736 onzjq.eth: 0xbafaf28d01aefec4cf16830d2187becd502c6e0f ntqbd.eth: 0x33d7147b957c1d1d0bb17d2b09e1d85e86be9873 lgxbl.eth: 0x81d53cd3e96fd8d51cef3de47e546d0b325af8bf pypke.eth: 0xd57e9df75381553ce9c154712ac7f73eb206bd63

  1. Those addresses have the same historical behavior pattern

1.1 Start from May-18-2022 : Create Proxy -> Receive 0.0995 ETH from FTX -> Deposit Pending Funds to Aztec -> Deposit ETH to Arbitrum

1.2 Start from May-18-2022 : Deposit Pending to Aztec 0.0104E - > Transfer 0.001E to oxmons: Multisig -> Pledge 0.002E

  1. The interaction with safe wallets are the same.

The only interaction with the safe wallets is transfering USDT from safe wallets to one of the 30 addresses. This kind of transaction is meaningless and is a typical behavior for airdrop hunters.

image

image

image

Examples: https://etherscan.io/tx/0xcd49be8c3022d8a6b45bf82b6b6bc74b370064ca139809742733f73cfc2e6848 https://etherscan.io/tx/0x763c38912ef35b1feebdf4d059f413e1cddaf66fe95f176f42f7bdbe63c1fd3a ... https://etherscan.io/tx/0x3926342c68ab318d955425ab72df703af02c839879837549479447a760bca6d2

  1. All of the safe wallets were created on the same day

  2. Those addresses sent transactions at the same time.

  3. All of the addresses have 5 characters ens domain. Those addresses must belong to one person.

    Methodology

I searched addresses that have very similar historical transaction patterns. And then divided into the safe wallets they created to check whether they have similar interactions with those safe wallets. All in all, I am 100% that the 14 addresses and 14 safe wallets belong to the same person based on the above envidence.

Safe Address

0x7675be26622B0885d96e2969f9681aF0E270E6a6

PulsarNetwork commented 2 years ago

already identified in https://github.com/safe-global/safe-user-allocation-reports/issues/294

tschubotz commented 2 years ago

Thanks for the report @hupeqgavec . All Safes have been found by another report already.