The Frank consolidation: two attested thefts, one cash-out hub

This case ships inside the free Chain Insights devkit — every step below can be reproduced locally against the bundled Bittensor dataset, then replayed against the live graph.

The complaint

A subnet-15 participant attested three thefts between March and May 2024. The first — 150 TAO on 24 March 2024 — moved directly to an identity the case file names Frank 1 (5D9yaXf5nqrzKHqgoWMYeKqEERthvftdJB7XkrwNgQzNGrYb). A second attested theft of 70 TAO in May landed at Frank 2 (5Df97gT4omdxrwckBKs2AekbBB66fDNA6VRKR46J2iSmJGgd). The victim's own address (5ENvH2…ALVy) stays truncated here as a matter of policy.

The consolidation

Tracing forward from Frank 2 shows the pattern that gives this case its name: Frank 2 does not cash out. Its largest outbound flow — $31,833 — moves directly into Frank 1, which acts as the hub for everything that follows. Frank 1 and Frank 2 are two separate addresses on the graph, not merged into one node — that's the point: address-grain topology keeps every address individually traceable, so a consolidation like this shows up as an explicit, followable money-flow edge instead of disappearing into a collapsed identity you'd have to trust was resolved correctly.

The exits

Two deposit points took the funds off the network:

• A direct cash-out deposit at hop 1 (5EewfVmTSj6XmoEgU5MW65hmjAMqZgs6hGcmGcAiy9pVihWy) — attested in the original incident.
• A dedicated low-throughput deposit at hop 3 (5EG4XyKYDccYH4YQJhGpA829kBihKPRJmnNK5qfsEw16Qout) — only a handful of transfers ever touch it, a shape consistent with a deposit address created for exactly this purpose.

The connection

The hop-3 deposit is where this case stops being self-contained. Its largest outbound flow moves directly into 5CrmVKApX6sJybZaL1geHfzvHWeCpbavqrrXgYLCQmhehX2q — Kucoin, the same exchange that terminates the seeded laundering chain of incident 2024-05-12 (the sample investigation on our homepage). Two independently attested cases, one shared cash-out exchange. That overlap is what risk propagation is for: label one chain, and the shared destination lights up the other.

Reproduce it

Install the devkit, open a workspace, and ask your agent to trace forward from Frank 1. The graph JSON, tabular extracts, and case notes this page is built from will land in your own reports/ directory.