Finiko’s FNK token: the $14 million taken from its pool two years after the collapse
PublicAML · On-chain investigation · 22 September 2026
On 18 September 2023 an address supplied with tokens by Finiko’s own deployer sold them into the FNK/USDT pool and withdrew 13,973,817 USDT, everything the pool still held. Within hours the money was converted to USDC, bridged to Avalanche and straight back to a fresh Ethereum address, and split. Part of it went to a Swapster deposit that same day; by 2024 the rest had reached HTX and OKX.
13,973,817
USDT withdrawn from the FNK pool, 18 Sep 2023
47,670,153
FNK the Finiko deployer sent the seller on 9 Jul 2021
2
chain hops the same afternoon: Ethereum → Avalanche → Ethereum
98,647
investor wallets the same token led us to, now labelled
Did you put money into Finiko? Check your address, or tell us where you paid →
The anchor
Finiko stopped paying in July 2021. Its token, FNK, was issued on Ethereum by 0xa89df75e20b7888ebb922f10c724fdb73c464c4f, which Etherscan labels “Finiko: Deployer”. It minted 100,000,000 FNK on 1 December 2020 and seeded a Uniswap FNK/USDT pool, 0x61b62c5d56ccd158a38367ef2f539668a06356ab. Anyone who bought FNK there paid USDT into that pool.
Everything below follows from that one label. No published address list was used.
The seller was supplied by the deployer
On 8 July 2021 a wallet that had been making the FNK market — about $300 million of trades against the pool since January — paid the gas for 0x76c9985d294d9aeadd33f451bfb59bc69b20c474. The next day the Finiko deployer sent that address 47,670,153 FNK. Days later Finiko stopped paying investors.
| When (UTC) | From | To | Amount | Tx |
|---|---|---|---|---|
| 2021-07-08 11:43 | 0x99873f…a940d4 | 0x76c998…20c474 | 0.22 ETH gas from the market maker | 0xeab234…74abb8 |
| 2021-07-09 | 0xa89df7…464c4f | 0x76c998…20c474 | 47,670,153 FNK from “Finiko: Deployer” | 0x2553d9…d869b1 |
The wallets that funded the market maker are tied to it and to each other the same way: 0x072ebb2b…, which received 50,000,000 FNK from the deployer on 21 June 2021, paid the gas of two of them, and on 28 June all three swept their leftover ETH to one address, 0xcba57ef73322e70007b8bbe9e52a0a2d42b21c01.
18 September 2023: the pool is emptied
Two years after the collapse, the same address sold FNK into the pool and took out 13,973,817.55 USDT in one transaction. That was the buyers’ money still sitting in the pool; what is left there today is 3,478 USDT against 460,878 FNK.
What followed took one afternoon. The USDT moved through two fresh addresses, was swapped to USDC on Uniswap — USDC cannot be frozen by Tether — and sent through the LI.FI bridge aggregator, Circle’s CCTP route, to Avalanche in sixteen transactions. On Avalanche it was never used: the same address sent all of it straight back to Ethereum, to a new address, where it was swapped back to USDT and split.
| When (UTC) | From | To | Amount | Tx |
|---|---|---|---|---|
| 09:26 | 0x61b62c…6356ab | 0x76c998…20c474 | 13,973,817.55 USDT sale of FNK into the pool | 0xb4e06f…c739f3 |
| 09:32 | 0x76c998…20c474 | 0x3df0f6…e6eb6c | 13,973,867.55 USDT | 0x91a149…63a2bc |
| 09:39–14:46 | 0x3df0f6…e6eb6c | 0xfb9b12…83dc72 | 13,973,467.55 USDT five transfers; first shown | 0x8efbd5…2b1adf |
| 09:49–14:53 | 0xfb9b12…83dc72 | 0x3416cf…3527c6 | ≈14.1M USDT → USDC Uniswap V3 USDC/USDT | — |
| 09:54–19:00 | 0xfb9b12…83dc72 | 0x1e2411…26f925 | 14,122,387 USDC LI.FI, celercircle, to Avalanche — 16 txs, see annex | — |
| same day | 0x1e2411…26f925 | 0x5d12a3…7b113d | 14,122,382 USDC LI.FI, celercircle, back to Ethereum — 16 txs on Avalanche | — |
| 14:23 | 0x5d12a3…7b113d | 0x3bd964…a7878e | 7,996,738 USDT the largest split; 3,999,257 went to 0xe423b02e… and 1,793,939 straight to a Swapster deposit | 0x952ee0…d6863a |
| 17:29 | 0x3bd964…a7878e | 0x95c097…c43e70 | 4,000,000 USDT | 0xf248a2…f09b29 |
| 17:30 | 0x3bd964…a7878e | 0xff9dec…f44b7b | 3,996,738 USDT | 0xe06d56…3b751d |
A round trip through a second chain within hours is not a payment. Its only effect is to break the direct link between the pool and the wallets that end up holding the money.
Where it reached exchanges
One slice went to an exchange the same afternoon: 1,793,939 USDT straight to a Swapster deposit address. The two holding wallets paid out the rest slowly, in round sums of 100,000 to 500,000, over the following months. The paths that are clear to the end:
- 18 Sep 20231,793,939 USDTSwapster
- 21–22 Dec 20232,000,000 USDTHTX
- 23 May 20241,000,000 USDTOKX
- 28 Apr, 30 Jul 20243,996,738 USDTExchange: —
Swapster, HTX and OKX hold the account records behind those deposit addresses. That is the point where this trace can reach a person, and it is a request only an investigator can make.
The same token found the investors
FNK also answers a question the Bitcoin side could not. One wallet, 0x03c8bd564f44d149bc38d06d2bec32b71c805066, sent FNK to 98,896 different addresses in 145,687 transfers between December 2020 and October 2021. The median transfer is 31.8 FNK and 72,958 addresses received exactly one; 139,000 of the transfers fall in June and July 2021, as the scheme stopped paying and people pulled their tokens out of the app. Across its whole life that wallet held three assets — FNK, USDT and ETH — so it is the platform’s own wallet, not an exchange, and the FNK deployer funded both it and its deposit addresses.
A wallet that took FNK out of that platform belonged to an investor. We screened all 98,896 and labelled 98,647 of them; the 249 we left alone are exchanges, deposit addresses and contracts. The label is identity, not risk: it carries no score and passes nothing to anyone those wallets deal with.
The wallets are still in use
Both holding wallets passed on everything they received from the pool. But they are not empty: in 2024 they were refilled from another address, 0x077e819d78c42e530da88b8abf6c320118f6a1bb, and today they hold the following. These balances are not the FNK proceeds; they are other money on wallets that handled them.
| Wallet | Holds now | Arrived from 0x077e819d… |
|---|---|---|
| 0xff9dec…f44b7b | 2,000,000 USDC | 2024-02-130x446498…62ed8f |
| 0x95c097…c43e70 | 3,000 ETH | 2024-08-050x305453…44cc54 |
Arrived from 0x077e81…f6a1bb
The address that refilled them receives USDC minted directly by Circle, which makes it a Circle Mint customer — an entity Circle has identified.
What this page does not say
It names nobody. Kirill Doronin was in custody from 2021, so whoever emptied the pool in 2023 was not him, and the chain does not say who it was.
The hub 0x574226d249225d063a6850b501525e828feebd3b paid the deployer’s gas and supplied 15 million USDT of pool liquidity in 2020–2021, but it behaves like an OTC or P2P desk and is not attributed to Finiko here.
Balances were read over public RPC on 22 September 2026 and may have changed since.
Annex: the sixteen bridge transactions
All sent by 0xfb9b12f6… to LI.FI (0x1231deb6…); each decodes to bridge celercircle, destination chain 43114 (Avalanche), receiver 0x1e2411c6…. Total 14,122,387 USDC.
Did you hold FNK? Check your address
We labelled 98,647 wallets that took FNK out of the Finiko platform between December 2020 and October 2021. Paste an address and you will land on its page, which says whether it is one of them. We do not store what you type here.
Did you put money into Finiko?
We have mapped Finiko’s treasury and the wallets that cashed it out, but not the addresses investors paid into. You know one of them. Tell us where you sent your money — a deposit address from the Finiko app, or a transaction — and we will trace it and add what we find to this investigation. Every address sent to us helps other investors find theirs.
Sources: Ethereum and Avalanche C-Chain data via public nodes and the PublicAML graph; the attribution anchor is Etherscan’s label on the FNK deployer. This is an information resource about transactions between addresses, not financial or legal advice, and it names no individual as responsible for anything.