Finiko: why the published numbers cannot all be right, and what the chain actually says

The one public list of Finiko Bitcoin addresses we could find is TokenScope's: fifteen addresses, and the basis for their 14,234.14 BTC. We enriched all fifteen against our own graph before walking them. Three are not Finiko's at all:

The first two alone account for 11,905 BTC of the set’s 22,637 BTC gross — more than half. Any total computed over this list is measuring, in large part, Coinbase and Vexel.

This is not a small correction to someone else’s work. It is the reason a number stated to the cent should never be quoted without the addresses that produced it.

That left us needing an address we could stand behind without trusting anyone’s list. Press reports from November 2021 said 750 BTC left the scheme as three transfers of 250 BTC to a single address, then on to an exchange. None of them named an address or a transaction.

The chain has them. Three transfers, 3, 6 and 10 November 2021, 250.0000 + 250.0000 + 250.4910 BTC, all from 328zFd28B4WpdGwuDSnYw7BAEtZQc41Lrk to one destination — bc1qgyu6rn65rf8ylgzmrq5vu7chfy8cn6x4kjls5y, an address that appears in no publication and has carried 12,956 BTC across 126 transactions.

Amount, dates and structure match a report written without them. That is one address we can build on, and it is the only one we did.

From that address outward, following flows of 20 BTC or more and checking every hop against our own graph before accepting it, the branch comes to 33 addresses and 375 transactions between 2 September 2020 and 12 November 2021.

The test that the arithmetic is right is the last line. Every address in the set is empty today, so external inflow minus external outflow minus current balances must be zero, and it is — exactly, to the satoshi.

The line above it is the finding. 34,075 BTC moved between members of the set, four times the money that actually entered it. A gross total — adding up what each address received — reads about 42,285 BTC for this branch. The real figure is 8,210. The inflation is not fraud or sloppiness; it is what happens when the same coins are counted again at every hop they take.

The 33-address branch is not where investors paid in. It took 117 deposits with a median of 20 BTC — treasury movements, not retail. One tier below it sit the addresses that fed it. We took the 30 largest and walked the 23 that our graph did not already know as exchanges.

They split cleanly in two. Ten send their money only or mostly into the branch — four of them all or nearly all of it — and between them received 5,928 BTC. The other thirteen paid the branch too, but sent most of what they held straight into the same exchange wallets the branch emptied into. They received 14,637 BTC, and we do not count it as Finiko’s.

An earlier version of this piece added all twenty-three together, 20,565 BTC, and set that against the 14,234 BTC TokenScope published for the whole scheme. That comparison does not hold, and we have withdrawn it. What remains true is narrower: the published figure cannot be reproduced from the chain, and ours cannot be stretched into a total either.

The branch emptied into a set of 38 addresses linked by common input. That set handled 194,933 BTC across 4,026 transactions between July 2019 and January 2022, with 8,800 BTC going on to a Binance deposit, and its inflow and outflow close to zero.

It is not a tier of the pyramid. 3,764 of its 3,822 incoming transactions are sweeps, each gathering around 360 deposit addresses into one, which is how an exchange collects its customers’ deposits. Where those swept addresses carry any label in our graph, the label is Bybit; they were topped up from Binance, bitFlyer, Gate and KuCoin; and the sweeps carry on at 7,000 to 8,000 BTC a month after Finiko stopped paying in July 2021. We earlier described its inputs as 398,942 payers. They are deposit addresses at the exchange, not people.

So Finiko’s treasury cashed out at an exchange, most likely Bybit, and an exchange keeps records of who owned the receiving account. That is where this trace hands over to anyone with the standing to ask. We did not walk into it: doing so would pull hundreds of thousands of the exchange’s customers into a fraud trace. Those 38 addresses carry no label in our own graph, a gap on our side that we have reported internally.

In Bitcoin, the individual investors. Even the feeders that paid only into the branch moved money in lumps of tens to hundreds of BTC, so retail is at least one level further down, and Chainalysis’s 800,000 deposits are in none of the figures above. On Ethereum we did reach them, through the FNK token: 98,647 wallets withdrew FNK from the Finiko platform, and every one of them is now labelled. What is still missing in both chains is the addresses investors PAID INTO.

So we are not publishing a Finiko total, and nobody should read one into these figures. What we are publishing is one branch measured with the invariant closed, where its money went, and a demonstration of how far gross counting and borrowed address lists drift from what the chain shows.

On 18 September 2023, two years after the collapse, an address supplied with tokens by Finiko’s own deployer emptied the FNK/USDT pool of 13,973,817 USDT, bridged it to Avalanche and back within hours, and moved it on to HTX and OKX. Every step, with its transaction hash.

Every address below is labelled in the PublicAML risk graph and links to its page. Six are the scheme’s own wallets. Three are exchange deposit accounts that received its proceeds — a deposit address belongs to one account holder, not to the exchange, and a deposit address is the one point in a chain where a KYC record exists.

Three addresses are deliberately not flagged and are named here so the choice is visible: the Coinbase, Vexel and Binance deposit addresses that appeared in the published list, and the 38-address venue. Receiving money from a fraud does not make a business part of it, and an exchange’s own infrastructure carries thousands of unrelated customers.

Every figure was read from the Bitcoin chain on 21 September 2026 and reconciled against address balances.