Wallet Forensics and XRPL Funds Tracking

Admin Wallet Forensics Reports

Report export surface for forensic findings, support templates, and next actions.

Executive summary

Read-only XRPL wallet forensics indicates the known 81.417325 XRP movement was a destination-tagged exchange deposit to ChangeNOW.

Support template

I need help locating an XRP deposit.

Tx hash:
84F7978E290E10A8F6FBFF17D04846C9E90EDC8224A40071DB70D55458A2FD47

Amount:
81.417325 XRP

From:
rpP12ND2K7ZRzXZBEUnQM2i18tMGytXnW1

To:
rKKbNYZRqwPgZYkFWvqNUFBuscEyiFyCE

Destination tag:
614122458

Date:
Mar 05, 2026, 12:46:21 AM UTC

Outcome:
Success

Please identify the ChangeNOW order tied to destination tag 614122458, confirm the payout asset/address, confirm whether payout completed, and advise whether refund is possible if the order failed.

HTML report preview

<!doctype html>
<html>
  <head>
    <meta charset="utf-8" />
    <title>Troptions Wallet Forensics Report</title>
    <style>
      body { font-family: Arial, sans-serif; margin: 24px; color: #0f172a; }
      h1, h2 { color: #0b1f36; }
      section { margin-bottom: 20px; }
      .warn { background: #fff7ed; border-left: 4px solid #f59e0b; padding: 12px; }
      pre { background: #f8fafc; border: 1px solid #e2e8f0; padding: 12px; white-space: pre-wrap; }
    </style>
  </head>
  <body>
    <h1>Troptions Wallet Forensics Report</h1>
    <section><h2>1. Executive summary</h2><p>Read-only XRPL wallet forensics indicates the known 81.417325 XRP movement was a destination-tagged exchange deposit to ChangeNOW.</p></section>
    <section class="warn"><h2>2. Key control question</h2><p>The critical control question is who set and controlled the regular keys rpKmcC1PevAxTBRQgkYtakdGVup2K2Luqh and rJpKvdn64acBnVGNQ873JpQKujA4TAVbfN after master-key disablement.</p></section>
    <section><h2>3. Wallet inventory</h2><ul><li>TROPTIONS Issuer (Cold) (rJLMSTy77hTxqgDw9WMxCnYC8m5vhqN3FQ)</li><li>TROPTIONS Distribution + AMM (Warm) (rNX4faQ35SdtE4rDoEg8YeVLQKQ57AYyCt)</li></ul></section>
    <section><h2>4. Timeline</h2><ul><li>2026-02-07: Legacy wallet set (issuer/treasury/escrow/attestation/amm/trading) generated offline.</li><li>2026-02-18 16:00–16:01 UTC: Issuer rGSDDiG (unykorn.org) distributes UnyKorn USDT to 4 holder wallets: rKNvud9 (39.7M), rnAF6Ki (38.8M), rPqUumc (38.8M), rGhaJrY (10M). Total: ~127.3M USDT issued.</li><li>2026-02-18: rpP12ND wallet ecosystem receives XRP and multiple IOUs from rGSDDiG (USDT, GOLD, EUR, USD, GBP, DONK). rDEW3 opens a USDT trustline (50M limit).</li><li>2026-02-21: NFT burn activity observed on rpP12ND.</li><li>2026-02-25 11:06:01 UTC: SetRegularKey on rpP12ND → rpKmcC1PevAxTBRQgkYtakdGVup2K2Luqh. [CRITICAL — first key takeover]</li><li>2026-02-25 11:06:10 UTC: AccountSet asfDisableMaster on rpP12ND. Original owner loses master key control.</li><li>2026-03-04 04:41 UTC: rDEW3 sends 20,000,513.71 USDT back to issuer rGSDDiG (tx: E29E7C...934C80). IOU burned.</li><li>2026-03-04 05:15 UTC: rPqUumc sends 38.8M USDT to rGSDDiG (tx: 95D3B8...C9DBD2). IOU burned.</li><li>2026-03-04 05:22 UTC: rnAF6Ki sends 38.8M USDT to rGSDDiG (tx: 0FCFAA...177124). IOU burned.</li><li>2026-03-04 05:35 UTC: rGhaJrY sends 10.0M USDT to rGSDDiG (tx: 646C49...CA0A80). IOU burned.</li><li>2026-03-04 06:45 UTC: rKNvud9 sends 39.7M USDT to rGSDDiG (tx: 6839ED...0114DA). IOU burned.</li><li>2026-03-04 07:37 UTC: rpP12ND sends 37.6M USDT to rGSDDiG (tx: 61717F...7D4943). IOU burned.</li><li>2026-03-04 21:47:41 UTC: rDEW3 sends 8.101678 XRP to rpP12ND — topping up reserve ahead of sweep.</li><li>2026-03-04 23:47 UTC: rKNvud9 closes all trustlines (USDT, DRUNKS, DONK, GOLD set to 0).</li><li>2026-03-04 23:47:41 UTC: rDEW3 AccountDelete attempt → FAILS (tecHAS_OBLIGATIONS, USDT trustline still open). Fee: 0.2 XRP.</li><li>2026-03-05 00:24:22 UTC: SetRegularKey on rpP12ND → rJpKvdn64acBnVGNQ873JpQKujA4TAVbfN. [CRITICAL — final controller set, 22 min before theft]</li><li>2026-03-05 00:25 UTC: AMM withdraw activity on rpP12ND.</li><li>2026-03-05 00:29–00:38 UTC: rpP12ND sends remaining IOU balances to rGSDDiG (USDT 37.6M, GOLD 15M, EUR 25M, USD 60K, GBP 22.5M, DONK 2M). All burned.</li><li>2026-03-05 00:33–00:43 UTC: rpP12ND closes all trustlines (DONK, USDT, GOLD, GBP, EUR, USD all set to 0).</li><li>2026-03-05 00:38 UTC: IOU drain complete. rGSDDiG now shows 0 IOUs issued, 0 held. Entire USDT supply destroyed.</li><li>2026-03-05 00:46:21 UTC: FINAL SWEEP — 81.417325 XRP sent from rpP12ND to ChangeNOW (rKKbNYZR...) destination tag 614122458. Tx: 84F7978E...</li><li>2026-03-24: rGSDDiG account still active with 7.02 XRP; no IOUs. Rippling still enabled. Two small 0.000001 XRP dust payments received.</li></ul></section>
    <section><h2>5. Native XRP movements</h2><ul><li>SETREGKEY-RPP12ND-20260225-RPKMCC1: 0 XRP rpP12ND2K7ZRzXZBEUnQM2i
...truncated preview...