I’ll be honest, I never liked Hannes. Imagine having the nerve to call yourself ‘The Builder’ when the thing you built is a steaming pile of shit wrapper enabling a ponzi. And the guy just surrounded himself with pond scum.
But generally speaking, I assumed he was just incompetent, not malicious. It seems I was mistaken.
If you missed it, I have a Stars Arena Part 1 as well. It mostly focuses on the incompetence though, this one is a bit juicer.
Research partner
Big thanks to @GiganticTip for tipping me off to this and helping with the research that led to this post.
I’ve hung out with him a few times and he seems like a cool dude, give him a follow. He is criminally under-followed.
Want to verify / research yourself?
Here’s a dump I got of all users from a week ago. You can also get some current info about accounts from ArenaBook like their twitter and ‘new’ address.
If you want the old addresses you can review this mapping provided by the Stars Arena team.
I strongly recommend you sign up for Arkham and add entities to make the tracking easier, that’s what I did. For each of the users I added both their old and new address. The ‘top counterparty’ tab makes tracking things down easy.
The spaces
Most of the people reading this probably don’t know me that well, but I avoid spaces like the plague. So when you see me joining spaces to shit on something, that’s how you know I’m really upset.
Several times in those spaces though, I heard the same question coming up: “What’s going on with referrals?”. And I dismissed this as being related to the fact that referrals weren’t migrated at relaunch, and sites like ArenaBook were claiming referrals for people. And then later, to add more confusion, the team quietly backfilled referrals from the contract prior to the relaunch, several days later, without ever mentioning it.
But they were talking about something a little stranger.
Top referrers
We never added much about referrers to ArenaBook, because the team fucked things up and I didn’t want to clean up the data / work around it. But I do have all the data.
You might ask yourself, who the fuck are these people with a ton of referrals? More than Kaleo? How does that even happen. Lets look them up.
Wow, this is really strange huh? I wonder how they got all those referrals. You know, given that they have no Twitter presence, and didn’t use the platform at all (according to ArenaBook).
People were pretty famously complaining about the fact that this ‘tronicqueen’ user got a lot of referrals. No one seems to know how exactly that happened, because who the fuck is this?
And wow, this is a bit weird, tronicqueen got referred by one of the other top referrers that no one knows about.
Follow the money
Thankfully, I have the old/new addresses for all users. And Arkham is a clutch platform for tracking money transfers. Lets add some of these users as entities and see who they’ve been interacting with.
Sorry, should have added a SPOILER ALERT. I guess you can already see where we’re going with this right? One really interesting thing is that last item, which isn’t actually a user in Stars Arena, it got the fees from the first contract.
Anyway, right off the bat you can spot a wallet that they’re all interacting with. Arkham has it labeled as an OKX Deposit Wallet.
That sure is a very suspicious set of users depositing to this address. And unsurprisingly Arkham labeled the wallet this way because the funds get swept right into the OKX hot wallet.
So here we’ve got one account with no Twitter, one account with Twitter deleted, and one account with no Twitter presence. All depositing into the same OKX user wallet that Hannes deposits into.
Lets see what else we can find. Unfortunately ‘Top Avax’ seems like a quiet dead end. But what’s this in ‘ThAvax’?
The KuCoin Deposit address doesn’t leak any info. It should be unsurprising at this point, but there’s a pointer directly to Hannes in there.
What’s this new OKX Deposit account?
Surprise! Direct evidence linking ThAvax to tronicqueen and cryptoqueen42 (and transitively to Hannes). As if it were even necessary at this point.
Summarizing the results
To be explicitly clear, what I’m saying here is that there are users in Stars Arena that have an anomalous number of referrers. People are reporting that their referrer was unexpectedly claimed by one of these clearly fake accounts.
The users that unexpectedly claimed the referrers have direct explicit ties to the same CEX address that Hannes uses to offboard.
TLDR: He’s stealing the referrals. It wasn’t enough for this piece of shit to make 60K a day or whatever in protocol fees, no, he had to ensure that you couldn’t get money for the people who clicked on your referral links.
I wonder if the other people on the team even know. If a user doesn’t have a referral, the money goes to the protocol. So he’s stealing from them too.
How are you sure?
I can’t believe you haven’t been convinced by the rest of this post. But the first thing that really clued me into this was the fact that koreanjewcrypto complained that he had no idea who the fuck tronicqueen was (and maybe the fact that she ‘referred’ CryptoKaleo). So I made a dashboard that showed when users first/last submitted a tx that included a referral for her, and looked him up.
This may be a bit hard to interpret, but you can see that he somehow submitted a tx that included her as a referrer immediately after the arena reopened, even though he claims (fairly) to never have heard of her or clicked on a link.
I verified that he had submitted TX with her on the old contract as well.
How did it happen?
I don’t have solid proof for this. I speculate that when the backend that does the ticket buys executes a request, it sometimes decides when to make a ‘Buy With Referrer’ and subs in a referrer that is quietly owned by Hannes. From then on, all your referrer are belong to Hannes; setting the referrer is a one-time action on the contract. Even if you use a ‘buy’ it will ‘buy with referrer’.
Alternatively, the backend stores your referrer and uses it regardless of what the front end requests. And then Hannes just went in and twiddled with the records of people who had no referrer set.
Impossible to know the specific mechanism without admin access, but it clearly happened.
How sure are you?
I’m really fucking sure. This is not like that retarded PDF file that got sent around today that ties Stars Arena to the Illuminati run by Avalabs. You don’t get more sure than this. ZachXBT would shit all over these fucking plebs way better than me but I’m what you’ve got, hopefully that’s enough.
Speaking of that PDF
I looked at the PDF yesterday and it was the work of the truly mentally ill. After reading a bunch of stupid takes, I scanned the rest and found more stupid takes, then gave up.
But one of the things that they look at is the first interactors with the contract (who, presumably, are related to the team). One of those people is an AvaLabs BD, which has the obvious explanation that they reached out to AvaLabs to look at it and the guy tested the product. The document somehow turns this into a conspiracy theory that the AvaLabs Illuminati orchestrated the whole thing, which is hilarious.
However, they do (very poorly) point out that the tronicqueen account was also an early interactor, and (extremely confusingly) make the linkage to Hannes.
So it turns out that it’s not complete bullshit. Just very poorly organized bullshit with a heaping spoonful of conspiracy flakes.
The end, again
I really didn’t think I’d be writing about this clown show again, but here we are. Hopefully this is the last of it.
At this point I’m starting to believe the ‘the hack was an inside job’ narrative. I’m really confused about how we never heard anything come out of it, even though everyone was all like “we’ve got hard evidence on the hacker, he’s fucked”.
In the past I’ve felt like Hanlon’s Razor was a really solid principle, but at this point I’m thinking stupidity no longer adequately explains this.