CIGO Incident Preservation Demand

Evidence link index

All known full addresses and transaction hashes below are hyperlinked for direct review. Shortened addresses are marked as needing the full address before final publication.

Official CIGO records

Relevant CIGO pools

Paper-wallet generator evidence

Known drained / compromised source wallets

First liquidation path

Second liquidation path

Other addresses requiring review

Key transactions

SEVERE ALERT — Pre-litigation preservation demand, public notice, and escalation request

To MetaMask / Consensys, BNB Chain ecosystem risk systems, HashDit-style scanner providers, Blockaid, GoPlus, CertiK, BNB DappBay, PancakeSwap risk systems, wallet interfaces, swap routers, risk-feed vendors, token-listing entities, exchanges, compliance departments, and all related parties:

This is a formal public notice, pre-litigation preservation demand, correction demand, escalation request, and record of continuing harm involving CIGO on BNB Smart Chain.

Please escalate this immediately beyond front-line support to legal, compliance, risk, product safety, executive review, and any third-party scanner, wallet-security, risk-feed, routing, exchange, or interface partners involved in labeling, warning, restricting, routing, displaying, suppressing, or otherwise impairing CIGO.

This is not an ordinary customer-support issue.

This matter now involves:

• MetaMask / Consensys-style hostile wallet treatment toward CIGO
• HashDit-style or third-party scanner / risk-feed influence
• severe token warnings or malicious / high-risk treatment
• lack of a clear remediation path
• online BNB paper-wallet generation
• approximately 200 paper-wallet-generated wallets drained or implicated
• approximately 195 non-imported paper-wallet-generated wallets drained or implicated
• stolen USDT / BSC-USD and CIGO
• mass collection of CIGO from multiple wallets
• stolen-token liquidation into public CIGO pools
• direct CIGO liquidity damage
• subsequent attacks through different collector wallets
• two separate CIGO liquidation wallets tied within short funding chains to major upstream wallets, including exchange-labeled or exchange-funded sources
• post-notice silence from relevant gatekeepers
• malicious activity escalating after notice, reporting, and public posting
• conduct that appears retaliatory in nature

This requires preservation, disclosure, correction, compliance review, and legal review.

I. Token and project details

Token name: cosigo market
Symbol: CIGO
Network: BNB Smart Chain
CIGO contract: 0x3a38e963f524E0dDFB75dFa1752b4Cd1364F5560
Official market site: https://market.cosigo.io
Official project site: https://cosigo.io
Contact site: https://contact.cosigo.io

CIGO is a source-verified BNB Chain token with public documentation, official project channels, active project ownership, and an identifiable founder.

Despite this, CIGO has been treated by MetaMask / Consensys and/or related third-party risk systems as dangerous, malicious, high-risk, restricted, or otherwise impaired.

Repeated attempts to obtain correction, explanation, or a clear remediation path have not produced a specific actionable basis.

II. Core public warning

The warning system labeled the victim and failed to stop the theft path.

CIGO was treated as the danger while actual malicious activity involving compromised private keys, stolen funds, mass wallet collection, stolen-token liquidation, routing infrastructure, and liquidity damage continued through the ecosystem.

The “malicious / high-risk” treatment did not stop the actual malicious actors. It did not protect the victim project. It did not prevent compromised-wallet liquidation. It did not stop stolen CIGO from being sold into public liquidity.

Instead, the burden landed on ordinary users, the founder, project reputation, wallet-interface access, liquidity confidence, and market credibility.

III. Major finding: two CIGO liquidation wallets trace within four or fewer funding layers to large upstream wallets

This is no longer adequately described as random wallet theft, isolated retail activity, or a single compromised user.

Two separate CIGO collector / liquidation wallets now trace within a short number of funding layers to large upstream funding sources.

First liquidation path

Second liquidation path

BscScan currently shows the second upstream wallet, 0x64391af2Cdc949013accF8E6e4c2BE12465eeE13, as “Funded By: Kraken 186.” If prior screenshots or historical labels show this same address as formerly associated with “Kraken 77,” that label history is also being preserved and should be reviewed.

This does not by itself prove that Crypto.com, Kraken, BNB Chain, or any exchange operator committed the theft. But it absolutely creates a major preservation, compliance, and discovery issue.

The CIGO liquidation wallets were not isolated, unfunded, random addresses operating in a vacuum. They were funded through short upstream chains connected to very large wallets or exchange-labeled / exchange-funded sources.

IV. MetaMask / Consensys and hostile CIGO treatment

CIGO has been subjected to severe wallet warnings, risk labels, restrictions, suppression, or hostile interface behavior involving MetaMask / Consensys and/or their risk-feed partners.

The problem is not merely that a warning appeared. The problem is that the warning and related conduct caused market-access harm while no clear, specific, verifiable remediation path was provided.

Questions requiring preservation and response:

1. Who or what generated the CIGO risk label?
2. Was the label generated by MetaMask, Consensys, Blockaid, HashDit, GoPlus, CertiK, BNB DappBay, PancakeSwap risk feeds, another vendor, user reports, automated heuristics, or a combination?
3. Was there any human review?
4. Was the review based on verified facts or automated scanner assumptions?
5. Was CIGO given a meaningful opportunity to correct or respond?
6. Why was no specific remediation path provided?
7. Why did the label fail to deter actual malicious actors while impairing the victim project?
8. Were theft-related addresses, collector wallets, routing paths, and liquidation wallets flagged with comparable severity?

If MetaMask / Consensys relied on any third-party risk feed, scanner, or vendor, identify that source and preserve all records.

V. HashDit-style scanner and third-party risk-feed involvement

HashDit and similar token-risk systems appear to influence wallet warnings, token-risk visibility, scanner classifications, and interface behavior in the BNB Chain ecosystem.

To the extent HashDit, HashDit-style scoring, or any similar scanner/risk-feed provider contributed to CIGO being labeled, warned against, hidden, restricted, suppressed, or treated as malicious, those records must be preserved.

This includes risk-score outputs, scanner findings, token-profile records, API responses, manual review notes, user reports, automated risk flags, blacklist or blocklist entries, partner-feed transmissions, records sent to MetaMask / Consensys, records sent to wallet providers, records sent to swap interfaces, and records sent to BNB Chain-related systems.

If HashDit or any similar provider did not contribute to the CIGO label, state that clearly in writing.

VI. BNB paper-wallet generator and corrected wallet-compromise finding

Wallets were reportedly generated through the online BNB paper-wallet generator:

https://bnbpaperwallet.com/

The site publicly lists the following BNB donation address:

0x8388c2A8Ab0bCff5BcB973DccFa1e434160Ab10f

At this stage, I am not stating that the site operator or donation address is conclusively proven to be the theft wallet. However, the site, donation address, and related transaction history are materially relevant because wallets generated through that source later appear to have been compromised.

Any wallet generated through that online paper-wallet generator must now be treated as unsafe.

Earlier evidence suggested that the affected wallets might be limited to imported private-key wallets. That is no longer accurate.

Updated evidence now shows that approximately 200 wallets generated through the online BNB paper-wallet generator were drained or implicated, including approximately 195 wallets that had not been imported into Rabby / MetaMask.

That materially changes the analysis.

The compromise is no longer reasonably explained only by wallet import, clipboard exposure, browser-extension exposure during import, or local wallet-software handling. The larger pattern now points much more directly to the wallet-generation source itself, or to private keys being exposed at or near the point of generation, display, QR rendering, printing, source-code execution, entropy creation, domain operation, repository compromise, malicious script injection, or related infrastructure.

The corrected pattern is:

• Paper-wallet-generated wallets: drained / implicated
• Imported paper-wallet-generated wallets: drained
• Non-imported paper-wallet-generated wallets: also drained / implicated
• Seed-derived wallets not generated through that site: separate category, not part of this specific finding

This correction is important because it supports a wallet-generation compromise theory, not merely an import-exposure theory.

Additional wallet lists and transaction evidence are being preserved separately because the affected set is now approximately 200 paper-wallet-generated wallets.

Known direct crypto damage is now approximately $1,000 and still being documented. This includes stolen USDT / BSC-USD, stolen CIGO, and related liquidity damage.

The immediate amount is not the central issue. The central issue is that the system labeled the victim project while actual wallet-drain and liquidation activity continued.

VII–VIII. First CIGO liquidation path and upstream funding chain

First suspected CIGO liquidation wallet: 0x7796067D1786A9572E4db38BfAD682C01b19D512

The first main liquidation transaction appears to have sold approximately 26,581 CIGO through routing and affected both CIGO pools. The observed activity included CIGO being sent into the CIGO/WBNB and CIGO/BSC-USD pools while WBNB and BSC-USD value was extracted.

This damaged CIGO liquidity and market behavior. This was not voluntary project selling. It was not ordinary liquidity management. It appears to be theft-related liquidation from compromised paper-wallet-generated wallets.

A funding chain has been identified upstream of the first CIGO liquidation wallet.

This does not by itself prove Crypto.com wrongdoing. But it creates a major centralized-exchange funding touchpoint that must be preserved and reviewed.

IX–XI. Second mass-collection attack and upstream funding chain

After initial mitigation and blacklisting of known addresses, additional activity was observed.

A later pattern shows many source wallets sending CIGO to a new collector / liquidation wallet:

0x3f046d25b658fC29a78f45F4788FdCaf440914bA

The key transaction is 0x131706716798bfc8b7d9088ef22925e3a72973c33360439627acda048f5b40fc.

This looked like mass collection followed by liquidation.

A second upstream funding chain has been identified:

BscScan currently shows the high-volume upstream wallet as funded by Kraken 186. If historical evidence shows the same address previously associated with Kraken 77, that label history should also be preserved and reviewed.

This does not by itself prove Kraken wrongdoing. But it creates a second major exchange-related upstream funding touchpoint requiring preservation and compliance review.

Layering concern

The second CIGO liquidation path does not begin from a small isolated wallet. It traces through several funding layers to a high-volume BNB wallet currently shown by BscScan as funded by Kraken 186.

The existence of multiple intermediary wallets does not eliminate relevance. It increases the need to review whether this was innocent customer funding, automated distribution, laundering-style layering, coordinated funding infrastructure, or knowing use of exchange-linked funding paths.

The fact pattern now requires preservation of exchange records, funding records, KYC-linked account records where legally available, API logs, withdrawal records, deposit records, internal risk flags, and all compliance records connected to the upstream wallet and downstream liquidation path.

XII. Why the two funding chains are significant

There are now two separate CIGO liquidation paths with upstream funding links to large exchange-related or high-volume funding sources within a short number of wallet layers.

This is no longer adequately described as one random wallet theft.

The evidence now supports the conclusion that CIGO suffered repeated funded wallet collection and liquidation activity, using different wallets, different paths, and collector/liquidation addresses that were not far removed from large upstream funding sources.

This must be treated as a serious investigation issue.

XIII. Post-incident mitigation

After the first identified liquidation event, the following addresses were blacklisted as emergency mitigation:

• 0x7796067D1786A9572E4db38BfAD682C01b19D512
• 0x828Ed2532C62Cd738360A44846DA540C59201FBB

After those actions, the pool appeared temporarily stable. Subsequent activity suggests that the attacker or attackers may be rotating through additional wallets or collector addresses.

Important: no legitimate pool, router, or ordinary trading infrastructure should be blacklisted without careful review. Mitigation is directed at suspected theft-related wallets and collector/liquidation addresses, not normal market participants.

XIV. Notice, silence, and post-notice conduct

Notice was given.

Addresses were identified. Transactions were identified. Drained wallets were identified. CIGO pools were identified. Risk-labeling harm was identified. Paper-wallet generator evidence was identified. Funding chains were identified. Preservation was requested. Correction was requested. Escalation was requested. The issue was posted publicly.

Crypto gatekeepers did not meaningfully respond.

No clear explanation was provided. No clear correction path was provided. No preservation confirmation was provided. No meaningful accountability was provided.

After notice was given, after malicious-label reporting occurred, and after the issue was posted publicly, additional wallet-drain, collection, and liquidity-attack activity was observed.

That timing is material. This timing is not being treated as coincidence.

Once notice was given and the evidence trail was identified, the attacks did not stop. They escalated. That is now part of the record.

XV. The warning system failed its stated purpose

The severe CIGO warnings did not stop the actual malicious actors.

The malicious / high-risk label did not deter the drainers. It did not prevent compromised wallets from being emptied. It did not prevent mass collection of CIGO. It did not prevent stolen CIGO from being sold into liquidity pools. It did not protect CIGO, users, liquidity, or the founder.

The actors with compromised keys used direct transactions, scripts, routers, collectors, funding chains, and liquidity pools. A warning label does not deter someone already operating with stolen private keys.

Instead, the warning burden appears to have landed on ordinary users, the founder, project reputation, liquidity confidence, wallet-interface access, token visibility, and market credibility.

This raises a serious question: did the risk-labeling system protect users, or did it function as a market-access impairment against the victim project while actual theft-related activity continued?

XVI. Interconnected harm and coordination hypothesis requiring discovery

This matter presents a substantial contradiction requiring immediate review.

CIGO was treated as dangerous, malicious, high-risk, or impaired by wallet/interface/scanner systems. Yet the actual harm arose from compromised private keys, unauthorized wallet draining, mass wallet collection, stolen-token liquidation, upstream funding chains, and movement through routing/swap infrastructure.

The apparent result:

• CIGO was labeled or restricted.
• The founder and project suffered reputational and operational harm.
• Approximately 200 paper-wallet-generated wallets were drained or implicated.
• Approximately 195 non-imported paper-wallet-generated wallets were drained or implicated.
• Stolen CIGO and USDT / BSC-USD were taken.
• Stolen or unauthorized CIGO was sold into public liquidity.
• CIGO liquidity and price behavior were damaged.
• Additional collector wallets appeared after initial mitigation.
• Two liquidation paths now trace within a short number of wallet layers to large upstream funding sources.
• The actual theft path appears to have remained operational.
• The affected project received warnings and friction while theft-related activity appears not to have received comparable visible enforcement.

Based on the timeline, wallet-labeling behavior, scanner/risk-feed influence, liquidity placement, funding paths, post-notice silence, post-publication escalation, and subsequent wallet-drain/liquidity-attack activity, the evidence supports a serious coordination hypothesis.

This is not being presented as a final legal conclusion before discovery. It is being presented as a preservation and investigation demand.

There are only a few plausible explanations:

1. Direct coordination between wallet, scanner, risk-feed, exchange, and ecosystem actors.
2. Functional coordination through shared third-party feeds, scanner APIs, blocklists, automated models, funding infrastructure, or token-risk databases.
3. Negligent or reckless reliance on defective scanner data that materially impaired CIGO.
4. Selective enforcement, where CIGO was labeled and impaired while actual theft-related wallets and liquidation paths remained operational.
5. Post-notice failure to preserve, correct, review, or meaningfully respond despite identified addresses, transactions, pools, drained wallets, funding chains, and ongoing harm.
6. Retaliatory post-notice and post-publication activity against the affected project.

That sequence requires discovery.

XVII–XVIII. Required preservation and address review

You are hereby requested to preserve all documents, data, logs, communications, records, and electronically stored information relating to CIGO, COSIGO, the CIGO contract, project websites, CIGO risk scores, scanner results, wallet warnings, token-list decisions, routing restrictions, swap-interface treatment, third-party scanner inputs, HashDit or HashDit-style records, MetaMask / Consensys internal review records, Blockaid records, GoPlus records, CertiK records, BNB DappBay records, PancakeSwap risk-feed records, Crypto.com-related funding records, Kraken-related funding records, support tickets and chat transcripts, manual review notes, API responses, wallet-warning triggers, blacklist / blocklist / allowlist records, routing decisions, suppression, hiding, blocking, warning, or restriction decisions, drained source wallets, approximately 200 paper-wallet-generated wallets now drained or implicated, suspected liquidation wallets, collector wallets, upstream funding wallets, exchange-labeled wallets, BNB transfer-out recipients, GhostSwap-labeled addresses, ChangeNOW-related paths, bnbpaperwallet.com, the bnbpaperwallet.com donation address, the first liquidation transaction, the second mass-collection transaction, and all records relating to post-notice or post-publication activity involving CIGO.

This preservation demand includes temporary logs, automated scoring outputs, risk-feed records, internal communications, third-party vendor communications, audit trails, decision records, customer-support records, compliance records, exchange funding records, KYC-linked records where legally available, and any records otherwise subject to deletion, rotation, expiration, or overwriting.

Destruction, alteration, non-preservation, or failure to suspend routine deletion after notice may give rise to spoliation issues.

XIX–XX. Required response and requested corrective action

Please provide a written response addressing:

1. Whether CIGO is or was labeled, warned against, suppressed, restricted, hidden, blocked, or otherwise impaired by your system.
2. The exact basis for any such label, warning, restriction, suppression, or impairment.
3. Whether the label was generated manually, automatically, or through a third-party feed.
4. Whether HashDit, Blockaid, GoPlus, CertiK, BNB DappBay, PancakeSwap risk systems, or any other third-party vendor contributed to the label.
5. Whether MetaMask / Consensys relied on any third-party risk feed, scanner, automated model, or vendor.
6. Whether the drained wallets, suspected liquidation wallets, collector wallets, exchange-funded paths, GhostSwap-labeled address, ChangeNOW-related path, suspicious gas-funder address, or paper-wallet donation address were flagged with comparable severity.
7. Whether any human reviewed the CIGO label before or after correction requests were made.
8. Why no specific remediation path has been provided.
9. Whether records have been preserved.
10. What corrective action will be taken.
11. Who is responsible for follow-up at the legal, compliance, risk, exchange, or executive level.

I request that all relevant parties preserve records immediately, correct any false or unsupported CIGO risk label, identify the exact source of the CIGO label, explain third-party scanner/risk-feed reliance, explain why the actual theft path was not visibly restricted with comparable severity, distinguish theft-related liquidation from legitimate CIGO project activity, review bnbpaperwallet.com and its listed donation address, review all drained source wallets, review the approximately 200 paper-wallet-generated wallets now drained or implicated, review all known collector and liquidation wallets, review the two upstream funding chains now identified, review the mass-collection pattern involving hundreds of transactions, review post-notice and post-publication activity for retaliatory character, provide a real remediation path for CIGO, and confirm whether prior support communications, chats, and internal notes have been preserved.

XXI. No waiver

Nothing in this notice constitutes a waiver of rights, remedies, claims, privileges, or future legal action.

I reserve all rights relating to business disparagement, tortious interference, negligence, unfair or deceptive practices, defective risk classification, failure to correct known false or misleading statements, market-access interference, selective enforcement, coordinated or functionally coordinated harm, retaliation, and any related causes of action that may become apparent through investigation, preservation, subpoena, discovery, exchange review, or regulatory review.

The immediate financial loss is not the only issue. The broader issue is whether powerful wallet, scanner, exchange, routing, and risk-labeling infrastructure can damage a lawful, source-verified token project while failing to provide comparable protection against actual theft-related activity.

Please treat this matter with urgency.

Silence, generic responses, refusal to provide the basis for the label, or failure to preserve records will be preserved as part of the record.

Sincerely,
Wendall Gregory Wilson
Founder / Owner, COSIGO
https://cosigo.io
https://market.cosigo.io
https://contact.cosigo.io