# Media and law-enforcement brief: The Sovryn Treasury Theft

**Status:** Published evidence brief. The narrative, continuous call excerpts, captions, redactions, evidence packet, and recovery materials completed their recorded publication checks.

## The finding

Sovryn investors, stakers, and RBTC lenders lost treasury protection, promised revenue, and lending-pool value while insiders retained the power to move funds and change the contracts. One exchange on Sovryn Community Call #73 captures the central accounting problem. At 35:03, project lead Edan Yago said, “Some of those funds were paid out by BOS on behalf of Sovryn.” At 44:33, a question began asking whether Sovryn was mingling funds with BOS; Yago answered, “No.” The two exchanges began nine minutes and thirty seconds apart on 27 March 2026.

The public record documents 27 material treasury operations, direct and indirect routes between Sovryn and BitcoinOS infrastructure, the removal of stakers’ RBTC and ZUSD claim rights, coordinated SOV-backed borrowing, and lender losses after a public warning. It supplies dates, transaction hashes, contract state, wallet-control evidence, source video, and reproducible calculations. The record supports immediate investigation of misappropriation, undisclosed related-party payments, misleading investor statements, and interference with recovery; exchange, custody, company-ledger, signer, and device records can identify the people, authorizations, and ultimate use behind the public-chain movements.

## Five principal facts

1. **Sovryn’s treasury assets were removed through a tightly approved sequence.** On 1 December 2025, the Exchequer treasury wallet held about **$3.20 million** in gross on-chain assets; a separate same-time price check produced **$3.250 million**. From 4 December 2025 through 24 January 2026, 27 material multisig operations moved treasury assets. Three sent exactly **23.146420437622064715 RBTC**, worth **$2,122,679.92** at the transfer times. After bridge and Bitcoin fees, **23.13948498 BTC** reached one terminal address. The wallet at **0xfEE171…4a9e7e** approved all 27 operations.

2. **Sovryn treasury routes and BitcoinOS token-control infrastructure converge.** Four source groups reconcile **508,947.877906 USDT** arriving at the DD multisig; a **5,385.062411-USDT** cross-chain component is matched by amount and timing. The Ethereum and BNB Chain DD Safes were deployed by the same 8C wallet and reuse the exact five owner addresses found across the official BOS token-control Safe family. The same two addresses—**0x509201…AbD6** and **0xcD9003…fBAA**—approved all 14 reviewed Ethereum DD executions. DD later reused the exact Ethereum forwarding route previously used after BOS collector receipts.

3. **Recovered BOS sale routes intersect Sovryn and the later treasury destination.** Origins’ completed counters record **609,509,366.81050959 BOS** sold and **$4,888,380.29942801134947357397** in USD-valued collections. The transaction-date public-chain scale benchmark is **$4,169,986.839549**, or **85.304060%** of that counter; Origins’ internal order ledger is the record needed to reconcile individual purchases and net proceeds. A participant-funded Rootstock BOS collector sent **0.02221978958 RBTC** directly into Sovryn’s Exchequer. A high-confidence BOS Bitcoin sale candidate sent at least **20.01114355 BTC** to the exact terminal that later received the **23.13948498 BTC** from Sovryn’s treasury.

4. **Sovryn promoted BTC income while its treasury signers retained the power to stop it.** On 12 January 2026, Sovryn told users to “Stake SOV right now” for up to **21.37% APR BTC and USD**. Sixteen days later, the Exchequer activated a live claim shutdown. On 25 February it activated code withholding **100% of RBTC and ZUSD fees** before a Bitocracy vote. By Rootstock block 9,162,805, **0.291168289253166829 RBTC** and **12,215.472705546004667895 ZUSD** had been withheld from staker claim accounting across **136 events**.

5. **A coordinated borrowing sequence was followed by the lender harm users had warned about.** Seven B7-funded wallets withdrew **10,048,901.290470 SOV** in less than two hours; four of them then borrowed **1.465 RBTC** from the lending pool within **15 minutes 12 seconds**. Public Disclosure #2 identified the loans and warned of the illiquid-collateral danger on 8 March 2026. Nine liquidation events later struck three February positions. At the 18 August snapshot, all **11 active SOV-backed loans** were unsafe, and selling all SOV collateral through the on-chain pool produced a modeled **4.044086930453946278-RBTC** lender shortfall.

**Evidence boundary:** Public records establish the transfers, contract changes, common routes, repeated owner sets, approval patterns, statements, and measured losses above. The credited exchange accounts, beneficial controllers, private instructions, invoices, authorizations, and company accounting are compulsory-record targets.

## Six dates that connect the case

1. **1 December 2025 — Treasury baseline.** The Exchequer held about $3.20 million in gross on-chain assets.
2. **4 December 2025–27 January 2026 — Treasury exits.** Twenty-seven material operations moved assets; the three Exchequer-derived Bitcoin releases ultimately delivered 23.13948498 BTC to the exact terminal previously used by the high-confidence BOS sale candidate.
3. **12 January 2026 — Investor solicitation.** Sovryn’s official account urged users to stake immediately for BTC and USD income; wallets then added stake or extended locks during the promotion-to-notice period.
4. **28 January–25 February 2026 — Claims disabled, then withheld.** A 44-hour-20-minute live shutdown preceded the larger 29 January BTC decline. Replacement code then stopped RBTC and ZUSD claim entries before any Bitocracy vote.
5. **8 March–17 April 2026 — Warning, resistance, and ratification.** Users publicly warned about the linked loans on 8 March. On 20 March, five B7-first-funded wallets supplied all **62,572,733.758251524367271838** votes against each executable SIP-0088 recovery proposal. On 23 March, Yago published the ratification proposal. On 27 March, he made the BOS-paid-on-behalf statement and the “No” answer on the same call. GovernorAdmin 26 was created on-chain on 17 April; B7-origin stake supplied **31,574,812.5 votes**, or **99.319883676856151617%** of its affirmative vote.
6. **16–18 August 2026 — Recorded lender harm.** Nine liquidation events had hit three February positions; the pinned snapshot then showed all 11 active SOV-backed loans unsafe and the modeled 4.044086930453946278-RBTC pool shortfall.

## Three documented roles

- **Edan Yago — policy, public statements, and ratification.** Sovryn identified Yago as project lead. He authored the approved executive-treasury framework, announced the February revenue redirection, described executive action before a vote, published the later ratification proposal, addressed the lender warning, and made both cross-project payment statements on Call #73.
- **Elan Nahari — treasury finance and reporting.** Founder records and Exchequer minutes place Nahari in Sovryn’s executive treasury process. Public call, forum, presentation, document, and email-metadata records place him in budgeting, financial reporting, treasury accounting, and the FastBTC explanation.
- **Tyrone Johnson — technical implementation.** Sovryn identified Johnson as a technical team lead. Git records attribute the January claim-shutdown code and February 100%-withholding code to Tyrone / `tjcloa`. The official deployment record names **0xfEE171…4a9e7e** as its sender, and that wallet deployed the replacement code and submitted the Exchequer actions.

**Attribution boundary:** The public record ties these named roles to policy, reporting, statements, code, and deployment workflow. Continuous natural-person custody of B7, 8C, DD, 0x509201, 0xfEE171, exchange accounts, and the Bitcoin terminal remains a signer-, device-, and account-record question.

## Five questions requiring records

1. **Who authorized the treasury exits?** Produce the instruction, invoice, agreement, approved budget, accounting entry, and three signer identities for each of the 27 Exchequer operations.
2. **Who controlled the receiving network?** Identify the people, devices, custodians, and exchange customers behind B7, 8C, DD, 0x509201, 0xfEE171, D9, the shared Bitcoin terminal, and every downstream exchange account.
3. **How are Yago’s two Call #73 statements reconciled?** Produce the complete Sovryn–BTC OS Limited intercompany ledger, every BOS-on-behalf-of-Sovryn payment, corresponding invoice and approval, and the transaction-level year-end consolidation.
4. **Who ordered the staker-fee intervention?** Produce the instructions, code review, signer approvals, marketing decisions, and accounting for the 28 January shutdown and the February 100% withholding before a vote, including each affected staker’s claim history.
5. **Who controlled the linked borrowers and recovery votes?** Produce wallet-access and common-service records for the B7 cluster, the response to the 8 March warning, the decision not to close or pause the loans before liquidation, and the delegation and voting instructions for SIP-0088 and SIP-0089.

## Records to preserve immediately

- Sovryn, BTC OS Limited, Origins, Exchequer, DD, and related-party general ledgers; bank and payment-processor statements; intercompany accounts; source-and-use schedules; invoices; payroll; reimbursements; budgets; and approvals.
- Multisig, wallet, vault, exchange, bridge, and custodian key assignments; signer logs; device and IP records; access histories; API logs; deposit-credit records; subaccount records; trades; withdrawals; and customer-identification files.
- Forum, Discord, Telegram, Signal, email, GitHub, Drive, Notion, ticketing, cloud, and administrator audit logs, including deleted or edited material and retention settings.
- FeeSharing, lending, governance, FastBTC, BOS sale, vesting, mint, distributor, and liquidity records: source code, reviews, deployments, incident logs, risk reviews, marketing approvals, order ledgers, refunds, rate calculations, and purchaser communications.
- The original Call #72 and #73 recordings, participant and account metadata, transcripts, chat, captions, upload history, and the source and clip hashes recorded in this packet.

## Public packet links

- [Download the complete evidence archive](../downloads/sovryn-public-evidence.tar.gz) and [its SHA-256 sidecar](../downloads/sovryn-public-evidence.tar.gz.sha256).
- [Read the case chronology](./case-chronology.json), [27-operation transaction ledger](./curated-transactions.json), and [treasury asset map](./asset-map.json).
- [Inspect the Sovryn–BitcoinOS control record](./dd-bitcoinos-control.json), [shared-terminal reconstruction](./exchequer-shared-terminal-flow.json), and [interactive fund-flow page](/fund-flows/).
- [Inspect the BOS sale-wallet record](./bos-presale-wallet-flows.json), [0x509201 trace](./bos-proceeds-509-trace.json), [Bitcoin reconstruction](./btc-origins-flow.json), and [Cardano reconstruction](./cardano-origins-flow.json).
- [Inspect the fee-authority record](./fee-authority-records.json), [loan record](./loan-records.json), [governance snapshot](./snapshots.json), and [named-role attribution record](./actor-attribution.json).
- [Review the call-excerpt manifest](./call-excerpts.json), [source index](./sources.json), [exhibit index](./exhibit-index.json), and [packet reproduction guide](./README.md).