3:02:17 UTC. Stop loss moved from 1.2012 to 1.1989 on a EUR/USD short position. Not a massive change, but enough to guarantee a loss—and enough to trigger a margin call that forced a liquidation two minutes later. A liquidation that moved exactly 0.23 BTC worth of value into an obscure liquidity pool.
A pause. “How do you know it’s not a trap?”
Someone had her session tokens. Not her passwords—her sessions . That meant a browser extension, a compromised Wi-Fi network, or physical access to a device she thought was clean. oanda+coinpass+compromised
Then she saw it. The timestamps weren’t random. Every OANDA API call was followed exactly 4.2 seconds later by a Coinpass withdrawal whitelist check. That wasn’t a human. That was a script. A bridge script. Someone had built an arbitrage engine that didn’t trade crypto–fiat spreads. It traded compromised accounts . It used OANDA to force losing trades that benefitted a dark pool, then moved the cleaned value through Coinpass into untraceable wallets.
Another pause, longer this time. “Where’s the source now?” 3:02:17 UTC
They weren’t watching the platforms.
Coinpass next. Login. Withdrawal addresses. A new whitelist entry dated 46 days ago: 0x3F9...aE7 . Labeled “Savings 2.” She’d never labeled anything “Savings 2.” She clicked through the edit history. IP address: 185.165.29.101 . Not her home. Not her VPN. A known residential proxy from Eastern Europe. A liquidation that moved exactly 0
Maya looked at the last line of the text file, which she hadn’t read fully until now. Below the signature—just a single letter, K —was a postscript: I’m in the OANDA London office. Third floor. Server room B. They don’t know I’ve been logging everything. They’ll check the backup logs at 6 a.m. UTC. That’s 90 minutes from now. Don’t send police. Send someone who can move through a financial district without being seen. And Maya—don’t use your real name when you come. She stared at the screen. She’d never told anyone her real name. Not in five years of ghost tracing.