FairWin: Who Won and Who Lost in the $120M Ethereum Ponzi

In September 2019, one smart contract accounted for about a third of all Ethereum transactions, The Defiant reported. It was called FairWin. Players sent in ETH, and the contract promised them more back. By the end of the month the contract was empty, and the game was over.

We traced FairWin again with the Bitquery MCP server to answer three questions. How much went in? Who came out ahead? And who ran it? Each step below shows the question we gave the AI and the tool it called to answer. We ran every query on 15 October 2026. All times are UTC.

Role	Address
FairWin contract	0x01eacc3ae59ee7fbbc191d63e8e1ccfdac11628c
Deployer wallet	0xcb104fa25a1a46040dbab9f554ff564ce325668b
Fee wallet	0x854d359a586244c9e02b57a3770a4dc21ffcaa8d

Step 1: how much went in and out?

We asked: "How much did the FairWin contract receive and pay out, and when? Include coins sent by contract code."

The AI used eth_address_profile and eth_transfers_raw_sql. The second part of the question matters. FairWin paid players from inside its own code, as internal transfers. Without them, the contract looks like it never sent a single coin.

Measure	FairWin, in ETH or counts
Received	693,151 ETH
Deposits	57,692
Addresses that deposited	19,068
Paid out	693,151 ETH
Payouts	304,116
Addresses paid	18,208
First deposit	28 July 2019
Last payout	11 October 2019

Every coin that went in came back out. At 2019 prices of $170 to $190 a coin, the total was worth about $120 million. At the time, developer Philippe Castonguay estimated 687,598 ETH, Decrypt reported. Our count is close to his.

Step 2: the rise and the four-day drain

We asked: "What was the contract's balance at the end of each day?"

The AI added up each day's deposits and payouts from the same transfers.

Date, 2019	Paid in that day	Balance at day end
28 Jul	2,925	2,336
31 Aug	7,079	19,979
15 Sep	21,062	38,987
26 Sep	31,802	49,518
27 Sep	25,245	43,650
28 Sep	27,698	37,476
29 Sep	21,304	19,362
30 Sep	8,805	0

The balance peaked at 49,518 ETH on 26 September, worth about $8.4 million. Four days later it was zero. On 27 September, developers had published flaws in the contract. Players rushed to get out, yet new money kept coming: 83,052 ETH arrived in those last four days.

Step 3: who triggered the payouts

We asked: "Who deployed FairWin, and what did that wallet do next?"

The AI used eth_contract_creator, then eth_transactions on the wallet it returned.

The deployer created FairWin on 27 July 2019. It then sent 67,490 transactions to the contract by 30 Sep, more than a thousand a day. None of them carried ETH. Together they set off 201,455 reward payouts. Developers who read the code that month warned that the owner could drain the contract and stop players from withdrawing.

Who sent the call	Payouts	Paid out, ETH
The deployer	201,455	115,549
Players, in transactions they sent	102,661	577,602

Those calls cost the deployer 1,150 ETH in gas. The fee wallet sent it 1,182 from June to September, which covered the bill. That is how the two wallets connect. Money also went the other way: the deployer sent the fee wallet 0.1 ETH on the day it created FairWin.

Step 4: the fee wallet's 4%

We asked: "Which address received the most from FairWin, and where did it get its other money?"

The AI used eth_flow_edges with internal transfers included, then eth_address_flow_summary on the top address.

One address took far more than any player: 27,617 ETH in 57,675 payments, almost exactly one for each deposit. Everyone else paid in 690,469 ETH, and 4% of that is 27,619. So FairWin sent 4% of nearly every deposit to this one wallet.

The same wallet made FairWin's first deposits, 2,683 ETH on 28 and 29 July, so the contract had money to pay the first players. It also took in 3,203 ETH from an earlier FairWin contract that Bitquery labels as the July 2019 version. The deployer had sent 1,522 calls to that one too.

Fee wallet flows	ETH
Received from FairWin	27,617
Received from the earlier FairWin contract	3,203
Sent back into FairWin as seed money	2,683
Sent to the deployer, for gas	1,182
Received in total, all sources	32,822
Left today	0

By February 2020 the fee wallet had paid out everything it held, to 55 addresses. Fifteen of them got between 1,100 and 1,650 each, from August to early October 2019. None of them carries a label in Bitquery's address labels. One that received 1,801 passed 1,267 of it to a contract of Tokenlon, a decentralized exchange.

Step 5: winners and losers

We asked: "For each address that deposited, compare what it put in with what it got back."

The AI used eth_transfers_raw_sql to total both sides for every depositor, leaving out the fee wallet.

Group	Addresses	Amount
Lost money	10,115	96,975 ETH lost
Got back as much or more	8,952	71,288 ETH gained
Paid without depositing	60	753 ETH received

The losers' losses, minus the winners' gains and the 753 paid to non-depositors, leave 24,934 ETH. That is the fee wallet's take after its seed money, to the coin. Every coin lost by players went to other players or to the fee wallet.

Losers lost about $17 million at 2019 prices. These are addresses, not people. One player can hold many addresses, so the count of people is unknown.

Who drained it at the end

When the contract emptied, The Block reported it was unclear whether an attacker or rushing users had taken the funds. The ledger answers that. From 27 Sep to the end, FairWin paid out 132,588 ETH.

Paid out from 27 Sep 2019	ETH	Addresses
Paid in transactions players sent	108,953	8,593
Rewards set off by the deployer	20,312	13,605
4% fee to the fee wallet	3,322	1

Most of that money left in transactions players sent, not in calls from the deployer. That matches The Defiant's reading at the time: withdrawals overtook deposits, and the last players in had nothing left to take.

What the 2020 version of this post got wrong

Our first write-up, in 2020, picked out four high-volume addresses that fed money into FairWin through other wallets. It said they probably belonged to one person or group. Bitquery's labels now identify all four as hot wallets of the exchange HTX, formerly Huobi. Their activity looked alike because exchange hot wallets all behave alike. They suggest that much of the money came from players withdrawing ETH from HTX. They do not point to a single organizer.

Address	Label today
0x137ad9c4777e1d36e4b605e745e8f37b2b62e9c5	HTX hot wallet
0x5861b8446a2f6e19a067874c133f04c578928727	HTX hot wallet
0xd8a83b72377476d0a66683cde20a8aad0b628713	HTX hot wallet
0x926fc576b7facf6ae2d08ee2d4734c134a743988	HTX hot wallet

Run this trace yourself

Connect the Bitquery MCP server to your AI client with one URL: https://mcp.bitquery.io. Tracing sits on the AI Investigation MCP plan, at $149 per month on our pricing page. The setup guide covers each client.

Client	How to connect
Claude Desktop / Claude web	Settings, Connectors, add custom connector https://mcp.bitquery.io
ChatGPT	Settings, Connectors, add a connector with the same URL
Cursor	Settings, MCP, Add new MCP server
Claude Code	claude mcp add --transport http bitquery https://mcp.bitquery.io

Then try these prompts:

Who deployed 0x01eacc3ae59ee7fbbc191d63e8e1ccfdac11628c, and how
many transactions did that wallet send to it?

Show the top receivers of ETH from the FairWin contract,
including internal transfers, and label them.

Where did 0x854d359a586244c9e02b57a3770a4dc21ffcaa8d send its
ETH? Follow the largest payments and stop at an exchange.

For the method on Bitcoin, see how we traced the 2020 Twitter hack.

Frequently asked questions

What was FairWin?

FairWin was an Ethereum smart contract game that ran from July to September 2019. Players deposited ETH and were promised larger returns, paid from later players' deposits. It took in 693,151 ETH before it emptied on 30 September 2019.

How much did FairWin players lose?

10,115 depositing addresses lost 96,975 ETH between them, about $17 million at 2019 prices. 8,952 addresses got back as much as they put in, or more.

Was FairWin a Ponzi scheme?

It paid early players from later players' deposits and collapsed when new deposits fell behind withdrawals. Bitquery's labels tag the contract as a Ponzi. No court has ruled on it that we know of.

Who ran FairWin?

The ledger shows one wallet that deployed the contract and set off its rewards, and a second wallet that took a 4% cut of deposits and paid the first one's gas. No public source has tied either wallet to a named person.

Related reading

• Where did the Twitter hack Bitcoin go? A full trace
• How Upbit hackers laundered millions using crypto exchanges
• How to investigate an Ethereum address

First published in July 2020 by Aleksey Studnev. Rewritten on 15 October 2026: every figure was worked out again with the Bitquery MCP server, the 2020 conclusion about the four source addresses was corrected, and AI tools helped run the queries and draft the text. Bitquery sells the MCP server named above. This post describes what the public ledger records. The wallets named here are described by what they did, and no person is named.