Operator: Bull Gaming N.V. (Curaçao No. 157086) | Platform: Rollbit.com Investigation Date: April 19, 2026 | Latest Data Refresh: May 10, 2026
This repo is a technical forensic workspace. It combines on-chain analysis, custody-visibility modeling, token-market snapshots, website/infrastructure inspection, and a canonical public complaint corpus. Legal/regulatory material is downstream context, not the analytical center of gravity.
Primary finding: the repo has attributed public wallet balances, but it does not have Rollbit's verified reserve. The May 10 live refresh showed about $59.13M across the tracked BTC/SOL wallets, yet there is no liability-matched proof-of-reserves, complete custody inventory, exchange-balance attestation, or customer-fund segregation proof in the public artifact set.
Analysis posture: the repo should show what was observed, what could not be verified, and what data would be needed next. It should not ask readers to accept an opinion about intent.
Most important correction: do not describe attributed wallets as "reserves." The stronger finding is that the public wallet set is incomplete as a solvency, custody, or withdrawal-reliability model.
External review attribution: X user Defi3000 flagged the need to remove opinion-led framing, re-check the treasury-flow interpretation, and correct the RLB liquidity venue framing. Those points are reflected in the current evidence-first wording.
Publication guidance lives in PUBLISHING_NOTES.md.
Live wallet state, treasury-flow review, RLB public-market snapshot, and source-backed corrections to earlier chain claims.
| Finding | Value |
|---|---|
| Visible known wallets (May 10, 2026) | ~$59.1M |
| Ukraine-linked seizure reporting | $123M |
| RLB tracked public DEX liquidity | ~$5.05M |
| RLB market cap | ~$118.22M |
| Main data gap | Reserves, liabilities, venue depth, and operating controls are not publicly reconstructable |
Canonical public complaint record with provenance fields, explicit dedupe rules, and amount-status labeling.
| Finding | Value |
|---|---|
| Counted public complaints | 80 |
| Quantified complaints | 74 |
| Total quantified amount | $562,081.08 |
| Public resolution rate | 5.0% |
| Largest counted case | $55,000 |
| Most common category | Multiple-account accusation |
Selected X threads used as corroboration for timing, public escalation, and staff conduct. X posts are not counted as a separate complaint-total system.
High-level synthesis tying the on-chain, complaint, website, and timeline evidence together.
DNS, edge, TLS, stack, and public license-verification findings for rollbit.com, blog.rollbit.com, and rollbot.rollbit.com.
Dated chronology of public reporting, operator activity, treasury alerts, and source-backed context.
Human-readable claim-to-source appendix. Machine-readable version: output/evidence_register.csv.
Computed technical indicators across custody visibility, RLB market data scope, complaint-pattern signals, duplicate review, and web acquisition gaps.
| Finding | Value |
|---|---|
| Attributed public wallet snapshot | $59.13M |
| Direct outflows / visible wallet snapshot | 29.4% |
| Reported off-wallet event / visible wallet snapshot | 208.0% |
| Tracked public DEX liquidity / market cap | 4.3% |
| Withdrawal-control keyword hits | 48 cases |
| KYC/compliance keyword hits | 33 cases |
Raw public-source preservation layer for complaint pages, public reporting, operator publications, verification pages, passive scans, and social corroboration links.
| Finding | Value |
|---|---|
| Deduplicated public targets captured | 67 |
| HTTP responses written | 67 |
| Bitcointalk complaint threads captured | 24 / 24 |
| Trustpilot automated capture result | HTTP 403 challenge |
| Casino Guru automated capture result | 9 / 9 URLs returned HTTP 200 |
Quality-control appendix mapping Defi3000 feedback to corrected report language and remaining collection tasks.
- Known public wallets still show roughly
$59.1Mas of May 10, 2026, but those balances are not verified reserves. The sharper issue is the absence of a liability-matched proof-of-reserves view. - A Ukraine-linked seizure reported at
$123Mremains central because it points to material off-wallet or exchange-linked custody exposure. - RLB market data is incomplete in this repo. The current snapshot captures about
$5.05Min tracked public DEX liquidity against roughly$118.22Mmarket cap, but it does not quantify Rollbit app/on-platform liquidity, order-book depth, or custody-side token inventory. It should not describe Uniswap as the only RLB trading or liquidity venue. - The complaint corpus now has one canonical count:
80counted public complaints,74quantified,$562,081.08total quantified. - Only four counted cases are publicly marked resolved, which keeps the complaint record materially unresolved.
- The technical deep-dive now extracts process signatures: withdrawal-control language appears in
48counted cases, KYC/compliance escalation in33, and win/profit context in35. - The website surface requires split acquisition because the main app is Cloudflare challenge-gated while the public blog is separately hosted and indexable.
- The key unresolved intersection is cross-dataset, not a single artifact: user-reported fund restrictions, no public reserve proof, unclear operating controls, unknown token-control attribution, and incomplete venue-depth data for RLB.
rollbit_forensic/
├── REPORT_0_EXECUTIVE_SYNTHESIS.md
├── REPORT_1_ONCHAIN_FORENSICS.md
├── REPORT_2_VICTIM_EVIDENCE.md
├── REPORT_3_X_TWITTER_EVIDENCE.md
├── REPORT_4_WEBSITE_TECHNICAL_INVESTIGATION.md
├── REPORT_5_NEWS_AND_REGULATORY_TIMELINE.md
├── REPORT_6_EVIDENCE_REGISTER.md
├── REPORT_7_TECHNICAL_DEEP_DIVE.md
├── REPORT_8_PUBLIC_RECORDS_AND_COMPLAINT_CAPTURE.md
├── REPORT_9_EXTERNAL_REVIEW_FACT_CHECK.md
├── LEGAL_SUBMISSION_TEMPLATE.md
├── PUBLISHING_NOTES.md
├── .gitignore
│
├── scripts/
│ ├── blockchain_analyzer.py
│ ├── build_case_corpus.py
│ ├── generate_visualizations.py
│ ├── public_record_capture.py
│ ├── run_investigation.py
│ ├── technical_deep_dive.py
│ ├── treasury_monitor.py
│ ├── complainant_collector.py
│ └── web_surface_capture.py
│
├── output/
│ ├── blockchain_analysis.json
│ ├── corpus_metrics.json
│ ├── evidence_register.csv
│ ├── forensic_indicators.csv
│ ├── public_record_capture.json
│ ├── public_record_index.csv
│ ├── technical_deep_dive.json
│ ├── web_surface_capture.json
│ ├── captures/ # local raw captures; ignored by git
│ ├── rollbit_analysis.json # superseded legacy stub
│ ├── rollbit_cases.csv
│ └── charts/
│
├── cases_database.json
└── requirements.txt
Publishable artifacts:
- reports
REPORT_0throughREPORT_8 - source index and computed outputs under
output/*.jsonandoutput/*.csv - charts under
output/charts/ - scripts needed to reproduce captures and indicators
Local/private artifacts:
output/captures/raw HTML/headers/bodies are ignored by git by default.env*,.vscode/,.claude/,.cursor/,.idea/,.venv/, caches, and OS files are ignored by git- firsthand complainant material should be reviewed for consent and private identifiers before publishing
pip install -r requirements.txt
# Rebuild the canonical complaint corpus and evidence register
python scripts/build_case_corpus.py
# Generate charts from the current corpus and on-chain data
python scripts/generate_visualizations.py
# Generate technical forensic indicators
python scripts/technical_deep_dive.py
# Capture DNS/TLS/HTTP web-surface artifacts
python scripts/web_surface_capture.py
# Capture complaint/public-record source pages
python scripts/public_record_capture.py
# Run the on-chain investigation workflow
python scripts/run_investigation.py --quick
python scripts/run_investigation.py --full
python scripts/run_investigation.py --capture-public-recordsStart with the technical artifacts, not the legal template:
- Report 1: On-Chain Financial Forensics
- Report 4: Website Technical Investigation
- Report 7: Technical Forensic Deep Dive
- cases_database.json
- output/blockchain_analysis.json
- output/technical_deep_dive.json
- output/forensic_indicators.csv
- output/public_record_capture.json
- output/public_record_index.csv
- output/web_surface_capture.json
- output/rollbit_cases.csv
The legal submission template remains available as an optional downstream packaging aid, but it should not drive the investigation. The core job is to preserve artifacts, classify flows correctly, separate confirmed from claimed complaint data, and identify testable data gaps.
Primary sources used in the current report set include Blockstream API, Solana RPC, CoinGecko, DEXScreener, dev.ua, ChainCatcher, official Rollbit blog pages, CGA policy pages, urlscan, Bitcointalk, Trustpilot, and Casino Guru.