Sanctuary Intelligence Desk

DATIP's recovery describes a three-tier payment structure totaling five million US dollars. Per reporting in MercoPress, The Block, Cointelegraph, and Buenos Aires Herald that has consistently described the same DATIP-attributed content:
**Tier 1: $1.5 million advance.** Liquid tokens or cash, paid up-front in connection with promotional commitments. The advance is the simplest economic transaction in the contract — the kind of pre-deal payment that, in legitimate venture finance, accompanies a binding non-disclosure or term sheet.
**Tier 2: $1.5 million tied to a public announcement of Davis as adviser.** Conditioned on Milei publicly naming Davis as a presidential adviser on blockchain matters. The payment is contingent on the announcement — meaning the announcement is the deliverable, and the deliverable is the act that would have produced the public legitimacy LIBRA needed.
**Tier 2 was not delivered.** Milei did not publicly name Davis as an adviser. The president did, however, post the LIBRA endorsement on February 14.
**Tier 3: $2 million contingent on a signed blockchain/AI consulting contract reviewed by Javier and Karina Milei.** The third tier is structured as a follow-on consulting engagement. The reviewers named in the recovered draft are Javier Milei and his sister Karina Milei, who serves as Secretary General of the Presidency.
The opening phrase "this is the final agreement discussed with H" identifies the counterparty as someone whose first name begins with H. Per the DATIP-attributed reporting, "H" is understood to refer to Hayden Davis. The reporting does not establish that the draft was signed by either party. It does establish that the draft was on Novelli's phone at the time of its forensic seizure.
The other evidence stream from the Argentine prosecutorial investigation is the call log between Milei and Novelli on the night of February 14, 2025 — the night of the LIBRA post.
Per Argentine federal call-log data released through the prosecutorial discovery process and reported by the New York Times (April 7, 2026), CoinDesk, and Buenos Aires Herald: there were seven phone calls between Milei and Novelli on the night of February 14, in the hours surrounding the LIBRA post. The timing places the calls bracketing the post — some before, some after.
The content of the calls is not in the public record. Argentine call-log data records the fact of the calls, the parties, and the durations, not the audio. What the call log establishes is the timing-based circumstantial association: Milei was actively in contact with Novelli, the person on whose phone the $5M contract draft was found, in the immediate window around the post that produced the $4 billion retail loss.
For Argentine federal court purposes, this is corroborative evidence — it does not prove that the contract was executed or that Milei was paid. It establishes that the document existed three days before the post and that the parties were in communication around the post.
The on-chain forensic record is more direct and is independently verifiable.
Bubblemaps documented in March 2025 (the analysis was later partially withdrawn after public pushback, but the underlying transaction data is on-chain) that a Davis-attributed wallet executed an immediate, large-scale snipe of LIBRA's liquidity pool within fifteen minutes of Milei's post. The wallet pulled more than $100 million in USDC from the LP. Total liquidity withdrawn across the relevant 48-hour window: in excess of $110 million USDC per the more recent ChainCatcher and Decrypt accounting.
Davis publicly admitted to sniping LIBRA on Coffeezilla's podcast in March 2025. He used the term himself. The admission is on the public record. Davis's framing was that the snipe was a sophisticated arbitrage by his team, not a fraud against retail.
A separate trail documented an additional **$507,500 Bitget transfer on January 30, 2025** — less than one hour after Milei's Casa Rosada selfie with Davis. Argentine prosecutors traced this transfer through the Bitget deposit address pattern.
So the on-chain timeline runs: January 30 ($507K Bitget transfer after a Milei-Davis photograph), February 11 (the $5M draft contract created on Novelli's phone), February 14 (the Milei LIBRA post + seven Milei-Novelli phone calls + the immediate snipe + the $4 billion retail loss).
**Argentinian criminal proceedings:** active but slow. Prosecutor Eduardo Taiano is the lead in the executive-conduct probe. As of mid-May 2026, fifteen months after the LIBRA launch, Argentine courts have not formally summoned witnesses or suspects in the investor-driven criminal case. On April 2, 2026, opposition deputies (Civic Coalition, Union for Homeland, United Provinces) filed a criminal complaint against Taiano himself for "unjustified delays in the production of evidence" and "retention and concealment" of evidence from plaintiffs. The opposition framing is that the case is being slow-walked under political pressure from the LLA-aligned executive branch.
**Impeachment:** The November 2025 Argentine congressional commission report concluded that Milei provided "essential collaboration" and used his presidential role to spread an "alleged scam." Impeachment proceedings were initiated. The October 26, 2025 LLA midterm sweep — 40.84 percent versus the Peronist 31.63 percent, with +64 deputy seats moving the LLA caucus to 95 — destroyed the math required to remove Milei from office. Impeachment remains technically pending; politically, it is dead.
**Approval rating:** Bloomberg reported on March 26, 2026 that Milei's approval has dropped to a new low of 36.4 percent, down five points from February, with disapproval near 62 percent. The cabinet has shed Cabinet Chief Guillermo Francos (replaced by former spokesperson Manuel Adorni). The political cost of LIBRA is real but has not produced a removal mechanism.
**US criminal proceedings:** none. As of May 15, 2026, no public reporting confirms a US grand jury, DOJ indictment, or SEC enforcement action against Davis. Davis remains at large, presumed in Texas, defending the SDNY civil class action *Hurlock v. Kelsier Ventures et al.* (1:25-cv-03891-JLR) before Judge Jennifer Rochon. Davis filed a 30-page motion to dismiss arguing SDNY lacks jurisdiction.
**Interpol Red Notice:** Argentine lawyer Gregorio Dalbón formally requested an Interpol Red Notice for Davis on March 13, 2025. As of May 15, 2026, Interpol has not issued the Red Notice. Argentina's request remains in processing within the Argentine system per Crypto.news and Bitget fact-checks. Davis is not, in the operational sense, internationally wanted.
**Asset freeze status:** $58 million USDC was placed under TRO by SDNY on May 30, 2025 (Judge Rochon, Hurlock). On August 11, 2025, Judge Rochon unfroze $57.6 million USDC, ruling plaintiffs had not shown irreparable harm. Davis was on-chain trading memes within 24 hours of the unfreeze. He sniped YZY (the Kanye West memecoin, August 2025) using fourteen wallets for approximately $12 million in profit per Decrypt and Unchained reporting. The wallets were funded via CCTP from the unfrozen USDC pool and traced to shared CEX deposits.
The LIBRA case is a category case study in why on-chain forensics and traditional legal process operate at different speeds.
The on-chain trail was complete fifteen minutes after the Milei post. The wallet snipe, the LP withdrawal, the CEX deposits — all of it was recorded on the Solana ledger and visible to any independent investigator in real time. By the end of February 14, 2025, the forensic facts were established.
The DATIP recovery of the $5M document took thirteen months. The opposition's criminal complaint against the prosecutor took thirteen more months. The Hurlock class action survived but lost its TRO. The Red Notice has not issued. The criminal indictment has not been filed.
Davis is presently sniping YZY-class memecoins with funds that an SDNY judge unfroze.
For Sanctuary's purposes, the lesson is structural. The on-chain evidence is sufficient for risk decisions today. Compliance officers do not need to wait for the criminal indictment to mark a wallet Critical. The wallets in the Davis cluster carry Sanctuary's `memecoin_sniper_operator` flag with `kelsier_ventures_attributed` provenance regardless of the SDNY ruling status.
The wallets that funded YZY snipes inherit the same flag. The wallets that received the $507K Bitget transfer in January 2025 are tagged. The wallet that pulled $100M USDC from LIBRA's pool on February 14 is tagged.
The pace of legal consequence is not the pace of compliance decisions. Compliance can move on the chain. The court can move on its own timeline. The two pipelines should not be confused.
The forensic team recovered the contract from a phone thirteen months after the launch. The on-chain snipe was complete in fifteen minutes.
For OTC desks, exchanges, and payment teams: screen the wallet, not the indictment. If you wait for the criminal case, you will be holding Davis-attributed inflows when the next YZY-class snipe lands.
The document is on Novelli's phone. The transactions are on Solana. One is slow. The other is not.
Scam alerts, new sanctions, and investigation techniques. One email per week. Unsubscribe anytime.