On-Chain Intelligence Analyst Fund Tracing • AML Compliance Assessment • Blockchain Analytics Making Blockchain Brighter.
Joined July 2026
- Tweets20
- Following5
- Followers5
- Likes12
🚨 Multiple Solana Wallets Stolen
Users including @sheissyxtee, @FLvZyn, and @Larry112066 have reported wallet theft, with a large number of other wallets also affected.
The theft address has stolen over $110K in total, according to on-chain analysis.
Theft address:
8dRrEYnSZN7zRHP5x2PBRanHhoAZB3trUdPhsSkdbb5L
851 SOL transferred to:
7QuFRXmP4LM4d86e6kb9hBBHM7XfMVYsu52YfAVNvPZd
The theft is still ongoing. Some affected wallets had been inactive for a long time. One possibility is that security breaches in apps previously used by the victims may have exposed their private keys.
Investigation ongoing.
Sorry, so far, on-chain analysis of victims’ addresses has not revealed any conclusive leads. One thing we have identified is that some victims used Phantom.
If you’ve been affected, any additional information about your past wallet activity could be valuable, especially the dApps or websites you previously connected to Phantom.
Every detail could help us connect the dots and identify what happened. Let’s work together to uncover the cause.
After more than a month away from posting, here’s what I’ve been working on.
I’ve been developing an automated crypto theft fund-tracking system, and it’s making solid progress.
🔎 Current capabilities:
• Transaction parsing across 15 major cross-chain bridges
• Cross-chain swap tracing for ChangeNOW, FixedFloat, and HitBTC
• Support for major blockchains, including ETH, BTC, and Solana
🚨 What’s next?
Expanding bridge coverage and developing automated alerts when stolen funds reach centralized exchanges or are converted into stablecoins that support issuer-level freezing, such as USDT.
🤝 Free assistance for theft victims
Through January 18, 2027, I’ll provide free automated monitoring and fund-tracing assistance to verified theft victims, provided they can supply credible evidence of the theft.
If your funds have been stolen and you need help, feel free to DM me with relevant transaction hashes, wallet addresses, and supporting evidence.
I’ll continue doing my part to improve blockchain security, and I hope to gain more attention and support along the way.
Users have reported unauthorized transfers of assets from their wallets to the following Ethereum address:
0x4E5Df8422271690327C0348845b639196aB0081E
More than 3,000 wallets were affected, with many of the affected addresses showing no recent transaction activity prior to the transfers.
The stolen assets were consolidated through Relay.link into the above address.
The address currently holds approximately $620K worth of ETH.
According to @somaxbt, the affected wallets are associated with @lootbot_ai. Users who have used @lootbot_ai should move their funds to a secure wallet immediately.
A binary-options exploit on @Injective resulted in approximately $4.9 million in losses.
Exploiter address:
injscan.com/account/inj10ykx…
The stolen funds were subsequently transferred to Ethereum, swapped for ETH, and are currently held at:
etherscan.io/address/0x5A18C…
1/
@avici was exploited, with 2,667 accounts drained of USDT and USDC (~$1.12M).
The exploiter address:
solscan.io/account/FVNFzqAny…
The exploiter swapped the stolen assets for ~10,890 SOL, then bridged the funds to Ethereum, receiving ~456 ETH, and deposited them into Tornado Cash using:
etherscan.io/address/0x2ce21…
#AviciExploit #FundTracking #BlockchainSecurity
2/
Further analysis shows that the initial fee funding of the exploiter address originated from Ethereum.
0.07946666 ETH was withdrawn from the @heleket_systems Withdrawal Hot Wallet:
etherscan.io/address/0x77502…
and transferred to:
etherscan.io/address/0xA1A15…
The funds were then bridged to Solana, funding the exploiter address:
solscan.io/account/FVNFzqAny…
The hardware wallet Coldcard was compromised, with approximately 1,129.49 BTC (~$72M) confirmed stolen across 2,468 affected addresses so far.
The stolen BTC from affected addresses was initially consolidated into the following major consolidation addresses:
bc1qc779m8gec84k3t0ffvu0pps94zheht7lr7ueyn
bc1qh0l7q0mca3ln7wsl9luwns0jc9jhgrtft025l4
bc1qdaarag7729c2n4l2wnyt3hkhfpcs66n98z7uuh
bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0
bc1qsjrf5ze5tmulz7y2x4pc7qaex2a35sanp3rqlx
The majority of the stolen funds are currently held at the following major addresses:
bc1qx76cae2706qd5q576feh7xq8rfcsjpf2htfhe3 — 398.48 BTC
bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r — 562.02 BTC
bc1q8jy96fe5lf8vfugydnte3cguk92gpev7kwtp3q — 89.62 BTC
bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0 — 32.45 BTC
bc1qtfrwa4j6rmj9rsgspv6a0yjumkg39js2numu75 — 45.90 BTC
Additional attacker-controlled addresses with smaller balances or fewer transactions are also being tracked, including:
bc1q0mh6rs0mjvv5ncdyqwhqma7hgup3aycucsc279
bc1qgt5s8rsjyvennup3dz3rk92pczlzqtvy8f5t09
bc1qjd6tcd5ey96fdujpkr7zgn2zjzp29h208xlvxg
bc1qzrl67rtyaqdvtl78rlklxmraqjk7d9f6cf23jm
bc1q7rmsw0ra7zrphe66wwa9960ffm69cp8dlrrcgf
bc1qhh4jkkj07vxpdt0zlvxctjlfhqmurhxa24x3h2
bc1qn79gwljlqwwrgpqqdulvmlnssazm9gasjg090r
bc1qhumhrcr24p4h8aznj9euyxq0ujmw3m9ha0vcf8
Additional attacker-controlled addresses may be identified as the investigation continues. For the latest Coldcard hacker address list and fund tracking updates, visit:
coldcard-hack-tracker.vercel…
#Bitcoin #BTC #CryptoSecurity #FundTracking
AFX Trade Stolen Funds Tracking @AFX_XYZ
The attacker transferred 663.75 ETH to Umbra and 36.4 BTC to Wasabi for mixing.
Approximately 1.7M DAI and 287 BTC (~$18M) remain held across attacker addresses.
Full address list: docs.google.com/spreadsheets…
#AFXTradeHack #FundTracking
👋 Hello, X.
I'm an On-Chain Intelligence Analyst focused on blockchain intelligence, fund tracing, and on-chain analytics.
Looking forward to sharing research, investigations, and insights.
Making Blockchain Brighter. ☀️
#BlockchainIntelligence #FundTracing #OnChain