Peel
Menu
OverviewMapVenuesFor investigatorsVictim checkMethod
balances 1m ago

Ledger / CryptoBillis drain

2026-10-09 20:25 UTC
Drained
$85.3M
In attacker wallets
$64.5M
Frozen
$10.0M
Bridges & exchanges
$9.7M
$64.5Min attacker wallets · 76%$10.0Mfrozen · 12%$9.7Mthrough bridges & exchanges · 11%$1.1Min transit / unresolved · 1%

$64.5M of the $85.3M drained is still in attacker wallets ($45.8M as ETH, $17.6M as BTC, $875k as stablecoins, still freezable). $875k of it is freezable stablecoin; Tether has frozen $10.0M. $9.7M left through bridges and exchanges whose output we cannot see yet.

Freezable now: $874k USDT in 7 attacker walletsfreeze targets · exports · alerts →

Money flow

The flow map needs a wide screen. Open the map on desktop, or read the tables below.

In → out through bridges

ServiceInOutAmount outRecipientsLegs
Bitget Wallet · arrival sidesee venueethereum1,313.35 ETH ($3.3M)117
Bridgers · arrival sidesee venueethereum315.03 USDT ($760k)411
HiFiSwap · arrival sidesee venueethereum1,380.33 ETH ($3.4M)311
NEAR Intents · arrival sidesee venueethereum415.9 ETH ($1.0M)34
THORChain · arrival sidesee venueethereum1,191.42 ETH ($3.0M)26
mayan.finance · arrival sidesee venueethereum158.26 ETH ($393k)11
USDT0$20.00M USDT · TRONethereum20,000,000 USDT540
Relay.link$9.45M USDT · TRONethereum3,764.5 ETH835
Chainflip$4.00M USDT · TRONethereum1,591.62 ETH78

Findings

automated · evidence linked · not legal conclusions
  • Exchange deposit2026-10-09 20:08 UTCauto · confidence 85%

    About $258k of stolen USDT sent to one Bybit deposit address on Oct 9

    A TRON wallet that received stolen USDT sent it in three transfers to a single Bybit deposit address within about eight hours. Bybit is a service that received the funds and is not the attacker. Bybit can trace the account that owns this deposit address and freeze it. About $25k more USDT was left in the sending wallet at the last check.

    1. 55,404 USDT 12:14 UTC to Bybit deposit addressTLBGPnW…uwgMtx a42745…5265
    2. 96,986 USDT 12:06 UTC to the same Bybit addresstx 9fd541…9dfa
    3. 105,788 USDT 20:02 UTC to the same Bybit addresstx 53dd04…0f95
    4. Sending wallet received funds from a wallet labelled as the CryptoBillis drainer; about 25k USDT leftTYvhjBk…citr
    watchTYvhjBk…citr
  • Pattern2026-10-09 19:54 UTCauto · confidence 78%

    Stolen USDT looped through USDD, SunSwap and Chainflip, about $3.7M re-routed

    On Oct 9, tracked TRON wallets sent millions of stolen USDT into the USDD stablecoin module, SunSwap and Chainflip. Some of the same amounts came straight back to the thief-controlled wallets. They were then forwarded to a new collection wallet. This looks like layering to blur the trail, not a final cash-out. The services involved only processed the swaps. Tether, USDD and Chainflip could review the flows and any related deposits.

    1. 1,618,288 USDT 11:13 UTC sent to USDD PSMTXYU5fp…xwfhtx 402482…7799
    2. 1,316,323 USDT 13:24 UTC came back from USDD PSM, then went to new hop walletTXYU5fp…xwfhtx b39586…b6e3
    3. New hop wallet received 200k, 700k, 1.316M and 700k USDT from the same drainer walletTVDxLEt…Rnpe
    4. 1,000,000 USDT 13:36 UTC to ChainflipTPSBhvy…Za7Vtx 84759c…fb10
    5. 999,992 USDT 13:40 UTC to SunSwap after receiving the same amount back from ChainflipTPSBhvy…Za7Vtx e4ba40…071f
    watchTVDxLEt…Rnpe0x30013…f441
  • Exchange deposit2026-10-09 18:59 UTCauto · confidence 85%

    About $464k of stolen USDT sent to one Binance deposit address, Oct 2-8

    Four TRON wallets in the theft chain made seven transfers, six of about $70k and one of $44k, to the same Binance deposit address between Oct 2 and Oct 8. The tracker flags the address as a Binance deposit, so Binance received these funds and is not the attacker. Binance can trace the account that owns this deposit address and freeze it. Separately, $333k of stolen USDT is sitting in one TRON wallet and could be frozen by Tether.

    1. 69,996 USDT Oct 2 20:16 UTC to Binance depositTMxnc43…rAZPtx e0d62b…7f5a
    2. 69,996 USDT Oct 6 09:44 UTC from TU13Q3 to same deposittx d3576e…54d1
    3. 69,997 USDT Oct 7 00:19 UTC from TYfRt7 to same deposittx 038f40…1da3
    4. 69,997 USDT Oct 7 07:15 UTC from TYfRt7tx 53929c…027f
    5. 44,165 USDT Oct 8 05:38 UTC from TU13Q3tx 3da83b…77f5
    6. 69,997 USDT Oct 8 16:11 UTC from TYfRt7tx 98fad3…91dd
    7. 69,997 USDT Oct 8 20:43 UTC from TJ35bLtx 63a6a2…906f
    8. 333,255 USDT still held, received 421,819 USDT from TU13Q3 on Oct 6TGgmQkF…e92Rtx 2a9adf…2516
    watchTGgmQkF…e92RTMxnc43…rAZP
  • Exchange deposit2026-10-09 18:48 UTCauto · confidence 85%

    About $845k of stolen USDT sent to two Binance deposit addresses on Oct 9

    On Oct 9, stolen TRON USDT was sent to Binance deposit addresses in repeated payments. One address got seven payments of about $50k, totalling about $355k. A second received seven payments of about $70k, totalling about $490k. Binance is a service, not the attacker. It can trace these deposit accounts and freeze the funds. Tether can also act on any USDT that has not yet moved.

    1. Binance deposit address labelled by tracker; 7 inbound transfers of about $50k from one theft hop, totalling about $355k, 10:34-14:32 UTC Oct 9TUDP8Tc…Aypi
    2. 49,999 USDT 14:32 UTC to Binance deposittx 2be603…043f
    3. 50,581 USDT 10:34 UTC to Binance deposittx 02a563…6edd
    4. Second Binance deposit address received repeated 69,996 USDT peel payments from theft hops from 09:42 UTCTMxnc43…rAZP
    5. 69,996 USDT 12:08 UTC from theft hop to Binance deposittx ebf486…9359
    6. 69,996 USDT 11:40 UTC from second theft hop to Binance deposittx 890042…9b8f
    watchTW5bHaw…8FPTTXXkfDw…kcQj
  • Pattern2026-10-09 17:25 UTCauto · confidence 80%

    $2M of bridged USDT, now ETH, funneled into one parked wallet

    Three more TRON-to-Ethereum Relay bridge runs (about 1.5M USDT, roughly 797 ETH) landed in fresh wallets and were forwarded within minutes to a single wallet that now holds about $3M of ETH. One of the 400 ETH batches was then split onward in 199 ETH pieces, and one of those pieces is now in another parked wallet. Relay is a bridge service, not the attacker. Exchanges and Tether can watch the parking wallet for cash-out attempts.

    1. 399.60 ETH from Relay to first-hop wallet, 10:37 UTC0xa4c4a…2d30tx 0xdae9…d7ad
    2. 399.59 ETH ($994K) forwarded to parking wallet 10:50 UTC0x131c9…fa6atx 0x348d…3c72
    3. 179.33 ETH from Relay (plus 19.98 ETH from a second bridge), 10:48 UTC0x66c7c…eda3tx 0x0194…2590
    4. 199.30 ETH forwarded to same parking wallet 10:51 UTCtx 0x96db…a2f5
    5. 198.30 ETH forwarded to same parking wallet 10:50 UTC (bridged 499K USDT)0x87a19…f3a7tx 0xffd6…047f
    6. 199.20 ETH ($495K) later sent to another parked wallet 17:09 UTC, after a THORChain inflow0xc322e…4065tx 0x548c…1dc2
    watch0x131c9…fa6a0xc322e…4065
  • Pattern2026-10-09 17:12 UTCauto · confidence 80%

    $4.97M of swapped ETH (1,998.5 ETH) now parked in one new wallet

    Stolen USDT that came across the USDT0 bridge was sold for ETH through UniswapX and Bebop, which are trading services and not the attacker. The roughly 2,000 ETH from those swaps was then moved to a single new wallet, where the live balance still shows it. Exchanges and market makers can watch this wallet for any deposit.

    1. 1998.50 ETH ($4.97M) sent 07:23 UTC from the swap wallet to the new hop0x064af…7160tx 0x4e2a…5146
    2. Live balance of the hop is 1998.5 ETH, with no outflow seen0x064af…7160
    3. 999,550 USDT sold via Wintermute/UniswapX for about 399.5 ETH at 07:21 UTCtx 0x560d…b9a2
    4. 999,700 USDT sold via Bebop at 07:17 UTCtx 0x6234…9bf1
    5. Source swap wallet, funded by USDT0 bridge exits0xed43b…cbd1
    watch0x064af…7160
  • Bridge exit2026-10-09 16:46 UTCauto · confidence 80%

    $6M stolen USDT bridged from TRON to Ethereum, then swapped to ETH

    Twelve 500,000 USDT transfers left TRON through the USDT0 bridge on Oct 9 and arrived on Ethereum at two wallets labelled as the CryptoBillis drainer. For one of them, Arkham shows about 594 ETH (roughly $1.5M) arriving from a THORChain router and then leaving to a new unlabelled wallet. USDT0 and THORChain are services, not the attacker. Because the funds are now ETH, Tether cannot freeze them, so the next step is tracking the new wallet and any exchange deposits.

    1. 500,000 USDT bridged via USDT0 to Ethereum wallet 07:05 UTC0xed43b…cbd1tx cf6a3a…3e92
    2. 500,000 USDT bridged via USDT0, 07:15 UTC (one of 10 transfers, $5M total, to the same wallet)tx 3057e5…8ec0
    3. 500,000 USDT bridged via USDT0 07:43 UTC to second wallet (2 transfers, $1M)0xce298…c647tx 8bf492…59fb
    4. 594.7 ETH ($1.48M) sent onward 15:52 UTC from the second wallet to a new wallet0xce298…c647tx 0x627a…175c
    5. About 198 ETH ($495k) received from THORChain router at 15:49 UTC0xce298…c647tx 0xb352…eb4f
    watch0xC322e…4065
  • Mixer2026-10-09 16:20 UTCauto · confidence 85%

    About $1.9M of stolen ETH split across 12 wallets and sent to Tornado Cash

    Two large ETH transfers (about $1.08M and $0.98M) from tracked theft wallets were split into 100, 10 and 1 ETH pieces across at least a dozen fresh wallets. Those wallets then deposited the pieces into Tornado Cash within about 45 minutes. Tornado Cash is a mixing service, not the attacker. Once funds are mixed, tracing them gets much harder, so any freeze or exchange alert would need to happen now.

    1. 434.53 ETH ($1.08M) received 15:45 UTC from a large parked theft-chain wallet0x165ed…ab64tx 0xe93b…ac9e
    2. 393.27 ETH ($979k) received 15:04 UTC from another parked wallet0xa27ff…650ftx 0x266f…000f
    3. 100 ETH ($249k) deposited to Tornado Cash 15:18 UTC0x433c2…b60btx 0x0ab9…59f0
    4. 100 ETH to Tornado Cash 15:43 UTC, followed by 10 ETH and 1 ETH pieces0x7b1c4…8330tx 0x76a2…6219
    5. Ten 10 ETH deposits to Tornado Cash at 15:55 UTC, from 90.10 ETH received from the splitter0x1df04…ff2ctx 0x9155…9411
    6. 100 ETH to Tornado Cash 15:55 UTC plus two 10 ETH deposits0x51f4f…7fectx 0x4356…b546
    7. Ten 10 ETH and seven 1 ETH deposits to Tornado Cash 15:17 UTC0x1827b…d3c4tx 0x9268…83b8
    watch0x9400e…40d60x283d2…ce24

Movements

UTC
  1. 20:20:27move2,838 USDT ($3k) left TYvhjB…citr → new hop TXXkfD…kcQj06bed…6612 ↗
  2. 20:19:27move2,056 USDT ($2k) left TYvhjB…citr → new hop TCanhf…a14pdad3a…0bbb ↗
  3. 20:18:09move2,013 USDT ($2k) left TYvhjB…citr → new hop TCanhf…a14p3ffd1…d704 ↗
  4. 20:16:33move2,211 USDT ($2k) left TYvhjB…citr → new hop TXXCjs…X8Th8034c…2768 ↗
  5. 20:13:42move2,271 USDT ($2k) left TYvhjB…citr → new hop TCanhf…a14p81268…6598 ↗
  6. 20:12:39move2,396 USDT ($2k) left TYvhjB…citr → new hop TZ8cu4…ieD891e59…75c3 ↗
  7. 20:08:22findingAbout $258k of stolen USDT sent to one Bybit deposit address on Oct 9a4274…5265 ↗
  8. 20:02:43mempoolTYvhjB…citr balance fell $133k → $27k — funds leaving, details follow
  9. 20:02:27exchange105,788 USDT ($106k) left TYvhjB…citr → Bybit53dd0…0f95 ↗
  10. 20:02:27woke upDormant wallet TYvhjB…citr moved 105,788 USDT ($106k) after 8h quiet53dd0…0f95 ↗
  11. 20:01:17freezable$131k USDT now sitting in attacker-controlled TYvhjB…citr (TRON) — freezable
  12. 20:00:24freezable$131k in stablecoins (USDT 130,862) now sitting in attacker-controlled TYvhjB…citr on TRON — freezable
  13. 19:54:52findingStolen USDT looped through USDD, SunSwap and Chainflip, about $3.7M re-routed40248…7799 ↗
  14. 19:50:30freezable$33k in stablecoins (USDT 33,349) now sitting in attacker-controlled TQCWGb…pDSd on TRON — freezable
  15. 19:50:30freezable$105k in stablecoins (USDT 105,403) now sitting in attacker-controlled TYvhjB…citr on TRON — freezable
  16. 19:50:01freezable$109k USDT now sitting in attacker-controlled TCanhf…a14p (TRON) — freezable
  17. 19:49:42freezable$109k in stablecoins (USDT 108,730) now sitting in attacker-controlled TCanhf…a14p on TRON — freezable
  18. 19:48:55freezable$386k in stablecoins (USDT 385,832) now sitting in attacker-controlled TZ8cu4…ieD8 on TRON — freezable
  19. 19:41:18move25,404 USDT ($25k) left TQFZuX…hxnP → wallet TYvhjB…citrc1613…46e0 ↗
  20. 19:36:36exchange106,167 USDT ($106k) left TW5bHa…8FPT → Binance096a6…3c20 ↗
  21. 19:35:09move106,168 USDT ($106k) left TCanhf…a14p → wallet TW5bHa…8FPT61308…bd22 ↗
  22. 19:35:09woke upDormant wallet TCanhf…a14p moved 106,168 USDT ($106k) after 8h quiet61308…bd22 ↗
  23. 19:35:00exchange64,720 USDT ($65k) left TQFZuX…hxnP → binancee801d…27c8 ↗
  24. 19:33:00exchange49,996 USDT ($50k) left TZ8cu4…ieD8 → binance07a3e…a610 ↗
  25. 19:31:03move2,024 USDT ($2k) left TXXkfD…kcQj → wallet TPWHCL…AcU422337…a096 ↗
  26. 19:30:57exchange49,996 USDT ($50k) left TQFZuX…hxnP → binancede857…886e ↗
  27. 19:22:39to venue67,543 USDT ($68k) left TQFZuX…hxnP → Unlabelled high-volume counterpartyd00e6…47ad ↗
  28. 19:18:36move25,557 USDT ($26k) left TQFZuX…hxnP → new hop TYvhjB…citre4c2d…77a7 ↗
  29. 19:12:36exchange69,997 USDT ($70k) left TCanhf…a14p → binancee5f8a…c27e ↗
  30. 19:06:18to venue105,082 USDT ($105k) left TCanhf…a14p → Unlabelled high-volume counterpartyfa7f2…fc4d ↗
  31. 18:59:45findingAbout $464k of stolen USDT sent to one Binance deposit address, Oct 2-8e0d62…7f5a ↗
  32. 18:55:54move33,341 USDT ($33k) left TCanhf…a14p → new hop TQCWGb…pDSd438f3…1307 ↗
  33. 18:48:28findingAbout $845k of stolen USDT sent to two Binance deposit addresses on Oct 92be60…043f ↗
  34. 18:34:58victimNew victim: bc1qt3…uw8n drained of 0.0619 BTC ($5k) into bc1qgq…d26n27b37…1acd ↗
  35. 17:25:10finding$2M of bridged USDT, now ETH, funneled into one parked wallet0xdae…d7ad ↗
  36. 17:12:59finding$4.97M of swapped ETH (1,998.5 ETH) now parked in one new wallet0x4e2…5146 ↗
  37. 15:52:59move594.70 ETH ($1.48M) left 0xce29…c647 → new hop 0xc322…40650x627…175c ↗
  38. 14:06:03to venue100,000 USDT ($100k) left TVCX9y…ZRQM → USDD PSM186f0…9429 ↗
  39. 14:04:00move100,000 USDT ($100k) left TUey97…NevU → new hop TVCX9y…ZRQM5c63d…8eb9 ↗
  40. 14:02:23bridge100,000 USDT via Relay → 40.18 ETH on ethereum to 0x3001…f441748e7…263d ↗
  41. 14:02:15to venue100,000 USDT ($100k) left TVCX9y…ZRQM → Relay.link748e7…263d ↗
  42. 13:59:24move100,000 USDT ($100k) left TUey97…NevU → new hop TVCX9y…ZRQMfc6dc…163f ↗
  43. 13:48:00to venue700,000 USDT ($700k) left TMd3x6…a2bx → Unlabelled high-volume counterparty346ff…af0c ↗
  44. 13:46:21move700,001 USDT ($700k) left TMTJy3…n2HK → new hop TV9zhX…64KF344fc…69f2 ↗
  45. 13:45:30move700,001 USDT ($700k) left TXYU5f…xwfh → wallet TVDxLE…Rnpea004b…9832 ↗
  46. 13:42:33to venue305,007 USDT ($305k) left TPSBhv…Za7V → SunSwap601f6…c697 ↗
  47. 13:40:36to venue999,992 USDT ($1000k) left TPSBhv…Za7V → SunSwape4ba4…071f ↗
  48. 13:37:24to venue305,015 USDT ($305k) left TPSBhv…Za7V → Chainflip8c83b…4331 ↗
  49. 13:36:30to venue1,000,000 USDT ($1.00M) left TPSBhv…Za7V → Chainflip84759…fb10 ↗
  50. 13:27:24to venue1,316,323 USDT ($1.32M) left TMd3x6…a2bx → Unlabelled high-volume counterparty770ae…417d ↗
  51. 13:25:54to venue1,305,015 USDT ($1.31M) left TY6swd…UPoE → SunSwapca831…fa77 ↗
  52. 13:25:48move1,316,323 USDT ($1.32M) left TMTJy3…n2HK → new hop TV9zhX…64KF62fdc…d126 ↗
  53. 13:24:57move1,316,323 USDT ($1.32M) left TXYU5f…xwfh → new hop TVDxLE…Rnpeb3958…b6e3 ↗
  54. 12:53:35move200.90 ETH ($500k) left 0xce29…c647 → new hop 0xb88d…18560x844…4ed6 ↗
  55. 12:37:15to venue700,000 USDT ($700k) left TMd3x6…a2bx → Unlabelled high-volume counterparty50445…481e ↗
  56. 12:35:57move700,000 USDT ($700k) left TMTJy3…n2HK → new hop TV9zhX…64KF41c64…e05d ↗
  57. 12:35:15move700,000 USDT ($700k) left TXYU5f…xwfh → new hop TVDxLE…Rnpe95925…82e2 ↗
  58. 12:21:06to venue807,619 USDT ($808k) left TXYU5f…xwfh → USDD PSM20050…347a ↗
  59. 12:10:36to venue490,417 USDT ($490k) left TXYU5f…xwfh → USDD PSMf66d6…d2aa ↗
  60. 12:08:18to venue223,649 USDT ($224k) left TEQWRr…C4fu → USDD PSM80d85…16b0 ↗
  61. 12:04:45to venue200,000 USDT ($200k) left TMd3x6…a2bx → Unlabelled high-volume counterparty51b0f…cd7d ↗
  62. 12:03:12move200,000 USDT ($200k) left TMTJy3…n2HK → new hop TV9zhX…64KF3c7c4…0bd3 ↗
  63. 12:01:54move200,000 USDT ($200k) left TXYU5f…xwfh → new hop TVDxLE…Rnpea4d14…a677 ↗
  64. 11:55:27to venue74,434 USDT ($74k) left TPRvH5…TCiQ → JustLendf582e…7587 ↗
  65. 11:54:33to venue81,733 USDT ($82k) left TRHRxs…5AN9 → JustLendabcad…237a ↗
  66. 11:54:12to venue441,193 USDT ($441k) left TUZAps…Hce7 → USDD PSMd0c26…1a17 ↗
  67. 11:54:00move74,434 USDT ($74k) left TMeswy…NSuH → new hop TPRvH5…TCiQa90a7…3cc1 ↗
  68. 11:53:42to venue84,493 USDT ($84k) left THzUZN…p4zR → JustLend522fe…af39 ↗
  69. 11:53:36to venue500,000 USDT ($500k) left TUZAps…Hce7 → USDD PSMa2aeb…8070 ↗
  70. 11:53:09move81,733 USDT ($82k) left TMeswy…NSuH → new hop TRHRxs…5AN9f0cb6…84ca ↗
  71. 11:53:00to venue500,000 USDT ($500k) left TUZAps…Hce7 → USDD PSM51868…ba85 ↗
  72. 11:52:18move84,493 USDT ($84k) left TMeswy…NSuH → new hop THzUZN…p4zRb05b5…da9a ↗
  73. 11:52:12to venue500,000 USDT ($500k) left TUZAps…Hce7 → USDD PSMa055b…1f60 ↗
  74. 11:51:36to venue500,000 USDT ($500k) left TUZAps…Hce7 → USDD PSM13e13…957b ↗
  75. 11:51:15to venue93,300 USDT ($93k) left TEbTX4…6o6v → JustLend0a08b…f1a0 ↗
  76. 11:51:03to venue500,000 USDT ($500k) left TUZAps…Hce7 → USDD PSM68d90…9ce6 ↗
  77. 11:50:48to venue86,632 USDT ($87k) left TPWtik…kX2A → JustLend14562…8a7c ↗
  78. 11:50:27to venue500,000 USDT ($500k) left TUZAps…Hce7 → USDD PSMb46ca…dea6 ↗
  79. 11:50:21to venue74,854 USDT ($75k) left TDLXkQ…v2WV → JustLend8a2dd…2622 ↗
  80. 11:49:51to venue500,000 USDT ($500k) left TUZAps…Hce7 → USDD PSMf2479…e4f6 ↗
  81. 11:49:51move93,300 USDT ($93k) left TMeswy…NSuH → new hop TEbTX4…6o6vb0209…b2d8 ↗
  82. 11:49:24move86,632 USDT ($87k) left TMeswy…NSuH → new hop TPWtik…kX2Aa3126…1806 ↗
  83. 11:48:54move74,854 USDT ($75k) left TMeswy…NSuH → new hop TDLXkQ…v2WV4e7b7…5fac ↗
  84. 11:48:24to venue500,000 USDT ($500k) left TUZAps…Hce7 → USDD PSMc1d97…7ed9 ↗
  85. 11:47:27move4,441,194 USDT ($4.44M) left TYohhJ…UfGj → new hop TUZAps…Hce7edb4e…2de0 ↗
  86. 11:27:51exchange69,996 USDT ($70k) left TCanhf…a14p → binancead7f7…681f ↗
  87. 11:13:06to venue1,618,288 USDT ($1.62M) left TXYU5f…xwfh → USDD PSM40248…7799 ↗
  88. 11:03:21move8,222 USDT ($8k) left TCanhf…a14p → wallet TKZSHe…dgad556fa…5cf6 ↗
  89. 10:48:59bridge450,000 USDT via Relay → 179.33 ETH on ethereum to 0x66c7…eda3a9703…c817 ↗
  90. 10:46:59bridge50,000 USDT via Relay → 19.98 ETH on ethereum to 0x66c7…eda3a83fb…69fc ↗
  91. 10:37:35bridge1,000,000 USDT via Relay → 399.60 ETH on ethereum to 0xa4c4…2d30539e2…220a ↗
  92. 10:28:27to venue82,424 USDT ($82k) left TZEXEy…9Dpt → JustLenda04de…96cf ↗
  93. 10:27:00to venue61,033 USDT ($61k) left TYojA8…XdBw → JustLend844fc…a42b ↗
  94. 10:26:48move82,424 USDT ($82k) left TNT1nV…ssLW → new hop TZEXEy…9Dpt464f2…4e2f ↗
  95. 10:26:06to venue80,932 USDT ($81k) left TFZta6…jcic → JustLend601ef…b46c ↗
  96. 10:25:36move61,033 USDT ($61k) left TNT1nV…ssLW → new hop TYojA8…XdBw083e3…275c ↗
  97. 10:25:06to venue92,067 USDT ($92k) left TBGEfD…WGMZ → JustLendd4b57…0256 ↗
  98. 10:24:42move80,932 USDT ($81k) left TNT1nV…ssLW → new hop TFZta6…jcicdaeb9…3ead ↗
  99. 10:23:48to venue84,433 USDT ($84k) left TYohXW…emK9 → JustLendd6f81…2f0e ↗
  100. 10:23:39move92,067 USDT ($92k) left TNT1nV…ssLW → new hop TBGEfD…WGMZ17cae…1746 ↗
  101. 10:22:51to venue83,392 USDT ($83k) left TF6m5J…SjKu → JustLend6b907…e8db ↗
  102. 10:22:35bridge1,000 USDT via Relay → 0.40 ETH on ethereum to 0x9862…648108f6a…d91f ↗
  103. 10:22:15move84,433 USDT ($84k) left TNT1nV…ssLW → new hop TYohXW…emK95959d…52eb ↗
  104. 10:21:57to venue77,392 USDT ($77k) left TUbkwL…FzPi → JustLenda82d6…c5af ↗
  105. 10:21:24move83,392 USDT ($83k) left TNT1nV…ssLW → new hop TF6m5J…SjKu81d18…6b88 ↗
  106. 10:20:39move77,392 USDT ($77k) left TNT1nV…ssLW → new hop TUbkwL…FzPi2d156…9547 ↗
  107. 10:19:42to venue88,371 USDT ($88k) left TEc2x7…HZgB → JustLend1892b…f574 ↗
  108. 10:19:35bridge499,000 USDT via Relay → 198.31 ETH on ethereum to 0x87a1…f3a7c2de8…c7c1 ↗
  109. 10:19:12to venue75,292 USDT ($75k) left TSD4zx…t9nw → JustLendd8de3…d960 ↗
  110. 10:18:45to venue96,304 USDT ($96k) left TWXfx6…k8Up → JustLendbec00…b1be ↗
  111. 10:18:18move88,371 USDT ($88k) left TNT1nV…ssLW → new hop TEc2x7…HZgB110b0…a3bb ↗
  112. 10:17:45move75,292 USDT ($75k) left TNT1nV…ssLW → new hop TSD4zx…t9nwa40a1…f2a3 ↗
  113. 10:17:18move96,304 USDT ($96k) left TNT1nV…ssLW → new hop TWXfx6…k8Upb62e9…0ff6 ↗
  114. 10:04:23bridge500,439 USDT via Relay → 198.78 ETH on ethereum to 0x8053…39f2d69d0…32f1 ↗
  115. 10:03:47bridge500,432 USDT via Relay → 198.83 ETH on ethereum to 0x8053…39f29e14f…13c5 ↗
  116. 10:02:47bridge500,439 USDT via Relay → 199.03 ETH on ethereum to 0x8053…39f21b0aa…3b93 ↗
  117. 10:02:23bridge500,439 USDT via Relay → 199.43 ETH on ethereum to 0x8053…39f2059ad…94ae ↗
  118. 09:55:42to venue71,585 USDT ($72k) left TWjddB…pxy4 → JustLendd4950…e362 ↗
  119. 09:54:24to venue85,539 USDT ($86k) left TQoFJd…WMyx → JustLend5c1ad…6d52 ↗
  120. 09:54:06move71,585 USDT ($72k) left TNT1nV…ssLW → new hop TWjddB…pxy4f85e2…7e12 ↗
  121. 09:53:18to venue77,363 USDT ($77k) left TUXLZW…hH4m → JustLend14849…002d ↗
  122. 09:52:57move85,539 USDT ($86k) left TNT1nV…ssLW → new hop TQoFJd…WMyx27619…3c46 ↗
  123. 09:52:12to venue94,333 USDT ($94k) left TCv3Ci…yCSW → JustLend4960b…31d9 ↗
  124. 09:51:51move77,363 USDT ($77k) left TNT1nV…ssLW → new hop TUXLZW…hH4m39646…08d4 ↗
  125. 09:50:57to venue92,033 USDT ($92k) left TC5oLH…eMpR → JustLendb0122…442d ↗
  126. 09:50:45move94,333 USDT ($94k) left TNT1nV…ssLW → new hop TCv3Ci…yCSWebf1d…eb26 ↗
  127. 09:50:03to venue72,988 USDT ($73k) left TPpaoG…Yytr → JustLendc559e…bb9f ↗
  128. 09:49:27move92,033 USDT ($92k) left TNT1nV…ssLW → new hop TC5oLH…eMpR4eda6…9bd2 ↗
  129. 09:48:54to venue84,427 USDT ($84k) left TCYw7o…N8Hf → JustLenddbab2…31b4 ↗
  130. 09:48:33move72,988 USDT ($73k) left TNT1nV…ssLW → new hop TPpaoG…Yytra83ab…ab5a ↗
  131. 09:47:33move84,427 USDT ($84k) left TNT1nV…ssLW → new hop TCYw7o…N8Hf9b9af…ca84 ↗
  132. 09:46:47bridge488,706 USDT via Relay → 194.25 ETH on ethereum to 0x4c80…f8c30229a…8691 ↗
  133. 09:46:33to venue76,642 USDT ($77k) left THSSzp…Bc87 → JustLendec183…f308 ↗
  134. 09:46:00to venue82,090 USDT ($82k) left TQbNb8…3Xz1 → JustLend49b76…3486 ↗
  135. 09:45:27to venue93,022 USDT ($93k) left TGKC7e…pteo → JustLend6b64a…6eb2 ↗
  136. 09:45:06move76,642 USDT ($77k) left TNT1nV…ssLW → new hop THSSzp…Bc873e685…a1b9 ↗
  137. 09:44:36move82,090 USDT ($82k) left TNT1nV…ssLW → new hop TQbNb8…3Xz116a33…d68d ↗
  138. 09:44:06move93,022 USDT ($93k) left TNT1nV…ssLW → new hop TGKC7e…pteo91123…4f04 ↗
  139. 09:43:38bridge447,109 USDT via Relay → 178.07 ETH on ethereum to 0x4c80…f8c3628ab…1136 ↗
  140. 09:42:59bridge500,435 USDT via Relay → 199.37 ETH on ethereum to 0x4c80…f8c37a60a…6332 ↗
  141. 09:41:11bridge500,417 USDT via Relay → 199.06 ETH on ethereum to 0x4c80…f8c3f3084…e317 ↗
  142. 09:39:35bridge500,426 USDT via Relay → 198.99 ETH on ethereum to 0x4c80…f8c3c0b4e…2369 ↗
  143. 09:38:11bridge10,009 USDT via Relay → 3.98 ETH on ethereum to 0x4c80…f8c3d4e01…a335 ↗
  144. 08:06:47to venue999,700 USDT ($1000k) left 0xce29…c647 → Wintermute (UniswapX)0x0f4…5629 ↗
  145. 07:23:59move1998.50 ETH ($4.97M) left 0xed43…cbd1 → new hop 0x064a…71600x4e2…5146 ↗
  146. 07:21:23to venue999,550 USDT ($1000k) left 0xed43…cbd1 → Wintermute (UniswapX)0x560…b9a2 ↗
  147. 07:20:11to venue999,550 USDT ($1000k) left 0xed43…cbd1 → Wintermute (UniswapX)0x71f…8478 ↗
  148. 07:18:59to venue1,000,000 USDT ($1.00M) left 0xed43…cbd1 → Wintermute (UniswapX)0x122…75d4 ↗
  149. 07:17:59to venue999,700 USDT ($1000k) left 0xed43…cbd1 → Bebop0x623…9bf1 ↗
  150. 07:15:59to venue999,700 USDT ($1000k) left 0xed43…cbd1 → Wintermute (UniswapX)0xbab…3eba ↗

Where it went

VenueKindReceived
USDT0bridge$20.00M · 40
Relay.linkbridge$9.45M · 35
Chainflipbridge$5.91M · 12
Bitget Walletbridge$3.70M · 19
HiFiSwapbridge$3.38M · 10
Tornado Cashmixer$3.12M · 72
Unlabelled high-volume counterpartyservice$3.09M · 6
JustLendlending$2.15M · 26
Binanceexchange$2.07M · 36
NEAR Intentsbridge$1.30M · 3
Bridgersbridge$600k · 4
Bybitexchange$258k · 3
swapped through (custody unchanged, not counted as exits): USDD PSM $18.2M · SunSwap $3.6M

Tornado Cash deposits

  1. 10-09 15:560x9b85…b123 → 10 ETH pool10 ETH0xc18f…9a6d ↗
  2. 10-09 15:550x9b85…b123 → 100 ETH pool100 ETH0x3e88…8fb6 ↗
  3. 10-09 15:550x51f4…7fec → 0.1 ETH pool0.10 ETH0x0c6c…17bf ↗
  4. 10-09 15:550x51f4…7fec → 10 ETH pool10 ETH0x4caa…a2dc ↗
  5. 10-09 15:550x51f4…7fec → 10 ETH pool10 ETH0xe434…e27f ↗
  6. 10-09 15:550x51f4…7fec → 100 ETH pool100 ETH0x4356…b546 ↗
  7. 10-09 15:550x1df0…ff2c → 10 ETH pool10 ETH0x0a96…6314 ↗
  8. 10-09 15:550x1df0…ff2c → 10 ETH pool10 ETH0xf7b6…e74f ↗
  9. 10-09 15:550x1df0…ff2c → 10 ETH pool10 ETH0xb9aa…9ffe ↗
  10. 10-09 15:550x1df0…ff2c → 10 ETH pool10 ETH0xb0b2…4a99 ↗
  11. 10-09 15:550x1df0…ff2c → 10 ETH pool10 ETH0xd4b5…9c7a ↗
  12. 10-09 15:550x1df0…ff2c → 10 ETH pool10 ETH0x9673…d87a ↗
  13. 10-09 15:550x1df0…ff2c → 10 ETH pool10 ETH0x7430…d850 ↗
  14. 10-09 15:550x1df0…ff2c → 10 ETH pool10 ETH0x1d08…637c ↗
  15. 10-09 15:550x1df0…ff2c → 10 ETH pool10 ETH0x9155…9411 ↗
  16. 10-09 15:540x4012…8447 → 0.1 ETH pool0.10 ETH0x27bd…4167 ↗
  17. 10-09 15:540x4012…8447 → 10 ETH pool10 ETH0x121a…b95a ↗
  18. 10-09 15:540x4012…8447 → 100 ETH pool100 ETH0x5164…9742 ↗
  19. 10-09 15:440x7b1c…8330 → 0.1 ETH pool0.10 ETH0x278b…6ad8 ↗
  20. 10-09 15:440x7b1c…8330 → 1 ETH pool1 ETH0xd530…bcf7 ↗
  21. 10-09 15:440x7b1c…8330 → 1 ETH pool1 ETH0x700c…429c ↗
  22. 10-09 15:440x7b1c…8330 → 1 ETH pool1 ETH0xef0f…46cf ↗
  23. 10-09 15:440x7b1c…8330 → 10 ETH pool10 ETH0x8fcc…cae9 ↗
  24. 10-09 15:440x7b1c…8330 → 10 ETH pool10 ETH0x0ba2…3faf ↗
  25. 10-09 15:440x7b1c…8330 → 10 ETH pool10 ETH0x9a25…5ead ↗
  26. 10-09 15:430x7b1c…8330 → 100 ETH pool100 ETH0x76a2…6219 ↗
  27. 10-09 15:430xfc65…7846 → 10 ETH pool10 ETH0xf76a…d987 ↗
  28. 10-09 15:430xfc65…7846 → 100 ETH pool100 ETH0xeb74…fad9 ↗
  29. 10-09 15:430xb099…0197 → 0.1 ETH pool0.10 ETH0x97bc…db13 ↗
  30. 10-09 15:430xb099…0197 → 1 ETH pool1 ETH0x504c…601a ↗
  31. 10-09 15:420xb099…0197 → 10 ETH pool10 ETH0xe173…d74e ↗
  32. 10-09 15:420xb099…0197 → 10 ETH pool10 ETH0x25ea…788b ↗
  33. 10-09 15:420xb099…0197 → 10 ETH pool10 ETH0x8d36…56cd ↗
  34. 10-09 15:420xb099…0197 → 10 ETH pool10 ETH0x959c…ce98 ↗
  35. 10-09 15:420xb099…0197 → 10 ETH pool10 ETH0x5ca2…5e02 ↗
  36. 10-09 15:420xb099…0197 → 10 ETH pool10 ETH0x0091…64d3 ↗
  37. 10-09 15:420xb099…0197 → 10 ETH pool10 ETH0x1f18…a254 ↗
  38. 10-09 15:420xb099…0197 → 10 ETH pool10 ETH0x4c3e…020e ↗
  39. 10-09 15:420xb099…0197 → 10 ETH pool10 ETH0x4987…7a08 ↗
  40. 10-09 15:420x1218…8d08 → 0.1 ETH pool0.10 ETH0x96c6…9514 ↗
  41. 10-09 15:420x1218…8d08 → 100 ETH pool100 ETH0xa1ee…efed ↗
  42. 10-09 15:180xc2dc…5356 → 0.1 ETH pool0.10 ETH0x6fea…24a6 ↗
  43. 10-09 15:180xc2dc…5356 → 1 ETH pool1 ETH0x6081…d9a4 ↗
  44. 10-09 15:180xc2dc…5356 → 1 ETH pool1 ETH0xe956…2286 ↗
  45. 10-09 15:180xc2dc…5356 → 10 ETH pool10 ETH0x1427…689e ↗
  46. 10-09 15:180xc2dc…5356 → 10 ETH pool10 ETH0xa260…e56d ↗
  47. 10-09 15:180xc2dc…5356 → 10 ETH pool10 ETH0x74b7…0468 ↗
  48. 10-09 15:180xc2dc…5356 → 10 ETH pool10 ETH0x33cd…4cbd ↗
  49. 10-09 15:180xc2dc…5356 → 10 ETH pool10 ETH0xb8ea…f67b ↗
  50. 10-09 15:180xc2dc…5356 → 10 ETH pool10 ETH0x4ee3…65c7 ↗
  51. 10-09 15:180xc2dc…5356 → 10 ETH pool10 ETH0x9e0d…70e5 ↗
  52. 10-09 15:180xc2dc…5356 → 10 ETH pool10 ETH0xf6e5…6629 ↗
  53. 10-09 15:180xc2dc…5356 → 10 ETH pool10 ETH0x69eb…acd6 ↗
  54. 10-09 15:180x433c…b60b → 100 ETH pool100 ETH0x0ab9…59f0 ↗
  55. 10-09 15:170x2e3c…8b3e → 100 ETH pool100 ETH0x3a09…9be3 ↗
  56. 10-09 15:170x1827…d3c4 → 0.1 ETH pool0.10 ETH0x818c…feae ↗
  57. 10-09 15:170x1827…d3c4 → 1 ETH pool1 ETH0x4082…79f5 ↗
  58. 10-09 15:170x1827…d3c4 → 1 ETH pool1 ETH0x038a…3c34 ↗
  59. 10-09 15:170x1827…d3c4 → 1 ETH pool1 ETH0xfe34…49fa ↗
  60. 10-09 15:170x1827…d3c4 → 1 ETH pool1 ETH0x5203…f6b0 ↗
  61. 10-09 15:170x1827…d3c4 → 1 ETH pool1 ETH0x8cfb…e8a1 ↗
  62. 10-09 15:170x1827…d3c4 → 1 ETH pool1 ETH0x1f94…3eac ↗
  63. 10-09 15:170x1827…d3c4 → 1 ETH pool1 ETH0x1fdd…5080 ↗
  64. 10-09 15:170x1827…d3c4 → 10 ETH pool10 ETH0xfe35…c3c0 ↗
  65. 10-09 15:170x1827…d3c4 → 10 ETH pool10 ETH0x7d84…ef76 ↗
  66. 10-09 15:170x1827…d3c4 → 10 ETH pool10 ETH0x678b…4a86 ↗
  67. 10-09 15:170x1827…d3c4 → 10 ETH pool10 ETH0xa10f…b681 ↗
  68. 10-09 15:170x1827…d3c4 → 10 ETH pool10 ETH0x2c08…325c ↗
  69. 10-09 15:170x1827…d3c4 → 10 ETH pool10 ETH0xa7c0…afb9 ↗
  70. 10-09 15:170x1827…d3c4 → 10 ETH pool10 ETH0x4ea3…ade5 ↗
  71. 10-09 15:170x1827…d3c4 → 10 ETH pool10 ETH0x7bad…617f ↗
  72. 10-09 15:170x1827…d3c4 → 10 ETH pool10 ETH0x9268…83b8 ↗

Parked

bc1qqnkw…jtm9theft addrBitcoin$9.17Mlive
0xfa4eab…b0e2Ethereum$8.55Mlive
0x468b3a…2a4eEthereum$7.68Mlive
bc1qjqgw…49dltheft addrBitcoin$7.62Mlive
0x064af5…7160Ethereum$4.95Mlive
0x988855…0444Ethereum$3.93Mlive
0x8bc2c1…2a34Ethereum$3.81Mlive
0xb88d9c…1856Ethereum$3.46Mlive
0x131c9c…fa6aEthereum$2.97Mlive
0x83aeac…a599theft addrEthereum$2.90Mlive
0x69c8f4…7841theft addrEthereum$2.83Mlive
0x033636…4f7atheft addrEthereum$2.55Mlive
0xc322ec…4065Ethereum$1.97Mlive
bc1qgqhe…d26ntheft addrBitcoin$795klive

Theft addresses