The Ledger / CryptoBilis drain, 9 October 2026: 75.49M USDT and 220.57 BTC traced, what Tether froze, and what still sits on attacker wallets

Correction, 15 Oct 2026 (UTC): an earlier version of this report and of the address list treated five TRON wallets as attacker wallets: TGe3p75NtsM6DgTxUZ3GpaFXAKH6LbGQkz, TBW8Fqzov5s19bP2jKbWSnHYBP59eP87JE, TFyjETWQN8svophpGSKmgAe1VZ3tSgGXfd, TSyQxuTzRAkZ7RC3s3w2cbukDDX7VP68Dn and TQU3Hfq5VwfURXHLhyk7SCLwtSPMrrFueU. Four of them bought USDD at a public swap router with their own funds, and the fifth only received USDD from one of the four. My walk had followed the router's payouts to its other users. I found no transaction that ties any of the five to the theft. I removed all five from the list and from the transfer map, and I apologise to their owners. I added three wallets that sit on the drain path (and, below, thirteen more): TKz9dXP2RFFnn4sgBrDexBi2y1uRrj8vWs and TKcsH2MPHDRPagEr2s6MwYok7LG8wM4dFR each passed 500,000 USDT from a collector to TQDGwZmYcUtcYGL9y2uWQYpRFjY9VTwsgR, and 0xd7ef9a5a5da8de7a348145401d0236ef4452dd2e received 1,033,440.89 USDC from 0x0c54660eD28A1b5698d5A4276502c67A7d6Bee52 and split it. I also corrected the USDD swap figures. The report counted 26,367,864 USDT in 55 swaps into USDD, but 21 of those transactions were redemptions of USDD into USDT (16,440,306 USDT), not purchases, and my detector had missed purchases. After reading every USDT and USDD transfer of the swap contracts from 8 to 16 Oct 2026, the listed wallets bought USDD with 17,219,936 USDT in 49 swaps (10 wallets), plus 8,806,905 USDT in 9 swaps by the wallet of the separate parcel in the first section (26,026,841 USDT in 58 swaps by 11 wallets in all), and redeemed USDD for 24,752,226 USDT in 30 transactions. I added thirteen more TRON wallets that bought USDD with money from the distributor or from another listed wallet, passed it on or redeemed it, as Medium. The USDD walk figures in the bottom line, the coverage limits and the next steps changed for a different reason: I removed the walks that started from the removed wallets. (High for the two TRON wallets and the 17,219,936 USDT in 49 swaps; Medium for the separate 8,806,905 USDT parcel, the Ethereum wallet and the thirteen TRON wallets)

Update, 16 Oct 2026 (UTC): seven TRON wallets on the list move from Medium to High: TQfPjcib9hKXppxnwcrP96Lw2vYgKrJgMn, TFU6L1mcNx7Vcs5uiNaikF9MMHpBxfvzZ2, TLkp2oDMTr7GebvHKaA8sZ2TmxCzUNEazz, TREwHYmr17h3LJHkUgSNabSTDdeF8d86yk, TNLkZnYn1czoFzgKofvCFwnZKqmaQHHasw, TNDek2bQs8hRpyyBmNxZA2KUX2J4RXxnJz and TVTNEeZkyh7dxnajexQKptURZkUDYe9chC. All seven got their USDD from TZ1eeDMo9Gr1ErSwCeQ4meMJGGtaPYv89n, 4,441,193 USDD in total. TUZApsGDcSsPpo4Sxyaz8Zhjg8vKaaHce7 bought that USDD with USDT from the drain address TYohhJpmXn4uuKhC1uFRCCjMWAWPJnUfGj. I read every USDT transfer into that address: all of it was taken from two victim wallets. The earliest attacker transaction I have found on TRON is at 03:55:27 UTC on 9 Oct, when the attacker took over one of those victim wallets (section 10).

Interactive map of every transfer by wallet: https://philgr8.github.io/ledger-drain-map/ · this report as a page: https://philgr8.github.io/ledger-drain-map/report.html

00·BLUF

• I traced 66,688,015 USDT on TRON from the collector wallets: 10,000,001.11 USDT is frozen by Tether on 20 wallets, and 56,688,014 USDT went into seven bridges and swap services in 158 transfers from 91 TRON wallets. Of that, 50,126,288 USDT is matched to a payout on the destination chain, 5,906,180 USDT (Chainflip) is accounted for in Chainflip's own records (4,006,165 swapped; 1,900,015 not swapped and refunded to the sending TRON wallets), and 655,546 USDT (355,546 HiFiSwap, 300,000 Bridgers) has no order in the services' lookups.
• Nine more TRON wallets emptied 8,806,905.13 USDT into one wallet, TRu643bTQVX74nxZ7nP6EetCkzhYxeD2pY, in one block at 20:49:21 UTC on 9 Oct. It swapped the USDT into USDD at the same venue as the 49 swaps below. The USDD went through eight single-use wallets. 2,806,900 USDT then entered THORChain and paid 1,101.18 ETH to 0xa2F0AFC2B7af4bcc56aADaA870cA4f5Ead987a87, already a THORChain payout wallet of the collectors (section 3). The other 5,998,960 USDT also went into THORChain, in six swaps, and paid 2,345.31 ETH to three Ethereum wallets that have never sent a transaction (section 5). I add this as a separate Medium parcel: 66,688,015 USDT from the collectors plus 8,806,905 USDT makes 75,494,920 USDT.
• 203.78822333 BTC was swept from 122 wallets into two collectors at 05:54 and 06:15 UTC on 9 Oct. Both collectors show zero spends, and both balances are unchanged at the snapshot. Two further collectors, bc1qgqhee…d26n and bc1q4zf7…6etz, swept 16.77789132 BTC from 204 more wallets between 7 and 11 Oct with the same transaction build (Medium). Together 220.57 BTC from 326 wallets. At the snapshot five Bitcoin wallets hold 214.22 BTC: 203.79 at the first two collectors (High) and 10.43 on three wallets downstream of the other two (Medium, section 6).
• Found on 13 Oct, after the snapshot: 0x8bc2c1bc6793663f67169ef7d8aabde7b24a2a34 holds 1,537.39 ETH and has never sent a transaction. 1,313.35 ETH of it is the Ethereum end of 3,300,000 of the 3,700,000 USDT that TLn8gUhnFShtyBQBZZJUZeQaK1WJPrcDUN sent into Bitget Wallet's TRON bridge on 9 Oct. I had missed that bridge leg. It is not in the rail table or the totals above (sections 8 and 9).
• At the snapshot, 17 wallets with at least 1 ETH each hold 18,993.32 ETH in total. Several of them are rail destinations, so this ETH is partly the other end of the USDT above; the two are not additive. Two of them moved 40 ETH each on 12 Oct, at 14:39:47 and 17:18:11 UTC, and both sent it on into Tornado Cash in 10 ETH deposits.
• 6,758.3 ETH went into Tornado Cash in 560 deposits: 6,678.3 ETH in 552 deposits from 60 wallets, and 80 ETH in 8 deposits from two forwarding wallets on 12 Oct. Tornado paid 445.2 ETH out to two wallets on 10 Oct; seven hop wallets sent 445.2 ETH to NEAR Intents, and NEAR Intents paid 899.71 ZEC to shielded Zcash addresses in seven transactions between 12:27 and 13:54 UTC on 10 Oct; section 4b follows them out of the pool.
• Update 14 Oct (section 4b): the trail did not end in the shielded pool. 586 Tornado Cash withdrawals, 7,199.2 ETH, tie to the attacker's deposits; 5,275.1 ETH of them went through NEAR Intents into 100 Zcash lots of 10,607.57 ZEC. 61 lots leave the pool by a fixed rule and paid 6,334,821.03 USDC and 384.14 ETH to wallets that are now empty; 4,285,338.27 USDC reached the Bitget Wallet bridge vault, and Bitget's TRON bridge wallet made a matching USDT payout for each deposit (section 9). Three Ethereum wallets that have never sent a transaction hold 3,500.90 ETH: 0xb6af05434cfb7b2e568c9bc862b14c873d85a9c8 1,944.04, from the Tornado leg and the USDD parcel, and 0x88bD4cD497Bb7c232740c7d6d726DDbAb5d9b929 778.46 and 0x5054C433e3Bc3586dB0a4991705CF5cDEE62678b 778.40, from the USDD parcel. (Medium for who controls them)
• I walked every chain the funds touched: TRON, Ethereum, Bitcoin, Solana, Polygon, Arbitrum, Base and BNB Chain. Avalanche and Optimism show no activity from any attacker address. Section 7 gives each chain's result.
• 10 TRON wallets on the list swapped 17,219,936 USDT into USDD in 49 swaps; the wallet of the separate parcel in the first section made 9 more (8,806,905 USDT). The USDD was swapped back into USDT at a swap venue and the USDT went into THORChain, Relay and Chainflip. 8,696,189 USDT of the THORChain entries and 1,305,015 USDT of the Chainflip entries in section 3 took this detour, so they are already inside the 56,688,014 above (section 5).
• I removed 12 addresses from my list after checking their paths (section 10); their transfers are out of every figure here.
• Who can act: Tether, which froze the 20 wallets between 12:09 and 14:10 UTC on 9 Oct (section 2); HitBTC, Binance and an instant-swap service, behind the deposit addresses in section 9; Tether again, for the 1,350,000 USDT that sits on TMAXFFdZQrciR412fcTU8GbSgvCiBLicYy after the Bitget Wallet payouts (section 9); Bitget, whose order records hold the 27 bridge orders from Ethereum and the 23 from TRON; and the services behind the unresolved rails.

01·How I started

Collector addresses were already in public write-ups by Specter, SEAL 911, Bitquery and YFarmX. I read each one on chain, kept the ones that matched the drain's timing and flows, and walked forward from them. Everything below is a transfer I read myself. The first rail deposit I traced is 05:41:18 UTC on 9 Oct (USDT0, 500,000 USDT, tx 14363215f8666b403ed1fc10776f9fd3dd7051898c4a93e4ba914e392edda898). (High)

02·Collectors, distributors and the frozen parcels

• TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C sent 10,000,000.000039 USDT to the distributor TPZwqN2gq3yb7JMX9CfiLCdW4G6XvnuSSk at 10:06:36 UTC on 9 Oct (tx 77a3372ec8bf99a119fde6b7666d7901cdcec8e7d7ffa4284c2aa9fdefe1dd51). (High)
• TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9 sent 4,167,708.226869 USDT to the distributor TViYzoyw3sExbhD2etYygUTDjSacqSGzfh at 10:11:18 UTC (tx 43c61e7090b7b71fce68ead04978ba507372bb9c54b15a284ace475ca086c50c). (High)
• Of the 91 TRON wallets that paid the rails, 60 trace back to a collector within three USDT hops of at least 20,000 USDT each. For the other 31 I searched over any token (USDT, TRX, USDD) up to eight hops: 30 are linked by paths of 2 to 5 hops, and one is named as a drain address in the Bitquery investigation. (Medium: the hop limits and the 20,000 USDT cut-off are my own, uncalibrated)
• I read 53 TRON wallets against Tether's USDT blacklist by contract call, between 18:44 and 18:46 UTC on 12 Oct. 33 are blacklisted. One of the 33, THvPCrsu2BwF3NRywFYhTu9Wsfwr59cQmo, is not an attacker wallet (section 10), so 32 attacker-set wallets are blacklisted: 31 at 12:09:39 to 12:09:45 UTC on 9 Oct and one at 14:10:51 UTC. 20 of them hold 10,000,001.11 USDT (19 x 500,000.00 and one 500,001.11); 19 of those 20 were blacklisted at 12:09:42 to 12:09:45 UTC and the twentieth at 14:10:51 UTC. 12 blacklisted attacker-set wallets hold 0 USDT. TViYzoyw3sExbhD2etYygUTDjSacqSGzfh is absent from the issuer's blacklist and holds 0 USDT. (High)
• Other USDT on TRON outside the 20 wallets: seven attacker-set wallets hold 36.37, 14.00, 5.74, 0.95, 0.26, 0.18 and 0.16 USDT. (High)
• On the EVM chains I read 13 issuer token contracts (USDT, USDC, PYUSD, USDT0 and XAUT on Ethereum, Arbitrum, Base, Optimism, Polygon and Avalanche) for the attacker-set Ethereum-format addresses between 18:39 and 18:43 UTC: 26.09 USD in total, and the issuers' contracts list every one of these addresses as live. BNB Chain is not in this sweep. (High)

03·The seven rails

56,688,014 USDT left 91 TRON wallets in 158 transfers. The USDT amounts, entry counts and times in the table are TRON transfers, without the five removed wallets (section 10). One 1,000,000 USDT transfer into a Chainflip deposit channel is the same money the Chainflip Vault fetched three minutes later; I count it once. "Resolved" means I matched an entry transaction to the payout on the destination chain from the service's own order record or an on-chain message id; the order counts cover the 187 service orders of the wallets I kept, on all source chains, read at 18:54 UTC. The table leaves out 3,700,000 USDT that TLn8gUhn… sent into Bitget Wallet's TRON bridge on 9 Oct, found on 13 Oct (section 9).

Resolved destinations, all (High) (protocol identifiers, not timing):

• USDT0 (40 of 40): 40 transfers of 500,000 USDT arrived as 19,994,000 USDT on five Ethereum wallets:

  wallet	USDT
  0xeD57b891C0Da306369eA5Bb0a2c02B78BdD6b1bA	4,998,500
  0xed43bB5404F3e9225Aa6f020C89D26Ba7A49cbD1	4,998,500
  0xC61E3185d0Ea73e41928D21d32Bd2EDdd0AD18e6	4,998,500
  0x6A33D3E252407078E2F432d7E22414CC02208D5f	3,998,800
  0xce29803592346a285e17d3C6595B0C0528a3C647	999,700

  Entries on TRON ran from 9 Oct 05:41 to 07:43 UTC; payouts from 05:43 to 07:45 UTC (entry time plus the reported latency).
• THORChain (26 of 26): the swap memo names the payout wallet, and the sender sets it. 7,189.07 ETH went to nine Ethereum wallets. The TRON entries ran 9 Oct 09:02 to 11 Oct 16:19 UTC; the payouts ran 9 Oct 12:15 to 11 Oct 23:23 UTC (entry time plus the reported latency):

  wallet	ETH	swaps
  0x65B66749148ba4908aC15609D827887265B2a62a	1,745.20	4
  0xa2F0AFC2B7af4bcc56aADaA870cA4f5Ead987a87	1,176.79	3
  0xC551875DC6d5c480E22e60b80f624Db68A5E86Cf	1,050.16	3
  0x5BF6B2E56Eb7AD34AA2B70F87a6f84b0ED9CCA0c	795.68	4
  0xce29803592346a285e17d3C6595B0C0528a3C647	793.66	4
  0x93F88A27d1844a113e810105f7b9b7eE4aBB8091	792.48	3
  0xA4C4a964B569A69b735E31F3c50ec85074412d30	397.76	2
  0x82F65df4A44d904804C328d69d9EFd0683e33208	397.45	2
  0xDc981029bbC1fE273bE3a4F087D7A03eee76B56F	39.90	1

• Relay (38 of 44 orders): 37 ETH payouts of 3,663.38 ETH in total: 19 of them, 1,156.92 ETH, to 0x468b3A1CB8eEf055e40022dB5961e8500e2c2A4E; further payouts to 0x8053C9e2d053F20C02ebf32ea6e9205b610d39f2 (796.08 ETH, 4), 0x4C805486c56C295Ee5414A88545D9943F5D7F8C3 (795.64, 5), 0xA4C4a964B569A69b735E31F3c50ec85074412d30 (399.60), 0x66c7cBdEAc9e8F2d705A57d821D5007E3FB4EdA3 (199.31, 2), 0x87A19E3e54d010EE7b89327770d1ef839f30F3a7 (198.31), 0xfa4EaBB840A33C156E600311433AE261CBfCb0e2 (57.30, 2) and three smaller ones (40.18, 19.64 and 0.40 ETH). The 38th is a Relay refund-status order (178.07 ETH recorded to 0x4C805486…F8C3 with a TRON destination chain); it is in none of these totals. Two of the 38 were paid from Solana. The other 6 of the 44 are Relay payouts on Solana to a large wallet; I found no order for them and do not draw them as drain transfers (section 7).
• Relay orders paid from other chains (section 7): 11 more orders, 5 from BNB Chain and 6 from Polygon, all succeeded and paid 414.20 ETH on Ethereum.
• NEAR Intents (6 of 7): 0x40eba3C0052ea532226cF0B87215489aAeFAe88c received 237.30 ETH for two orders of 300,000 USDT each, and the order's refund address is a TRON attacker wallet; 0x83aeaC166f6832aE3500000a24510a95a052A599 received 197.99 ETH. The other three resolved orders show no amount out, so I do not quote them. The unresolved order is 100,000 USDT on Solana: the service's deposit address needs a Solana node to derive; that is the next step.
• Bridgers (3 of 7), HiFiSwap (3 of 49), LI.FI (1 of 1): the Bridgers payouts are 119.28 ETH to 0x468b3A…2A4E; HiFiSwap paid 59.47 ETH and 49.25 ETH to 0x033636e45d519BeBB7b5c2520Ca6CE56FBDB4F7a and 0x83aeaC…A599. Four Bridgers orders and 46 HiFiSwap hashes return no order in the services' lookups (resCode 927, "Order does not exist" for HiFiSwap); I record each empty answer. I read the 46 as legs between the service's own wallets, which is an inference (Medium).
• Chainflip (13 of 13 in the service's records): every transfer is a transfer into the official Chainflip Tron Vault or into a Chainflip deposit channel, and I read each in Chainflip's swap records and the Vault's transaction logs. Nine swapped on Ethereum: eight into ETH, 1,591.62 ETH in total to 0xd60cbffF028ca5EBf78f9eCdF2b8AE2ed1b192E3 593.90 (2 swaps), 0xB9C9350E2b808D87857a5c555560Ba08bE1Ad075 593.53, 0x368C6Fb3da1252350a58a82312baecbdd2e609E5 397.84, 0xce29803592346a285e17d3C6595B0C0528a3C647 1.99, 0x03fA7Eb4EDF92b1B3A0b590eFBc4C36a7EaE2fC0 1.99, 0xBDB58B2c08666FfB1f8d560f25f4d7DbA773c393 1.58 and 0x9862F0A61567E4301775381534BeDd2D93A16481 0.80, and one of 1,165 USDT into 1,147.41 USDT on 0xb042683Fbb0ef9897dD44E6fca436212F5C7eE7e. Four did not swap: Chainflip refunded 1,900,015 USDT (1,899,985 after fees) to the sending TRON wallets. Two of the USDD swaps in section 5 (999,992 and 305,007 USDT) spend two of these refunds, to the cent.

04·Tornado Cash and the exit to Zcash

• 552 deposits of 6,678.3 ETH went into the Tornado Cash pools from 60 depositor wallets, from 9 Oct 15:17:23 UTC to 12 Oct 12:47:35 UTC. The depositors are one to two hops from the attacker's Ethereum wallets. They are inferred, not seeds. Sample: 10 ETH at 15:17:23 UTC on 9 Oct from 0x1827B8964074a8F7A44e306344dfb77565f8d3c4 (tx 0x2c081416d0064e80291d8798747604c8f4cd4ed841ff90fcd1863033d87e325c). (Medium)
• Eight more deposits of 10 ETH each, 80 ETH, came from two forwarding wallets that each received 40 ETH from a held wallet on 12 Oct. 0x3b2F9cfec7CD8DE706c64b5d4De9aB19f28DfD70 sent 40 ETH to 0xF75Cb5036b1e521F6433e017490B61D27A01e5b6 at 14:39:47 UTC (tx 0x7e345db352c8264bdd8ddff097be21cee21b03d25c187b5d148ab66575d4edfc), which made four deposits at 14:45:59, 14:46:47, 14:50:23 and 14:55:23 UTC. 0xfa4EaBB840A33C156E600311433AE261CBfCb0e2 sent 40 ETH to 0x5531734B212Eb6930712eDA5eD8dEAac00568cF7 at 17:18:11 UTC (tx 0x8d896c13dfedaa692dbcf77ebe42e96c0ef21fb283050a4edccbe8bfa793a91e), which made four deposits between 17:25:11 and 17:26:23 UTC. All eight went to the Tornado Cash router 0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b. With the 552 above: 560 deposits, 6,758.3 ETH. (High for each transfer, Medium that the forwarding wallets are attacker-controlled)
• On 10 Oct, 15 pool withdrawals of 445.2 ETH went to two wallets, 12:18:35 to 13:26:23 UTC, none relayed: 0x0D697aA182801566D87aDc86E68E95fD3b2f5f82 received 313.1 ETH (3 x 100, 1 x 10, 3 x 1 and 1 x 0.1) and 0x676b16cC18542f37d202A1A79Ac05463395496A4 received 132.1 ETH (1 x 100, 3 x 10, 2 x 1 and 1 x 0.1). The 445.2 ETH is 440.0 ETH from the 100 and 10 ETH pools, 5.0 ETH from the 1 ETH pool and 0.2 ETH from the 0.1 ETH pool. Linking these withdrawals to specific deposits is the next step. That the two wallets belong to the attacker set rests on their later path. (Medium)
• Seven hop wallets then forwarded 445.2 ETH to NEAR Intents between 12:21:11 and 13:45:59 UTC on 10 Oct (55.0, 61.0, 79.0, 59.6, 71.1, 59.7 and 59.8 ETH), the same 445.2 ETH that came out of the pools. (High for each transfer, Medium for the link to the withdrawals)
• NEAR Intents paid 899.71 ZEC to shielded Zcash addresses in seven transactions, 10 Oct 12:27:00 to 13:54:44 UTC (Zcash block times). The service's own order records match each ETH deposit to one payout. The payouts, by Zcash block time (ETH sent in, ZEC paid out): 12:27:00 55.0 ETH in, 111.36 ZEC out; 12:33:30 61.0 ETH in, 123.36 ZEC out; 12:41:24 79.0 ETH in, 159.86 ZEC out; 13:33:14 59.6 ETH in, 120.51 ZEC out; 13:38:03 71.1 ETH in, 143.55 ZEC out; 13:43:01 59.7 ETH in, 120.34 ZEC out; 13:54:44 59.8 ETH in, 120.73 ZEC out. The Zcash hashes are in the appendix. Section 4b follows the money out of the shielded pool. (High)

04b·Update, 14 Oct: out of Tornado Cash and out of Zcash

• Section 4 said the trail ends in the shielded pool. It does not. This section follows the money out of Tornado Cash and out of the shielded Zcash pool. Balances are read at Ethereum block 26,191,839 (16:08 UTC on 14 Oct).
• From 9 Oct 15:17:23 to 13 Oct 17:52:35 UTC the attacker made 585 deposits of 7,258.5 ETH into the Tornado Cash ETH pools, in 18 runs. Section 4 counted 560 deposits and 6,758.3 ETH up to 12 Oct. (Medium, as in section 4)
• I tie 586 withdrawals of 7,199.2 ETH, from 9 Oct 15:19 to 13 Oct 17:58 UTC, to those runs. They are direct calls from single-use wallets, with no relayer. Most other users of these pools withdraw through a relayer, so the build alone does not single out the attacker. The counts carry the rest. In 12 of the 18 runs (131 deposits) the withdrawals from each pool equal the deposits into it, one for one. In the six larger runs of 10 to 12 Oct (454 deposits) the withdrawals of one run overlap the next, and the counts agree only in total: 184 of 184 in the 1 ETH pool, 39 of 39 in the 100 ETH pool, and 311 of 317 in the 10 ETH pool, where six notes (60 ETH) have not come out this way. The 0.1 ETH pool shows 52 such withdrawals against 45 deposits, so at least seven of them (0.7 ETH) belong to someone else or to deposits I have not found; that is why the withdrawals outnumber the deposits by one. The 15 withdrawals of section 4 are among the 586. Twelve more candidates, 11.1 ETH, are left out. (Medium)
• Six more withdrawals from the 0.1 ETH pool, 0.6 ETH between 09:06 and 09:30 UTC on 10 Oct, are built the same way, each in the same minute as a batch I tie to the attacker. Their gas came from the THORChain router 0xD37BbE57…, as it did for 31 of the withdrawals I tie to the attacker. Each recipient sent its ETH on about six minutes later to a fresh wallet, which passed it into NEAR Intents within a minute. I do not count them. With them the 0.1 ETH pool would show 58 such withdrawals against 45 deposits, so either the attacker made 0.1 ETH deposits I have not found, or someone else withdraws this way. (Low)
• Where the withdrawn ETH went next: 5,275.1 ETH into 100 NEAR Intents deposit addresses, which sweep to 0x2CfF890f0378a11913B6129B2E97417a2c302680; 1,155.6 ETH gathered on 12 Oct through 0x04e8da930e825e7f2751086a067228c8ef9a7203 into 0xb6af05434cfb7b2e568c9bc862b14c873d85a9c8; 522.6 ETH swapped to stablecoins through Uniswap; 177.3 ETH shielded in Railgun; 77.0 ETH on one forwarding wallet, not followed further. (High for each transfer)
• 0xb6af05434cfb7b2e568c9bc862b14c873d85a9c8 holds 1,944.04 ETH and has never sent a transaction. 1,155.59 ETH of it is the Tornado leg above, from 0x04e8da93… at 17:40:47 UTC on 12 Oct. The other 788.45 ETH came from THORChain in two payouts on 12 Oct, for two swaps of 1,000,000 USDT each from single-use TRON wallets of the USDD parcel (section 5): 393.85 ETH at 17:37:11 UTC and 394.60 ETH at 19:08:59 UTC. The balance was unchanged at 19:59 UTC on 14 Oct, and the wallet has still never sent a transaction. (High for the balance, the inflows and the swap pairing; Medium for who controls the wallet)
• All 100 NEAR Intents orders paid out in ZEC: 100 lots, 10,607.57 ZEC, shielded from 15:28 UTC on 9 Oct to 13:53 UTC on 12 Oct. The seven lots of section 4 are among them. The service's order records tie each ETH order to its ZEC lot. (High)
• 58 of the 100 lots left the shielded pool by a fixed rule within three hours of entry: the lot minus 0.25%, minus 152,817 zatoshi, paid in two halves (rounded down and up) in two separate transactions to transparent addresses. Each of the 58 lots, 5,740.68 ZEC, matches exactly one pair of exits, 26 to 167 minutes after entry, and none matches more than one pair. Of the 382 lots the service shielded in the blocks I scanned, only these 58 match the rule, so it is the pattern of whoever withdrew these lots, not of the service. Shifting the fee by 1 to 400 zatoshi gives no match in 305,600 tests. Three more lots of 10 Oct, 320.46 ZEC (85.27, 125.73 and 109.46 ZEC, shielded at 11:18, 11:25 and 11:34 UTC), left by the same rule 233 to 243 minutes after entry. Up to Zcash block 3,517,788 (18:30 UTC on 14 Oct) no other pair of their exit values appears, so I count them: 61 lots, 6,061.14 ZEC. The other 39 lots, 4,546.43 ZEC, show no exit of either half value up to that block. The service's records show all 39 orders completed, none refunded, each to its own shielded address that no other lot of the case used. They are still in the pool or left another way. (Medium for each lot-to-exit link)
• Each of the 122 exit transactions paid into a NEAR Intents order, and the service's records give the payout: 121 paid, 1 refunded. The orders paid 5,942,340.36 USDC and 384.14 ETH, from 18:17 UTC on 9 Oct to 16:40 UTC on 10 Oct. USDC by recipient: 0xBA736A4b616e79867B6d586293966b552883f3F3 1,110,428.00; 0x816D5Ee17DB1495d1409F135b98FF3edc5F3cDf8 1,110,263.82; 0xc164F12CE0C5B3D050AdeCE9527FEf769eB59545 1,057,060.81; 0xE2FC35E86F4dF7Bd2b04E6eC4e9E95C1584C9c11 1,056,803.92; 0x901b149dC0aef3bE4652C974b750B86D81B19855 837,329.36; 0x0c54660eD28A1b5698d5A4276502c67A7d6Bee52 770,454.45. The ETH went to 0x33Fd156c011Bd895bD9D93c1CAD83bE5Ab6e700b and 0xc164F12C…, both of which paid the six HitBTC deposit addresses of section 9 (313.18 ETH on 10 Oct). The six exits of the three later lots paid into six of these orders at 15:24 to 15:29 UTC on 10 Oct: 196,222.86 USDC to 0x901b149d… and 196,257.81 USDC to 0x0c54660e…. With these, the orders paid 6,334,821.03 USDC. Each of the two wallets then sent on all it had received: 0x901b149d… took in 1,033,552.22 USDC and sent 1,033,552.22 to 0x84bD80bf… (section 9); 0x0c54660e… took in 1,033,440.89 and sent 1,033,440.89 to 0xd7ef9A5a…. All of these wallets are empty now. (High for each order and payout; Medium for the link through the exit)
• 4,285,338.27 USDC from these wallets reached the Bitget Wallet bridge vault 0x08eC0883Dec73e786CCf01461e4e543E23A731a7 (section 9): 2,927,792.33 through 0xa2CAc565900dA7bcA348f3597ADd8f24A1149B09, 1,057,545.94 through 0x85DD9d8d46C4dF238ecD47f151FCEc3dBC951a7E and 300,000.00 from 0xd7ef9A5a5dA8dE7a348145401D0236ef4452dd2e. A further 1,433,552.22 USDC went to the contract 0x0e841149b31e4e8b0dFf7E5d5ED4e94d353f56EA, from 0x84bD80bfB50420876dbe40f720C77D85d2e9Bde0 and 0xd7ef9A5a…. The vault holds many users' funds: 1,842,011.67 USDC and 1,295,028.79 USDT at the read. Each of the 27 deposits matches a USDT payout on TRON from Bitget's TRON bridge wallet, by amount and timing: 4,272,415.97 USDT to three wallets (section 9, gist file 4). On the open item about 0x84bd80bf… in section 9: its 1,033,552.22 USDC came from 0x901b149d… and went to 0x0e841149… (733,552.22) and 0x6C33B63D6742a1bF8e355482aF31Cfc50e8A57A2 (300,000.00). Of the seven NEAR Intents payouts of 10 Oct to 0x901b149d… and 0x0c54660e… that I first left unexplained, 459,209.30 USDC, six are the three later lots above. One remains: 66,728.64 USDC to 0x0c54660e… at 16:35 UTC (0x636ded9a2dcda939f67484ded0f1a5689e936721a09a2029eb64485f28096438). (High for each transfer)
• Who can act on this part: Bitget, for the 4,285,338.27 USDC deposited into its bridge vault; NEAR Intents, whose order records cover the 100 lots and the 122 exit orders. ETH has no issuer that can stop it: the 3,500.90 ETH on 0xb6af0543…, 0x88bD4cD4… and 0x5054C433… can only be watched. The CSVs behind this section are gist file 6 (Tornado withdrawals) and file 7 (Zcash lots, exits and payouts).

05·USDD: a detour inside the rails, and nine more wallets

• 10 TRON wallets on the list swapped USDT for USDD in 49 swaps between 9 Oct 10:40:06 and 10 Oct 13:39:30 UTC, 17,219,936 USDT in total (9 more swaps, 8,806,905 USDT, belong to the separate parcel in the first section): 45 of them (14,109,922 USDT) at a contract that emits BuyGem events, which I read as the USDD Peg Stability Module, and 4 swaps (3,110,014 USDT) through a router contract whose name suggests the SunSwap family. I read every USDT and USDD transfer of the swap contracts from 8 to 16 Oct, and three further buying wallets, funded from the distributor and from TAet8wXA…, are on the list because of it. The same router carried 30 other transactions in which a listed wallet sent USDD and received USDT, 24,752,226 USDT in total, between 9 Oct 13:21:48 and 12 Oct 13:51:42 UTC. Those are redemptions of USDD, not swaps into it, and they are the swap-back described below. My detector counted 57 rows and 27,672,862.84 USDT in both directions; two transactions appeared under two wallets, and I count each once. (High for each swap, Medium for the contract names)
• I walked the USDD forward from the wallets that received the swappers' own USDD and valued each walk in USD at the time of transfer: 4 walks finished, with 10,042,336 USD at the seeds. 5,610,407 USD reached labelled exits (a TRON swap venue labelled SUN, THORChain, Relay, Chainflip and the USDD contract), 4,228,162 USD sits on wallets I expand next, 108,659 USD went into Chainflip and I decode that next rail, and 95,109 USD stopped at the depth limit. The earlier version also walked from four wallets that had bought USDD at the swap router with their own USDT; nothing ties those wallets to the theft, and they and one wallet they paid are removed from the list (correction note above). (Medium: label-based exits, uncalibrated depth)
• In the walks, USDT goes to USDD, the USDD is swapped back to USDT at the swap venue, and the USDT goes into a rail. 8,696,189 USDT of the THORChain entries and 1,305,015 USDT of the Chainflip entries in section 3 were routed this way; those transfers are already in the section 3 totals and I do not add them again. (High for each transfer)
• Nine more TRON wallets emptied into one wallet. At 20:49:21 UTC on 9 Oct, in one block, each of nine wallets sent all its USDT to TRu643bTQVX74nxZ7nP6EetCkzhYxeD2pY. That is nine transfers and 8,806,905.13 USDT (one is tx 9c6397e5ec109aafd10bdc83623d78c1c71fbcf724025e5026d009ea4eafe50c). Three seconds later each also sent its leftover TRX to the same wallet. Each had received two USDT transfers between 17 and 20 Sep and made no other USDT transfer before or after. None of the nine is in my earlier lists. (High for the transfers)
• TRu643b… swapped 8,806,905 USDT for USDD in nine swaps between 20:50:27 and 21:01:39 UTC, 1,000,000 USDT each except the last (806,905), at the same USDD contract as the 49 swaps above: TSUYvQ5tdd3DijCD1uGunGLpftHuSZ12sQ receives the USDT in both. It sent the USDD on in nine transfers to TFxdckPCvXjn48YcUhHf5uhfcRDp6CciNP (4,000,000) and TMGrwEhgoPQeUuBBj7eCw6F5X8FQ4fmZcw (4,806,905). From 9 Oct 21:02 UTC to 12 Oct 13:49 UTC those two paid the USDD on to eight single-use wallets (seven of 1,000,000, one of 1,806,905), and each of the eight swapped it back to USDT at the swap venue labelled SUN above, within 2 to 30 minutes of receiving it. (High for each transfer)
• The USDT left each single-use wallet within two minutes of the swap. 1,806,900 USDT from TPJVig7AhZBgb593AJBdfz3irNECcvjKxz and 1,000,000 USDT from TVn4YYsK9xEY3nPveE6XvoyxxhXzCHSE8E went into the THORChain Tron vaults TQFZuXmTssrCoAPU4bMTEBz5sNBSS1hxnP and TXXCjsqRqa3WdjUMiesyAG72pSFfjhX8Th, both labelled THORChain in my walks. The swap of the first, on 11 Oct at 18:51:24 UTC (tx 81369cb61f373570d81c18aa9056c697263b2d7138b47a26192f2cb94323287d), names 0xa2F0AFC2B7af4bcc56aADaA870cA4f5Ead987a87 as the payout wallet in its memo and paid it 708.31 ETH. That wallet is one of the nine THORChain payout wallets of section 3, which received 1,176.79 ETH from the collectors' swaps. The swap of the second wallet, on 11 Oct at 18:46:09 UTC (tx 0ec0e032d6877914cf7bbff8bad615565bd992d7f740bfc3ebc5e42969b439d7), names the same wallet and paid it 392.86 ETH at 22:36:11 UTC (0x3670c1219fd30472caf0536953fe894273b707ebbdfc077575409d2d39f123e3). The other 5,998,960 USDT went into four busy wallets that I first read as service wallets. They are THORChain's TRON vaults: each of the six transfers carries a THORChain swap memo that names an Ethereum payout wallet, and THORChain's records pair each with its payout from the router 0xD37BbE5744D730a1d98d8DC97c42F0Ca46aD7146. The six swaps of 12 Oct (TRON swap time, then Ethereum payout time): TBGef3XYLwaYdrEEhmTXY6aDVqhUKdQnoQ 1,000,000 USDT at 06:11:21 to 0x88bD4cD497Bb7c232740c7d6d726DDbAb5d9b929, 389.19 ETH at 11:44:23; TUd1yQ57yQezjkQDDtS4kVJYJ1VmUUVVFh 1,000,000 USDT at 06:15:48 to 0x88bD4cD4…, 389.27 ETH at 12:02:35; TXLhvSRzQyzh436krHegbJN4EXNaSUvTzy 999,689 USDT at 06:36:09 to 0x5054C433e3Bc3586dB0a4991705CF5cDEE62678b, 389.15 ETH at 11:56:23; TD7AzAKitekvhb3jBWsVPsngfHd5wQ8tmN 999,271 USDT at 07:09:57 to 0x5054C433…, 389.25 ETH at 11:49:59; TReyW5pnEdHfFZjbStUVS3zEfykzV5zQhB 1,000,000 USDT at 13:33:45 to 0xb6af05434cfb7b2e568c9bc862b14c873d85a9c8, 394.60 ETH at 19:08:59; TF8JQ4AQsVf2ECJGpQz4JwofSjiA6pT5N7 1,000,000 USDT at 13:52:27 to 0xb6af0543…, 393.85 ETH at 17:37:11. In all, the 8,805,860 USDT that left the eight single-use wallets became 3,446.48 ETH on four Ethereum wallets. 0x88bD4cD4… holds 778.46 ETH and 0x5054C433… 778.40 ETH at 20:10 UTC on 14 Oct: each balance is its two payouts, and neither wallet has ever sent a transaction. (High for the transfers, the memos, each swap and payout; Medium for who controls the wallets)
• I add the nine wallets to the TRON total as a separate parcel: 66,688,015 USDT from the collectors plus 8,806,905 USDT is 75,494,920 USDT. I do not know who owns them. Four facts tie them to the drain: nine wallets emptied in one block with their TRX swept along, the same USDD contract and swap venue as the 49 swaps, THORChain payouts of 1,101.18 ETH to a wallet already on the list, and two payouts, 788.45 ETH in all, to 0xb6af0543…, the wallet that also took 1,155.59 ETH of the Tornado Cash withdrawals I tie to the attacker (section 4b, Medium). That makes the parcel Medium. The nine sending wallets are not on the per-address CSV. TRu643b…, the two relays and the eight single-use wallets are, at Medium. (Medium)

06·Bitcoin

• 122 wallets were swept into two collectors, each wallet in its own transaction with one output and no change. Block 970590, 9 Oct 05:54 UTC: 111 sweeps, 203.25674 BTC (46 into bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9, 65 into bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl). Block 970591, 9 Oct 06:15 UTC: 11 more sweeps into the second collector, 0.53146 BTC. Together 203.78822333 BTC. Sample sweep: bbae30f5eb6223b8195e62d17272dd9f542cdf995d24844be162ea8a45e2e6dc. (High)
• Neither collector has ever spent: in 203.78822333 BTC equals out 0 plus held 203.78822333 BTC (bc1qqnkw…jtm9 111.28199071, bc1qjqgw…49dl 92.50623262). I read every transaction of both addresses to the end, and both balances were unchanged at the snapshot. The second collector also received four 583-sat transfers from one address, which I read as address poisoning, not victims. (High)
• Two further collectors swept 204 more wallets in the same way. bc1qgqheemzla77pesl227hdtgf5ykz62d0zvld26n received 157 sweeps, 9.64525039 BTC, between 14:41 UTC on 7 Oct and 00:41 UTC on 10 Oct. bc1q4zf7sack0r58knctpwmv942l0xf4k6s0py6etz received 47 sweeps, 7.13264093 BTC, between 14:31 UTC on 10 Oct and 04:11 UTC on 11 Oct. Together that is 16.77789132 BTC from 204 wallets. None of the 204 is one of the 122, and no wallet was swept into two collectors. All 326 sweeps into the four collectors share one build: transaction version 1, locktime 0, one input wallet, one output. I did not test how common that build is. I found no shared transaction, input or funder between the first two collectors and these two, so the link rests on the build alone. (High for each sweep, Medium that the two collectors belong to the same operation)
• Three wallets hold 10.43 BTC and sit downstream of the two further collectors: bc1qq2gz3dnwhcafw35uk997w3agtz7mgvl5ysv87c received 4.69052803 BTC from bc1qgqhee…d26n (tx 54e7af311e6f2a4d35aee3b6bc87947d81b92c19791f896a296590c8e186fe67, six inputs all from that collector, 0.31714337 BTC change back to it) and holds 4.08527466; bc1qynaz7ar500dxxacyfkhjyaa63y45x9a5szdsgv received 3.92138248 BTC from bc1q4zf7…6etz (tx dfaeab82b98479fc59e944c68f8970c7c28ab410398d44533a09b6e740420d68) and holds all of it; bc1qzg9q2mecv3g9s9eehjrr6pkakuvppfhgrmj33x received 1.21138703 BTC from bc1qkpdp6jz0wtr2knky6zaduq4mtstyptxduxruqh (tx 78f4acf82b804fc4edf59e878760e0af8cf7bafd4bdcf55e32a4c72647ee4953), which bc1qgqhee…d26n paid 4.95031636 BTC, and 1.21011959 BTC from bc1qf63lxkswjfqetdqwmdsykld6vusvqwyd953qlc, which bc1q4zf7…6etz paid 3.20988845 BTC; it holds 2.42150662. The third and fourth collectors hold 0. 16.77789132 BTC came in and 10.42816376 BTC sits on these three wallets; about 6.35 BTC went on to other addresses; tracing them to an exit is next. (High for each transfer; Medium that the wallets are attacker-controlled, because that rests on the two collectors)
• Bitcoin swept in all: 203.78822333 + 16.77789132 = 220.56611465 BTC from 326 wallets. Held at the snapshot in five wallets: 203.78822333 (High) + 10.42816376 (Medium) = 214.21638709 BTC. I read all seven addresses again on 13 Oct at 05:23 UTC and the balances had not changed.

07·The other chains

• Avalanche: I probed all 118 Ethereum-format attacker addresses of the list at that time, one by one; none shows a transaction. (High)
• Optimism: walked from 0x381825deb972B3d0a031A9ce86902AC8b22Df8F2; no activity. (High)
• Arbitrum and Base: walked from the same attacker wallets (3 walks on Arbitrum, 4 on Base); no transfer above the dust floor, valued at 0 USD. (High)
• BNB Chain: 0x033636e45d519BeBB7b5c2520Ca6CE56FBDB4F7a sent 103,656.10 USDC to a HiFiSwap bridge address at 06:37 UTC on 9 Oct and 845,272 USDT in two transfers (400,000 at 06:42, 445,272 at 06:43 UTC) to the LI.FI contract 0x1231DEB6f5749EF6cE6943a275A1D3E7486F4EaE. LI.FI's route records show both landed on Ethereum at the same wallet: 175.94 ETH for 445,272 USDT and, through the Mayan route, 158.26 ETH for 396,204 USDT. 0x83aeaC166f6832aE3500000a24510a95a052A599 sent 459,473.77 USDT to 0xE6AC7Be48dA05d56B6a389c23eD44041f45FA0Cb at 06:23 UTC, which paid it to Relay's BNB Chain contract in five transfers (4 x 100,000 and 59,473.77 USDT) between 06:24 and 06:31 UTC; all five orders succeeded and paid 183.37 ETH to 0x468b3A…2A4E. I left out three transfers of a look-alike token with invisible characters in its symbol. Three further BNB Chain wallets (0x69c8F401cfC6cd40Ac94691d6D7C48e3b7a47841, 0x381825deb972B3d0a031A9ce86902AC8b22Df8F2 and 0x1d32E3EB9873f5afD24d623aB5b814E2d810cE39) were walked: all their outflows (8, 69 and 52) are below 6,772 USD each, 0.01% of the traced value. (High)
• Polygon: 0x83aeaC166f6832aE3500000a24510a95a052A599 sent 576,756.08 USDC at 06:09 UTC on 9 Oct to 0x02EC774f7B4791410aFffD3dd098c93E9F10d1ab, which paid it to Relay's Polygon contract in six transfers between 06:14 and 06:22 UTC. All six orders succeeded and paid 230.83 ETH to 0xfa4EaBB840A33C156E600311433AE261CBfCb0e2. (High)
• Solana: I walked five Solana wallets. 6Lx2Ma9LHSVXZUaJdN75uPW35APxfzjswLoW1MiMTVUy sent 1,300.54 SOL to MhhUk3eeCfikG1wgaXz5KAvBfbUXQg2k67ZfCPxqevh at 06:08 UTC on 9 Oct, which paid 650 and 650.5 SOL to Relay at 06:10 and 06:13 UTC; both orders resolved to Ethereum payouts. I read the four Solana wallets at about 19:00 UTC, after the snapshot window: they hold dust (at most 1.44 SOL each). On 12 Oct Relay's Solana wallet paid F7p3dFrjRTbtRp8FRF6qHLomXbKRBzpvBLjtQcfcgmNe six transactions that are in my rail table (13:00 to 13:02 UTC, 96,765.51 USDC and 56.41 SOL) and more payments later that day; I found no order for the six, the wallet holds assets from many other sources, and I draw no link to the drain. (High for the transfers, Low for any link to the drain)

08·Held and moving

Read between 18:37 and 18:46 UTC on 12 Oct: the watch read 123 wallets (Ethereum, Bitcoin and TRON addresses) and did not read the four Solana wallets, which I read separately (section 7).

• ETH: 17 wallets with at least 1 ETH each hold 18,993.32 ETH. The largest:

  wallet	ETH
  0x468b3A1CB8eEf055e40022dB5961e8500e2c2A4E	3,100.00
  0xa2F0AFC2B7af4bcc56aADaA870cA4f5Ead987a87	2,237.96
  0x064AF5bdf02a90435681BEa136D10EAC99c87160	1,998.50
  0x3b2F9cfec7CD8DE706c64b5d4De9aB19f28DfD70	1,788.39
  0x5a71034c50fE5463FE5508A911051d65DB83B726	1,745.20
  0xfa4EaBB840A33C156E600311433AE261CBfCb0e2	1,692.10
  0x988855aE609553deb7c522826E70322BA8510444	1,585.26
  0xb88d9c9d6E7b7E989d4A2a72bA0Ec76bBC441856	1,395.70
  0x131c9Cafa8959A5E7cD7293Df8D5D4B0887dFA6a	1,200.00
  0x033636e45d519BeBB7b5c2520Ca6CE56FBDB4F7a	1,026.91
  0x617013EB6Fee71Daaa3eE3f339fa97315c7651E2	817.50

  (High for balances, Medium that each wallet belongs to the attacker)
• BTC: five wallets hold 214.21638709 BTC. The first two collectors hold 203.78822333 BTC, bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9 111.28199071 and bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl 92.50623262 (High). Three downstream wallets hold 10.42816376 BTC: bc1qq2gz3dn…v87c 4.08527466, bc1qynaz7ar…dsgv 3.92138248 and bc1qzg9q2me…j33x 2.42150662 (Medium, section 6). Of these, bc1qq2gz3dnwhcafw35uk997w3agtz7mgvl5ysv87c spent once: at 00:41:50 UTC on 10 Oct it sent 0.60519697 BTC to 3FhnXNh8HxJeqVMKdzNPfJEJmaZmexCNZy and kept 4.08527466 BTC as change (tx 15679caaa69fd8712604f11328fcd579d740246033c8a8946ca5592ab1e9a10f). (High) The third and fourth collectors hold 0.
• Moved on 12 Oct: 0x3b2F9cfec7CD8DE706c64b5d4De9aB19f28DfD70 sent 40 ETH at 14:39:47 UTC and holds 1,788.39 ETH at the snapshot; 0xfa4EaBB840A33C156E600311433AE261CBfCb0e2 sent 40 ETH at 17:18:11 UTC and holds 1,692.10 ETH at the snapshot. Both 40 ETH went into Tornado Cash (section 4). (High)
• Moved on 13 Oct: 0xfa4EaBB840A33C156E600311433AE261CBfCb0e2 sent 240.005 ETH in three transfers of about 80 ETH, at 06:38:23, 09:41:47 and 10:02:23 UTC, to 0x3f6943c9ed2eb786a0aefdd54bd386fa13531ae6, 0x0b1f357e902fd88d2a8a15106f60a0bc806187ac and 0x67b2ec823e023adb991d578cdf74f721414c3479. The three wallets put it into Tornado Cash between 06:41 and 10:17 UTC. 0xfa4EaBB840A33C156E600311433AE261CBfCb0e2 holds 1,452.10 ETH at 13:01 UTC on 13 Oct. (High)
• Frozen: the 20 TRON wallets in section 2, 10,000,001.11 USDT at the snapshot. (High)
• Found on 13 Oct, after the snapshot: TMAXFFdZQrciR412fcTU8GbSgvCiBLicYy holds 1,350,000 USDT at 16:10 UTC on 13 Oct. About 1.22 to 1.27 million of it came from the Bitget Wallet payouts of the Ethereum USDC (section 9). (High for the source; Medium for who controls it)
• Found on 13 Oct, after the snapshot: 0x8bc2c1bc6793663f67169ef7d8aabde7b24a2a34 holds 1,537.39 ETH at 18:05 UTC on 13 Oct. It has never sent a transaction. It received 1,533.92 ETH from 0x482719f181d00429fb10ea964d269ee4cf8fd5fa at 13:36:23 UTC on 9 Oct (0x6a17e8902f12521f26832264d9a05085963ed8f032b3a84b65833594859a029d) and 3.46 ETH from 0x7d9c6116d0b3b255acf6ae3c6dcb52b233b91e3e 36 seconds later. Section 9 gives where that ETH came from. The watch of 12 Oct did not read this wallet, so it is not among the 17 above. (High for the balance and the transfers; Medium for who controls it)
• Found on 14 Oct, after the snapshot: 0x88bD4cD497Bb7c232740c7d6d726DDbAb5d9b929 holds 778.46 ETH and 0x5054C433e3Bc3586dB0a4991705CF5cDEE62678b holds 778.40 ETH at 20:10 UTC on 14 Oct, each from two THORChain payouts of the USDD parcel on 12 Oct (section 5), and 0xb6af05434cfb7b2e568c9bc862b14c873d85a9c8 holds 1,944.04 ETH (section 4b). None of the three has ever sent a transaction. The watch of 12 Oct did not read them, so they are not among the 17 above. (High for the balances and the payouts; Medium for who controls them)

09·Exchange deposit addresses

Update 13 Oct 2026: I reconciled every outflow of every attacker wallet on my list after the theft. That found more exchange and bridge exits than the three in the table below. It missed the Bitget Wallet legs from TRON, added at 18:05 UTC. (confidence per line)

• HitBTC: six deposit addresses received 313.18 ETH between 10:33 and 12:27 UTC on 10 Oct, from 0x33Fd156c011Bd895bD9D93c1CAD83bE5Ab6e700b (0xfe4c510414a876420d70c252eff80379f39f93f0 48.07, 0x558a2c9616dbd5b59e0b6a2589aa4b6bef1011f8 60, 0x5310D2f0BE3EEaC8B684EcC18232413658cC18Ba 60) and 0xc164F12CE0C5B3D050AdeCE9527FEf769eB59545 (0x95379d9ecE36c5025C4C5945C2f84645A632728F 50, 0x5ea9f639f055bb2b97a9203e39bbe95b238297d4 55, 0x65b592e905778c7550dbb70bdad7464335674280 40.11). All six were swept into the HitBTC hot wallet 0x80787af194c33b74a811f5e5c549316269d7ee1a at 10:52 and 13:27 UTC. (High)
• Binance, through a pass-through wallet: TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C, TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9, TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW and TVoUpEDZPMwXzzBdhdpzSpvRKn86xr8TDt sent 3,403,651.52 USDT in eight transfers of 300,000 to 500,000 to TBZdyd7dhAQZ1eYJFizh3EpnqEbmmnpVpd between 06:31 and 08:25 UTC on 9 Oct. Within 3 to 18 seconds of each one, that wallet paid a matching amount to TLYqMAQ1FcNkvUsLxsopM6BRYR8xH2ReiY: 3,302,147.93 USDT in total. TLYqMAQ1FcNkvUsLxsopM6BRYR8xH2ReiY forwards everything it receives to a Binance reserve wallet, TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf, so Binance holds the account behind it. TBZdyd7dhAQZ1eYJFizh3EpnqEbmmnpVpd had 1,584 senders in 26 hours: it is a service, not an attacker wallet, and that account may be the service's own. (Medium)
• Bitget Wallet's cross-chain vault: 0x85dd9d8d46c4df238ecd47f151fcec3dbc951a7e (attacker set) and two wallets funded only by the attacker set, 0xa2cac565900da7bca348f3597add8f24a1149b09 and 0xd7ef9a5a5da8de7a348145401d0236ef4452dd2e, deposited 4,285,338 USDC in 27 transfers into 0x08ec0883dec73e786ccf01461e4e543e23a731a7 between 12:05 UTC on 10 Oct and 09:39 UTC on 12 Oct. The vault is Bitget's. It is an EIP-7702 account delegated to the contract tagged "Bitget Wallet: 7702 Logic" (0x490aac77c960b0569c8e446ac7e12490bd44ca1d), and Etherscan tags it "Bitget: Crosschain Bridge Vault". It sweeps its USDC and USDT to 0xe70c5182e2b5abb776890c40c4e8f0608a2144b8 (2,000,000 USDT in 0x8bd65829d98f4b854aee16ef55176ad97076d6d09b7ebe33cb27e61f6766e61f on 13 Oct). That is a Bitget exchange deposit address, and it empties into Bitget hot wallets. Bitget's swap route feeds the vault too. 0x85dd9d8d… swapped 23 ETH through the Bitget DEX aggregator (0x2aadf5c2c1394b6cb51e1e1f684073c44a211d8c4d2d5694657148f33b0c0bb7), which paid 57,212.9 USDT to the Bitget Wallet intermediary 0x78ace9b2ee9a31737fad748015266a59f32dc79a. Twelve seconds later that account sent 57,212.82 of it into the vault (0x67d2b360fe803cfbe9e95c2a062cdb3ac01033024fc66e96405a017b512de7d7) and 0.08 to a fee address. A second swap of 0.99 ETH went the same way (2,470.33 USDT). The vault pools many users: the case's deposits are 23% of the USDC it took in from 9 Oct to 13 Oct. I matched every deposit to a USDT payout on TRON by amount and timing. Bitget's TRON bridge wallet TZG47zhb8kcriWQ2rE719yHs1KqgzwMrvF paid 99.70% of each deposit 55 to 79 seconds after it. It pays other users the same way, so Bitget's order records are the final proof of each destination. All 27 deposits match, 4,272,415.97 USDT in total, to three wallets. TPrdicyWfjDVre48ZdFzYPkPLNeJbWkG2P got 18 payouts, 2,918,966.29 USDT; it was created at 07:19:57 UTC on 11 Oct, 98 seconds before its first deposit. TK4UNyu88p9xpgctgDU9Ct1xZoPxQmo5A4 got 7 payouts, 1,054,355.31 USDT, plus 59,618.97 USDT for the two swap orders through 0x78ace9b2…, and TS9yaeuEUDu4pVXK7SaZDrhLhPVvVpBELe got 2, 299,094.37 USDT. Every pair, with both transaction links, is in bitget_tron_payouts.csv (gist file 4). On 11 Oct TPrdicy… sent 1,350,000 USDT to TMAXFFdZQrciR412fcTU8GbSgvCiBLicYy in three transfers, among them 959,900 USDT at 14:39:24 UTC (8b81a9b5769cfdcaee3d97ac8efde428ff09a906f00b31db84ee6fc8ea459129) and 390,000 USDT at 18:04:09 UTC (35f276bf64918643639d7fcee6aa78ad60799f0698ad06078a993b3ade773d71). That wallet has no outgoing transfer and held all 1,350,000 USDT at 16:10 UTC on 13 Oct. About 1.22 to 1.27 million of it traces to the payouts above, depending on the tracing rule; the rest reached TPrdicy… from two other services. TPrdicy… also sent 722,709 USDT through TSdrKsMrbLvL4i4VFG1V4A5P1iZsbSyVhY back into the same Bitget TRON wallet on 12 Oct. The items below follow it to Ethereum. The rest went to busy wallets with dozens of counterparties: 1,113,974 USDT from TK4UNyu… to TFmTLRkTouyGgwhafKs5CPecuaRS9AmVKj, and 620,000 and 570,000 USDT from TPrdicy… to THfBNL5jpfUNnHEQsdgfgpiZos6c7o8bme and TQvTASbfuYTCkmh4ca2UnJDdXAJqekjbXy, which also got 304,057 USDT from TS9yae…. None of the 804 addresses the vault paid from 9 Oct to 14:10 UTC on 13 Oct is in the attacker set. Blockscout also shows a "Fake_Phishing3514058" flag on the vault, from a phishing report attributed to MetaMask. Etherscan does not show it on the vault page (checked 13 Oct), and I found nothing in the vault's flows that fits it. The vault is not the one Bitget Wallet's BKBridge router names. 0x22cE84A7F86662b78E49C6ec9E51D60FddE7b70A set its vault once on Ethereum, at block 18,689,416, to 0x11235534a66a33c366b84933d5202c841539d1c9, so these deposits did not go through that router. They went through Bitget Wallet's newer order flow, where relayers pay out from delegated accounts. The docs do not name this vault. (High for the deposits, the vault and the 27 payout matches; Medium for who controls TMAXFF…)
• Bitget Wallet's bridge from TRON to Ethereum (added 13 Oct, 18:05 UTC). Two attacker wallets sent USDT to Bitget's TRON bridge wallet TZG47…. For each order the vault 0x08ec0883… paid USDT or USDC on Ethereum to the Bitget Wallet intermediary 0x78ace9b2…. 60 to 72 seconds later the intermediary swapped the whole amount through the Bitget DEX aggregator. The aggregator sent the ETH to the wallet the order named and a 0.3% fee to a separate address. Each order, with its TRON transfer, vault payout and swap, is in bitget_tron_to_eth.csv (gist file 5).
• Bitget from TRON, 9 Oct: TLn8gUhnFShtyBQBZZJUZeQaK1WJPrcDUN received 2,000,000 USDT from TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C at 07:00:30 UTC and 2,000,000 USDT from TRTVHpgANbyo44HUpjUPLQnezo66GT2bzE at 12:20:45 UTC. It sent 300,000 USDT to Bridgers (section 3). It sent 3,700,000 USDT to TZG47… in 19 transfers between 07:02:51 and 12:47:48 UTC. These 19 are not in the rail table of section 3 or its totals. 17 of them match a vault payout 56 to 68 seconds later, at 99.82% to 99.90% of the amount: 3,296,124.16 USDT and USDC in total. All 17 swaps paid ETH to 0x482719f181d00429fb10ea964d269ee4cf8fd5fa, 1,313.35 ETH between 07:04 and 12:49 UTC. That wallet also took 186.67 ETH in five payouts from the contract 0xc1d13492285eb664951e201bf7c80c7c6318a1b5, verified on Blockscout as "SwftSwap", 32.47 ETH from 0xfb19ffd1ff9316b7f5bba076ef4b78e4bbedf4e1, which Blockscout tags "Aeroswap 2", and 1.43 ETH from 0xa5013a0cc6d35bbe0ef0389f960de883486c6e74. Next I trace what paid for these three. At 13:36:23 UTC it sent all 1,533.92 ETH to 0x8bc2c1bc…; section 8 gives that wallet's balance. The other two transfers, 400,000 USDT at 12:46:18 and 12:47:48 UTC, have no unpaired vault payout within 30 minutes on Ethereum, BNB Chain, Arbitrum, Base, Optimism or Polygon. I have not found their payout.
• Bitget from TRON, 12 Oct: TSdrK… sent the 722,708.91 USDT in four transfers between 05:09:45 and 05:13:06 UTC. The vault paid 721,614.10 USDT and USDC, 59 to 65 seconds after each transfer. The four swaps paid 280.19 ETH to 0xe43c1c48247fd7cdc159926a179b60f3c97f679a. That wallet made one transaction: all of it to 0xa0dbdce5a44409df0a815d83cc4e54edb3bc7d9d at 05:19:11 UTC. Between 05:21 and 07:08 UTC 0xa0dbdce5… paid out:
• HitBTC, 12 Oct: 199.17 ETH to four deposit addresses, 0xd006ce061487a8de6885bf1920e6e1fc24cce628 55, 0x96fe0c2c18e42beb4bed9247a4dbbae2b640be9d 40, 0x04cc6fea91bc2e0a00ffc5e19279ae62fb3f8702 55 and 0x28b5bcbc9afd3814c0daa9c9140c03f79c5b1451 49.17. All four were swept into the HitBTC hot wallet 0x80787af1… in one block at 07:35:35 UTC. (High)
• An instant-swap service, 12 Oct: 54 ETH to two one-time deposit addresses, 0x771cf8301025e80a756f7bd6a706854759b20cb6 27 and 0x0ff3c5182f156d539d0cc8ecd552ab08d7b24ab0 27. Both were swept into 0x016606ac…, the service payout wallet in the "Still open" item below. Blockscout tags that wallet "changehero: Hot Wallet". (High for the sweeps; Medium for the service's name)
• Binance, 12 Oct: 27 ETH to the deposit address 0x5d77e7b11aabc3d9865855244738ea920eb6b211, swept into Binance at 05:52:59 UTC. That address has taken deposits since 22 Mar 2026. 0.02 ETH went to 0x464e21903545bfe5c063dc29e331dc9668f8bf81 and is still there. (High)
• How sure the Bitget pairing is: the intermediary pools many users. It took part in 3,416 USDT and USDC transfers, in 2,273 transactions, between 05:09 UTC on 12 Oct and 17:29 UTC on 13 Oct. So each TRON transfer is paired with its payout by amount and timing, the test that matched all 27 orders in the other direction. Bitget's order records are the final proof. Fake USDC, USDT and ETH tokens that address poisoners sent around these wallets are excluded from every figure. (High for every transfer, payout, swap and sweep; Medium for the pairing and for who controls 0x482719f1… and 0x8bc2c1bc…)
• Aeroswap: 0xa2cac565900da7bca348f3597add8f24a1149b09 paid 283,420.89 USDC on 11 and 12 Oct through six one-time wallets to 0xfb19ffd1ff9316b7f5bba076ef4b78e4bbedf4e1. (Medium)
• Binance, small: 3,010 USDT on BNB Chain at 11:17 UTC on 10 Oct from 0x1d32e3eb9873f5afd24d623ab5b814e2d810ce39 (a payout address the attacker chose in a Bridgers order) through 0xf287efcf71c02ba2a8c6af96771004e1bd2aafff to the Binance deposit address 0x3fc37b769b692c5dd7997ae03d62392e6ce0812d; and 0.06 ETH on 10 Oct through three one-time wallets to the Binance deposit address 0x487cab40f6d11a278fa7c442c6741eabe44eab5d. (Medium)
• Still open: 0x84bd80bfb50420876dbe40f720c77d85d2e9bde0 took 1,033,552 USDC and its walk ends at NEAR Intents, matching is next. I walked the six smaller outflows as far as the chain allows. 47.19 ETH in two transfers went to one-shot deposit addresses of what looks like an instant-swap service. Its payout wallet 0x016606acc6b0cfe537acc221e3bf1bb44b4049ee pays about the deposit amount, less gas, into a Kraken deposit address that it funds almost alone. 201 of its 241 payments there since 30 Jul match an inbound deposit within 25 blocks. 53.47 SOL went to NEAR Intents over the Omni Bridge, and 59,683 USDT went into the Bitget vault above. 0.61 BTC went into a split-and-merge pool, where it mixes with other funds. Fake tokens named ETH and USDC that address poisoners sent to these wallets are excluded from every figure.
• Correction for the third row of the table below: TCPPRajgXVBkR5Qvpd3RHh4xUvibhzrqSa is a service wallet, not an attacker wallet. It had 730 senders in 36 hours, mostly deposits of 30 to 100 USDT. Attacker-set funds reached it once: 230,964 USDT from TXgTmcFvJ5UeoERJkQmK2SQWf1vsucnpbT at 08:29 UTC on 9 Oct. The two 75,000 USDT transfers to TMRPKQobP6M56TNJGQeuBxbzGEnnDdgTt3 on 12 Oct are the service's own payouts, and I no longer count them as an attacker exit. (High for the transfers)

The first three deposit addresses I found: (Medium: deposit-address pattern, not a confirmed customer)

10·Addresses removed from my list

I removed 12 addresses after checking their paths, and the transfers they made are out of every figure above. (Medium: each rests on the absence of a path)

• THvPCrsu2BwF3NRywFYhTu9Wsfwr59cQmo: a victim wallet, not an attacker wallet. It was drained once, to the drain address TYohhJpmXn4uuKhC1uFRCCjMWAWPJnUfGj, and Tether blacklisted it at 12:14:00 UTC on 9 Oct, which is consistent with a protective freeze. The attacker had taken it over earlier that day. At 03:55:27 UTC a permission change, signed with the wallet's own key, added a second key TU9bsvYgky2DdFNgEUijiSc9XBNNM6henx with weight 2. The threshold became 2, so the original key could no longer sign alone (tx f12e536959e54e09258169b7d28657b02b58b3249ffa4adf815d5b2cd20a9aa3). TAzdU79XsKJNX4n9ks7GAeA1zKCPZXCSYQ, the address that signed the approval pulls of the drain, funded the added key at 08:50:39 UTC (tx be4473c80702510929ca4cdd2192f7656286db648d205e2f83ae7845b5e5d6a3). At 09:49:09 UTC both keys signed the transfer of 4,303,775.81 USDT to TYohhJpmXn4uuKhC1uFRCCjMWAWPJnUfGj (tx 5afad9caf03488859ffddc83ed152f6f4b1e4f607588fe58d5478bb0936a9b37). (High)
• 0x1299e05b17f06124ba05ea54f20395c5c54de6cb: the payout wallet of a swap or bridge service, not attacker-controlled.
• Five TRON wallets with no path to the theft within eight hops: TFsg744fGSULJ3YFRbegRY2RHUcMaLgw7M, TMirxheYqFzUTwitUoYZQfbsBzzvZsVmu3, TQTgtJKhuBuJCAxSPv8Qis89mu2tEC5iDS, TTJxMakQP8gqAsJzaBrXfhqjN61JTJEKQk and TXn41Ytbaf1kRdqRn79wHy4ZVGZ1Rocv4x. Two look like services: 13 and 15 unrelated senders, and none of their outflows go to attacker addresses. The five sent 31,334.91 USDT into Relay and Bridgers in 14 transfers; I took them out of the rail totals. Eight Relay orders from TQTgtJKh… that paid 0x04b5C7b305150dB42cfcE5A3Ce255b0c643c9678 on Polygon are out with them.
• Five TRON wallets that bought USDD at a swap router with their own funds, or only received USDD from one of the buyers. No transaction I read ties them to the theft; they are listed in the correction note at the top, and the USDD swap figures above no longer count them. (Medium: the absence of a tie)

11·Open items

• Walk the 4,228,162 USD on unexpanded wallets, and value the walks of the other buying wallets.
• HiFiSwap (3 of 49), one Bridgers order and one NEAR Intents order on Solana: resolve each when the services' lookups allow.
• Read the six Relay payouts on Solana to F7p3dFrj… against their orders, and attribute or exclude the wallet.
• Read the 39 Zcash lots without an exit (4,546.43 ZEC) again as later blocks arrive. Find the order behind the one unexplained NEAR Intents payout of 66,728.64 USDC to 0x0c54660e….
• Confirm the 27 Bitget Wallet payouts on TRON with Bitget's order records; the pairing in section 9 is by amount and timing.
• Walk the two forwarding wallets 0xF75Cb503…1e5b6 and 0x5531734B…8cF7 further; their Tornado deposits are where I can no longer read the trail.
• Follow the 6.35 BTC that the third and fourth Bitcoin collectors passed on beyond the three downstream wallets to an exit.
• Find the payout of the two Bitget Wallet transfers of 9 Oct from TLn8gUhn…: 400,000 USDT at 12:46:18 and 12:47:48 UTC.
• Find what paid for the 186.67 ETH from the SwftSwap contract, the 32.47 ETH from 0xfb19ffd1… and the 1.43 ETH from 0xa5013a0c… that reached 0x482719f1… on 9 Oct. If attacker TRON wallets paid for them, they are rails outside the table in section 3.
• Re-read held balances and Tether's blacklist before any update; 12 Oct 18:37 to 18:46 UTC is the only balance snapshot here.

Per-address CSV: file 2 in this gist. Every wallet-to-wallet transfer I drew, as of 15 Oct: hops.csv (file 3 in the gist holds the rows up to 13 Oct). Bitget Wallet payouts to TRON: file 4. Bitget Wallet orders from TRON to Ethereum: file 5. Map of the transfers: https://philgr8.github.io/ledger-drain-map/

A·Appendix: transaction hashes

Times in the report are block times.

• USDT0, TRON entry: 14363215f8666b403ed1fc10776f9fd3dd7051898c4a93e4ba914e392edda898; delivered on Ethereum: 0x5e89a2847510f5be6b53c1eb30e6730fbadf888bd0c326e82e6155539cbb45a3
• THORChain, TRON entry: 818b5529ca2db3d4762aef38ea953e2bb9750c82469beb9b8aee9b1116dc1a6c; ETH payout to 0xce29803592346a285e17d3C6595B0C0528a3C647: 11bbf92f95f5578cb3e87cd58c4d4af08ed1d9023394f261eef7d66b4f2451d2
• Relay, TRON entry: 3526d20dbc5484efb7d62953561b10bca9cb9630521229a68411ec0c8a325a30; Ethereum fill: 0x27891ecd369b91acf335069ecd948909fffbdcf8dcee12d85f007c53366a7044
• NEAR Intents, TRON entry: 36a78d0a4c112e86c892bef18215c8d6796755c9ec9a17a6c88a90517990ac83; Ethereum payout: 0xb1b7fc7b4911994739652507586eb8d0e4fd06434efe19b17ba041474ee6f55c
• Chainflip, TRON entry into the Vault (5,000 USDT): fcd93ffbc4047b7c51a0c22f04df735d4fd37f5b35ca52c8ea8adffb91e76501; Ethereum payout: 0xf8af80d3b85e2140f30b95fbc63f335c439d1cddfb81a4af27df947236f74ad3
• Collector to distributor: 77a3372ec8bf99a119fde6b7666d7901cdcec8e7d7ffa4284c2aa9fdefe1dd51; 43c61e7090b7b71fce68ead04978ba507372bb9c54b15a284ace475ca086c50c
• Tornado deposit: 0x2c081416d0064e80291d8798747604c8f4cd4ed841ff90fcd1863033d87e325c; first pool withdrawal to 0x0D697a…5f82: 0xa16961c9aef636b2a18733cb43ad0de5f2d09fe992f832ca73ccb9e56b1afc2c
• The two 40 ETH moves of 12 Oct: 0x7e345db352c8264bdd8ddff097be21cee21b03d25c187b5d148ab66575d4edfc and 0x8d896c13dfedaa692dbcf77ebe42e96c0ef21fb283050a4edccbe8bfa793a91e; first Tornado deposit after each: 0x7cd07e910045b64b0a9c2e2b534c555d9a7b5f44080309933454ddc01dfebf4d and 0x241bccb5cd978ee808498c9dcb8aa50011c17e1c61578be005e9c66d61d281be
• BNB Chain, LI.FI route payout on Ethereum: 0x7ef0d3f8c3d1a747fade2e1b1d7c755dbe9e2bcffa7d0e63b51a513f49cfd972; Mayan route payout: 0xf204d26a513367104f672d9585176a700bcdecd00c483d6881994d494e9eee41
• Bitcoin, victim sweep: bbae30f5eb6223b8195e62d17272dd9f542cdf995d24844be162ea8a45e2e6dc
• Bitcoin, link from the third collector to the downstream wallet: 54e7af311e6f2a4d35aee3b6bc87947d81b92c19791f896a296590c8e186fe67; from the fourth: dfaeab82b98479fc59e944c68f8970c7c28ab410398d44533a09b6e740420d68
• TRON, nine wallets into one: 9c6397e5ec109aafd10bdc83623d78c1c71fbcf724025e5026d009ea4eafe50c; first USDD swap of that wallet: 39142fd5c58def559eb5fd1a438895991c03d79d629aae8db9cf051864e69b08; USDT into the THORChain vault after the USDD detour: 81369cb61f373570d81c18aa9056c697263b2d7138b47a26192f2cb94323287d

NEAR Intents to Zcash, seven payouts (Zcash block times, 10 Oct): 12:27:00 4ef0612f0227d010cbbea38d3ad58788d8d58027f0b9f62b9b242421e781e7c5; 12:33:30 ebc7ec63cb5e7b220a8ae5d5ef91c1c36e46e2d3173807934586c784031626ad; 12:41:24 85e0441da8ec3241f93fdf19fbb5e204b608714899392df18e808edff0cfdf6f; 13:33:14 5c4a28b4404d955bc228842274ef2978a96d944f36bd72e02761efa70ca095e9; 13:38:03 e7c0b42b771d6aca724527f369b7b8df83cca3dd1eda3900f705c07f5fc7834a; 13:43:01 b1936b55e9ce4f16b4ee0e87a04b837bde4c9ce0f673b202a365366990b20430; 13:54:44 70a8035bf1b7d408e4588af76bbf5e76d1e27e49b8c6cd5c3f6f54e45466bf0d

USDD parcel THORChain swaps, TRON swap then Ethereum payout: 11 Oct TRON swap 18:51:24 81369cb61f373570d81c18aa9056c697263b2d7138b47a26192f2cb94323287d; its Ethereum payouts 12 Oct 03:59:59 0xbc56156e308dea5ab1c9ec0ae5549bacaa14ef81452b50527a584d336cd46e27 (491.67 ETH) and 0x28c9e56358eb264dc15a76d2f29dae2a7afa84b878ee981c1f4f6ccb2bb1150f (216.64 ETH). 11 Oct TRON swap 18:46:09 0ec0e032d6877914cf7bbff8bad615565bd992d7f740bfc3ebc5e42969b439d7; its Ethereum payout 11 Oct 22:36:11 0x3670c1219fd30472caf0536953fe894273b707ebbdfc077575409d2d39f123e3.

12 Oct TRON swap 06:11:21 4bea29231f2db5bce7612efe752d332e8bed9dac7cf04e7b34eb6bd2995b64a7; its Ethereum payout 12 Oct 11:44:23 0x70d580f7059c7b8bc1317cb9496a07b160695ed1b113835e3b7e6260930bd107. 12 Oct TRON swap 06:15:48 812914dd2f5a07b8b5ce88fbb0b44ceeaff570ebdeb6505ca7e5d357c3101d1d; its Ethereum payout 12 Oct 12:02:35 0x76348aa448f36ce45aae7d5ee8c288ef88a016518c36ef107ec97d1dfde482f2. 12 Oct TRON swap 06:36:09 f520bbd65fdde1f8dcb95de8233a3d5b527dac90cb828a70dc154b6bddfca7b1; its Ethereum payout 12 Oct 11:56:23 0x31ecd74ca475579452f9b5f5a36eab5679bbb4c89de64e2d580b155ec1fe9dac.

12 Oct TRON swap 07:09:57 e9b9d647db2c42879a9e90ed1b6f94ba796ce2e81a9284628a1ad832cca27288; its Ethereum payout 12 Oct 11:49:59 0xb2196ffd2592c403ed9e6bb57a3d1a2966e202059a4ee76a43209152ce06c3c0. 12 Oct TRON swap 13:33:45 34cd551eb9ded5300d4d783323f10805b92ca0eece2bde9ac03f573d41219da9; its Ethereum payout 12 Oct 19:08:59 0x15a83c397b7e8bd4e2ba5b265706235ccf84312b95e8383a1738298149bf92b0. 12 Oct TRON swap 13:52:27 00f02d8ade5af3b929bb38ff86ac5bccce1686d88fbb9bb344ca42d2e637cd80; its Ethereum payout 12 Oct 17:37:11 0x3098413cb38e44f5b3ea8581d34ded063a1474cbdb9eca548f8911b367d797a1.

Zcash, three later lots and their exits (10 Oct): 92099a0196bdcebaf2cd60ff721ad28d86e637f8a8d61a2808a2bc534029526a -> 5a347e5f41d7969975b9e93de947a23b4208147aec44bdfa030f697ea6077195, 7810e00d9f1e2d7bd26ebbf739d5e86073c4453d7c9f1940acc3f69d26800eb2; c8903a9fa4b607a0d63d9c589cda8fb6dc02f3d09f2d0a2f8bccf9817f77e980 -> daffb9cccc5a69de5cabed503f6161d39978403867f4345f376b8f000dabb18c, 9b2f6baca40d566a5c952d299b14de6964518721a71b1f3d51a6a4dd1f696f1f; 8fa169363c7da575b7bb30d52aa2df2934feb973658d3750e9e9120275d6763e -> 7f49db42695eee7a05e393fd288e30882593ef077e17db67ef3b224609114b48, 8053cef6654ed6d71b307f2fc338dd9f60385135ea1c4774ac52237110224a12.

Tornado withdrawals to the two thief wallets: the 15 transaction hashes are in file 3 (leg TORNADO-OUT), including the 5 x 1 ETH and 2 x 0.1 ETH withdrawals. The eight 12 Oct deposits are in file 3 (leg ETH-TORNADO, from 14:45:59 and 17:25:11 UTC).

Tether's freeze of one wallet (TB6bJfqPjbfhg4Qa8y81CnUK3KHrN6Sd1g) at 12:09:42 UTC on 9 Oct, tx fbf788661c249713fd0816c8a3fe9d93313209fe8763f83249b9199d6987231a.