For business
KYT office
Compliance solution to monitor risks, detect sanctions and ensure AML rules.
KYT office
Compliance solution to monitor risks, detect sanctions and ensure AML rules.
AML certification
How industry players can get up-to-date knowledge and professional certification.
AML certification
How industry players can get up-to-date knowledge and professional certification.
Comprehensive transaction analytics that helps to build graphs and trace funds.
Graph
Travel rule
(soon)
For personal use
Telegram bot
Bot for checking crypto for risks, providing AML reports.
Telegram bot
Bot for checking crypto for risks, providing AML reports.
Crypto recovery
Services are focused on tracking
and recovering crypto assets.
and recovering crypto assets.
Сrypto recovery
Services are focused on tracking
and recovery crypto assets.
and recovery crypto assets.
Docs and reports
All types of documents related
to cryptocurrency.
to cryptocurrency.
Docs and reports
All types of documents related
to cryptocurrency.
to cryptocurrency.
Portfolio tracker
Information about all assets and risk assessment in one place.
Portfolio tracker
Information about all assets and risk assessment in one place.
AML checks
Сhecking wallets and transactions
for illicit funds.
for illicit funds.
AML checks
Сhecking wallets and transactions
for illicit funds.
for illicit funds.
AML-сертификация
Актуальные знания в области AML/KYT от ведущих экспертов отрасли.
AML-сертификация
Актуальные знания в области AML/KYT от ведущих экспертов отрасли.
Graph
Визуализация перемещения активов
и связей между кошельками.
и связей между кошельками.
Graph
Визуализация перемещения активов
и связей между кошельками.
и связей между кошельками.
KYT Office
Мониторинг транзакций и кошельков для вашего отдела комплаенса.
KYT Office
Мониторинг транзакций и кошельков для вашего отдела комплаенса.
Для себя
Для Бизнеса
Travel rule
(Cкоро)
Телеграм-бот
Бот для проверки кошельков и транзакций с выдачей отчётов.
Телеграм-бот
Бот для проверки кошельков и транзакций с выдачей отчётов.
Возврат средств
Услуги по отслеживанию и возврату украденных криптоактивов.
Возврат средств
Услуги по отслеживанию и возврату украденных криптоактивов.
AML-проверки
Проверка кошельков и транзакций на наличие "грязной" криптовалюты.
AML-проверки
Проверка кошельков и транзакций на наличие "грязной" криптовалюты.
Портфолио трекер
Информация о всех активах и оценка рисков в одном месте.
Портфолио трекер
Информация о всех активах и оценка рисков в одном месте.
Отчёты
Все типы документов связанные
с криптовалютой.
с криптовалютой.
Отчёты
Все типы документов связанные
с криптовалютой.
с криптовалютой.
On September 24, 2026, one of the largest crypto exchanges, Bitget, was hacked. BitOK analysts reconstructed the chronology of the incident. We explain how the fraudsters hacked the exchange and where the money went.
The fund movements were tracked using BitOK’s Graph tool.
The fund movements were tracked using BitOK’s Graph tool.
Contents:
- The first 45 minutes
- Timeline of the initial outflows
- Source wallets and the first gas payments
- Swaps and consolidation on Ethereum
- How the other EVM networks entered the route
- Where the bulk of the funds remained
- XRP: five holding wallets and one active branch
- How the XRP branch reached Ethereum
- Payments to an exchange address
- What links this branch to the AFX exploit
- How the linked addresses were funded
- Separate branch: preparations for the AFX exploit
- The overall picture
The first 45 minutes
The first 45 minutes
On the evening of September 24, funds began leaving Bitget operational wallets on several networks at once. The first notable transactions were small: 93 TRX on TRON and 0.84 ETH on Ethereum, eleven seconds apart. Half an hour later, 34.75 million USDT arrived at the same Ethereum address. The next wave reached Arbitrum, Optimism, Base, and the XRP Ledger. Fifteen minutes after that, large transfers took place on BNB Chain, Avalanche, and TRON.
The repeated use of addresses and the close timing of the transactions point to coordinated control over the outflows. The main recipient across six EVM networks was 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee. The assets were then distributed to swap addresses, routed through decentralized services, and consolidated primarily on Ethereum. XRP and TRX followed separate routes.
By the morning, eight Ethereum holding wallets contained 67,809.926999 ETH. The XRP hub and five first-tier wallets held 102,588,692.506528 XRP. Another 5,896.58 BNB and 20,593,376.573718 TRX remained on their respective networks. These are the balances of specific addresses at the time of review. Transfers between those addresses trace the movement of the same assets and are not counted again in the totals.
The repeated use of addresses and the close timing of the transactions point to coordinated control over the outflows. The main recipient across six EVM networks was 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee. The assets were then distributed to swap addresses, routed through decentralized services, and consolidated primarily on Ethereum. XRP and TRX followed separate routes.
By the morning, eight Ethereum holding wallets contained 67,809.926999 ETH. The XRP hub and five first-tier wallets held 102,588,692.506528 XRP. Another 5,896.58 BNB and 20,593,376.573718 TRX remained on their respective networks. These are the balances of specific addresses at the time of review. Transfers between those addresses trace the movement of the same assets and are not counted again in the totals.
Timeline of the initial outflows
Timeline of the initial outflows
September 24, UTC | Network | Transaction |
18:31:00 | TRON | 93 TRX to TBWN…YwKD |
18:31:11 | Ethereum | 0.84 ETH to 0x770b…63Ee |
18:58:59 | Ethereum | 34,751,168.120990 USDT |
19:01:20–19:01:33 | Arbitrum, Ethereum, Optimism, XRP, Base | Large transfers in rapid succession |
19:16:14–19:16:20 | BNB Chain, Avalanche, TRON, XRP | Second wave of outflows |
19:30:35 | Ethereum | 22,320 ETH arrives at 0xA6dD…5545 after swaps |
Transactions from the source wallets carried valid signatures. The observed pattern is consistent with a compromise of private keys or signing infrastructure: the operator was able to move funds on behalf of those wallets. The transfers alone cannot establish how access was obtained. The on-chain evidence does, however, allow the sequence of actions after access was obtained to be reconstructed.
Source wallets and the first gas payments
Source wallets and the first gas payments
The EVM portion involved four source addresses. A single address could operate on multiple networks, so the networks are listed separately from the address identifiers.
Source address | Networks and assets in the traced branch |
0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23 | Ethereum: ETH, USDT, USDC; Arbitrum: USDT0; Avalanche: USDC |
0xffa8DB7B38579e6A2D14f9B347a9acE4d044cD54 | Ethereum: ETH; BNB Chain: BNB; Avalanche: AVAX |
0x5bdf85216ec1e38D6458C870992A69e38e03F7Ef | Ethereum: XAUT; Optimism: ETH |
0x97b9D2102A9a65A26E1EE82D59e42d1B73B68689 | Base: ETH |
At 18:31:11, wallet 0x1AB4…8F23 sent 0.84 ETH to the main collector. The small amount and its position before the large-scale outflows are consistent with a test transfer and funding for subsequent transaction fees. Transaction 0xc195…7be6.
At 19:05:11, the collector sent 0.1 ETH to 0x7c96279Ec1e888Aa56b9B836e0dB26ca48573E1C. That address subsequently received tokens and executed swaps. The sequence shows how the swap address was funded for gas from assets already collected. Transaction 0x4c70…dcff.
On TRON, the new recipient was TBWNguTTgezw9dVorX441C6nDrZpRxYwKD. Three seconds after the account first appeared in the records, it received 93 TRX from TJ7hhYhVhaxNx6BPyq7yFpqZrQULL3JSdb, labeled Bitget 9. Transaction 698c…ec4b.
At 19:16:18, the same recipient received 20,593,283.573704 TRX from TJxe1MWrb5ppk3beWArqU2Dwg3jvhGUGx5. Regular two-way transfers with Bitget 9 suggest that this source was part of a related operational flow. That role is inferred from its transaction history; its owner has not been independently confirmed. Transaction ce9b…d13f.
The amounts and timing of these transactions show the visible preparation for subsequent fund movements. The earlier stage at which access to Bitget infrastructure was obtained lies outside the transactions presented here.
At 19:05:11, the collector sent 0.1 ETH to 0x7c96279Ec1e888Aa56b9B836e0dB26ca48573E1C. That address subsequently received tokens and executed swaps. The sequence shows how the swap address was funded for gas from assets already collected. Transaction 0x4c70…dcff.
On TRON, the new recipient was TBWNguTTgezw9dVorX441C6nDrZpRxYwKD. Three seconds after the account first appeared in the records, it received 93 TRX from TJ7hhYhVhaxNx6BPyq7yFpqZrQULL3JSdb, labeled Bitget 9. Transaction 698c…ec4b.
At 19:16:18, the same recipient received 20,593,283.573704 TRX from TJxe1MWrb5ppk3beWArqU2Dwg3jvhGUGx5. Regular two-way transfers with Bitget 9 suggest that this source was part of a related operational flow. That role is inferred from its transaction history; its owner has not been independently confirmed. Transaction ce9b…d13f.
The amounts and timing of these transactions show the visible preparation for subsequent fund movements. The earlier stage at which access to Bitget infrastructure was obtained lies outside the transactions presented here.
Swaps and consolidation on Ethereum
Swaps and consolidation on Ethereum
The Ethereum branch began with liquid tokens being sent to 0x770b…63Ee. The collector then transferred assets to the swap address 0x7c96…3E1C.
Asset | Direct outflow on Ethereum | Evidence |
USDT | 34,751,168.120990 | |
USDC | 12,852,046.242513 | |
XAUT | 3,000.322053 |
ETH also arrived separately, including tranches of 7,130.858709312 and 13,965.927231303 ETH. After the swaps, 0x7c96…3E1C sent 22,320 ETH to 0xA6dD3F218B65E32Ccc37BE30f74884133c655545. The transfer at 19:30:35 establishes the latter address as a consolidation point. Transaction 0xbf42…d36a.
How the other EVM networks entered the route
How the other EVM networks entered the route
Arbitrum. Wallet 0x1AB4…8F23 sent 19,668,851.773202 USDT0 to the main collector. The collector transferred 19,668,851.77 USDT0 to 0xe410a2E5710Ee787bcaa63f52A3943ff71F0d946. A series of swaps through UniswapX, 1inch Fusion, and execution contracts yielded approximately 7,111 ETH. On Ethereum, 0xe410…d946 later sent 9,610 ETH and a further 2,947.661777 ETH to the consolidation address. By then, the address was also handling another branch, so those two outgoing transfers cannot be attributed in full to the original USDT0 outflow. Outflow from Bitget; transfer to the swap address.
Base. The collector 0x770b…63Ee received 1,555.318215225 ETH. The funds then passed through 0x469Ac1406dE92f82C0563477240a3627057425DC. On Ethereum, that address sent 1,541.51 ETH to 0xA6dD…5545. Initial transfer; receipt at the consolidation address.
Optimism. The initial outflow was 5,737.680149787 ETH. The collector then sent 5,737.67 ETH to 0x94A43df7687A8494948Be937400e9d5D33135DA0. In the reconstructed Ethereum portion of the route, several transfers to 0xA6dD…5545 totaled approximately 5,144 ETH. Initial transaction.
Avalanche. The collector received 821,011.971142467 AVAX and 8,204,678.8 USDC. Subsequent activity in this branch includes swaps and an interaction with 0x5085b3d52b5587c18EF456FcbcDe9A11d48340F8; on Ethereum, the same address sent 2,943.570538 ETH to 0xe410…d946. The matching address and coordinated sequence form part of the route reconstruction. Matching each individual cross-chain transaction conclusively would require an order ID or bridge message. AVAX outflow; USDC outflow.
BNB Chain. The initial 12,719.460681306 BNB passed through the collector and 0x7c96…3E1C. After interactions with LI.FI, KyberSwap, and other contracts, the funds moved through 0xe07Bd590E1198666230932BAd5db3DbBE21e7d57 and 0xA6dD…5545. At 23:39:33, the remaining 5,896.58 BNB in this branch arrived at 0x150889fe4fa7a7699588f75c4189fa9e721acfd3, where they remained in the snapshot. Initial outflow; receipt at the holding wallet.
The following graph shows how the swap addresses converge on the consolidation points. DEX, bridge, and exchange labels identify services involved in the transactions. Interaction with a service does not, by itself, establish the owner of a customer address.
Base. The collector 0x770b…63Ee received 1,555.318215225 ETH. The funds then passed through 0x469Ac1406dE92f82C0563477240a3627057425DC. On Ethereum, that address sent 1,541.51 ETH to 0xA6dD…5545. Initial transfer; receipt at the consolidation address.
Optimism. The initial outflow was 5,737.680149787 ETH. The collector then sent 5,737.67 ETH to 0x94A43df7687A8494948Be937400e9d5D33135DA0. In the reconstructed Ethereum portion of the route, several transfers to 0xA6dD…5545 totaled approximately 5,144 ETH. Initial transaction.
Avalanche. The collector received 821,011.971142467 AVAX and 8,204,678.8 USDC. Subsequent activity in this branch includes swaps and an interaction with 0x5085b3d52b5587c18EF456FcbcDe9A11d48340F8; on Ethereum, the same address sent 2,943.570538 ETH to 0xe410…d946. The matching address and coordinated sequence form part of the route reconstruction. Matching each individual cross-chain transaction conclusively would require an order ID or bridge message. AVAX outflow; USDC outflow.
BNB Chain. The initial 12,719.460681306 BNB passed through the collector and 0x7c96…3E1C. After interactions with LI.FI, KyberSwap, and other contracts, the funds moved through 0xe07Bd590E1198666230932BAd5db3DbBE21e7d57 and 0xA6dD…5545. At 23:39:33, the remaining 5,896.58 BNB in this branch arrived at 0x150889fe4fa7a7699588f75c4189fa9e721acfd3, where they remained in the snapshot. Initial outflow; receipt at the holding wallet.
The following graph shows how the swap addresses converge on the consolidation points. DEX, bridge, and exchange labels identify services involved in the transactions. Interaction with a service does not, by itself, establish the owner of a customer address.
Graph 1. Supplied analytical screenshot of the EVM branch. Turnover figures and dollar values shown on the address cards may cover each address's entire history. The incident-specific amounts in this report come from the transactions and balances cited in the text.
Where the bulk of the funds remained
Where the bulk of the funds remained
The central address 0xA6dD…5545 acted as a distribution point. After receiving large tranches, it sent ETH onward. By 03:35 UTC on September 25, most of the funds were in eight holding wallets: six held approximately 10,000 ETH each, while the other two held 4,596.47 and 3,213.45 ETH.
Ethereum address | ETH balance in the snapshot |
0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899 | 10,000.004731 |
0x600cfeDc6Bd65Fa79B604dC44964f419e45784b2 | 10,000.000700 |
0x9FA39d62095302431d7d4167a7E80F8Ec6eA4FA0 | 10,000.000231 |
0xFd5EBe912e2061992437767e24e5BCb52a3f9e54 | 10,000.000031 |
0xeD5a394a7558929112848B7e97B569de6bbE1A51 | 10,000.000010 |
0xA6BFd7FcaF4711dA1f61D5E91d03A2c7C72dB272 | 10,000.000000 |
0xDc2901f741B4003e32B8B752e97b8c4C1891dC63 | 4,596.471296 |
0x52f08Feb1B0Da609A5442514E2Bb43C99D25d284 | 3,213.450000 |
Total across eight holding wallets | 67,809.926999 |
The table rounds each balance to six decimal places; the total was calculated from the original balances. Small deposits from other sources after the main transfers account for the fractions of ETH above the round amounts. The entire balance therefore cannot automatically be treated as the exact amount lost in the incident.
An additional 170.466027 ETH remained at the intermediary address 0xe07Bd590E1198666230932BAd5db3DbBE21e7d57. Together with small balances at other mapped addresses, the Ethereum portion amounted to approximately 67,981.41 ETH. This figure includes the eight holding wallets listed above.
On BNB Chain, 0x150889fe4fa7a7699588f75c4189fa9e721acfd3 held 5,896.58 BNB. On TRON, TBWNguTTgezw9dVorX441C6nDrZpRxYwKD held 20,593,376.573718 TRX. No outgoing transfers from these two holding wallets appeared in the saved snapshot.
At the time of review, the EVM assets were concentrated in several large holding wallets. Most of the XRP also remained at its first-tier addresses. Tracing the small portion that had moved onward led to cross-chain swaps and addresses with their own transaction histories.
An additional 170.466027 ETH remained at the intermediary address 0xe07Bd590E1198666230932BAd5db3DbBE21e7d57. Together with small balances at other mapped addresses, the Ethereum portion amounted to approximately 67,981.41 ETH. This figure includes the eight holding wallets listed above.
On BNB Chain, 0x150889fe4fa7a7699588f75c4189fa9e721acfd3 held 5,896.58 BNB. On TRON, TBWNguTTgezw9dVorX441C6nDrZpRxYwKD held 20,593,376.573718 TRX. No outgoing transfers from these two holding wallets appeared in the saved snapshot.
At the time of review, the EVM assets were concentrated in several large holding wallets. Most of the XRP also remained at its first-tier addresses. Tracing the small portion that had moved onward led to cross-chain swaps and addresses with their own transaction histories.
XRP: five holding wallets and one active branch
XRP: five holding wallets and one active branch
Two wallets publicly labeled as Bitget sent three large payments to the hub rwNhefsz1UQEusxhCvHip3RANinWi4CTck. The total inflow was 102,976,680.091945 XRP.
The hub distributed the funds among five addresses. Four received 20 million XRP each; the fifth received about 22.98 million. Outgoing payments soon appeared at the first of these addresses.
First-tier XRP holding wallet | Balance on September 25 at 03:35 UTC |
rDRV9nLg8xbLsafKZnhNgWuE1TiSLE95hs | 19,612,012.414513 XRP |
r3UGfDM4ZyFSCzKH7TQEjgago9QoUJagtJ | 20,000,000.000010 XRP |
rH7oMFKBgdK99TPQctFVzddD7srRzyCqZn | 20,000,000.000010 XRP |
rwSjBrtxBC75TqZ5YvJ1TGfaRpQvVNsAKw | 20,000,000.000010 XRP |
r6NcwN3dR5ciyBv9XsLyMNc9Kg2FBCs7Y | 22,976,677.000010 XRP |
Together with the hub balance, these addresses held 102,588,692.506528 XRP. The difference from the initial inflow was about 388,000 XRP; a precise reconciliation must account for fees and small deposits from other sources.
Two tranches left rDRV…95hs for rhdAf73TPX45LmHeZqxzLMdtd44jrY2w3p: 19,205.928251 XRP at 23:03:21 and 308,580.133444 XRP at 23:04:10. Together, they amounted to 327,786.061695 XRP. First payment; second payment.
At 00:11:20 on September 25, that recipient sent 200 XRP to rHQMjheCWcuCzKofw6LTPHTZNcMeTxump3. Another 49,999 XRP from the same traced branch arrived there later. Cross-chain payments at the next stage led the investigation to an Ethereum address with an earlier transaction history. 200 XRP transfer.
Two tranches left rDRV…95hs for rhdAf73TPX45LmHeZqxzLMdtd44jrY2w3p: 19,205.928251 XRP at 23:03:21 and 308,580.133444 XRP at 23:04:10. Together, they amounted to 327,786.061695 XRP. First payment; second payment.
At 00:11:20 on September 25, that recipient sent 200 XRP to rHQMjheCWcuCzKofw6LTPHTZNcMeTxump3. Another 49,999 XRP from the same traced branch arrived there later. Cross-chain payments at the next stage led the investigation to an Ethereum address with an earlier transaction history. 200 XRP transfer.
How the XRP branch reached Ethereum
How the XRP branch reached Ethereum
The Ethereum recipient was 0xA0772d6E70D2c97CFB70628C7B00f666A6476feb. The order data is crucial to establishing this link: two XRP payments explicitly specify this EVM address in their memos.
Sent from rHQM…ump3 | XRP transaction with destination address | SwftSwap payout to 0xA077…6feb |
1,000 XRP | ||
2,000 XRP |
The XRP went to rM27yzkCw6WA3T4g1sPaeC1kpxHUhuxRWn; the Ethereum payouts were executed by contract 0xc1d13492285eb664951E201BF7C80c7c6318a1b5. For these two orders, the stated memo destination and subsequent payouts establish a 3,000 XRP → 1.704496 ETH link.
Two earlier payments of 100 and 98 XRP also left rHQM…ump3. Shortly afterward, the address labeled NEAR Intents, 0x2CfF890f0378a11913B6129B2E97417a2c302680, sent 0.056975498124795555 ETH and 0.056066898947350751 ETH to 0xA077…6feb. The timing and service route align, but the originating XRP payments do not contain an EVM destination address. These two pairs therefore remain probable matches. First ETH payout; second ETH payout.
The four Ethereum receipts totaled 1.817538397072146306 ETH. At 02:34:11, 0xA077…6feb sent 1.817514377824659306 ETH to 0x00154b473b0a4817dEf2dE1ec87aACA074b411A7. This is the last transfer in this branch covered by the supplied materials; the recipient's current balance is not established here. Transaction 0x63b9…89d3.
The 327,786 XRP represents the inflow to an intermediate branch. The documented orders cover only a small portion of it. It would be incorrect to equate that entire inflow with the 1.817538 ETH; accounting for the remainder requires further investigation.
Two earlier payments of 100 and 98 XRP also left rHQM…ump3. Shortly afterward, the address labeled NEAR Intents, 0x2CfF890f0378a11913B6129B2E97417a2c302680, sent 0.056975498124795555 ETH and 0.056066898947350751 ETH to 0xA077…6feb. The timing and service route align, but the originating XRP payments do not contain an EVM destination address. These two pairs therefore remain probable matches. First ETH payout; second ETH payout.
The four Ethereum receipts totaled 1.817538397072146306 ETH. At 02:34:11, 0xA077…6feb sent 1.817514377824659306 ETH to 0x00154b473b0a4817dEf2dE1ec87aACA074b411A7. This is the last transfer in this branch covered by the supplied materials; the recipient's current balance is not established here. Transaction 0x63b9…89d3.
The 327,786 XRP represents the inflow to an intermediate branch. The documented orders cover only a small portion of it. It would be incorrect to equate that entire inflow with the 1.817538 ETH; accounting for the remainder requires further investigation.
Payments to an exchange address
Payments to an exchange address
The history of the mixed-funds wallet rM27…xRWn includes payments to an address labeled Binance, rNxp4h8apvRis6mJf9Sh8C6iRxfrDWN7AV, with DestinationTag 460674891. One recorded payment was 10,000 XRP. The wallet also received other funds, so the share attributable to Bitget in this payment cannot be determined. The address and tag may help in a request for records from the service; they do not identify the exchange account holder. Transaction 2415…6E92.
What links this branch to the AFX exploit
What links this branch to the AFX exploit
The history of 0xA077…6feb predates the Bitget incident by months. On April 9, 2026, it sent 0.485791292434730422 ETH to 0xCbCfd64A96837D874943641fc9BA159C10d6CC80. Eight days earlier, the same recipient had received 0.58 ETH from 0x989CA8568c0C636cA9e062f8Ff0f74450E0A4Cc5. USDT was also transferred between the latter two addresses. April 9 payment; April 1 payment.
The next part of the link concerns the July 22, 2026 exploit of the AFX bridge. According to a separate reconstruction of that case, 24,150,000 USDC was withdrawn from the AFX USDC bridge on Arbitrum using five valid signatures from a set of seven hot validators. After CCTP transfers and swaps, approximately 12,467.44 ETH arrived at 0x627654B2782bfC57580ecD11d40869b350B6ebAC.
On July 25, some of that address's funds passed through two further wallets. The sender 0x989C…4Cc5, seen earlier in the chain of links, appeared at the second.
The next part of the link concerns the July 22, 2026 exploit of the AFX bridge. According to a separate reconstruction of that case, 24,150,000 USDC was withdrawn from the AFX USDC bridge on Arbitrum using five valid signatures from a set of seven hot validators. After CCTP transfers and swaps, approximately 12,467.44 ETH arrived at 0x627654B2782bfC57580ecD11d40869b350B6ebAC.
On July 25, some of that address's funds passed through two further wallets. The sender 0x989C…4Cc5, seen earlier in the chain of links, appeared at the second.
July 25, UTC | Transfer | Amount | Transaction |
07:24:47 | AFX holding wallet 0x6276…ebAC → 0x4Eed…9d39 | 313.365165 ETH | |
08:52:11 | 0x4Eed…9d39 → 0x1a58…F390 | 316.439486 ETH | |
09:07:35 | 0x989C…4Cc5 → 0x1a58…F390 | 0.015433789653264039 ETH |
The full addresses of the intermediary recipients are 0x4EedAd8cE8c6a5B20D7acbB1BCE92317311A9d39 and 0x1a587644C0fb5702a7F169692272F4844890F390. The second transfer exceeded the immediate inflow from the AFX holding wallet: it also drew on an additional balance. The small transfer from 0x989C…4Cc5 arrived between the recipient's swap transactions and is consistent with funding for gas.
This yields a dated chain of links: the Ethereum recipient in the September XRP branch had previously paid 0xCbCfd…CC80; that address had received ETH and USDT from 0x989C…4Cc5; and in July, 0x989C…4Cc5 funded gas for an address handling the AFX funds.
The transaction-level connection is established. It supports the possibility of shared settlement or operational infrastructure. The transfers presented here do not prove that all the addresses had the same controller, that assets taken in the two incidents were directly mixed, or that the participants belonged to any particular country. The April payment predates both incidents and provides a historical link between the addresses.
This yields a dated chain of links: the Ethereum recipient in the September XRP branch had previously paid 0xCbCfd…CC80; that address had received ETH and USDT from 0x989C…4Cc5; and in July, 0x989C…4Cc5 funded gas for an address handling the AFX funds.
The transaction-level connection is established. It supports the possibility of shared settlement or operational infrastructure. The transfers presented here do not prove that all the addresses had the same controller, that assets taken in the two incidents were directly mixed, or that the participants belonged to any particular country. The April payment predates both incidents and provides a historical link between the addresses.
How the linked addresses were funded
How the linked addresses were funded
Address 0x989CA8568c0C636cA9e062f8Ff0f74450E0A4Cc5 had existed since at least December 2025. Its funding sources include 0xffe15FF598e719d29DFe5E1d60BE1A5521A779Ae, publicly labeled as a HashKey Exchange hot wallet.
Date and time, UTC | Receipt at 0x989C…4Cc5 | Evidence |
April 1, 08:36:47 | 19,974.260250 USDT | |
April 1, 09:05:47 | 0.6062 ETH | |
April 9, 05:48:11 | 39,921.162160 USDT | |
April 18, 08:27:11 | 17,848.341000 USDT | |
April 20, 05:10:47 | 73,884.451000 USDT |
After these receipts, the address sent similar-sized USDT tranches to 0xCbCfd…CC80. This reveals the intermediary wallet's role in the payment flow. Other transactions took place between April and the July gas payment, so the specific 0.015433789653264039 ETH cannot be traced in full to a single April deposit. The HashKey label identifies the source of the payout; the exchange customer cannot be identified from the public transaction history.
Separate branch: preparations for the AFX exploit
Separate branch: preparations for the AFX exploit
The address that submitted the transaction creating the fraudulent AFX withdrawal was 0x32E3200D6E944cd9bD1C8C9865293B07206e7A01. At 15:20:39 on July 22, it received 0.20422872 ETH on Arbitrum from 0xe94667d85ae6050Dbb41E63109BC303759876cbA. Funding transaction.
At 19:48:04, 0x32E3…7A01 sent 0.1 ETH through MetaBridge. Seven seconds later, 0.099090274592921356 ETH arrived on Ethereum from Relay solver 0x370A7E2d300c14D79d4A7ee07aACA46c4B3012cF. The address then supplied 0.05 ETH each to 0x2f2974fAbc54dbA33442261211c06BD20E0FEefc on Arbitrum and Ethereum. That recipient subsequently received the withdrawn USDC and carried out a cross-chain transfer and swap. MetaBridge transfer; Relay payout.
The initial sender, 0xe946…6cbA, had a nonce of 7015 at the time of the payout and served many counterparties. That history is consistent with a multi-user payout wallet. Identifying the deposit corresponding specifically to the 0.20422872 ETH payout would require order or service records. The address's aggregate balance does not provide that match.
This branch explains how execution of the AFX transaction was funded. Its link to Bitget runs through the later settlement addresses described above; there is currently no basis for attributing all funds handled by the initial AFX sender to the Bitget case.
At 19:48:04, 0x32E3…7A01 sent 0.1 ETH through MetaBridge. Seven seconds later, 0.099090274592921356 ETH arrived on Ethereum from Relay solver 0x370A7E2d300c14D79d4A7ee07aACA46c4B3012cF. The address then supplied 0.05 ETH each to 0x2f2974fAbc54dbA33442261211c06BD20E0FEefc on Arbitrum and Ethereum. That recipient subsequently received the withdrawn USDC and carried out a cross-chain transfer and swap. MetaBridge transfer; Relay payout.
The initial sender, 0xe946…6cbA, had a nonce of 7015 at the time of the payout and served many counterparties. That history is consistent with a multi-user payout wallet. Identifying the deposit corresponding specifically to the 0.20422872 ETH payout would require order or service records. The address's aggregate balance does not provide that match.
This branch explains how execution of the AFX transaction was funded. Its link to Bitget runs through the later settlement addresses described above; there is currently no basis for attributing all funds handled by the initial AFX sender to the Bitget case.
The overall picture
The overall picture
In the first hours after the outflows, the operator moved assets through several swap and cross-chain routes. On Ethereum, the funds were concentrated in eight large holding wallets; BNB, TRX, and most of the XRP remained at separate addresses on their own networks. These addresses provide specific points to monitor for further movement.
The strongest historical link emerged in the small XRP branch. Two orders that explicitly name an Ethereum address in their memos allow 3,000 XRP to be traced with confidence to payouts at 0xA077…6feb. The recipient's history links it, through April transactions, to an address that funded gas for a wallet handling AFX funds in July. Establishing a common operator would require further evidence of control or records from the services involved.
Amounts are rounded and cross-chain routes simplified. The arrow from the 327,786 XRP branch shows the direction of further investigation: documented swap orders cover 3,000 XRP, while another 198 XRP is matched by timing and service. The historical AFX link concerns April and July. Balances in the lower section reflect the September 25 snapshot at 03:35 UTC.
The strongest historical link emerged in the small XRP branch. Two orders that explicitly name an Ethereum address in their memos allow 3,000 XRP to be traced with confidence to payouts at 0xA077…6feb. The recipient's history links it, through April transactions, to an address that funded gas for a wallet handling AFX funds in July. Establishing a common operator would require further evidence of control or records from the services involved.
Amounts are rounded and cross-chain routes simplified. The arrow from the 327,786 XRP branch shows the direction of further investigation: documented swap orders cover 3,000 XRP, while another 198 XRP is matched by timing and service. The historical AFX link concerns April and July. Balances in the lower section reflect the September 25 snapshot at 03:35 UTC.
