It depends entirely on where your share of the money went. There are four possible answers, and they are very different. The chart below shows how much of the stolen total is in each.
Five days of theft, then almost nothing. Every figure below is read from the Bitcoin blockchain.
Follow the ribbons left to right: from the victims, into the thieves’ collection addresses, to where each coin sits today. Widths are proportional to BTC.
Every time traced coins landed somewhere a freeze is possible. If you are a victim, these are the transaction IDs to put in your police report and to quote when you contact the exchange. Each links to the block explorer so anyone can verify it independently.
| Date | Service | Traced to this theft | Transaction |
|---|
Read the two amounts carefully. A transaction often moves other people’s money in the same batch. We show what the whole transaction moved and how much of it traces back to this theft — only the second number is the thief’s, and claiming the first would be wrong.
Newest first. Tiny amounts sent to these addresses are ignored — strangers spam famous wallets with dust, and that is not the thief moving anything.
| When | How much | What happened |
|---|
Every service the traced coins have reached. These are the places where a freeze is possible — if you are a victim, these names belong in your police report.
Which company an address belongs to comes from industry screening data. The behaviour beside each name — transaction counts, lifetime volume, the deposit itself — is measured by us directly from the blockchain, and you can verify every figure through the linked explorer.
| Service | Received (traced) | What it means for recovery |
|---|
—
Every address links to the Bitquery explorer so you can verify the balance yourself.
| Tier | Address | Balance BTC | UTXOs spent |
|---|
Confirmed means an independent source ties the address to this exploit. Attributed means a named entity whose on-chain activity matches that claim. Traced means we reached it from a confirmed address. Venue means a high-volume service the money passed through — the address is not the holder’s own and its balance is not stolen money. Reported means published by other researchers and not yet reproduced by us. Nothing is called attacker-controlled on our word alone.
—
| Largest single losses | BTC taken | Wallet had been untouched since |
|---|
The complete list of every wallet we traced is available as a spreadsheet further down, for researchers, exchanges and law enforcement. If you are a victim, you do not need it — check your own address privately below, and treat anyone who contacts you about your loss as a scammer until proven otherwise.
Everything on this page as spreadsheets, regenerated on every update. Open directly in Excel. Each file carries its own provenance header and the block it was compiled at.
If you run an exchange or a compliance desk: the attacker file is the one to screen deposits against. Read the classification column first — several rows are exchanges the funds passed through and must not be treated as attacker-controlled.
Paste a Bitcoin address to see whether it appears in the victim set we derived on-chain.
—
