Figures as of 2026-10-06 08:30:22 UTC · block 970,147 · updated once a day
Tracked and written by Gaurav Agarwal at Bitquery. The figures are computed from chain data by our own pipeline each day, the text is drafted with AI help, and a person checks both before anything is published.
Still unmoved
1,295.89BTC
$100.6M
JUL 30 – AUG 3, four theft wavesNO NEW THEFT WAVE → 06 OCT
It depends entirely on where your share of the money went. There are six possible answers, and they are very different. The chart below shows how much of the stolen total is in each.
Still sitting, fully traceable
1,302.12 BTC · 72.8% · $101.0M
Parked in identified addresses that we and every major tracing firm watch. It cannot be sold through a compliant exchange without being flagged. If law enforcement ever identifies the holder, this portion is seizable. Large seizures years after a theft have happened before.
Do: file a police report and an IC3 complaint now, listing your address and the sweep transaction. Seized funds are returned to documented victims.
Reached an exchange
7.46 BTC · 0.4% · $579,229
Deposited at named services: Coinbase, Bullish, KuCoin, Bybit, ChangeNow among them. Exchanges hold identity records and freeze deposits when law enforcement asks. This is the portion with a real recovery path.
Do: name these services and the deposit transactions in your report. The full list is further down this page.
Secured by a rescuer, held for return
30.18 BTC · 1.7% · $2.3M
Swept out of victims’ addresses before the thief got to them, by someone who then set the coins aside to hand back. In one transaction the holder split 52.37 BTC into 478 outputs, one for each address it had emptied, each matching what that address lost. 30.18 BTC of that came from addresses in our set and 22.19 BTC from sweeps outside it. 20.00 BTC has since been paid back out of 13 of them, and whoever received it lost only the network fees. We stop following the money there, so no address a claimant is paid on ever appears on this page.
Do: keep your police report on file. Treat anyone who contacts you about giving your coins back as a scammer until you have checked them yourself. Nobody genuine asks for your seed phrase, your private key or a fee.
Swapped to Ethereum via THORChain
20.69 BTC · 1.2% · $1.6M
Converted to ether through THORChain, a cross-chain swap protocol with no company behind it, no accounts and no way to freeze a payment. Every swap announces itself on the Bitcoin side with a protocol memo naming the Ethereum address that receives the ether, so we know exactly where it landed and watch that address. Nothing can be frozen on Bitcoin; a recovery path opens only where that ether is eventually deposited. Since then, 660 ETH of it has gone into Tornado Cash, a mixer on Ethereum. That part is realistically gone.
Do: quote the swap transactions and the Ethereum address listed further down. Any exchange that later receives from that address can be asked to freeze.
We cannot say yet
292.40 BTC · 16.3% · $22.7M
Taken in parts of the theft whose destination addresses have never been published by anyone. This is not money we lost track of. It was never tracked. Our address set covers the waves that were documented publicly; the rest of the theft has not been mapped address-by-address, by us or by anybody else.
Do: if the check below says your address is not in our set, your coins are most likely in this slice. Report it anyway, and check back, because we add addresses as they are confirmed.
Through a mixer, realistically gone
136.42 BTC · 7.6% · $10.6M
Run through CoinJoin rounds that blend hundreds of people’s coins. Tracing beyond this point is speculative, and no freeze is possible. Honesty matters more than hope here: this slice is unlikely to come back.
Do: still report it. Amounts entering a mixer remain evidence in the wider case.
Anyone who contacts you offering to recover your bitcoin for a fee is a scammer
No exception. Victims of this exploit are being targeted a second time by fake “recovery agents”. Recovery only happens through law enforcement and the exchanges themselves.
What happened, step by step
Five days of theft, then almost nothing. Every figure below is read from the Bitcoin blockchain.
Prefer the story to the balances? Read the full investigation, the narrative account of how the exploit worked and how the money was moved. Its figures are frozen at 7 August 2026 and cover a narrower address set than this page, which keeps updating.
30 July
The theft starts. In about 40 minutes 1,196 wallets are emptied of 1,082.65 BTC. Most had been sitting untouched for years. The typical victim wallet had not moved in over three years.
Blocks 960,183–960,191 · a single sweep, paying 30 sat/vB
31 July – 3 August
Three more waves follow. By the 3rd the total reaches 1,789.28 BTC across 8,865 wallets, worth about $114.7M at the prices of the day.
Wave totals credited to Galaxy Research
2–7 August
The thieves try the exits. Roughly 7.46 BTC reaches Unnamed high-volume service, ChangeNow, KuCoin, Quidax and other services. That is 0.4% of everything taken, a rounding error against the pile. Another 64.90 BTC goes through CoinJoin mixers instead.
0.24 BTC is swapped to ether through THORChain, a swap protocol with no one who can freeze anything. The ether lands at one Ethereum address, which we watch alongside the bitcoin.
2 swap transactions · 0x6A08B5B2…
7 August
30.18 BTC is moved out of one collecting address into a fresh one. It sat there until 21 September.
Address bc1qez89sph5tg…
19 August
1.05 BTC leaves one of the parked addresses and is run through a CoinJoin mixer the next day, a trivial sum against what is still sitting.
One CoinJoin round
2 September – 3 September
20.45 BTC is swapped to ether through THORChain, a swap protocol with no one who can freeze anything. The ether lands at 2 Ethereum addresses, which we watch alongside the bitcoin.
34 swap transactions · 0x160a7A4c…, 0x8B5b6500…
5 September – 7 September
70.26 BTC goes through 2 CoinJoin rounds, where it is blended with hundreds of other people's coins. That money is realistically gone.
The 30.18 BTC taken in that sweep turns out not to be in the thief’s hands. In one transaction it is split, together with 22.19 BTC swept from addresses outside our set, into 478 outputs, one for each address it was taken from, each matching what that address lost. 20.00 BTC has since gone back out of 13 of them, and only the network fee was taken.
tx 38b524ccb8ca260e… · block 967,948
Today
1,302.12 BTC, about $101.0M, has not been cashed out, mixed or swapped. It sits at addresses we watch. Nothing has reached an exchange for 63 days. The single largest pile, 562.02 BTC ($43.6M), has never been touched at all.
Read from block 970,147
Where the stolen bitcoin is now, and what we cannot account for
Follow the ribbons left to right: from the victims, into the thieves’ collection addresses, to where each coin sits today. Widths are proportional to BTC.
The transactions you can actually act on
Every time traced coins landed somewhere a freeze is possible. If you are a victim, these are the transaction IDs to put in your police report and to quote when you contact the exchange. Each links to the block explorer so anyone can verify it independently. Open a trail to see every step, with amounts in BTC: they shrink along the way because the coins are mixed with other people’s money at each hop.
Only 0.01 of what finally arrived traces back to this theft.
2 further movements are deliberately not listed here. They reached services too, but the addresses they came from were funded only by wallets that predate the exploit, and the amounts passed through unchanged, the signature of an owner moving their own coins to safety after the news broke, not a thief cashing out. Calling those a cash-out would smear both a victim and an exchange, so we leave them out until they can be resolved.
Converted to ether through THORChain: nothing to freeze on Bitcoin
20.69 BTC of the traced coins was converted to ether through THORChain in 36 swaps, landing at the Ethereum address 0x160a7A4c067B084F03400c6980Ac29F73F6782f6, which holds 0 ETH as of 2026-10-06 07:55 UTC. Each Bitcoin transaction below carries THORChain's own memo naming that destination, so the link is the protocol's, not our inference. No exchange holds these coins.
On Ethereum since then:649 ETH in 73 transactions to TornadoCash eth0x47CE0C6e…, 5 ETH in 1 transaction to 0x9dD14d97…, 0.48 ETH in 1 transaction to 0x8d0079D0… (0 ETH left, checked 2026-10-06 07:55 UTC). 649 ETH went into Tornado Cash, a mixer on Ethereum, which is the same dead end as a CoinJoin on Bitcoin: realistically gone.
Read the two amounts carefully. A transaction often moves other people’s money in the same batch. We show what the whole transaction moved and how much of it traces back to this theft. Only the second number is the thief’s, and claiming the first would be wrong.
Every time the money moved
Newest first. Tiny amounts sent to these addresses are ignored: strangers spam famous wallets with dust, and that is not the thief moving anything.
When
How much (BTC)
What happened
2 Oct
4 days ago
6.23
$483,123
From a holding address one step removed from the theft. Moved into a fresh address. It is still sitting there, unspent.
Split by the holder into one output per address it had emptied, each matching what that address lost. We do not print those outputs: each one names a victim.
block 967,948 · split into one output per swept address
7 Sep
29 days ago
54.78
$4.3M
Went into a CoinJoin mixing round, where it was combined with hundreds of other people's coins. The trail cannot be followed past this point.
Paid into a THORChain vault and swapped to ether. The protocol memo on the transaction names the Ethereum address that received it; nothing can be frozen on the Bitcoin side.
Paid into a THORChain vault and swapped to ether. The protocol memo on the transaction names the Ethereum address that received it; nothing can be frozen on the Bitcoin side.
Every service the traced coins have reached. These are the places where a freeze is possible. If you are a victim, these names belong in your police report.
Which company an address belongs to comes from industry screening data. The behaviour beside each name (transaction counts, lifetime volume, the deposit itself) is measured by us directly from the blockchain, and you can verify every figure through the linked explorer.
Confirmed means an independent source ties the address to this exploit. Attributed means a named entity whose on-chain activity matches that claim. Traced means we reached it from a confirmed address. Venue means a high-volume service the money passed through: the address is not the holder’s own and its balance is not stolen money. Reported means published by other researchers and not yet reproduced by us. Nothing is called attacker-controlled on our word alone.
The victims
8,865 wallets were drained. The typical victim lost 0.0152 BTC (about $1,179), and the typical wallet had been sitting untouched for over three years, long-term savings, not trading money.
The complete list of every wallet we traced is available as a spreadsheet further down, for researchers, exchanges and law enforcement. If you are a victim, you do not need it. Check your own address privately below, and treat anyone who contacts you about your loss as a scammer until proven otherwise.
Take the data
Everything on this page as spreadsheets, regenerated on every update. Open directly in Excel. Each file carries its own provenance header and the block it was compiled at.
If you run an exchange or a compliance desk: the attacker file is the one to screen deposits against. Read the classification column first. Several rows are exchanges the funds passed through and must not be treated as attacker-controlled.
Check an address
Paste a Bitcoin address to see whether it appears in the victim set we derived on-chain.
Derived independently by walking back from the attacker addresses: 4,718 victim addresses holding 1,479.00 BTC. That accounts for 99.51% of everything our watched addresses took in, but only 53.2% of the addresses Galaxy Research counts. We do not cover the whole theft, and we would rather say so than imply otherwise.
Checked entirely in your browser. The address never leaves this page and nothing is logged.
Never enter a seed phrase, private key, or xpub
This tool accepts a public Bitcoin address and nothing else. Any site asking for your recovery words is stealing from you, including one that looks like this.
