ACTFUN's exposed key: where 591 million ACT went

01 — DisclosureWhat ACTFUN said

ACTFUN posted a security update on Wednesday. It said a private key used during setup had been exposed and let someone access linked wallets and funds. Claims were paused while the team checked code control, admin rights, treasury wallets and payout code.

The notice did not publish incident tx hashes or a loss total. It also said the full scope was still being worked out. That leaves one task for the chain record: find the proved moves without filling the gaps with guesses.

02 — First movesThree ACTFUN contracts emptied

The live ACTFUN app names a fixed claim address, a Genesis NFT claim address and a sale registry. Within thirteen seconds, each sent its full ACT balance to 0x08235e…8009, which the same app names as its launch admin wallet.

All three source balances became zero. The wallet later sent ten million ACT to 0x83c3d4…45bcb. That address still held the full amount at our cut-off and had sent no ACT onward.

These moves line up in time and scope with ACTFUN's notice. ACTFUN has not named them as the illicit txs, so that link is reasoned from the timing and live app data.

03 — Sale checkWas the ACT sold?

No direct ACT swap has the admin wallet or the ten million ACT receiver as its tx sender in our Arc DEX records. The second wallet did not send its ACT anywhere.

The admin wallet did place ACT and USDC into a market pool. It added funds, let other wallets trade against them, then took funds out in two cycles. The exact in and out sums sit below.

The pool share shifted toward USDC as other wallets traded. Once ACT entered the pool, it mixed with every trader's funds. The record can measure that shift. It cannot say how much ACT from the key wallet was sold.

04 — Cross-chain exit$50,178 left Arc

Two Relay routes moved USDC from Arc and paid ETH to the same address on Base. The match uses Relay's request log and both chains' send data. The exact sums and input-to-output map are in the flow card and audit file.

Nearly all the ETH reached 0x9eE203…296e, once through 0xB2b10a…1BaB and once by a direct send. Only dust stayed at the first Base wallet.

Confirmed cross-chain pathArc → Base → BNB Chain

One branch sold ETH for USDC, crossed through LI.FI and paid USDT on BNB Chain. The target address had no USDT outflow at the cut-off. The flow card gives each exact amount.

A second branch also sold ETH for USDC. Its full USDC output stayed at the Base address. A much smaller branch split again: most stayed parked, some entered a busy wallet where funds mixed, and a small part returned to Arc. We stop at the busy wallet because no later send can be tied to this flow without a rule for which funds left first.

05 — The $1M claimDoes the evidence show more than $1 million stolen?

The traced flow does not support that number yet. Even at the highest ACT/USDC price in our window, the marked value of all ACT moved from the three source wallets stayed below one million dollars.

The later USDC route cannot simply be added. Some of that value came from the same pool share, so the sum would count part of the flow twice. ACTFUN may find other affected assets, but they are outside the proof mapped here.

06 — Current stateWhere the funds sat at the snapshot

At the cut-off, most of the ACT still sat in the admin wallet. The second ACT wallet had not moved its share. On Base, the main later wallet still held most of its ETH. The two sale paths ended in USDC on Base and USDT on BNB Chain.

No identity claim is made for any later wallet. A transaction proves control of a key at that moment. It does not prove a person's name, intent or link to ACTFUN.

07 — AuditHow we checked the trace

We queried Bitquery's own live clusters for Arc data, Base and BNB Chain. We checked sends against state balances, matched inputs to outputs across chains, and searched DEX trades by tx sender. Frozen rows and exact sums are kept with the article.

The audit found one event log trap. Six ACT events from the pool to the wallet did not change the wallet's state balance. Final holdings use state balances. Flow sums use sends whose state changes matched.

This trace follows fund tracing rules: value is tracked in order, a pool is treated as a mixing point, and a busy wallet ends naming. Address labels help name services. They do not turn an unknown wallet into a named person.

Readers can repeat the method with Bitquery's chain data lake or query the same chains through the Bitquery MCP server.

08 — EvidenceKey transaction hashes