Preliminary investigation, 15 October 2026. This write-up shows what Hornet surfaces on the NEAR Intents exploiter address two weeks after the theft, how a single graph follows the funds across four networks, and, just as important, where the evidence stops being proof and becomes a lead. Investigators should read the confidence table at the end before quoting anything from the middle.
The incident in one paragraph
On 1 October 2026 the HOT Bridge treasury behind NEAR Intents paid out roughly 3.865 million USDT on BNB Smart Chain in five transactions to an address it should never have paid. CertiK attributed that address publicly:
0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
Bitquery's follow-up the same day traced about 34.69 BTC sitting in four Bitcoin wallets linked to the theft and roughly $802,000 deposited to KuCoin. Those three facts, the address, the BTC and the exchange deposits, are the externally corroborated baseline. Everything below builds on them.
One address, two chains: the first thing Hornet gets right
An EVM address is the same string on every EVM network, but its history is not. Hornet keeps the chains apart:
| Chain | Transactions seen by Hornet | Role |
|---|---|---|
| BNB Smart Chain | 443 | the exploit payout and first dispersal |
| Ethereum | 77 | later consolidation and laundering, 1 to 11 October |
The screenshot above is the Ethereum view. Opening the same address with the chain set to BSC shows the 443-transaction history where the USDT landed. In a report, always state which chain a figure comes from. The exploit is a BSC event; the fan-out we follow next is Ethereum.
Risk in two layers: intelligence tags and the model
Hornet scores the address 99.98 on the experimental ML model and, separately, the deep analysis finds four intelligence categories on its counterparties: stolen funds, scam/fraud, high risk and flagged wallet.
These are two different kinds of evidence and we show them separately on purpose. The tags come from sourced intelligence (a feed, a published attribution, a case) and are defensible in a report. The model score is behavioural: it reacted to funds moving fast with no retention. It is excellent for triage and must not be cited as attribution. The outflow table in the same view is the bridge between the two: 101.68 ETH left for a wallet that already carried all four tags.
The cross-chain graph
Read left to right. Every edge carries an amount and a date taken from chain data; every node icon says which network it lives on.
- Fan-out, 1 October. From the exploiter address, ETH leaves in a burst to five fresh wallets: 2, 49.69, 43.98 and 32 ETH on the visible branches. Round-ish amounts into fresh addresses within minutes is the classic layering opener.
- Re-aggregation. Three of those branches feed
0xf5e1...f62bccwith 49.69, 48.02 and 47.60 ETH, and two more wallets pass 50 ETH each through0xccf1...2d557eand0x72ac...b6286f. Note the amounts do not match hop by hop. 43.98 ETH in, 48.02 ETH out means that wallet received something else as well. The graph shows connectivity; it does not yet prove that every wei on the far side is exploit proceeds. - Two weeks of silence, then volume. On 14 and 15 October the aggregation wallet moves 411.75 ETH and 310.30 ETH onward, to
0xd779...67e3c8and0x602b...59b2cb. That is far more than entered from the exploiter on 1 October, so other inflows joined the pool. Those two transfers are the most valuable new leads in the dataset: they are recent, large and headed somewhere. - Into a bridge. From
0xde85...576b1c, 21.84 ETH goes to the THORChain router. Hornet labels the router with its own entity and the chain pair it bridges, ETH to BTC, and the graph continues on the Bitcoin side instead of stopping at the bridge. This is the step that single-chain tools cannot draw. - Bitcoin side. After THORChain the funds appear as BTC in wallets Hornet classifies as mule wallets, and 41.37 BTC lands at
bc1q9w...3ey9tz, an address already carried in Hornet's intelligence under an unattributed ransomware cluster. Hornet's export also carries 34.59 BTC and 33.59 BTC edges on 14 and 15 October. Bitquery's 1 October figure was 34.69 BTC. The numbers are close enough to ask whether this is the same coin moving again, and far enough apart that we say "ask", not "is". - Token contracts on the right edge. USDC, USDT and Wrapped Bitcoin nodes at 0.00 ETH are contract interactions, not value transfers; Hornet draws them because token movements through those contracts are part of the story, but the amounts shown are the ETH leg, which is zero.
The Tornado Cash lead
A separate branch of the same graph, not in the crop above, shows 100 ETH moving from 0xa473e...12a866a to 0xd90e2f92...324f31b on 15 October. Hornet's entity attribution for that destination is tornado.cash: router, and the address is indeed the public Tornado Cash Router contract. If the full transaction hash confirms the deposit, this is a mixer hop two weeks after the incident, which none of the published incident reports mention.
We are not calling it confirmed yet. The checklist before we would: the full transaction hash, the chain, the destination contract call, the timestamp, and a provenance chain from the 1 October payout to the 100 ETH. Hornet gives us every hop to walk; walking it is the work of a report, not a screenshot.
What this case says about cross-chain tracing
- Chain context is evidence. The same address has 443 transactions on BSC and 77 on Ethereum. A tool that merges them produces numbers nobody can defend in court. Hornet keeps them separate and labels every node with its network.
- Bridges are nodes, not dead ends. The THORChain hop is drawn as an entity with its ETH and BTC legs, and the trace continues on Bitcoin with the same case graph, export and tags.
- Tags and model scores are different claims. Sourced intelligence and behavioural scoring are shown side by side so an investigator can cite the first and use the second to decide where to look next.
- Amounts that do not reconcile are findings too. 43.98 in and 48.02 out is not a rounding error. It tells you another inflow exists and that proportional taint tracking, not single-path reading, is required for an asset-recovery figure.
Confidence table
| Conclusion | Assessment |
|---|---|
0x09fd...b3ad37 received the NEAR Intents payout on BSC |
High: independently corroborated (CertiK) |
| Hornet rates the address as high risk with sourced stolen-funds tags | Confirmed in the platform |
| The 1 October Ethereum fan-out and 14 to 15 October consolidation transactions occurred | Chain data; amounts do not reconcile hop by hop, so not a single-asset trail yet |
| 21.84 ETH entered THORChain and continued as BTC | Chain data plus router attribution; destination clustering is a lead |
| 41.37 BTC reached a ransomware-linked cluster | Hornet intelligence tag; needs the tag's source cited in any report |
| 100 ETH Tornado Cash deposit on 15 October | Unverified lead, router attribution is correct |
| Current location or recoverability of the $3.865M | Not established |
Next steps we are taking
- Pull the full transaction hash of the 100 ETH router transfer and publish it with the verified chain and timestamp.
- Reconcile the 14 to 15 October BTC edges (34.59, 33.59, 41.37 BTC) against Bitquery's four wallets to decide whether this is the same 34.69 BTC moving on or new coin.
- Produce a chain-of-custody report in Hornet for the Ethereum consolidation wallet, with proportional taint from the 1 October payout, so the 411.75 and 310.30 ETH transfers get an attributable share.
If you are working this case at an exchange, a bridge or an agency and want the live graph rather than screenshots, write to legal@hornet.technology.
Sources outside Hornet: CertiK's attribution of the exploiter address and the five BSC payouts; Bitquery's 1 October tracing of 34.69 BTC and about $802,000 to KuCoin. Hornet data as of 15 October 2026, 16:30 IST.