On 10 July 2026, an early Solana wallet tied to the genesis distribution was drained of about 181K SOL (~$14M). ZachXBT, working with Specter Investigations, has now flagged the irregular unstaking and bridging behind it. The attacker crossed from Solana to Ethereum to cover their tracks. Following the money across that boundary is where most investigations stall, so we traced the case with Hornet.
The victim
HwtbQBNnLERakdUDuCCLWmUs2oETLFQZeHUWeQdPads was a long-held wallet. Its history goes back to 2024, with staking inflows and small token airdrops (STEAK, PFSHRK). Nothing in it suggests the owner was preparing to move funds.
Four and a half hours on Solana
All times are UTC on 10 July 2026.
| Time | What happened |
|---|---|
| 06:57–07:53 | 181,026 SOL drained from the victim to Ffd1oB… in 7 transfers, after two 1-SOL test sends |
| 07:15–07:28 | Ffd1oB swaps ~13K SOL to USDC on Jupiter and bridges each swap to Ethereum through Mayan |
| 09:20–10:43 | The remaining 168K SOL moves to a second wallet, 653pnn… |
| 09:21–11:17 | ~41 Jupiter swaps of 3–6K SOL each, all bridged out: Mayan (~128K SOL), Relay (34K SOL) and deBridge (5K SOL) |
By 11:26 the Solana wallets were empty. There was nothing left for a stablecoin issuer to freeze.
Laundering on Ethereum
- Bridged ETH collects in one wallet. It arrives at
0xD66E…and moves on to a hub,0xAa5c…, which received 7,345 ETH. - The hub splits the funds within hours.
- About 5,100 ETH goes to Railgun.
- About 1,100 ETH goes to Tornado Cash through
0xbf11…. - About 1,100 ETH stays in
0x536B…for two months, then reaches Tornado Cash through three fresh wallets on 9–17 September.
- A second Mayan route lands at
0x124b…. It carries 573 ETH, which reaches Tornado Cash through0x5D73…on 12 July. - Funds still held: dust only, under $1K in total across every attacker address.
Following the money across the bridge
Most tools trace inside a single chain, so a bridge is a dead end. An investigator then has to work out the destination chain, find the matching transaction by hand, and start a second investigation.
Hornet traces Solana and Ethereum in the same case. In this case:
- Solana side: Hornet traced the victim and the theft wallet.
- The Mayan route: Hornet followed it from Solana into Ethereum.
- Ethereum side: Hornet followed the funds to Tornado Cash.
- The rest: we matched the other bridge orders (Mayan, Relay and deBridge) to their Ethereum fills using the bridges' own order data. That is how we found the main 7,345 ETH hub.
Cross-chain work also means knowing what not to tag. Bridge escrow accounts, DEX pool vaults and solver wallets sit right in the flow but belong to the protocols, not the thief. So do the 1-gwei address-poisoning lookalikes that swarm the attacker's wallets. Tagging them would put innocent infrastructure on watchlists.
What it tells investigators
- Stablecoins are the window, and it closes fast. The attacker swapped and bridged every USDC within four and a half hours. A freeze request has to be made the same day.
- Bridges are the choke point, not the dead end. Attackers bridge because they expect the trail to break there. Bridge order data turns the bridge into evidence.
- Patience is part of the playbook. About 1,100 ETH sat untouched for two months before it moved. Long-term monitoring of tagged wallets is what catches that.
- Mixers aren't the end of the trail. Tornado and Railgun deposits of this size, made within narrow time windows, are often traceable to withdrawals by timing and amount.
Addresses
Hornet is adding these addresses to its intelligence feed as stolen funds:
- Solana:
Ffd1oB2aYM5UzMYUM7TmxULDRQb6KzgrBwmgj9U1C2bE,653pnn5fzF51FfotBwxua55Es4QXxTdaXJLbPczVmswp - Ethereum hubs:
0xd66e7f945672381193525f0a3f34aa0789b13cd3,0xaa5cfa4e96dda0f9aa30f4dc948b542a9b5817c6,0x124bc160ef2d2eb3851683d78412e0e5c35002b1,0x5d73e47308362228fbf23372dea225a7d5b6d506 - Mixer feeders:
0xbf11bdfbeb9ed137c352c81e45d191cacae6b0cf,0x536b4ee7507c41143e1b0bd1bf3f2b84be404836and 10 more downstream wallets
Exchanges and VASPs screening against Hornet will see them flagged. If you receive deposits from them, contact us.
Hornet Technology builds blockchain forensics for law enforcement and compliance teams. Credit to ZachXBT and Specter Investigations for the original disclosure. Request a demo.