Cabal Desk
Search
Wallets No. 000287

79thVault Gets $11 Million Back, With Two Rates for How Much Is Back

The loss was listed at 16,249 BNB; a separate count says 17,881.

Illustration: 79thVault Gets $11 Million Back, With Two Rates for How Much Is Back

79thVault got its BNB back; the coins were worth about $11 million at the time of the return, per TokenPost[1]. The loss was first put at 16,249 BNB, so the money back is about 92 percent of that[2]. A separate on-chain count put the total at 17,881 BNB, which would make the money back near 84 percent[3]. No wallet label is attached to any of it.

Who ran the theft and where the rest sits has not been shown[4]. Coldcard said a post with a phishing link “was published from this account. It has since been deleted.”[5]

What to do: no action needed — Coldcard says no money lost has been tied to the October 11 phishing try[6].

Who gains, who loses

$11 million back against a listed 16,249 BNB loss holders get one rate near 92 percent and another near 84 percent[2][3]
Who ran it and where the rest sits unshown the coins came back, the name did not[4]
A phishing post from Coldcard's own account, since deleted, no money lost nobody holds a supported approval to revoke from it[5][6]

Receipts

[1]

TokenPost reported that 79thVault’s recovered BNB was worth about $11 million at the time of return.

“The recovered BNB was worth about $11 million at the time of the return.”

[2]

TokenPost reported that the initial loss was listed as 16,249 BNB and that the recovery represented roughly 92% of that amount.

“The initial loss was listed as 16,249 BNB, making the recovery roughly 92% of that amount.”

[3]

TokenPost reported that separate on-chain accounting identified 17,881 BNB in total proceeds, leaving the final recovery percentage unsettled.

“A separate on-chain accounting identified 17,881 BNB in total proceeds, which would place the recovery rate near 84%.”

[4]

TokenPost reported that the attacker’s identity and the status of the remaining funds had not been established.

“The attacker’s identity and the status of the remaining funds have not been established.”

[5]

Coldcard said a phishing post had appeared on its official X account and that it had been deleted.

“We are investigating how a post containing a phishing link was published from this account. It has since been deleted.”

[6]

Coldcard said no confirmed financial losses had been attributed specifically to the October 11 phishing attempt.

“No confirmed financial losses have been attributed specifically to Sunday’s phishing attempt.”

Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.