$822,000 of Stolen BNB Left by Seven Doors, One of Them Its Own Swap Desk
Bitquery counted seven routes off BNB Chain. About $822,000 of the loot went through NEAR Intents' own swap service.
Bitquery traced the stolen USDT off BNB Chain by seven routes: 805 BNB over the MetaMask Bridge, 800 BNB to an address behaving as a KuCoin deposit, 120 BNB to Arbitrum through LI.FI, 120 BNB to Hyperliquid[1]. 70 ETH reached three more KuCoin deposit addresses on Ethereum[2].
An hour in, 120 BNB was bridged to Arbitrum as USDC and spent on the XMR1 spot token; 165.3 XMR1 still sat on Hyperliquid[3][4].
Bitquery reported about $822,000 of the loot, roughly a fifth, went through NEAR Intents’ own swap service, including 750 BNB paid to the vault being drained[5].
What to do: no action needed — Bitquery says the remaining 165.3 XMR1 still sits untouched on Hyperliquid[4].
Who gains, who loses
Receipts
Bitquery reported that the stolen USDT left BNB Chain through seven routes, including 805 BNB through the MetaMask Bridge, 800 BNB to a KuCoin deposit, 120 BNB through LI.FI to Arbitrum, and 120 BNB to Hyperliquid.
“From those wallets the money left BNB Chain by 7 doors.”
Bitquery reported that 800 BNB was sent to a BNB Chain address behaving as a KuCoin deposit address, while 70 ETH reached three additional KuCoin deposit addresses on Ethereum.
“Yes. 800 BNB went to a deposit address on BNB Chain that sweeps into KuCoin's wallets, and 70 ETH reached 3 more KuCoin deposit addresses on Ethereum through other wallets.”
Bitquery reported that 120 BNB was bridged to Arbitrum as USDC and then sent through Hyperliquid, where it was spent on the XMR1 spot-market token.
“An hour into the theft, before any of the Bitcoin swaps, 120 BNB was swapped and bridged to Arbitrum as USDC.”
Bitquery reported that 165.3 XMR1 remained in the Hyperliquid account when it last checked.
“When we last checked, 165.3 XMR1 was still sitting in the Hyperliquid account, untouched.”
Bitquery reported that approximately $822,000 of the stolen funds was swapped through NEAR Intents itself, including 750 BNB paid to the vault being drained.
“Add it up and about $822k of the loot, roughly a fifth, was handled by NEAR Intents' own swap service.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.