The Same Wallets Were Refilled and Emptied Again in Four Seconds
Bitquery traced 3,488.6 SOL out of 20,776 Solana wallets. Two of them still hold almost all of it.
Bitquery traced the sweep to Solana: four runs pulled 3,488.6 SOL from 20,776 wallets, starting September 30 and running two and a half hours[1].
The keys stayed in use. One drained wallet took fresh deposits and was emptied again inside four seconds[2].
About 94% of the SOL still sat in two wallets on October 1[3]. That day, 100 SOL went through a forwarder to a KuCoin deposit address[4]. Another 91 SOL followed three hours later[4].
The attacker also closed nearly 93,000 token accounts and collected 189 SOL in rent[5].
What to do: do not send funds to a wallet the sweep already touched. The keys stayed in use, and the refill was gone in four seconds[2].
Who gains, who loses
Receipts
The main drain began on September 30 and affected 20,776 wallets, sweeping 3,488.6 SOL across four runs.
“The main sweep started early in the afternoon of September 30 and ran for two and a half hours.”
A drained TradeWiz wallet received new deposits after the sweep and was emptied again within four seconds.
“The keys stayed in use.”
Bitquery reported that approximately 94% of the SOL remained in two wallets as of October 1.
“Very little of it has gone anywhere.”
On October 1, 100 SOL was sent through a forwarder to a KuCoin deposit address, and another 91 SOL followed the same route three hours later.
“The first real cash-out came on October 1.”
The attacker later closed nearly 93,000 token accounts and recovered 189 SOL in rent.
“It went back through nearly 3,000 wallets and moved out the USDC, the USDT and a few hundred memecoins it found.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.