Tracked Addresses
Every address in the flagged network. Click any address to view it on IOTAScan. Connections are based on on-chain transaction analysis. Addresses marked Unverified have external senders not yet confirmed.
Affected Wallets
337,539 IOTA moved across multiple transactions: 332,472 IOTA in main drain (Sep 17), +4,084 IOTA unstaked via Swirl Protocol (Sep 22), +983 IOTA remaining balance drained (Nov 4). All funds routed through flagged addresses to aggregator, then to KuCoin and Binance.
Reported ~6,000 IOTA moved. On-chain tracing confirmed 3,055.52 IOTA routed to same aggregator as Case #1.
~46,500 IOTA drained ~5 Mar 2026 (traced publicly by IF mods). Source 0x41ef → relay 0xae45 → main aggregator. Source and relay both verified 0 balance on-chain 2026-06-29.
PROVISIONAL amount. Forensic trace (victim's team, Book1.xlsx) attributed 943,615 IOTA to this victim across two main-aggregator outputs (50,167 → Binance feeder; 893,448 → Cream/Ankr/TokenLabs staking via 0xef45), both flagged 'comingled funds from different sources'. The origin wallet 0xe66d drained ~4.36M total on 3-4 Jun 2026, but ~3.25M of that went direct to KuCoin with no client attribution, so it is NOT counted here pending victim confirmation that 0xe66d is solely their wallet. Origin + relays verified 0 balance on-chain 2026-06-29.
These are individually confirmed cases. See all 726+ likely affected addresses →
Subject (Level 1)
Split Addresses (Level 2)
marsbars (Case #3) funds passed through here to the main aggregator.
BryGuy (Case #4) → main aggregator.
BryGuy (Case #4) → main aggregator.
BryGuy (Case #4) → KuCoin hot wallet (direct).
BryGuy (Case #4) → sub-relays 0x5e03/0xae47/0xe373.
BryGuy (Case #4) → main aggregator.
BryGuy (Case #4) → KuCoin hot wallet (direct).
BryGuy (Case #4) → main aggregator.
Aggregators & Feeders
ACTIVE — routing. 14.8M total processed. Only 4 cases human-confirmed; others inferred by on-chain heuristics.⚠️ 26 wallets (3.3M IOTA) drained in exact round amounts (125k/100k/200k) on Sep 8 2025 — see docs/WHALE_CONCERN.md. Scoring cannot distinguish theft from whale exit.
Receives 114K from L2-Split-1. Part of the network's own fund path, NOT an independent aggregator.
9.0M IOTA → Binance (83 txs)
Downstream from main aggregator. Receives FROM it, forwards 997K → KuCoin. Not an independent collector.
Downstream from main aggregator. Receives FROM it (692K). 0 external senders.
Downstream from main aggregator. Received 448K — most funds appear staked/locked with validators.
Downstream from main aggregator. Distributes tiny amounts (avg 2.7 IOTA) to 1,852 addresses — airdrop/dust pattern.
Downstream from main aggregator. Distributes to 513 addresses. 2 unknown external senders (⚠️ unverified).
KuCoin Feeders
Receives from KuCoin Passthrough and distributes to KuCoin Feeders below.
Forwards funds to KuCoin exchange. Fully drained.
Forwards funds to KuCoin exchange. Fully drained.
Forwards funds to KuCoin exchange. Fully drained.
Downstream from aggregator. Sends 997K → KuCoin directly and via intermediary chain.
Exchange Hot Wallets (monitored)
Distributors & Stakers
58K IOTA from aggregator, discovered Feb 17
300K IOTA from aggregator, 250+ txs — staking/validator node
Received ~1.13M from main aggregator (BryGuy/Case #4), staked to Cream/Ankr/TokenLabs validators. Still holds ~37K IOTA staked (verified on-chain 2026-06-29).
Staking
399K IOTA routed here from aggregator — nearly all staked with validators (4 liquid)