Affected Addresses
Individually confirmed cases and algorithmically identified affected wallets. Every connection is proven by on-chain transactions flowing to the same aggregator address.
Confirmed Cases
337,539 IOTA moved across multiple transactions: 332,472 IOTA in main drain (Sep 17), +4,084 IOTA unstaked via Swirl Protocol (Sep 22), +983 IOTA remaining balance drained (Nov 4). All funds routed through flagged addresses to aggregator, then to KuCoin and Binance.
Reported ~6,000 IOTA moved. On-chain tracing confirmed 3,055.52 IOTA routed to same aggregator as Case #1.
~46,500 IOTA drained ~5 Mar 2026 (traced publicly by IF mods). Source 0x41ef → relay 0xae45 → main aggregator. Source and relay both verified 0 balance on-chain 2026-06-29.
PROVISIONAL amount. Forensic trace (victim's team, Book1.xlsx) attributed 943,615 IOTA to this victim across two main-aggregator outputs (50,167 → Binance feeder; 893,448 → Cream/Ankr/TokenLabs staking via 0xef45), both flagged 'comingled funds from different sources'. The origin wallet 0xe66d drained ~4.36M total on 3-4 Jun 2026, but ~3.25M of that went direct to KuCoin with no client attribution, so it is NOT counted here pending victim confirmation that 0xe66d is solely their wallet. Origin + relays verified 0 balance on-chain 2026-06-29.
Community Reports
How Are the 726+ Affected Addresses Identified?
Every address that sent funds to a known aggregator wallet is scored 0–100 based on four suspicious movement indicators:
Why these criteria?
Balance drained (+30) — The strongest signal. Legitimate senders keep a working balance; a near-zero balance means the wallet was emptied.
Single large outflow (+25) — Funds swept in one transaction. If the largest outflow exceeds 80% of total, it points to an unauthorized drain.
Wallet abandoned (+25) — Affected users stop using a compromised wallet. At most 2 transactions after the drain means the owner moved on.
High drain % (+20) — When >90% of all incoming funds were sent to the aggregator, it wasn't a partial voluntary transfer.
Address Distribution by Amount
All Identified Addresses (781)
These are all addresses identified as sending funds to the known aggregator wallets. Higher scores indicate stronger movement-pattern indicators. Full list available upon request.
Note: Confidence scores are heuristic estimates, not confirmations. Known intermediaries have been excluded, but some addresses classified as "affected" may be unrelated wallets. Only addresses with individually verified cases should be treated as confirmed.
Recognize your address?
If your wallet was drained by this network, report it. Every confirmed case strengthens the analysis and adds to the on-chain evidence.
Report Your Case