Data Export
Download the complete on-chain data report. All data is sourced from the public IOTA blockchain.
👮 For Reference
This dashboard documents suspicious cryptocurrency fund movements involving 726+ affected addresses with ~14,144,895 IOTA tracked.
Key facts:
- Tracked funds have been deposited to Binance, KuCoin, and OKX — exchanges that maintain KYC records on deposit accounts
- Fund movements are ongoing — deposits continue as of today
- Every transaction listed here is immutable and publicly verifiable on the IOTA blockchain
Recommended actions:
- Review flagged deposit addresses at relevant exchanges via their portals:
- Binance: Kodex portal / LE portal
- KuCoin: LE portal / law@kucoin.com
- OKX: LE portal
- Review KYC data from all 3 exchanges for the deposit accounts
- Download the data report for your records
🏦 For Exchange Compliance Teams
Your platform is receiving deposits of flagged cryptocurrency. The depositing accounts can be identified through your KYC records.
Key deposit addresses:
How to verify:
- Visit IOTAScan and search any address listed here to verify on-chain
- Check the fund flow page to see the complete routing from affected wallets to your exchange
- Cross-reference the deposit timestamps and amounts with your internal records
Police reference: Diligències 76852/2026 — Mossos d'Esquadra (Spain)
⚠️ Data Accuracy Notice
- Only 4 cases are individually confirmed with verified transaction hashes.
- The “726+ affected addresses” figure is an estimate based on automated pattern analysis (scoring heuristic, score ≥ 70).
- Known intermediary addresses are excluded from the count to prevent double-counting, but false positives may remain.
- Exchange totals are computed from on-chain transaction scanning when available, with static fallbacks when the API is unreachable.
Summary
- Confirmed Cases
- 4
- Likely Affected
- 726+
- Total Tracked
- 14,144,895 IOTA
- Sent to Exchanges
- 10,698,728 IOTA
- Period
- Jun 2025 – Jun 2026
- Aggregator Processed
- 14,797,747 IOTA
Methodology & Data Integrity
Data Provenance
All data derives from a single, independently verifiable source: the main aggregator wallet (0x91c7ab819ff916133e71eedf69ca12a2f7ebca6b8e38795bd35c36a39e0a2bbd). Every address in the tracked list sent funds directly to this aggregator address. Anyone can reproduce these results by querying the aggregator on IOTAScan or via the IOTA JSON-RPC API. The victims.json file is regenerated daily from on-chain data via an automated pipeline.
Scoring System
Each address is assigned a confidence score (0–100) based on four behavioral heuristics that characterize movement patterns. These are computed automatically from on-chain transaction data:
| Criterion | Points | Condition |
|---|---|---|
| Balance Drained | +30 | Current balance < 10 IOTA |
| Large Single Outflow | +25 | Largest outflow > 80% of pre-drain balance |
| Minimal Post-Drain Activity | +25 | ≤ 5 outflow transactions after drain |
| High Drain Percentage | +20 | Drain > 90% of pre-drain balance |
Maximum score: 100 (all four criteria met). These are behavioral heuristics — a score of 100 means the address matches all movement patterns, not that the case is human-confirmed.
Evidence Tiers
Addresses are classified into four tiers based on their confidence score. Only 4 cases have been individually verified by an address owner identifying themselves and confirming the transaction.
| Tier | Score | Count | Meaning |
|---|---|---|---|
| Strong Pattern | 100 | 708 | All 4 criteria met — strongest automated signal |
| Likely Affected | 70–99 | 18 | Meets most criteria — counted as likely affected in totals |
| Unclear | 40–69 | 53 | Matches some but not all patterns — may be affected addresses with unusual transaction history or unrelated wallets |
| Low Confidence | < 40 | 2 | Weak pattern match — sent very small amounts or show minimal indicators |
Confirmed = an address owner has been personally identified and specific transactions independently verified. Currently 4 cases.
Likely (score ≥ 70) = address matches automated movement-pattern heuristics. Independently verifiable on-chain, but not personally confirmed by the wallet owner.
Known Limitations
- False positive risk: Independent audit found 0 false positives among the 726 “likely affected” addresses (score ≥ 70). Among the addresses with scores below 70, a small number may be unrelated wallets (estimated < 1% overall rate).
- Scoring divergence (Python vs. live): Confidence scores in the database are computed by a Python pipeline using total outflows / total inflows. The live scoring API (/api/score-address) uses pre-drain balance as its baseline. On rare addresses with complex transaction histories, these methods can yield different tier classifications.
- Aggregator assumption: The the analysis assumes the aggregator wallet is controlled by the subject. This is supported by the fact that the aggregator never received funds from known exchanges (only from affected wallets), and all outflows went to exchanges or staking — consistent with fund routing behavior.
- Single aggregator scope: This analysis tracks funds through one known aggregator address. Additional aggregators may exist but have not yet been identified.
Fund Accounting
Of ~14.8M IOTA processed by the aggregator, the following destinations have been identified:
| Destination | Amount (IOTA) | % of Total |
|---|---|---|
| Binance | 9,009,841 | 60.9% |
| KuCoin | 996,668 | 6.7% |
| OKX | 692,219 | 4.7% |
| Staking | 398,751 | 2.7% |
| Other / In Transit / Internal Recycling | 3,700,268 | 25.0% |
The “Other” category includes funds still held in intermediary wallets, internal transfers between related addresses (not double-counted), and amounts in transit.
Confirmed Cases
Key Addresses
Timeline of Events
The network begins draining IOTA wallets. Over the following months, hundreds of addresses will be affected.
Large cluster of addresses drained on a single day — suggests automated exploit.
332,472 IOTA drained in main event, plus 4,084 IOTA unstaked and 983 IOTA swept later.
TX: 4HsjhTeTxSSwEmPYLAnhS9zGWooA6p34JVNg6k36VznCFunds immediately split: 159K, 55K, 53K, 35K, 30K IOTA across 5 L2 wallets.
19,999.95 + 32,499.95 IOTA from Case #1 deposited to KuCoin from L2 split path.
TX: DR5RXTpi1SBjb479m6e8jpWDvALfxehDgkfoTMx3BsZ9Subject (still controlling Case #1's compromised wallet) unstakes time-locked staking positions (+209.82 + 3,859.68 IOTA) via Swirl Protocol, then sends 4,084.5 IOTA to flagged address → aggregator → staking.
TX: 7NSaL8VD6BMhpkVLcZetzHPsrgfsbCEVGoZN4aw3wpFdL2 splits drip-feed ~169,000 IOTA to the main aggregator address (0x91c7ab81...) over 5 weeks (Sep 22 – Oct 30), joining funds from 725+ other addresses matching drain patterns.
10 IOTA gas money returned to helper address (0x05bf0d81...), which was used to fund unstaking operations on the compromised wallet. Helper address later sends funds to KuCoin.
TX: VEnRZnWtnVC8J7VvArr6k9LD6hY7eUi35jtdACnFvcLSubject (still controlling Case #1's wallet) collects remaining balance (airdrops + residual) and sends 982.97 IOTA to flagged address → intermediaries → Binance hot wallet.
TX: ADSVaHEnsh5V6Vo2EGypyyiavEyeoYMApbffdftk5bBfSecond confirmed case. 3,055.52 IOTA drained and routed through intermediate address to the same aggregator.
TX: DnhgLYHMLNkf57aFCCH8RZ6zvL68x66y4eGoBfPkcnrGAggregator sends batch to Binance via feeder address.
TX: FsX3X24w3qXfyve2DyhH44yEMe8ykC8nGJUqaHTtaH9ENew year exchange deposits continue.
TX: BTwfcSx6rGvoTabeDQRxuB3fBcWiyuxbv6o6WUz86MJGAggregator → feeder → Binance hot wallet.
TX: Dj7BTRV9euvY96tUzbA3xxn9DMohTkg1AsCr9Z8mezo6Continuing daily Binance deposits.
TX: 3kfvuZJs5gfsqETU4riDpZeAitwtXAbmvUoeUKi9C9JiBatched exchange deposit.
TX: FWx9pnupoi8pyJuNbu2W46UT9D8w7yjtunr3o79yqD2nThree deposits in one day: 100K + 73.3K + 91.9K IOTA.
TX: 6Fk94peyh7Nz9F3VkV9sCLL2dhF2nj9umhn8DSHXFc9NFormal complaint submitted to police with on-chain evidence.
Aggregator moves funds to staking wallet — funds also being staked for rewards.
TX: BCpHfj2kvKEwPeiKyevrtctRwvZPNp7KXvPMLm8aRzaxAggregator sends 2,071 IOTA to KuCoin intermediary (0x47020bac...). Part of ongoing small-batch routing.
TX: 7RXj2GMbWeJy7bxrYLQLWSKtUbjYjsjsZGTQaE6Y3RQDFresh routing activity detected: aggregator → Binance feeder → Binance hot wallet.
TX: 87Q3A64Ls4DhCcH1iQAre7HfQvPdHrDcoxGzbvvgPjDZAggregator sends 4,063 IOTA to KuCoin intermediary (0x47020bac...). Continued small-batch KuCoin deposits.
TX: 97zEm65aMLHE679o+410 IOTA received into aggregator, then 1,034 IOTA sent to KuCoin path. Network still active.
TX: 7EV8d1ixpXKMo3dZHkR8JHpjyVP5FPb5M5FVKxN9vEYdUpdated police report with Binance, KuCoin, and OKX evidence: Binance (9,009,841 IOTA via feeder, 83 txs), KuCoin (996,668 IOTA via 4 feeders), OKX (692,219 IOTA via aggregator). Investigation ongoing.
Fund Flow Summary
Report generated by IOTA Flow Tracker · 2026-11-14T12:52:21.330Z