To the person holding the funds: I stand by my offer. Return the first 0.3685 ETH and the public reports come down the same day. I am waiting for your move.
Contact me on Telegram: @ed7ls
A public record, built only from verified on-chain evidence
One wallet was drained.
Every move since is on this page.
On 18 October 2026, 0.8626 ETH was taken from the victim wallet. The stolen 0.5189 ETH has never moved. Everything the drainer's network has done since — every transfer, every exchange deposit, every swap — is mapped here with a transaction hash and a block number. Nothing on this page is a guess.
Last updated: — (UTC) · Data cutoff: — (UTC)
The network, as a map
Every wallet the network touched, and how the money flowed between them. Node size is total volume. Click any node for its totals and recent transfers. Drag to explore, Ctrl + scroll or pinch to zoom.
Loading the network…
Click a wallet
Select any node to see its totals and its most recent transfers.
The wallets at the centre
Amounts are traced network funds. Nothing on this page proves that any particular amount is the victim's stolen 0.5189 ETH — that sum is still untouched in the consolidator wallet.
Timeline
Volume over time
Traced stablecoin volume per day (UTC). The network never stopped moving.
Where the money went
Largest destinations by stablecoins received.
| # | Wallet | Address | Stablecoins received |
|---|
Bybit: twelve deposits, seven freeze requests, zero freezes
Traced network funds reached Bybit Hot Wallet 5 twelve times, totalling 7,660.716808 USDT — in two groups. Seven deposits (5,143.316808 USDT) had a freeze request sent for each; every reply used the same law-enforcement-only template, and none confirmed a freeze. The other five (2,517.4 USDT) were found late, predate the watch, and no freeze request was sent for them. Deposits 4, 5 and 6 arrived after the first freeze requests had already been sent.
| # | Date (UTC) | Amount | From | Route | Transaction | Block | Freeze request | Reply |
|---|
These are traced network funds. They are not proven to be the victim's stolen 0.5189 ETH, which is still untouched. The five earlier flows are listed below the seven touches. Three of them (1–4 October 2026) predate the theft itself; they are network activity through the same Bybit deposit address, documented here for completeness — not proceeds of this theft.
KuCoin: observed transfers
Observed transfers from wallet 05B6 reached KuCoin's deposit addresses. A freeze request was sent to KuCoin on 6 November 2026, with a follow-up the same day; no reply has been received yet. The table below lists the observed transfers; they are not claimed to be proven network deposits — see the note below.
| Destination | From | Transfers | Stablecoins | ETH | First (UTC) | Last (UTC) | Example transaction |
|---|
These are observed transfers to KuCoin's deposit addresses. Only the first 50,000 USDT has any documented link to the traced network, and that link is thin: the funds passed through wallet 6A48, which had received only 100 USDT from the traced network, so the 50,000 USDT cannot be shown to be network funds. The remaining transfers reached wallet 05B6 from a source with no documented network link, and are not claimed to be network funds. None of these amounts is proven to be the victim's stolen 0.5189 ETH, which is still untouched. HitBTC figures that appeared here before 7 November 2026 were removed after wallet 7005 was identified as a HitBTC deposit address: its transfers to HitBTC were the exchange's own deposit sweeps, not network deposits.
SWFT swaps: ~800.95 ETH, payouts invisible
Wallet 56E8 was refuelled four times and swapped the ETH through SwftSwap, a cross-chain swap service. SwftSwap is not a centralised exchange, so no freeze request applies. The payout destinations are not visible on Ethereum.
| # | Date (UTC) | Amount (ETH) | Transaction | Block |
|---|
The standing offer
Sent on-chain to the consolidator wallet on 23 October 2026. It is still open — but only while the stolen 0.5189 ETH sits untouched.
Keep $300. Return 0.737 ETH in two steps of 0.3685 ETH.
When step 1 lands, the victim deletes the public Chainabuse reports and this site the same day. Step 2 follows within 24 hours. Then the swap-service reports are withdrawn and the pursuit ends permanently.
On-chain message, transaction 0xe8bf6623…7042, block 26256894. No return has ever arrived.
Reports on file
- Chainabuse — consolidator address: chainabuse.com/address/0x8F171C…E577
- Chainabuse — supplementary report: chainabuse.com/report/6ea37349…
- IC3 complaint (FBI Internet Crime Complaint Center): reference number 18ed0b51f07241c8bb90953e297cfabf — filed 25 October 2026, with a supplementary filing on 2 November 2026 covering the first four Bybit touches.
- Interpol: victim report sent 29 October 2026. No reply received yet.
- SEAL 911: case opened 23 October 2026.
Every transfer
— transfers. Every row has a transaction hash and a block number. Search by wallet, label, transaction hash or block.
| Date (UTC) | From | To | Asset | Amount | Transaction | Block |
|---|
Method and limits
- Every transfer on this page comes from a forensic watch log kept since 18 October 2026. Each row was parsed by a script from that log and from the watch run outputs — no number was typed by hand.
- On 6 November 2026 the totals were corrected: four watched addresses turned out to be exchange hot wallets (HitBTC, OKX, KuCoin), not drainer fragments, and Union Chain addresses are protocol infrastructure. Their own flows were removed from the totals. Earlier totals were overstated.
- On 7 November 2026 a further correction removed the HitBTC figures entirely: wallet 7005, whose transfers to HitBTC had been counted as network deposits, was identified from Etherscan's label as a HitBTC deposit address, and its transfers were the exchange's own deposit sweeps from many users. The same wallet's transfers to the Union Chain bridge and to Union Chain were removed for the same reason. The KuCoin figures were also re-qualified: the transfers from wallet 05B6 to KuCoin are real, but only the first 50,000 USDT has any documented link to the traced network, and that link is thin. Earlier versions of this page overstated what the exchange figures prove. A second correction the same day removed the outflows of KuCoin deposit addresses 83C4 and 7491, which had leaked into the totals because the parser could not resolve their labels; those transfers are KuCoin's own operations, not network movements. A third correction later the same day identified a further KuCoin deposit address, KuCoin 20, from Etherscan's label: wallet 05B6 had sent it 27 transfers totalling 599,489.78 USDC, of which the three newest (15,712 USDC, 10,260 USDC and 2,550 USDC) had first been reported as not KuCoin deposits because Blockscout returns no name or tags for that address; all are now counted, bringing the observed KuCoin transfers to 64 totalling 1,310,842.72 USDT. All were funded with no documented network link and are not claimed as network funds.
- A transfer is listed only if it has a transaction hash and a block number, and only if the amount is greater than zero. Spoof, lookalike-token and fake-event entries are excluded.
- Amounts are shown in their native units. For graph sizing only, ETH is converted at $2,408 (the Ether price observed on 5 November 2026); that conversion is never used for any amount shown.
- Two movements are documented in the timeline but not in the table: the mule-to-consolidator split of 0.51892627 ETH (block 26218156) has no transaction hash in any source, and the 13.15 USDT consolidator outflow of 20 October 2026 (block 26234512) likewise has none.
- “Traced network funds” means funds that moved through wallets in this network. It does not mean the funds are proven to be the victim's stolen 0.5189 ETH. That sum is still untouched. Rows in the exchanges table are observed transfers to deposit addresses; their funding is qualified in the Exchanges section, and they are not claimed to be the victim's funds.
- Times are UTC throughout. The victim is referred to only as “the victim”. No personal details are published on this site.
- This site makes no threats and calls for no action against anyone. It is a public record.
Data: transfers.json · meta.json · coverage.json