To the person holding the funds: I stand by my offer. Return the first 0.3685 ETH and the public reports come down the same day. I am waiting for your move.
Contact me on Telegram: @ed7ls
A public record, built only from verified on-chain evidence
One wallet was drained.
Every move since is on this page.
On 18 October 2026, 0.8626 ETH was taken from the victim wallet. The stolen 0.5189 ETH has never moved. Everything the drainer's network has done since — every transfer, every exchange deposit, every swap — is mapped here with a transaction hash and a block number. Nothing on this page is a guess.
Last updated: — (UTC) · Data cutoff: — (UTC)
The network, as a map
Every wallet the network touched, and how the money flowed between them. Node size is total volume. Click any node for its totals and recent transfers. Drag to explore, Ctrl + scroll or pinch to zoom.
Loading the network…
Click a wallet
Select any node to see its totals and its most recent transfers.
The wallets at the centre
Amounts are traced network funds. Nothing on this page proves that any particular amount is the victim's stolen 0.5189 ETH — that sum is still untouched in the consolidator wallet.
Timeline
Volume over time
Traced stablecoin volume per day (UTC). The network never stopped moving.
Where the money went
Largest destinations by stablecoins received.
| # | Wallet | Address | Stablecoins received |
|---|
Bybit: twelve deposits, seven freeze requests, zero freezes
Traced network funds reached Bybit Hot Wallet 5 twelve times, totalling 7,660.716808 USDT — in two groups. Seven deposits (5,143.316808 USDT) had a freeze request sent for each; every reply used the same law-enforcement-only template, and none confirmed a freeze. The other five (2,517.4 USDT) were found late, predate the watch, and no freeze request was sent for them. Deposits 4, 5 and 6 arrived after the first freeze requests had already been sent.
| # | Date (UTC) | Amount | From | Route | Transaction | Block | Freeze request | Reply |
|---|
These are traced network funds. They are not proven to be the victim's stolen 0.5189 ETH, which is still untouched. The five earlier flows are listed below the seven touches. Three of them (1–4 October 2026) predate the theft itself; they are network activity through the same Bybit deposit address, documented here for completeness — not proceeds of this theft.
Other exchanges: deposits with no freeze requests yet
Traced network funds also reached HitBTC and KuCoin, and the Union Chain bridge — 90 transfers in total. No freeze request has been sent for any of these yet. The Union Chain bridge is a cross-chain bridge, not a centralised exchange, so no freeze request applies to it.
| Destination | From | Transfers | Stablecoins | ETH | First (UTC) | Last (UTC) | Example transaction |
|---|
These are traced network funds. They are not proven to be the victim's stolen 0.5189 ETH, which is still untouched.
SWFT swaps: ~800.95 ETH, payouts invisible
Wallet 56E8 was refuelled four times and swapped the ETH through SwftSwap, a cross-chain swap service. SwftSwap is not a centralised exchange, so no freeze request applies. The payout destinations are not visible on Ethereum.
| # | Date (UTC) | Amount (ETH) | Transaction | Block |
|---|
The standing offer
Sent on-chain to the consolidator wallet on 23 October 2026. It is still open — but only while the stolen 0.5189 ETH sits untouched.
Keep $300. Return 0.737 ETH in two steps of 0.3685 ETH.
When step 1 lands, the victim deletes the public Chainabuse reports and this site the same day. Step 2 follows within 24 hours. Then the swap-service reports are withdrawn and the pursuit ends permanently.
On-chain message, transaction 0xe8bf6623…7042, block 26256894. No return has ever arrived.
Reports on file
- Chainabuse — consolidator address: chainabuse.com/address/0x8F171C…E577
- Chainabuse — supplementary report: chainabuse.com/report/6ea37349…
- IC3 complaint (FBI Internet Crime Complaint Center): reference number 18ed0b51f07241c8bb90953e297cfabf — filed 25 October 2026, with a supplementary filing on 2 November 2026 covering the first four Bybit touches.
- Interpol: victim report sent 29 October 2026. No reply received yet.
- SEAL 911: case opened 23 October 2026.
Every transfer
— transfers. Every row has a transaction hash and a block number. Search by wallet, label, transaction hash or block.
| Date (UTC) | From | To | Asset | Amount | Transaction | Block |
|---|
Method and limits
- Every transfer on this page comes from a forensic watch log kept since 18 October 2026. Each row was parsed by a script from that log and from the watch run outputs — no number was typed by hand.
- On 6 November 2026 the totals were corrected: four watched addresses turned out to be exchange hot wallets (HitBTC, OKX, KuCoin), not drainer fragments, and Union Chain addresses are protocol infrastructure. Their own flows were removed from the totals; only verified network deposits into them remain counted. Earlier totals were overstated.
- A transfer is listed only if it has a transaction hash and a block number, and only if the amount is greater than zero. Spoof, lookalike-token and fake-event entries are excluded.
- Amounts are shown in their native units. For graph sizing only, ETH is converted at $2,408 (the Ether price observed on 5 November 2026); that conversion is never used for any amount shown.
- Two movements are documented in the timeline but not in the table: the mule-to-consolidator split of 0.51892627 ETH (block 26218156) has no transaction hash in any source, and the 13.15 USDT consolidator outflow of 20 October 2026 (block 26234512) likewise has none.
- “Traced network funds” means funds that moved through wallets in this network. It does not mean the funds are proven to be the victim's stolen 0.5189 ETH. That sum is still untouched.
- Times are UTC throughout. The victim is referred to only as “the victim”. No personal details are published on this site.
- This site makes no threats and calls for no action against anyone. It is a public record.
Data: transfers.json · meta.json · coverage.json