What this report is
This is an on-chain investigation into the theft of two wallets by the same operator (the suspect, "Mounaim"). On 2026-06-03, Emerald (@Emeraldxyzz) was drained of 0.542 ETH — swapped to USDT via ChangeNOW, it became the seed funding of the operator's linchpin wallet, 8pW. On 2026-06-26, Prisoner (@PRIS0NER) was drained (Ethereum + MegaETH). This document reconstructs, transaction by transaction, where the money went; shows the receiving cluster is Mounaim's; and documents that two wallets he publicly called "hacked" were in fact his own. Every statement is backed by an on-chain transaction hash.
How the thefts were carried out (reported by the victims): Mounaim was a long-time friend of both Emerald and Prisoner who, over years of trust, had been given access to their wallets' private keys. The drains were carried out from the inside — not via an external hack. This context is stated by the victims; the on-chain trail below is what is independently verifiable.
Method & sources: data pulled directly from the blockchains via Alchemy (RPC + transfers), the Relay cross-chain API, and Etherscan. No private keys were used and no funds were moved — this is read-only tracing.
A
The theft — 2026-06-26
The victim ("Prisoner") was drained in five transactions on a single day: one on Ethereum and four on MegaETH. These are the moments the assets left the victim's control.
2THEFT— drain (MegaETH) megaeth
victim Prisoner — VICTIM #1 → thief wallet Hacker — first hop
What this shows: The drain itself — the victim's assets are pulled out of their wallet on megaeth.
tx megaeth 2026-06-26T09:58:29Z (unix 1782467909)0x25e31a70165fe2b7d97454eb446e83a8e4677c231aa7b8e381891b92df47831f ·
explorer ↗
3THEFT— drain (MegaETH) megaeth
victim Prisoner — VICTIM #1 → thief wallet Hacker — first hop
What this shows: The drain itself — the victim's assets are pulled out of their wallet on megaeth.
tx megaeth 2026-06-26T09:59:00Z (unix 1782467940)0x619febb066a24bd399f4950b869bfb69233d69f65bc292bbd161550769ae079e ·
explorer ↗
4THEFT— drain (MegaETH) megaeth
victim Prisoner — VICTIM #1 → thief wallet Hacker — first hop
What this shows: The drain itself — the victim's assets are pulled out of their wallet on megaeth.
tx megaeth 2026-06-26T10:01:13Z (unix 1782468073)0xb2bd8bead81a2e9ae86d3daca859620776a4394f5698eb8f20637221cdf80940 ·
explorer ↗
5THEFT— drain (ETH) ethereum
victim Prisoner — VICTIM #1 → thief wallet Hacker — first hop
What this shows: The drain itself — the victim's assets are pulled out of their wallet on ethereum.
tx ethereum 2026-06-26T10:04:47Z (unix 1782468287)0xe346ddab00c62224cac214980ba83bb00983a21ad5cef7a710ad5b38bb57cfaf ·
explorer ↗
6THEFT— drain (MegaETH) megaeth
victim Prisoner — VICTIM #1 → thief wallet Hacker — first hop
What this shows: The drain itself — the victim's assets are pulled out of their wallet on megaeth.
tx megaeth 2026-06-26T10:06:50Z (unix 1782468410)0x7971c73e46c2ff31b08cfdb9b6dadb8ccc498e8859e30e9e7ee943f16bfc55fd ·
explorer ↗ B
Laundering the stolen funds
The stolen value is bridged to Base, handed to a fresh "distributor" wallet, then fanned out as USDT to six brand-new Solana receiver wallets. Operating gas for the whole operation is seeded by Mounaim's linchpin wallet (8pW) and topped up through a ChangeNOW swap. Each Relay bridge below lists both its deposit (money in, origin chain) and its fill (money out, destination chain).
7Relay bridge— 0.8337 ETH (ETH→Base) ethereum
thief wallet Hacker — first hop → thief wallet Hacker — Base consolidation
What this shows: Stolen ETH is bridged out of the first hop toward the consolidation wallet (one Relay bridge = a deposit tx + a fill tx).
Relay bridge request — 0.833720153226689988 ETH
0xb9558052147c85654272d3a343b7bdcdba61e4155cdc6b4a48da0104f4ff7b9c ·
relay.link ↗ deposit ethereum 2026-06-26T10:17:11Z (unix 1782469031)0xd9f962ddbf0d6e6d10fdf7511454b38539c14e97c888aa7194edbd308f868ad6 ·
explorer ↗ fill base 2026-06-26T10:17:17Z (unix 1782469037)0xe7284de971549ce8e28dd42a772fc466c214407a5072025c5237b622675e8e10 ·
explorer ↗
8Relay bridge— 0.0988 ETH (ETH→Base) ethereum
thief wallet Hacker — first hop → thief wallet Hacker — Base consolidation
What this shows: Stolen ETH is bridged out of the first hop toward the consolidation wallet (one Relay bridge = a deposit tx + a fill tx).
Relay bridge request — 0.098774057233576538 ETH
0x73578b2e4e219f04d3a462dbad4acf6bc842f00459a11371d33f3aa58c47b6dc ·
relay.link ↗ deposit ethereum 2026-06-26T10:18:59Z (unix 1782469139)0x848f4888bbcbbb61e80fb92394f54ddfeddc6c01d9ae208a34d483bce8ead837 ·
explorer ↗ fill base 2026-06-26T10:19:05Z (unix 1782469145)0xb7538ffab407cf364a38afce6d90c15753ccc6d4c6682f237f5d541de356e6c8 ·
explorer ↗
9Relay bridge— 0.0325 ETH (MegaETH→Base) megaeth
thief wallet Hacker — first hop → thief wallet Hacker — Base consolidation
What this shows: Stolen ETH is bridged out of the first hop toward the consolidation wallet (one Relay bridge = a deposit tx + a fill tx).
Relay bridge request — 0.03247187105320128 ETH
0xba38d80d63f9ffaf6f8b9da48753133f18ca7b185b3e554e0a444b25e9ef3fb7 ·
relay.link ↗ deposit megaeth 2026-06-26T10:19:32Z (unix 1782469172)0x44a6b62a8ebc89b44e983c6f85a8dbaeaec5f4796d2e5596ad003de0815988f0 ·
explorer ↗ fill base 2026-06-26T10:19:35Z (unix 1782469175)0xa1fa5ce87ca4d4955405ecf58afafeb371af5340d80dba129fec47cf57725eb5 ·
explorer ↗
10Fund (swap+send)— ~$10 USDT → 0.1448 SOL solana
linchpin · 8pW 8pWAehnk — LINCHPIN (Mounaim) → Mounaim wallet 5uJe — gas/bridge router (0 other history)
What this shows: Mounaim's linchpin wallet (8pW) seeds the operating funds ("gas") that drive the rest of the laundering.
tx solana 2026-06-26T10:45:49Z (unix 1782470749)KbV4jghzcgdmixy33ojpHjgPA7siExmEYbMVsPXURgy9mWuZrJHTnsj3W7H8P59GvmHVKR9o7wNjizNAfJ1Ja5t ·
explorer ↗
11Fund— 6.867 USDT (gas-swap funding) solana
Mounaim wallet 5uJe — gas/bridge router (0 other history) → Mounaim wallet BwJe — Mounaim's disposable deposit wallet (one-time; 0 other history)
What this shows: Tops up Mounaim's own Solana wallet (BwJe) that will fund the ChangeNOW gas swap — BwJe is his own one-time wallet, not a ChangeNOW address.
tx solana 2026-06-26T10:48:34Z (unix 1782470914)3Ya3vhnSi9S3C29tVNnNon2Q2Km9V2FeysrQdHcRjr5p11jUchh2wSwBRG9nbVFUVXTahrpWnAffkwVHutWijHSV ·
explorer ↗
12ChangeNOW swap— 5 USDT (Solana) → ~$5 ETH (Base), ~50s solana
Mounaim wallet BwJe — Mounaim's disposable deposit wallet (one-time; 0 other history) → Mounaim wallet 0x9692 — Mounaim's disposable Base wallet (one-time: receives payout → bridges via Relay)
What this shows: A ChangeNOW swap: he deposits USDT on Solana (to ChangeNOW's assigned deposit address) and ~$5 ETH lands in his own fresh Base wallet 0x9692 ~50s later — switching chains so the gas looks unrelated.
Mechanics: Both BwJe and 0x9692 are Mounaim's own one-time wallets — NOT addresses assigned by ChangeNOW. The deposit (pay) tx is BwJe paying ChangeNOW's assigned deposit address ETc4JXU65koEnoKgE3JrZhK9jK7fJ4KYFrjdw2M7q4sm; ChangeNOW then swept that to its Solana hot wallet 9byY2BBoUrQijZ5Xwe2KKgsmwtSCxjURLFTGZZNdrGdw (tx 3iYCmXP6MpQyrxPzV4gDQptd6pzdsPfbSuj3qzVd4cCxX9xQKq7EmvoXxUP4aDkEiQinXkzUZkqoV1k29JRcJTUf). The fill (receive) tx is ChangeNOW's Base hot wallet 0x1b1D2149d656F8CA33fB633e6F642b5a2426B53D paying out to Mounaim's 0x9692. ETc4JXU / 9byY / 0x1b1D are ChangeNOW's; this is ordinary exchange deposit-and-payout plumbing.
deposit (pay) solana 2026-06-26T10:53:49Z (unix 1782471229)2YZPC6iAA4amw8msXFvfXsNd5t5hcJVhYmCvyyCVhvZF8FbKb4MmzwumsnJJbuBB4hFA3sq5AtN5b1cjcaEkAT7J ·
explorer ↗ fill (receive) base 2026-06-26T10:54:39Z (unix 1782471279)0x34ea410bc8e41b9e462e4999691c5737c6c36ba0810629129ce711950a5b36b7 ·
explorer ↗
13Relay bridge (gas seed)— 0.00198 ETH (Base→ETH) base
Mounaim wallet 0x9692 — Mounaim's disposable Base wallet (one-time: receives payout → bridges via Relay) → thief wallet Hacker — Base consolidation
What this shows: His ~$5 ETH gas seed is bridged from his own Base wallet (0x9692) into the consolidation wallet — operating funds for the laundering, with the source chain switched first.
Relay bridge request — 0.001978430354329458 ETH
0xfd1402f7cd807afc7cc3428fc634a4857afe4360c2942055b3376e1ace1b4485 ·
relay.link ↗ deposit base 2026-06-26T11:02:03Z (unix 1782471723)0xc5ab8ff15033cb92efd8b28eb91d61b7976c8a720840d7992ea2d4c4353de4f6 ·
explorer ↗ fill ethereum 2026-06-26T11:02:11Z (unix 1782471731)0x8b00cba73195deb5b1018e0a6549dcd067a0ed40a8006edb4fa15db182c62fa1 ·
explorer ↗
14Relay bridge— 0.9637 ETH (Base→ETH) base
thief wallet Hacker — Base consolidation → thief wallet Hacker — EVM distributor
What this shows: The consolidated stolen ETH is handed to a brand-new "distributor" wallet that performs the fan-out.
Relay bridge request — 0.963712038305787371 ETH
0x3aa483d5112a69702c4a2a3f0bbfadfe026b84ce28d897a826db9bbaa5190d5c ·
relay.link ↗ deposit base 2026-06-26T11:10:13Z (unix 1782472213)0xd5a1193168b27b3a29792d3dd30edb176287ad06d479fb2f66e3d88cd1825fe3 ·
explorer ↗ fill ethereum 2026-06-26T11:10:23Z (unix 1782472223)0x427ae4365916a71f5c742fdb3c3af5ba108b6d86ceeb90daa3892e74200a139f ·
explorer ↗
15Relay bridge— 297.89 USDT (ETH→SOL) ethereum
thief wallet Hacker — EVM distributor → receiver Receiver H9ny
What this shows: Stolen value is fanned out as USDT to a fresh, single-purpose Solana receiver — one of six used to split the money.
Relay bridge request — 297.893584 USDT
0x6b0d3fb8b7fcb2e97039d3823a4c2f436a3b6a05ac00004724f3ff25c24fa87c ·
relay.link ↗ deposit ethereum 2026-06-26T11:44:23Z (unix 1782474263)0x92b44046478ae9a933904496522ccdf2698fc624ae1e9fad87a607fcb2a3322a ·
explorer ↗ fill solana 2026-06-26T11:44:26Z (unix 1782474266)56gN4eLMrDsrX7aTXW5BjLa5T9jVTCDuiMHHCcvy1AzpJ23BphcNDFMwZ8EPbT41ZdPeHcee3nhacTvRHEcC1yFf ·
explorer ↗
16Relay bridge— 238.20 USDT (ETH→SOL) ethereum
thief wallet Hacker — EVM distributor → receiver Receiver 3aAK
What this shows: Stolen value is fanned out as USDT to a fresh, single-purpose Solana receiver — one of six used to split the money.
Relay bridge request — 238.198046 USDT
0x48ed8de72855f32e31ac597f2979402fc4ae2a71bc74a8fd98884dd02e4663a1 ·
relay.link ↗ deposit ethereum 2026-06-26T11:48:59Z (unix 1782474539)0xb3dda0a0259f811c4e007f0f37a46a00418a95278242c3753f87d5905a7168da ·
explorer ↗ fill solana 2026-06-26T11:49:04Z (unix 1782474544)jS6RjmX9PirvMGVqXfGp2CmVyKdAiFouLLEsm59NaxeK8NcgDqMKZKAQBsgmX6LrihVdw4sAcmNYGm2oXuxsZB2 ·
explorer ↗
17Relay bridge— 190.46 USDT (ETH→SOL) ethereum
thief wallet Hacker — EVM distributor → receiver Receiver P2ik
What this shows: Stolen value is fanned out as USDT to a fresh, single-purpose Solana receiver — one of six used to split the money.
Relay bridge request — 190.455552 USDT
0xaeb9189ced729c6ebd0bdad8f9fa7739548fc06053a03f75b1c7479150dc18ae ·
relay.link ↗ deposit ethereum 2026-06-26T11:49:59Z (unix 1782474599)0x1d7795ca934d46a3585ecc099b103caf20e2caea947f51aa519f988d8f75162e ·
explorer ↗ fill solana 2026-06-26T11:50:01Z (unix 1782474601)cmkrqtKmMoYD7zmHRzUgXRGge1y6M1adm7yHHazqJMtcXm8MqsuGfDL7TiVMNtoQdfC99VK3NhXkhDv9DLdCeED ·
explorer ↗
18Relay bridge— 379.98 USDT (ETH→SOL) ethereum
thief wallet Hacker — EVM distributor → receiver Receiver DbhH
What this shows: Stolen value is fanned out as USDT to a fresh, single-purpose Solana receiver — one of six used to split the money.
Relay bridge request — 379.976109 USDT
0xeef7409115d9289f1f4dd36e7be3a357472e42f485ba94be059174be948d5ced ·
relay.link ↗ deposit ethereum 2026-06-26T11:54:35Z (unix 1782474875)0xa89cbc34a38765dded484c37cfa723a2365f7ee07ef2112a9ff87044aa8f3501 ·
explorer ↗ fill solana 2026-06-26T11:54:39Z (unix 1782474879)5XciRw4dkmJvmw6ukqyddPZrbJJKoZ3gwpHFrGWRArc2G8fojQMBjoNoRt886JkpEeKDjaHMYgiKFCa6axkNwjFT ·
explorer ↗
19Relay bridge— 190.11 USDT (ETH→SOL) ethereum
thief wallet Hacker — EVM distributor → receiver Receiver 3MuM
What this shows: Stolen value is fanned out as USDT to a fresh, single-purpose Solana receiver — one of six used to split the money.
Relay bridge request — 190.113852 USDT
0xbc17c9bc0a512408348adc98d15a2f883354df4ac339c7e6877e307ba4a27884 ·
relay.link ↗ deposit ethereum 2026-06-26T11:55:47Z (unix 1782474947)0xcb2dd4599e1bf2c3cd35990f26ff1dd758c163abf357e7367ad95932f57fdb8c ·
explorer ↗ fill solana 2026-06-26T11:55:48Z (unix 1782474948)4pr3wa2aBr1kSaTL43gpsM3LyWUDPUosfogTwYDfdVXPXPV5CLpWq3inPzUnuNXUSXkrL4nSn7e9Gbs6JqqUU9C1 ·
explorer ↗
20Relay bridge— 189.67 USDT (ETH→SOL) ethereum
thief wallet Hacker — EVM distributor → receiver Receiver BTGS
What this shows: Stolen value is fanned out as USDT to a fresh, single-purpose Solana receiver — one of six used to split the money.
Relay bridge request — 189.672977 USDT
0x90ba72d52a5970233aaec72e4d3548e431e0ede6bc7df7b07d7bbf077e74dd6d ·
relay.link ↗ deposit ethereum 2026-06-26T11:56:47Z (unix 1782475007)0xb4b12946bc801c9e011cc4e79b5aab782c3d5e3c33cea9f5f0eafd24c1e5c34f ·
explorer ↗ fill solana 2026-06-26T11:56:50Z (unix 1782475010)1dkpmprpWQa9bU5jcrQCSsxSmk5NrBSKcw6Tqc9wFaw9PYf3VkzdwQdmtTT4mEcgjvD2mSXt54eUsVZKLEvCM2U ·
explorer ↗
21Gas fund— 0.02 SOL solana
Mounaim wallet 5uJe — gas/bridge router (0 other history) → receiver Receiver H9ny
What this shows: Operating funds routed toward the working wallet.
tx solana 2026-06-27T11:29:47Z (unix 1782559787)PtYvnscejPLhUymvA1QdNnbbPstvJnW5BSoTTa2JpQ7zDcTGpYApLTM3xsZK9CFeFCtiy7CLTgEPmDvqv9oynfw ·
explorer ↗ C
Cash-out & where the money is now
Before cashing out, the six receivers shuffle value among themselves: a single ~0.02 SOL "gas packet" is passed hand-to-hand around the whole ring (rF→rE→rD→rA→rB→rC→rF) so each wallet can pay its own fees off one funding, and rA/rB/rC pool their USDT (~465) into rF. Then the receivers bridge everything back to one EVM re-consolidator wallet, which converts the proceeds into a staked position.
22Relay bridge (cash-out)— 0.00125 ETH (SOL→ETH) solana
receiver Receiver H9ny → thief wallet Hacker — re-consolidator (HOLDS FUNDS)
What this shows: A receiver sends its share back to a single EVM re-consolidator — the six streams rejoin into one.
Relay bridge request — 0.001248186802563275 ETH
0xd46fe49230d8339252d232dee1503c97b7875affbe2f7743fe7c2c603e94edb9 ·
relay.link ↗ deposit solana 2026-06-27T11:32:18Z (unix 1782559938)3LPcCX78HefLULR74fDspUUN92zMvdQi1wWDytjbP2QMNNCjQY4AHk9o2x838hn3EoTz79ggFF1VNUx1mj6iUjD6 ·
explorer ↗ fill ethereum 2026-06-27T11:32:23Z (unix 1782559943)0xbd31d31681241e7108b6592357b70f81664d390d49bfdd306a57261898ef2316 ·
explorer ↗
23Relay bridge (cash-out)— 295.02 USDC (SOL→ETH) solana
receiver Receiver H9ny → thief wallet Hacker — re-consolidator (HOLDS FUNDS)
What this shows: A receiver sends its share back to a single EVM re-consolidator — the six streams rejoin into one.
Relay bridge request — 295.020763 USDC
0x771fdc70e44647897a4a501a0070d065dc04dd5d6295d870fabe7ffd8de72931 ·
relay.link ↗ deposit solana 2026-06-27T11:33:46Z (unix 1782560026)4r2A8cq4DyzpUPKc6YDz1WYsRKWer5DBh35TjwJUciyJ9ipnr3CG76ghL7oExAyY7LMp62GwZE2fAr1tHacC3Uzj ·
explorer ↗ fill ethereum 2026-06-27T11:33:59Z (unix 1782560039)0x316d0821843201499f08360207c69afe711f35cd6fdbd4156a0881d970384534 ·
explorer ↗
24Fee-seed (SOL)— 0.01968 SOL (gas relay) solana
receiver Receiver H9ny → receiver Receiver 3aAK
What this shows: A single shared ~0.02 SOL "gas packet" is passed hand-to-hand around all six receivers (rF→rE→rD→rA→rB→rC→rF) so each can pay its own transaction fees — one funding covers the whole cluster.
tx solana 2026-06-27T11:34:59Z (unix 1782560099)33HTbP1PUL5bd61HMESYnPaxjpahop2jTJ1H8HAtp7ewrdRck3dbc5JsfwY9pqToF3kjDDnDJ8VHGw8c3v3HbVKv ·
explorer ↗
25Relay bridge (cash-out)— 237.48 USDC (SOL→ETH) solana
receiver Receiver 3aAK → thief wallet Hacker — re-consolidator (HOLDS FUNDS)
What this shows: A receiver sends its share back to a single EVM re-consolidator — the six streams rejoin into one.
Relay bridge request — 237.482266 USDC
0x84a3caee14272b56c7dc9afeed7baebebca85325536b12d20b0176c916383011 ·
relay.link ↗ deposit solana 2026-06-27T11:35:41Z (unix 1782560141)3ivuDfCWTfvexgmpQdv68qb9n19NMsq8wE4aaGz59hfstcySZrHUnvVdqN3hbdoCZjHAXNNpn7s5twt7waynX3Y2 ·
explorer ↗ fill ethereum 2026-06-27T11:35:59Z (unix 1782560159)0x47fed222d424706df96f00b8ceefd94b83c0c7148a6e58e23d2be5d21c5537af ·
explorer ↗
26Fee-seed (SOL)— 0.01942 SOL (gas relay) solana
receiver Receiver 3aAK → receiver Receiver P2ik
What this shows: A single shared ~0.02 SOL "gas packet" is passed hand-to-hand around all six receivers (rF→rE→rD→rA→rB→rC→rF) so each can pay its own transaction fees — one funding covers the whole cluster.
tx solana 2026-06-27T11:36:23Z (unix 1782560183)4bFNNw9gbDUm1iXSAXFPx6HtCZEfCLBdgy1Qdt7zv6gECgRAkfnXBfkp28nrQnCaDCqjHxnTgH5LQDhwVHBoPWQs ·
explorer ↗
27Relay bridge (cash-out)— 189.89 USDC (SOL→ETH) solana
receiver Receiver P2ik → thief wallet Hacker — re-consolidator (HOLDS FUNDS)
What this shows: A receiver sends its share back to a single EVM re-consolidator — the six streams rejoin into one.
Relay bridge request — 189.885166 USDC
0xb3382151d02df9cc732864f6258ed3eab667d9eeca30aa34a672bd62385d2f80 ·
relay.link ↗ deposit solana 2026-06-27T11:37:01Z (unix 1782560221)2rENepWmixgsWL7QuYPZdoXwAZVx87YGCAaoUd2veeWt57wHAAQHaTYz2pj42UDz3d48WyFuASZHeWbyt1VK96Xk ·
explorer ↗ fill ethereum 2026-06-27T11:37:11Z (unix 1782560231)0x82599e0a67686ee982dd90fc4bb7e6cae0daa437b5bdd34d72e4e4c623a5c8b4 ·
explorer ↗
28Fee-seed (SOL)— 0.01925 SOL (gas relay) solana
receiver Receiver P2ik → receiver Receiver DbhH
What this shows: A single shared ~0.02 SOL "gas packet" is passed hand-to-hand around all six receivers (rF→rE→rD→rA→rB→rC→rF) so each can pay its own transaction fees — one funding covers the whole cluster.
tx solana 2026-06-27T11:39:21Z (unix 1782560361)2hKZxaGy4vvuFvZadRx4qdgTBt4crhurxREUYgUD5ZctLxqZDpzx39CLGYKvCvN8r1nWjw8LRJYEJGwvezxZSBos ·
explorer ↗
29Relay bridge (cash-out)— 289.44 USDC (SOL→ETH) solana
receiver Receiver DbhH → thief wallet Hacker — re-consolidator (HOLDS FUNDS)
What this shows: A receiver sends its share back to a single EVM re-consolidator — the six streams rejoin into one.
Relay bridge request — 289.435551 USDC
0x3689a225feaab70026066902eb9cd88f056eaba15e83bafc0714cbc8b87445c5 ·
relay.link ↗ deposit solana 2026-06-27T11:40:13Z (unix 1782560413)8e7Agp5Y2N1S7FvGcCDRqoMzsiFVYKhSg64mMd76YByvbrLDdGTzzy9eq7HJ5JYGHAGRfwZXPogJ6KTvycQVbYD ·
explorer ↗ fill ethereum 2026-06-27T11:40:23Z (unix 1782560423)0xdf37d7a89aec87e7406af4dd73455ac12fa2ed32e7c97520ad47a98360653bcf ·
explorer ↗
30Relay bridge (cash-out)— 4.98 USDT (SOL→MegaETH) solana
receiver Receiver DbhH → thief wallet Hacker — re-consolidator (HOLDS FUNDS)
What this shows: A receiver sends its share back to a single EVM re-consolidator — the six streams rejoin into one.
Relay bridge request — 4.975921 USDT
0xd9d6ba98c482d7ccd965c6dfdb3c61aefecd4f1321f7e27a29e768c3fa983604 ·
relay.link ↗ deposit solana 2026-06-27T12:05:19Z (unix 1782561919)hvpTBNi6NbzePNC2h2hRcBhwSEfHqY9X9B62CkLFi7u6ki8GATKjraNyaHRs74eQctpABzKACViHivuexZU92az ·
explorer ↗ fill megaeth 2026-06-27T12:05:24Z (unix 1782561924)0x9f4a199791646f28bcd48caabec5561e4d9089114701c3918d4024130cd4fc59 ·
explorer ↗
31Stake (park funds)— 22,205.11 MEGA (~$1,000) megaeth
thief wallet Hacker — re-consolidator (HOLDS FUNDS) → service / exchange MEGA staking (funds parked)
What this shows: The proceeds are parked as staked MEGA tokens (~$1,000) — this is where the money sits today.
tx megaeth 2026-06-27T12:07:59Z (unix 1782562079)0x0bff5206d960ce9bd12ecaab7a99f9a03a1e64ba059a63e79ccc4805e96a6be0 ·
explorer ↗
32Consolidate USDT— 84.98 USDT → H9ny solana
receiver Receiver DbhH → receiver Receiver H9ny
What this shows: A receiver pools its USDT into rF (H9ny) just before the cash-out — a partial re-consolidation of the split funds inside the cluster.
tx solana 2026-06-27T12:13:05Z (unix 1782562385)5K4ADNCpHpUgdBSxpF2UQ6SLJC7fzAPXbH6ftXjTTsPdcvXhKe8bPj6j2pTYFNdYB6QUvDPvmJ8xHCHcKV8c7o5f ·
explorer ↗
33Fee-seed (SOL)— 0.01893 SOL (gas relay) solana
receiver Receiver DbhH → receiver Receiver 3MuM
What this shows: A single shared ~0.02 SOL "gas packet" is passed hand-to-hand around all six receivers (rF→rE→rD→rA→rB→rC→rF) so each can pay its own transaction fees — one funding covers the whole cluster.
tx solana 2026-06-27T12:13:30Z (unix 1782562410)5GYm6X337jQEtPnQ27Bhn1Snv9Nvkx6dR8Yo2ZdVKVeWcfyxSM88uSSWwALF49mKfad1YX2ra6JPVXTUBrTow8QB ·
explorer ↗
34Consolidate USDT— 190.11 USDT → H9ny solana
receiver Receiver 3MuM → receiver Receiver H9ny
What this shows: A receiver pools its USDT into rF (H9ny) just before the cash-out — a partial re-consolidation of the split funds inside the cluster.
tx solana 2026-06-27T12:13:46Z (unix 1782562426)4Scd7yTmc7qvVbj98e2b526MxNLP2iKNeCS2TuvLxuSbbf6A6Tn9CSjUkqcg9hq8bFxkW6fgPcKNKF69MVJCJoMM ·
explorer ↗
35Fee-seed (SOL)— 0.01877 SOL (gas relay) solana
receiver Receiver 3MuM → receiver Receiver BTGS
What this shows: A single shared ~0.02 SOL "gas packet" is passed hand-to-hand around all six receivers (rF→rE→rD→rA→rB→rC→rF) so each can pay its own transaction fees — one funding covers the whole cluster.
tx solana 2026-06-27T12:14:02Z (unix 1782562442)ZErb2Ev4QspvCbA5XQcjKrLsQLX8xtXRiiYbRkYucpoyKazWiee27EginvKNHZSJ244VDAkFxFT6e4g7VEALpD7 ·
explorer ↗
36Consolidate USDT— 189.67 USDT → H9ny solana
receiver Receiver BTGS → receiver Receiver H9ny
What this shows: A receiver pools its USDT into rF (H9ny) just before the cash-out — a partial re-consolidation of the split funds inside the cluster.
tx solana 2026-06-27T12:14:25Z (unix 1782562465)5PZuHbrwxHHo2WGxEuVBbU66AyWRYNTGUfS3YkxitwU8RW5HawSuks2XLn9k8xWNZ8XY9rtpQEnhf4Yk5BmDJKPa ·
explorer ↗
37Fee-seed (SOL)— 0.01861 SOL (gas relay — ring closes back at rF) solana
receiver Receiver BTGS → receiver Receiver H9ny
What this shows: A single shared ~0.02 SOL "gas packet" is passed hand-to-hand around all six receivers (rF→rE→rD→rA→rB→rC→rF) so each can pay its own transaction fees — one funding covers the whole cluster.
tx solana 2026-06-27T12:16:34Z (unix 1782562594)3aQbzFGvi7kVoXQntBqcduuaWdHf3fiFuzRVrnC4BLKARY61zFcnzFJAGQQ1WaDWrAckxceRMD4r4SWNqi2mQsfg ·
explorer ↗
38Relay bridge (cash-out)— 0.293 ETH (SOL→Base) solana
receiver Receiver H9ny → thief wallet Hacker — re-consolidator (HOLDS FUNDS)
What this shows: A receiver sends its share back to a single EVM re-consolidator — the six streams rejoin into one.
Relay bridge request — 0.293024994598699946 ETH
0x9247902ced6f514a1d9a77dc5d504d77631396ba088891bea6fbadbadbc01324 ·
relay.link ↗ deposit solana 2026-06-27T12:18:16Z (unix 1782562696)4wF9j6mo7j3DEnDdHCKuEoEpgViqB8bAV9Qd7V5pw3Qh3cv263inSE2bBzsizbZHEKSmNpqT5EsUfgcKp1m3CHqJ ·
explorer ↗ fill base 2026-06-27T12:18:21Z (unix 1782562701)0x88af81cebdb6b02201603c5f8c9f6bdc7e4b3de20e233ab8db9c8b80697a6482 ·
explorer ↗ 📍 Status of the funds (updated 2026-07-07)
About an hour after being confronted, the operator returned the funds directly from the re-consolidator 0xd6bd57991e4814769376cC11f15B710d51aA8666 to Prisoner's new wallet 0x7df425E383dd4aAFA8141e2E3f9275EbFA10b88C:
- 22,225.98 MEGA (MegaETH), after unstaking it
- 515.13 USDC (Base) — the value of the ~0.293 ETH it held, returned as USDC
Prisoner's wallet currently holds both. Returning them directly from that re-consolidator wallet also confirms the operator controls it.
D
Attribution — the linchpin "8pW" is Mounaim
Three ChangeNOW swaps send USDT from 8pWAehnk… (Solana) and pay out USDC into Mounaim's own EVM wallet 0x785fF898… (Base) — value-correlated (input USDT ≈ output USDC minus ChangeNOW's ~1-token fee), 44–51 seconds apart, with his own wallet set as the payout: the signature of one person swapping their own funds. This is reinforced by co-signed transactions (G5GFpTfM…), zero-history bridge wallets (5uJe / BwJe), and 8pW funding Mounaim's other Solana wallets. And on 2026-06-30, 8pW cashed 437 USDT out to Binance: swapped to SOL via ChangeNOW, routed through a fresh 0-history burner, and deposited into a Binance account that Mounaim's known wallet 7FnZ has funded since 2024 — a KYC'd chokepoint that independently ties 8pW to Mounaim.
39ChangeNOW swap (IDENTITY)— 25 USDT(sol) → 24.055 USDC(base), 49s solana
linchpin · 8pW 8pWAehnk — LINCHPIN (Mounaim) → Mounaim wallet Mounaim EVM (0x785f)
What this shows: Same person on both sides: USDT leaves 8pW (Solana) and comes out as USDC in Mounaim's own Base wallet via ChangeNOW — the same value minus ChangeNOW's fee, ~50s apart (he set his own wallet as the payout).
deposit (pay) solana 2026-06-30T17:06:00Z (unix 1782839160)5zZ2HZ2hq18hnEeQwmSpnAhfkXZYbuytxDbckwzxX6MuuhBJhQP5qXYtjVJxokRyvKoATB5iL7VmEv4sXX5cYHMy ·
explorer ↗ fill (receive) base 2026-06-30T17:06:49Z (unix 1782839209)0xd73b9682f2e9658094b11c46de106e10992d7f23a4c29589d94ae6172f494c29 ·
explorer ↗
40ChangeNOW swap (IDENTITY)— 20 USDT(sol) → 19.081 USDC(base), 51s solana
linchpin · 8pW 8pWAehnk — LINCHPIN (Mounaim) → Mounaim wallet Mounaim EVM (0x785f)
What this shows: Same person on both sides: USDT leaves 8pW (Solana) and comes out as USDC in Mounaim's own Base wallet via ChangeNOW — the same value minus ChangeNOW's fee, ~50s apart (he set his own wallet as the payout).
deposit (pay) solana 2026-06-30T17:18:56Z (unix 1782839936)vWY48VrLtWMHBJePvA15ZkTQrBGboHNo7ke4Xdk8KCvyJRJ2fyXxfK2izVGxZWQ7VsKaczoGUDNhS7azJdzHq9e ·
explorer ↗ fill (receive) base 2026-06-30T17:19:47Z (unix 1782839987)0x51b89d1364c4ef259b2fd4358ec50d20a1f2b8882bc9747bd093637208827df3 ·
explorer ↗
41ChangeNOW swap (IDENTITY)— 20 USDT(sol) → 19.081 USDC(base), 44s solana
linchpin · 8pW 8pWAehnk — LINCHPIN (Mounaim) → Mounaim wallet Mounaim EVM (0x785f)
What this shows: Same person on both sides: USDT leaves 8pW (Solana) and comes out as USDC in Mounaim's own Base wallet via ChangeNOW — the same value minus ChangeNOW's fee, ~50s apart (he set his own wallet as the payout).
deposit (pay) solana 2026-06-30T17:19:19Z (unix 1782839959)2FW1RBDVNeu3qguk8wHHkLSuP7YqkoGD9fj9ytHjusj5mfQh1RC5HkuoLmiS4xJ8Q4DSbx8kaaKL7a1YDJMexSg5 ·
explorer ↗ fill (receive) base 2026-06-30T17:20:03Z (unix 1782840003)0x2381abb1be6a2bc48ee0c4c77614aa7dd28cc7c6e2dc112469905216a8e13557 ·
explorer ↗
42ChangeNOW swap → SOL (IDENTITY)— 437 USDT(sol) → 5.879 SOL(sol) solana
linchpin · 8pW 8pWAehnk — LINCHPIN (Mounaim) → Mounaim wallet Burner (Gzs) — 0-history swap payout → Binance
What this shows: 8pW swaps 437 USDT into SOL via ChangeNOW and routes the payout through a fresh 0-history burner — the classic hop right before an exchange deposit.
Mechanics: Deposit of 437 USDT went to ChangeNOW's one-time address 9KFYgsNMcSmDmYJCRdbiFWmZ9mduetxN4PPQ1oBcPEdh, swept to ChangeNOW's Solana hot wallet 9byY2BBoUrQijZ5Xwe2KKgsmwtSCxjURLFTGZZNdrGdw (tx bVJMDxw9A7… at 22:21:57 UTC); ChangeNOW then paid out 5.87921853 SOL from hot wallet B48kNVXs4YK4amkBCH2XokQiv1SeiVQGHDR17xDeKAAn to the fresh burner GzsEEcW… (no prior history).
deposit (pay) solana 2026-06-30T22:14:55Z (unix 1782857695)66aBeV3SiCfy4DoGpJUkRtxKX1aMrkVQ2XgCkLveGcUbNBjFHXEjExVB1kGzRKBJ6RxQA4ozeDjiihen8CRcC84y ·
explorer ↗ fill (receive) solana 2026-06-30T22:15:33Z (unix 1782857733)5kUtVmBtEtCfHeZXZSPUktAENhi75Wrg1qgfZYGdeySMt3uDrn5eu9zgm686i3SuRox5XqTBrmcnNMyFa17jRrCC ·
explorer ↗
43Deposit to Binance— 5.87905853 SOL → Mounaim's Binance solana
Mounaim wallet Burner (Gzs) — 0-history swap payout → Binance → service / exchange Binance deposit — Mounaim's (sweeps to Binance hot 5tzFki; fed by 7FnZ since 2024)
What this shows: The burner deposits the SOL into a Binance account (it sweeps to Binance's hot wallet 5tzFki… 33×). That same Binance deposit address was funded 9× by Mounaim's known wallet 7FnZ (Feb–Dec 2024) — so the Binance account is Mounaim's, and 8pW cashing into it ties 8pW to Mounaim.
Mechanics: Binance deposit address HgkWVijubHx5WSH8MTUQUKf4RP5d8sG8SEALved4tjWN sweeps to Binance's Solana hot wallet 5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9 (33×). It was also funded 9× by Mounaim's known wallet 7FnZJcWHAeRsjJsxdSEXWhPXvJr893EXUPwUVtTi5pt4 (2024-02-28 → 2024-12-23) — i.e. it is Mounaim's KYC'd Binance account.
tx solana 2026-06-30T22:23:41Z (unix 1782858221)5rky2eLJY2xvTEp4WrE9FG2QrjMRtfRzWT4L77d37XdJghXKYvgj1T1G73DQ1mgv9rZG1AGnWeBkef1qa5BMruh8 ·
explorer ↗
44Transfers— 210 USDT + 1.05 SOL (his wallet) solana
linchpin · 8pW 8pWAehnk — LINCHPIN (Mounaim) → Mounaim wallet Mounaim Solana (7FnZ)
What this shows: 8pW funds a wallet already independently identified as Mounaim's.
Aggregate of several transactions of the same kind — see the raw evidence files for each hash.
45Relay (bidirectional)— 102.85 USDT in / 0.0385 ETH out ethereum
Mounaim wallet Mounaim EVM #3 (a3a8) — funder hub → linchpin · 8pW 8pWAehnk — LINCHPIN (Mounaim)
What this shows: Mounaim's EVM wallet #3 bridges back-and-forth with 8pW — tying his named wallet directly to the linchpin.
Aggregate of several transactions of the same kind — see the raw evidence files for each hash.
E
The false "hacked" claim
The claim: On 2026-06-28 at 15:30 UTC (16:30 his local GMT+1), Mounaim posted two wallet addresses in Discord, saying they had been "hacked" — implying he was a victim too. The blockchain shows the opposite: he funded these wallets from his own wallet after the theft and kept trading through them until ~4.5 hours before the claim. There is no drain, no sweep, no attacker.
1) He funded both "hacked" wallets from his own EVM wallet #3 — after the theft. Nobody sends ETH into a wallet an attacker controls.
46Fund "hacked" wallet— 0.005 ETH — AFTER theft ethereum
Mounaim wallet Mounaim EVM #3 (a3a8) — funder hub → "hacked" wallet Mounaim EVM #4 — falsely claimed "hacked"
What this shows: Mounaim sends ETH into a wallet he later told Discord was "hacked" — from his own wallet, after the theft. You don't fund a thief's wallet: this is direct evidence the "hack" claim is false.
tx ethereum 2026-06-26T14:39:59Z (unix 1782484799)0x4e77aa5c232913e9728465b3f8fc840cc51630bbbf559e523b0e0fbaf9d16d34 ·
explorer ↗
47Fund "hacked" wallet— 0.005 ETH — AFTER theft ethereum
Mounaim wallet Mounaim EVM #3 (a3a8) — funder hub → "hacked" wallet Mounaim EVM #2 — falsely claimed "hacked"
What this shows: Mounaim sends ETH into a wallet he later told Discord was "hacked" — from his own wallet, after the theft. You don't fund a thief's wallet: this is direct evidence the "hack" claim is false.
tx ethereum 2026-06-26T14:54:59Z (unix 1782485699)0x6f49e2f6668dee6b38c4145c4dbbd4f1aac40f1bdba5488249a59ec996fd41d0 ·
explorer ↗
2) He kept using them as his own for three days. Both wallets traded NFTs on OpenSea — ordinary, owner-driven activity, with no theft pattern:
NFT trading through the "hacked" wallets ethereum
0xECd6… NFT buys/sells
2026-06-26 14:55 → 16:09 UTC0xECd6821b3fC4755F8b01CB83fD78B736F16B6975 · example tx
0x8937e60330e70fd4a0102741915fafa6c61368ee5d25f68a9bfbb90bed235684 ·
explorer ↗
0x4f07… last action
2026-06-28 11:04:11 UTC —
~4.5 hours before he called it hacked
0x4f07185ab254B8B526294290700017D3740a2931 · final tx
0xeb64f08d1714c1b6d165d4880af73c876d4299b3c33d622d66efc6f81a6541c9 ·
explorer ↗
What this shows: The wallets behaved as Mounaim's own right up to the claim — normal trading, tiny balances left behind, no attacker emptying them.
⏱ Timeline of the claim
- 2026-06-26 ~10:00 UTC — the victim is drained.
- 2026-06-26 14:39–14:55 UTC — Mounaim funds both wallets he would later claim were "hacked" — from his own EVM #3.
- 2026-06-26 → 06-28 — Mounaim keeps trading NFTs through both wallets.
- 2026-06-28 11:04 UTC — last activity in 0x4f07 (his own action).
- 2026-06-28 15:30 UTC — ~2 days after the theft, he finally posts them as "hacked."
⚑
Post-confrontation conduct
After the victims confronted him, Mounaim erased himself. He deleted his X account, left the community server where he had met the victims and used to hang out with them, and blocked everyone across all his socials.
His X handles were
@MounaimRa and
@Mounaimxyz — both now dead (disabled / deleted). This was
not a handle change: a rename leaves a forwarding trail, but here every trace is gone — meaning the accounts were
deleted, a deliberate scrub consistent with consciousness of guilt.
Known identifiers for the suspect (Mounaim)
Note: this section is behavioral / off-chain (reported by the victims and their community); the transaction-level evidence above is what is independently verifiable on-chain.
↩
Partial return of funds (2026-07-07)
About an hour after being confronted, the operator contacted Prisoner and returned the funds directly from the re-consolidator wallet 0xD6bd, which by itself proves he controls it. He returned both the staked MEGA (unstaked first) and the ETH value (sent as 515 USDC) to Prisoner's new wallet 0x7df425E3…, which currently holds both.
48RETURN to victim— 22,225.98 MEGA (after unstaking) megaeth
thief wallet Hacker — re-consolidator (HOLDS FUNDS) → victim Prisoner — new wallet (received the returned funds)
What this shows: Returned directly from the re-consolidator wallet (0xD6bd) to Prisoner's new wallet about an hour after the confrontation, which itself proves the operator controls 0xD6bd. Both the MEGA and the ETH value (sent as 515 USDC) were returned, and Prisoner's wallet holds them now.
Mechanics: About an hour after being confronted, the operator returned funds directly from the re-consolidator 0xD6bd57991e4814769376cC11f15B710d51aA8666 to Prisoner's new wallet 0x7df425E383dd4aAFA8141e2E3f9275EbFA10b88C. He unstaked the staked MEGA first (tx 0xca4f6aef929b41a6b02acd5b21f5a7fedc033cdea19add38a200ec3fcf2364b2, 00:58 UTC) then sent 22,225.98 MEGA. The ETH portion was returned separately as USDC (next).
tx megaeth 2026-07-07T02:45:39Z (unix 1783392339)0x7c841bd55158e387ff7f1400178eefb0e51cd4d3894c2bca430b3df433bf76f4 ·
explorer ↗
49RETURN to victim— 515.13 USDC (≈ the 0.293 ETH value) base
thief wallet Hacker — re-consolidator (HOLDS FUNDS) → victim Prisoner — new wallet (received the returned funds)
What this shows: Returned directly from the re-consolidator wallet (0xD6bd) to Prisoner's new wallet about an hour after the confrontation, which itself proves the operator controls 0xD6bd. Both the MEGA and the ETH value (sent as 515 USDC) were returned, and Prisoner's wallet holds them now.
Mechanics: Recon sent 515.128051 real USDC (canonical Base USDC contract 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913) to Prisoner's new wallet — the value of the ~0.293 ETH it held, returned as USDC. (Not to be confused with several spoofed 'USDC' lookalike-token transfers to address-poisoning wallets around the same time.) Prisoner's wallet currently holds both this USDC and the returned MEGA.
tx base 2026-07-07T02:55:29Z (unix 1783392929)0x7a128dacdefa5350f44aa374f0baf2e97976faf07e283f399410531ed0ba8cee ·
explorer ↗
▦
Visual maps of the money trail
Two views of the same evidence. Time flows top → bottom (victim at the top, cash-out at the bottom); each arrow is one transaction, colored by the blockchain it happened on. Hover any arrow for its action, meaning and UTC time; click a wallet to open it in an explorer, or an arrow to open the transaction.
wallet role: victimthief walletreceiverlinchpin · 8pWMounaim walletservice / exchange"hacked" wallet
blockchain: ethereumbasemegaethsolanaarbitrumbnbpolygon
Flow map — the laundering pipeline
Boxed, pipeline-style layout. Best for following the route from the theft down to where the funds rest now.
Bubble map — wallets & transactions
The same data as round bubbles (hexagons = Solana wallets). Best for seeing the six-way fan-out and the clustering at a glance.