The $4M frogman drain: three chains emptied in 69 seconds, and the SOL went into a privacy pool

Update, 7 October 2026, 8:36 AM ET: the third chain. On BNB Chain, the same gas wallet, 0xf659…1C2A, sent the drained EVM wallet a little BNB at 4:15:54 PM ET on 6 October. The drained wallet then sent 13,958,467 MarsCoin and 91.6 SPCXB, a tokenized SpaceX share, to the same receiver, 0x427C…bA83, by 4:16:03 PM ET, and returned its leftover BNB to the gas wallet. So all three drained wallets were emptied within 69 seconds, from 4:14:54 to 4:16:03 PM ET, with one gas wallet paying for the EVM side.

At 1:21 AM ET on 7 October, the memecoin trader @frogmanhaha wrote: "Was drained for $4m+ USD this morning at 4:30am while I was asleep". He added that he didn't know how it happened yet, that he was in Singapore, where TOKEN2049 was under way, and that he had met a lot of new people. The post has been seen more than half a million times. He hasn't said which wallets were drained or how.

Three hours earlier, at 9:59 PM ET on 6 October, the on-chain researcher @EmberCN had named two wallets as his: one on Solana, 9wMS…v8zQ, and one on EVM chains, 0x14AA…5794, and put the loss at about $4 million across nine tokens. He hasn't confirmed the wallets. We followed both on-chain.

Both were emptied in the same 40 seconds. On Solana, starting at 4:14:54 PM ET on 6 October, 9wMS…v8zQ sent 1,429,939 $BP (Backpack's token), 16 million of a smaller token, 7,860 USDC and its SOL to a wallet with no earlier history, 69Fn…CFS. On Base, at 4:15:09 PM ET, 0x14AA…5794 sent 11.7 million BLUE CHIP and 2.8 million Basecat to 0x427C…bA83. Every transfer was signed by the drained wallets themselves, so whoever sent them had signing control of both wallets. That points to stolen keys or account access rather than a flaw in any token. That 4:14 PM ET is 4:14 AM in Singapore, close to the 4:30 he gave.

One wallet links the two sides. 0xf659…1C2A paid a few cents of gas to the drained EVM wallet on Base at 4:13:59 PM ET, 70 seconds before its tokens moved, and at 4:19 PM ET sent 0.037 ETH to the receiving wallet 0x427C…bA83 on Ethereum. Whoever paid the drained wallet's gas also funded the wallet the tokens went to.

On Solana, the receiving wallet sold all 1.43 million $BP between 4:18 and 4:23 PM ET for 13,053.6 SOL, then sold the rest. Between 4:36 and 5:00 PM ET it put 13,241 SOL, roughly $1.6 million, into Privacy Cash, a Solana privacy pool, in 10 deposits (the first, the last). It held almost nothing as of 8:23 AM ET on 7 October. A deposit into a privacy pool breaks the public trail; we can't see what was withdrawn, by whom or when.

On Ethereum, 0x427C…bA83 received 362.2 ETH between 7:40 and 8:22 PM ET: 107.9 ETH as fills from Across, a cross-chain bridge, and 254.3 ETH from an unlabeled contract. By 10:18 PM ET it had sent all 362.3 ETH back out in 15 transactions, mostly in fixed amounts of 35.001 and 18.501 ETH to 13 different wallets. The ETH arrived about three hours after the Privacy Cash deposits, which fits funds being withdrawn and bridged, but we haven't traced the other side of those fills, so we can't say where the ETH came from.

What we haven't found: how the keys or accounts were compromised; the drained EVM wallet's four transactions on BNB Chain, which we couldn't retrieve; and the dollar value of each token at the time it moved. The EVM wallet is now set up as a smart account (an EIP-7702 delegation to a standard account contract); we can't tell from the chain who set that up or when. He has said he will share more when he can; we'll add his account here.