# The $4M frogman drain: three chains emptied in 69 seconds, and the SOL went into a privacy pool

Source: trenchbook.app · filed Oct 7, 2026, updated Oct 7, 2026 · https://trenchbook.app/dispatch/frogman-drain

> There is no official trenchbook token or contract address (CA). Anyone selling one is not us.

**In short:** @frogmanhaha said on 7 October 2026 that he was drained of more than $4 million while asleep in Singapore. Wallets @EmberCN named as his, on Solana, Base and BNB Chain, were emptied between 4:14:54 and 4:16:03 PM ET on 6 October by transfers each wallet signed itself. One wallet paid gas to the drained EVM wallet on Base and BNB Chain and to the receiving wallet. The Solana proceeds, 13,241 SOL (about $1.6 million), went into the Privacy Cash pool; 362 ETH later passed through the EVM receiver in 15 transfers. How the wallets were compromised is unknown.
Update, 7 October 2026, 8:36 AM ET: the third chain. On BNB Chain, the same gas wallet, 0xf659…1C2A, [sent the drained EVM wallet a little BNB](https://bscscan.com/tx/0x84727d2b3f0c4bae00d15f3646fa7b5698e7145422b74766696b16eb2cec71f9) at 4:15:54 PM ET on 6 October. The drained wallet then [sent 13,958,467 MarsCoin](https://bscscan.com/tx/0xe1ec3d6576e11d517cfe892864de0e947e8cc65444ea60065844f04411505d46) and [91.6 SPCXB](https://bscscan.com/tx/0x618882f9edcbabaf1ccfb0ac3a00621558739f8a1c06d9bccdca0bff46e6afdb), a tokenized SpaceX share, to the same receiver, 0x427C…bA83, by 4:16:03 PM ET, and [returned its leftover BNB](https://bscscan.com/tx/0x6ba59e19971be00c67aecaf66c6f6c85ee9f55727ad84f11060207070dc1d243) to the gas wallet. So all three drained wallets were emptied within 69 seconds, from 4:14:54 to 4:16:03 PM ET, with one gas wallet paying for the EVM side.
At 1:21 AM ET on 7 October, the memecoin trader @frogmanhaha [wrote](https://x.com/frogmanhaha/status/2107702850679943584): "Was drained for $4m+ USD this morning at 4:30am while I was asleep". He added that he didn't know how it happened yet, that he was in Singapore, where TOKEN2049 was under way, and that he had met a lot of new people. The post has been seen more than half a million times. He hasn't said which wallets were drained or how.
Three hours earlier, at 9:59 PM ET on 6 October, the on-chain researcher @EmberCN had [named two wallets as his](https://x.com/EmberCN/status/2107652063245291897): one on Solana, 9wMS…v8zQ, and one on EVM chains, 0x14AA…5794, and put the loss at about $4 million across nine tokens. He hasn't confirmed the wallets. We followed both on-chain.
Both were emptied in the same 40 seconds. On Solana, starting at 4:14:54 PM ET on 6 October, 9wMS…v8zQ [sent 1,429,939 $BP](https://solscan.io/tx/57wSAHgVrsNf7hDvnnEDnpjb6fF1nWj6h9bGKLB5ivKRLwT7TZia4USS1u1GZWsndXK3TB6LKGy3Aj62jMhMu1aj) (Backpack's token), 16 million of a smaller token, [7,860 USDC](https://solscan.io/tx/2opj8gEvy5whjXfnVRa3y98JcVZtFg95A5pq9EuWDGVLNkd8B3rhfcXNgM8NAg6HWjDSbbD9TQn5wwYZd3zUJTug) and its SOL to a wallet with no earlier history, 69Fn…CFS. On Base, at 4:15:09 PM ET, 0x14AA…5794 [sent 11.7 million BLUE CHIP](https://basescan.org/tx/0x036248bca26184dd6b4cf25d0dcc67acb5c4f58d28411eee4d2148c1b6582fd8) and [2.8 million Basecat](https://basescan.org/tx/0x49c104ab3e7ef960198cc0e0ae6254f56fe0cd63440c5af442ac64d6b755f11c) to 0x427C…bA83. Every transfer was signed by the drained wallets themselves, so whoever sent them had signing control of both wallets. That points to stolen keys or account access rather than a flaw in any token. That 4:14 PM ET is 4:14 AM in Singapore, close to the 4:30 he gave.
One wallet links the two sides. 0xf659…1C2A [paid a few cents of gas](https://basescan.org/tx/0xb2cddcec6dcbd1e15d56f091c0e06aadddd220d1cfba4c563957c2fc892e6951) to the drained EVM wallet on Base at 4:13:59 PM ET, 70 seconds before its tokens moved, and at 4:19 PM ET [sent 0.037 ETH](https://etherscan.io/tx/0xb644bf8e644a1195ad838180fd015f88938a8664128b9e0ad1e7b4a5eebe2198) to the receiving wallet 0x427C…bA83 on Ethereum. Whoever paid the drained wallet's gas also funded the wallet the tokens went to.
On Solana, the receiving wallet sold all 1.43 million $BP between 4:18 and 4:23 PM ET for 13,053.6 SOL, then sold the rest. Between 4:36 and 5:00 PM ET it put 13,241 SOL, roughly $1.6 million, into Privacy Cash, a Solana privacy pool, in 10 deposits ([the first](https://solscan.io/tx/2z3oR5xtnE9mkk3F5Y7HFf3NZxzNtKJBEx3Fwzo9jcERr288dCQDiX6mjF8ECcu4wS6umS5jZes7Tcyv8rUatumN), [the last](https://solscan.io/tx/3f9ABQgo1xe4gVrDYxFJTSVvfeEz6pucS2ARDypLis6cMDDiT8X789Jf9ipR71n8ZjbvnAu1e9vQHquFwz21DWYm)). It held almost nothing as of 8:23 AM ET on 7 October. A deposit into a privacy pool breaks the public trail; we can't see what was withdrawn, by whom or when.
On Ethereum, 0x427C…bA83 received 362.2 ETH between 7:40 and 8:22 PM ET: 107.9 ETH as fills from Across, a cross-chain bridge, and 254.3 ETH from an unlabeled contract. By 10:18 PM ET it had [sent all 362.3 ETH back out](https://etherscan.io/tx/0x204c2bf7375b0d44cc648f630a09a9c32e93fe8cedc416f6587012c2afa7cc99) in 15 transactions, mostly in fixed amounts of 35.001 and 18.501 ETH to 13 different wallets. The ETH arrived about three hours after the Privacy Cash deposits, which fits funds being withdrawn and bridged, but we haven't traced the other side of those fills, so we can't say where the ETH came from.
What we haven't found: how the keys or accounts were compromised; the drained EVM wallet's four transactions on BNB Chain, which we couldn't retrieve; and the dollar value of each token at the time it moved. The EVM wallet is now set up as a smart account (an EIP-7702 delegation to a standard account contract); we can't tell from the chain who set that up or when. He has said he will share more when he can; we'll add his account here.

## What we don't know

- How the wallets were compromised, and whether it involved any app.
- Whether the wallets @EmberCN named are his; he hasn't confirmed them.
- Where the 362 ETH on 0x427C…bA83 came from before the bridge fills, and who controls the 13 wallets it went to.
- What was withdrawn from Privacy Cash, and when.
- What MarsCoin and SPCXB were worth when they moved, and where they went after 0x427C…bA83.

## The wallets

- **drained (Solana):** `9wMSNoA7TzhwUjqsACVGEvzAxAibCHnsZTgXEAGov8zQ`: Named by @EmberCN as @frogmanhaha's; emptied 4:14:54–4:15:34 PM ET, 6 Oct.
- **receiver (Solana):** `69FnU8vszZSZF6DZCT6VHdsvm3DvvojDgbwqzHJ4cCFS`: First activity was the drain; sold the tokens and deposited 13,241 SOL into Privacy Cash.
- **drained (EVM):** `0x14AA2A71dbb5eF87b81F92205E2699AA4aa65794`: Named by @EmberCN; sent its Base tokens to 0x427C…bA83 at 4:15:09 PM ET, 6 Oct.
- **receiver (EVM):** `0x427C4b37de0714821B09C4FC655a713AbbCfbA83`: Received the Base tokens; on Ethereum, received 362.2 ETH in bridge fills and sent 362.3 ETH on in 15 transfers.
- **gas funder:** `0xf65954D6d6F877963bAcE359E44c1f01D3b11C2A`: Paid gas to the drained EVM wallet on Base and to 0x427C…bA83 on Ethereum.

## Sources

- post: [@frogmanhaha: "drained for $4m+" (7 Oct)](https://x.com/frogmanhaha/status/2107702850679943584)
- researcher: [@EmberCN names the wallets (6 Oct, 9:59 PM ET)](https://x.com/EmberCN/status/2107652063245291897)
- tx: [$BP leaves the drained Solana wallet](https://solscan.io/tx/57wSAHgVrsNf7hDvnnEDnpjb6fF1nWj6h9bGKLB5ivKRLwT7TZia4USS1u1GZWsndXK3TB6LKGy3Aj62jMhMu1aj)
- tx: [BLUE CHIP leaves the drained EVM wallet (Base)](https://basescan.org/tx/0x036248bca26184dd6b4cf25d0dcc67acb5c4f58d28411eee4d2148c1b6582fd8)
- tx: [MarsCoin leaves the drained EVM wallet (BNB Chain)](https://bscscan.com/tx/0xe1ec3d6576e11d517cfe892864de0e947e8cc65444ea60065844f04411505d46)
- tx: [Gas to the drained EVM wallet (Base)](https://basescan.org/tx/0xb2cddcec6dcbd1e15d56f091c0e06aadddd220d1cfba4c563957c2fc892e6951)
- tx: [Gas to the EVM receiver (Ethereum)](https://etherscan.io/tx/0xb644bf8e644a1195ad838180fd015f88938a8664128b9e0ad1e7b4a5eebe2198)
- tx: [First Privacy Cash deposit](https://solscan.io/tx/2z3oR5xtnE9mkk3F5Y7HFf3NZxzNtKJBEx3Fwzo9jcERr288dCQDiX6mjF8ECcu4wS6umS5jZes7Tcyv8rUatumN)
- tx: [Last Privacy Cash deposit](https://solscan.io/tx/3f9ABQgo1xe4gVrDYxFJTSVvfeEz6pucS2ARDypLis6cMDDiT8X789Jf9ipR71n8ZjbvnAu1e9vQHquFwz21DWYm)
- tx: [Last ETH transfer out of 0x427C…bA83](https://etherscan.io/tx/0x204c2bf7375b0d44cc648f630a09a9c32e93fe8cedc416f6587012c2afa7cc99)