The wallet rrealist says holds his stolen funds: $719K USDC reached a HitBTC deposit address within 2 h 43 min, and 346 SOL left through NEAR Intents
On 12 October @rrealist said he had been robbed of about $800K and linked one wallet as holding the stolen funds. We followed that wallet forward on-chain. Its $718,736 in USDC went to an address that was swept, with other deposits, into a wallet Solscan labels "HitBTC: Hot Wallet 1". Its 346 SOL was swapped through NEAR Intents into 14.70 ETH; 12.30 ETH of it sat in one Ethereum wallet on 14 October.
trenchbook.app · The wallet rrealist says holds his stolen funds: $719K USDC reached a HitBTC deposit address within 2 h 43 min, and 346 SOL left through NEAR Intents · filed Oct 14, 2026, updated Oct 14, 2026 · trenchbook.app/dispatch/rrealist-stolen-funds-trace
Update, 14 October, 1:04 PM ET: we followed the SOL. NEAR Intents' public status for the deposit address vj83…QaH shows the 346.125 SOL was swapped into 14.70 ETH and paid out on Ethereum to 0xF672…1926 at 9:24:59 PM ET on 12 October, a minute after it left Solana (payout). At 11:52:11 PM ET, 0xF672 sent 14.70 ETH on to 0xEeC3…700f. On 13 October, between 10:55 AM and 12:08 PM ET, 0xEeC3 sent 2.40 ETH in four payments to four other addresses. At 1:03 PM ET on 14 October it still held 12.30 ETH. We've left out tiny lookalike transfers sent to both addresses afterwards; they're address-poisoning spam.
At 9:09 PM ET on 12 October @rrealist posted that he had been robbed of about $800K, and in the same post linked a Solana wallet as the "wallet with stolen funds": B3pMs…ArCR (post 2109813738559693002). We haven't checked his account of the robbery, and this page takes no view on it. We started from the one wallet he published himself and followed the money forward, hop by hop, on public Solana data. Times are ET.
Two amounts arrived at that wallet on 12 October: 346.13 SOL at 6:38:19 PM and 718,735.80 USDC at 6:58:50 PM. Both left the same evening, after his post: the SOL began moving at 9:19 PM, ten minutes after he named the wallet publicly, and the USDC at 9:41 PM.
The USDC. At 9:41:08 PM, 2 hours 42 minutes after it arrived, B3pMs sent 718,735 USDC to DN2c…Mt2J, an address with no other activity. At 10:16:10 PM, 35 minutes later, DN2c was swept, together with the deposits of four other addresses (741,403.94 USDC in all), into BfP2…B34G, a wallet Solscan labels "HitBTC: Hot Wallet 1". That's how an exchange deposit address behaves. @ashxonchain first pointed the USDC at a HitBTC hot wallet, in a public trace made with @iris_intel_app at 3:01 AM ET on 13 October (post 2109902262244118831); we checked that leg on-chain and it holds.
The SOL. At 9:19:07 PM and 9:20:28 PM, B3pMs sent 20 SOL and 326.13 SOL to DWMD…oXwf. At 9:24:15 PM DWMD sent 346.125 SOL on to vj83…QaH. Eight seconds later, at 9:24:23 PM, vj83 sent it out through the NEAR Omni bridge program (instruction InitTransferSol, over Wormhole), in a transaction signed by a wallet Solscan labels "Near Intents Refill". We haven't followed it on NEAR yet.
Both services see deposits at the address level.
- Who controls B3pMs…ArCR, DN2c…Mt2J, DWMD…oXwf and vj83…QaH.
- Which HitBTC account DN2c…Mt2J belongs to.
- Anything about the robbery itself beyond what @rrealist posted.
- Who controls 0xF672…1926 and 0xEeC3…700f, and who the four addresses paid on 13 October are.
Where the funds went, 12 October (ET)
The 10:16 PM sweep moved 741,403.94 USDC from five deposit addresses, including DN2c's 718,735.| Time | Move | Amount |
|---|---|---|
| 6:38:19 PM | arrived at B3pMs | 346.13 SOL |
| 6:58:50 PM | arrived at B3pMs | 718,735.80 USDC |
| 9:19–9:20 PM | B3pMs → DWMD | 346.13 SOL |
| 9:24:15 PM | DWMD → vj83 | 346.125 SOL |
| 9:24:23 PM | vj83 → NEAR bridge | 346.125 SOL |
| 9:41:08 PM | B3pMs → DN2c | 718,735 USDC |
| 10:16:10 PM | DN2c → HitBTC hot wallet | 718,735 USDC |
| 9:24:59 PM | NEAR Intents → 0xF672 (Ethereum) | 14.70 ETH |
| 11:52:11 PM | 0xF672 → 0xEeC3 | 14.70 ETH |
The wallets
7 on fileThe trail
how the wallets connectSources
- post @rrealist's post linking the wallet, 2109813738559693002
- post @ashxonchain's trace (with @iris_intel_app), 2109902262244118831
- onchain B3pMs…ArCR on Solscan
- onchain USDC to DN2c, 9:41:08 PM ET 12 Oct
- onchain Sweep into HitBTC: Hot Wallet 1, 10:16:10 PM ET 12 Oct
- onchain HitBTC: Hot Wallet 1 on Solscan
- onchain SOL out through the NEAR Omni bridge, 9:24:23 PM ET 12 Oct
- onchain Near Intents Refill on Solscan
- onchain NEAR Intents status for deposit address vj83…QaH
- onchain ETH payout to 0xF672, 9:24:59 PM ET 12 Oct
- onchain 0xF672 → 0xEeC3, 11:52:11 PM ET 12 Oct
- onchain 0xEeC3…700f on Etherscan
Read next
$1.1M still outBRIEFING$1.1M still outPapertrade says its overnight winner gave “almost all” his profit back. The records show $1.1M still out
Same signers, all supplyBRIEFINGSame signers, all supplyHunter Biden says $LAPTOP's founder coins never moved. That wallet checks out, but its signers run the rest of the supply too
3 chains in 69 secondsBRIEFING3 chains in 69 secondsThe $4M frogman drain: three chains emptied in 69 seconds, and the SOL went into a privacy poolWe check new claim sites, airdrops and launches as they trend. Follow @trenchbookapp for the next one.
Know more, or named here and want to reply? DM @trenchbookapp on X. A wallet's owner who proves control of it gets their reply printed.