# The wallet rrealist says holds his stolen funds: $719K USDC reached a HitBTC deposit address within 2 h 43 min, and 346 SOL left through NEAR Intents

Source: trenchbook.app · filed Oct 14, 2026, updated Oct 14, 2026 · https://trenchbook.app/dispatch/rrealist-stolen-funds-trace

> There is no official trenchbook token or contract address (CA). Anyone selling one is not us.

**In short:** Checked 14 October 2026 on public Solana data, starting only from the wallet @rrealist linked himself (B3pMs…ArCR). 346.13 SOL and 718,735.80 USDC arrived there on 12 October. The USDC went at 9:41 PM ET to DN2c…Mt2J, which 35 minutes later was swept with four other deposit addresses into "HitBTC: Hot Wallet 1" (Solscan label). The SOL went through two hops and out through the NEAR Omni bridge at 9:24 PM ET, in a transaction signed by a wallet Solscan labels "Near Intents Refill".
Update, 14 October, 1:04 PM ET: we followed the SOL. NEAR Intents' public status for the deposit address vj83…QaH shows the 346.125 SOL was swapped into 14.70 ETH and paid out on Ethereum to [0xF672…1926](https://etherscan.io/address/0xF672434c9a5C67f4394B3A94842Fb86102dD1926) at 9:24:59 PM ET on 12 October, a minute after it left Solana ([payout](https://etherscan.io/tx/0x98d4f3053950bc7929312b300dfd01366d1b547c86f0aa60d1c384d4789df46b)). At 11:52:11 PM ET, 0xF672 [sent 14.70 ETH](https://etherscan.io/tx/0xc2147e660656ce4027c22626f9c6c2ac963053f72dabb13d0770fc99fd49d94c) on to [0xEeC3…700f](https://etherscan.io/address/0xEeC36E6B1dad28331E457d1aBF532265D6ee700f). On 13 October, between 10:55 AM and 12:08 PM ET, 0xEeC3 sent 2.40 ETH in four payments to four other addresses. At 1:03 PM ET on 14 October it still held 12.30 ETH. We've left out tiny lookalike transfers sent to both addresses afterwards; they're address-poisoning spam.
At 9:09 PM ET on 12 October @rrealist posted that he had been robbed of about $800K, and in the same post linked a Solana wallet as the "wallet with stolen funds": [B3pMs…ArCR](https://solscan.io/account/B3pMs331kxjEjiB8rj6tyNsiGkLaXeKyPjJqTpBAarCR) (post 2109813738559693002). We haven't checked his account of the robbery, and this page takes no view on it. We started from the one wallet he published himself and followed the money forward, hop by hop, on public Solana data. Times are ET.
Two amounts arrived at that wallet on 12 October: [346.13 SOL at 6:38:19 PM](https://solscan.io/tx/qj9jzddGTvSD7JDpsJuzJzjuWvNNyktQKfN2tWnCDSurQbwpJkYDRqnc54RwNmmehHZpsBv96psLgFLoB4iHwqb) and [718,735.80 USDC at 6:58:50 PM](https://solscan.io/tx/G4VQQUfjKcyPdrssCeZjqT5ypPNhviVbxbBbJWoZZrdQiTiY3yG4RenC9jxWNmX5NgPujP41LxTAeCokRdf245k). Both left the same evening, after his post: the SOL began moving at 9:19 PM, ten minutes after he named the wallet publicly, and the USDC at 9:41 PM.
The USDC. At 9:41:08 PM, 2 hours 42 minutes after it arrived, B3pMs [sent 718,735 USDC](https://solscan.io/tx/3GgFcoV4rGLpvZ8YGjoyqWDMdFgaDrAKFStuBaQCVdf1R9P6GtVoWxxTySHdEwrytx9cN3qyKgd91GsyZ8aCYWzd) to [DN2c…Mt2J](https://solscan.io/account/DN2cCPNJnHjUxHwmNvfcKbhvcQnNQwvimugZLwDKMt2J), an address with no other activity. At 10:16:10 PM, 35 minutes later, DN2c [was swept](https://solscan.io/tx/27Qb9BzF1U3rXyJXvss1hRdiVVpUmWeNyS6vXH3AYokCGtcqcfqhz6P2HN4iV7qk1phqkuu9pyCoKSGpmvbCMKEy), together with the deposits of four other addresses (741,403.94 USDC in all), into [BfP2…B34G](https://solscan.io/account/BfP2dBiHbiqYvsmESsgHEL8wQtZt25sbDNKnwmNRB34G), a wallet Solscan labels "HitBTC: Hot Wallet 1". That's how an exchange deposit address behaves. @ashxonchain first pointed the USDC at a HitBTC hot wallet, in a public trace made with @iris_intel_app at 3:01 AM ET on 13 October ([post 2109902262244118831](https://x.com/ashxonchain/status/2109902262244118831)); we checked that leg on-chain and it holds.
The SOL. At 9:19:07 PM and 9:20:28 PM, B3pMs sent [20 SOL](https://solscan.io/tx/4wKkcwmpxdegUPY2wWAQRRCLvTtzcw2NqVhzxDBaF2XWYpNZVU25b2NnpDPfaAmuUGB1BTfCvuChyLLoqeL3aNoy) and [326.13 SOL](https://solscan.io/tx/5Zxy7BJFY9x5uAfk8kcxeFdYH5ZqU39LCn3p5SboU3v6YACqfr1Q81CpdMn7j2AiBhnLjcvdxuQJqCK7HkJa4mgK) to [DWMD…oXwf](https://solscan.io/account/DWMDdqJUy9ywU3MVRcpZjehqfpSyTV6o3r9Rf2UQoXwf). At 9:24:15 PM DWMD [sent 346.125 SOL](https://solscan.io/tx/4oAvhA6nAdvRAZE8UJ5tS9dy6DroqUos8Q5erY57XwgFtBHNttZDMSUkP5zpCGMsaEh5rUMMTxkH6o8NW5Tm7Tun) on to [vj83…QaH](https://solscan.io/account/vj83ppgFCvR1MJbopKzkJqZ7PFanmAEpE2aFVPVdQaH). Eight seconds later, at 9:24:23 PM, vj83 [sent it out through the NEAR Omni bridge program](https://solscan.io/tx/2ytKVDA9mDHgJhsKZmm1tt3xV8QjELnKAt9ypBQXn9enXyFojvKZ6Ln2P35kzPBLoq6kpHtukxXoN1E3Zh3rcYg8) (instruction InitTransferSol, over Wormhole), in a transaction signed by a wallet Solscan labels "Near Intents Refill". We haven't followed it on NEAR yet.
Both services see deposits at the address level.

## What we don't know

- Who controls B3pMs…ArCR, DN2c…Mt2J, DWMD…oXwf and vj83…QaH.
- Which HitBTC account DN2c…Mt2J belongs to.
- Anything about the robbery itself beyond what @rrealist posted.
- Who controls 0xF672…1926 and 0xEeC3…700f, and who the four addresses paid on 13 October are.

## The wallets

- **he says holds the funds:** `B3pMs331kxjEjiB8rj6tyNsiGkLaXeKyPjJqTpBAarCR`: Linked by @rrealist in post 2109813738559693002. Received 346.13 SOL (6:38:19 PM ET) and 718,735.80 USDC (6:58:50 PM ET) on 12 Oct; sent all of it on by 9:41 PM ET.
- **USDC hop (deposit-like):** `DN2cCPNJnHjUxHwmNvfcKbhvcQnNQwvimugZLwDKMt2J`: Received 718,735 USDC from B3pMs at 9:41:08 PM ET 12 Oct; swept into HitBTC: Hot Wallet 1 at 10:16:10 PM ET. No other activity.
- **HitBTC: Hot Wallet 1:** `BfP2dBiHbiqYvsmESsgHEL8wQtZt25sbDNKnwmNRB34G`: Received DN2c's 718,735 USDC in a 741,403.94 USDC sweep of five deposit addresses at 10:16:10 PM ET 12 Oct.
- **SOL hop:** `DWMDdqJUy9ywU3MVRcpZjehqfpSyTV6o3r9Rf2UQoXwf`: Received 20 + 326.13 SOL from B3pMs at 9:19–9:20 PM ET 12 Oct; sent 346.125 SOL to vj83 at 9:24:15 PM ET.
- **SOL hop to NEAR bridge:** `vj83ppgFCvR1MJbopKzkJqZ7PFanmAEpE2aFVPVdQaH`: Received 346.125 SOL at 9:24:15 PM ET 12 Oct; 8 seconds later it left through the NEAR Omni bridge program, signed by a wallet Solscan labels "Near Intents Refill".
- **ETH payout of the SOL swap:** `0xF672434c9a5C67f4394B3A94842Fb86102dD1926`: Received 14.70 ETH from the NEAR Intents swap of the 346.125 SOL at 9:24:59 PM ET 12 Oct; sent it all to 0xEeC3 at 11:52:11 PM ET.
- **holds most of the ETH:** `0xEeC36E6B1dad28331E457d1aBF532265D6ee700f`: Received 14.70 ETH from 0xF672 at 11:52:11 PM ET 12 Oct; sent 2.40 ETH in four payments on 13 Oct; held 12.30 ETH at 1:03 PM ET 14 Oct.

## Sources

- post: [@rrealist's post linking the wallet, 2109813738559693002](https://x.com/rrealist/status/2109813738559693002)
- post: [@ashxonchain's trace (with @iris_intel_app), 2109902262244118831](https://x.com/ashxonchain/status/2109902262244118831)
- onchain: [B3pMs…ArCR on Solscan](https://solscan.io/account/B3pMs331kxjEjiB8rj6tyNsiGkLaXeKyPjJqTpBAarCR)
- onchain: [USDC to DN2c, 9:41:08 PM ET 12 Oct](https://solscan.io/tx/3GgFcoV4rGLpvZ8YGjoyqWDMdFgaDrAKFStuBaQCVdf1R9P6GtVoWxxTySHdEwrytx9cN3qyKgd91GsyZ8aCYWzd)
- onchain: [Sweep into HitBTC: Hot Wallet 1, 10:16:10 PM ET 12 Oct](https://solscan.io/tx/27Qb9BzF1U3rXyJXvss1hRdiVVpUmWeNyS6vXH3AYokCGtcqcfqhz6P2HN4iV7qk1phqkuu9pyCoKSGpmvbCMKEy)
- onchain: [HitBTC: Hot Wallet 1 on Solscan](https://solscan.io/account/BfP2dBiHbiqYvsmESsgHEL8wQtZt25sbDNKnwmNRB34G)
- onchain: [SOL out through the NEAR Omni bridge, 9:24:23 PM ET 12 Oct](https://solscan.io/tx/2ytKVDA9mDHgJhsKZmm1tt3xV8QjELnKAt9ypBQXn9enXyFojvKZ6Ln2P35kzPBLoq6kpHtukxXoN1E3Zh3rcYg8)
- onchain: [Near Intents Refill on Solscan](https://solscan.io/account/9WL2A89YBr6X47ABKYNzPentWiBA3H8tpaiuf5CaYHx6)
- onchain: [NEAR Intents status for deposit address vj83…QaH](https://1click.chaindefuser.com/v0/status?depositAddress=vj83ppgFCvR1MJbopKzkJqZ7PFanmAEpE2aFVPVdQaH)
- onchain: [ETH payout to 0xF672, 9:24:59 PM ET 12 Oct](https://etherscan.io/tx/0x98d4f3053950bc7929312b300dfd01366d1b547c86f0aa60d1c384d4789df46b)
- onchain: [0xF672 → 0xEeC3, 11:52:11 PM ET 12 Oct](https://etherscan.io/tx/0xc2147e660656ce4027c22626f9c6c2ac963053f72dabb13d0770fc99fd49d94c)
- onchain: [0xEeC3…700f on Etherscan](https://etherscan.io/address/0xEeC36E6B1dad28331E457d1aBF532265D6ee700f)